I've used jichang services, and I've built my own nodes. Now I want to talk seriously about why I lean toward the latter — and under what circumstances the former actually isn't so bad.
Let me answer the question in the title first: if a jichang can push its price down to a few yuan a month, while bandwidth and clean IPs both cost real money, then it must be making money from something else. What that something is, this article will cover. But before that, I want to walk you through something more fundamental —
This isn't a tutorial; one-click scripts are all over the internet. What I want to discuss is a question more worth thinking through: when you pay for "internet freedom," what exactly are you entrusting, and to whom?
First, a Model: Three Tiers of Trust
The options on the market fall roughly into three tiers. The difference isn't price — it's who you need to trust.
Tier one, jichang. You pay a subscription fee, get a subscription link, import it into a client, and you're good to go. Who's the operator? You don't know. Where's the company registered? There's probably no company. Who do you contact when something goes wrong? Nobody. You're entrusting all of your internet traffic to an anonymous stranger with no legal entity who could vanish at any moment.
Tier two, commercial VPNs. Proton, for example. It's a properly registered company, with a legal entity, a public privacy policy, and third-party audits under its belt. What you trust is an institution with a name, one that can be held accountable, one for which running away would be very costly.
Tier three, self-hosting. You rent a VPS and configure the node yourself. Now there are only two things left to trust: a server provider with a legal entity, and a pile of open-source software. The trust chain is the shortest, and the most transparent.
Once you've thought through these three tiers, the rest of the judgment follows naturally. What I want to convince you of across this whole article is to move your default option back from tier one.
The Problem with Jichang Isn't the Price — It's That You Don't Know What You Bought
The Client Is a Black Box
Many jichang services steer you toward installing their self-developed client, rather than giving you a standard subscription link to import into open-source tools.
The risk here is often underestimated. That client is a closed-source program you run with administrator privileges. What it's capable of doing goes far beyond "proxying your traffic" — reading your clipboard and scanning local files are all within its capabilities, and the deadliest part is that it can install a root certificate on your system. The moment you trust its certificate, all of your HTTPS traffic can, in theory, be decrypted by it. You think encryption protects your passwords, but if the decryption key was handed over by your own hands, the encryption is a sham.
By contrast, those open-source cores on GitHub — Clash, sing-box, Xray and the like — have public code that developers all over the world are looking at. It's not that open source is absolutely problem-free; it's that the cost of hiding something is much higher: any suspicious behavior can get caught and exposed in broad daylight. Closed-source clients have no such constraint.
To be clear: not every jichang forces you to install a self-developed client; plenty honestly just hand you a subscription link. What I'm criticizing is the ones that induce or even force you to install modified clients. When you run into one of those, no matter how good it sounds, walk away.
The Nodes Are "Ridden by Ten Thousand People"
Jichang nodes are shared. A single exit IP may have hundreds or even thousands of people hanging off it at once.
There's a very practical consequence here, called IP reputation. Many of the websites you visit score incoming IPs, and a shared IP that's been used repeatedly by countless people, with every kind of traffic run through it, tends to have a very low reputation score. The result: you constantly hit captchas, get asked for secondary verification, get your new account registrations instantly banned — not because of anything you did, but because of what the other few hundred people sharing that IP did. The bill lands on the IP, and therefore on you.
What about the "residential IPs" jichang services advertise? Here's a bucket of cold water. Real residential IPs do exist, but their sources are often dirty — many come through malicious SDKs that hijack ordinary people's home broadband and secretly sell off their bandwidth. So the so-called "residential" IPs a jichang sells you are either datacenter IPs in disguise, or these dubiously sourced shared residential ones. Neither is what you want, and once enough people pile on, even a "residential" IP will get flagged by risk control.
A Special Warning: The Ones at a Few Yuan a Month
If you see a jichang with absurdly low monthly pricing — the few-yuan-a-month kind — turn your vigilance up to maximum.
The costs of a proxy service are real: bandwidth costs money, clean IPs cost money. When a service is priced well below its costs, it must be making money from something else. And that something, most likely, is you.
It might be reselling your connection as an exit — you become someone else's "residential node," whatever traffic others run exits through you, and the IP records land on your name. It might be collecting a wave of top-ups and then vanishing — luring customers at rock-bottom prices, then shutting down once enough money has accumulated and reopening under a new domain; that's the standard playbook in this circle. Or it might be that your browsing history and connection logs are the product themselves, packaged and sold downstream.
In one sentence: there's no free ladder in this world. When something is sold below cost, what's being sold is you.
What Self-Hosting Gives You Is "Controllability"
Flip the above around and you get the value of self-hosting. But I want to be honest and not oversell it.
The trust chain is short. You only need to trust one VPS provider with a legal entity and a reputation, plus a pile of open-source software audited by the whole world. No anonymous middleman.
The IP is exclusively yours. Your own server, an exit IP used by you alone. The reputation score is clean, and the odds of hitting captchas or getting banned drop off a cliff. The nodes I use myself — an NTT/AS9929-line home-broadband exit, for instance, and a Seoul KT exit — are all exclusive clean IPs, and the experience is a different world from the ten-thousand-rider kind.
Your traffic signature doesn't stand out. This point needs to be stated with restraint. A jichang is a single entrance shared by thousands, with an extremely conspicuous traffic signature — once it's targeted, the whole thing gets blocked. Your single IP with low traffic drowns in the noise of the internet and is actually harder to single out. Pair it with protocols like REALITY/VLESS — which borrow the TLS fingerprints of real websites and behave like a legitimate site under active probing — and the concealment gets even better.
But I won't lie to you and claim self-hosting is "absolutely uncatchable." There are countermeasures against individual self-hosting too: IP-range blocking of low-traffic VPSes, TLS-in-TLS signature detection, active probing — all genuinely exist. So the accurate phrasing is higher controllability, not absolute safety. Distributed is indeed harder to deal with than centralized, but there's no silver bullet.
You pick up some skills along the way. What you learn in the process of building a node — Linux basics, network configuration, certificates, protocols — is transferable. Someday when you want to build a return-to-China VPN for your family, remotely access your home NAS, or set up intranet tunneling, it's all the same craft.
"I Don't Know Tech" Is No Longer an Excuse
A few years ago, the barrier to self-hosting really was discouraging. Not anymore.
One-click scripts are everywhere, and on top of that you can have AI do it for you. With tools like Codex, you can configure an entire server almost entirely in plain language, and it will tell you what each step is doing. The technical barrier has been shaved very low.
But there's a pitfall I must warn about: don't blindly trust AI-generated configurations and push them straight to production. They often leave security holes — default ports, weak configurations, admin panels exposed directly to the public internet. At minimum, make it explain every step, and shut down the panel or put access control in front of it. The tool saves you time, but the responsibility of "is this server secure" is still yours in the end.
If You Just Don't Want to Self-Host
At this point you might say: I get all the reasoning, but I really just want something that works out of the box and don't want to touch any tech.
Perfectly reasonable. Self-hosting isn't the only correct answer, and I don't want to turn this piece into black-and-white advocacy. If you're going to use a ready-made service anyway, here are two backstop safety lines.
First, if you can avoid installing a self-developed client, don't install one. Prioritize services that give you a standard subscription link and let you import it into open-source tools yourself (Clash, sing-box, v2rayN and the like). Never install the modified client it gives you, and never install the root certificate it demands. This is a red line, no exceptions.
Second, avoid the ones that are obviously off. Too short an operating history, a domain registered yesterday — avoid. Absurd pricing — too expensive is an IQ tax, too cheap is a trap — avoid both.
On "pick a big name," I have to say something honest. Jichang services are all fundamentally in a gray zone; there's no such thing as a true "big name." So-called good reputation only means "a relatively lower probability of vanishing" — it doesn't mean it's trustworthy, and it certainly doesn't mean it's compliant. Don't treat a service as something you can safely entrust just because it's famous and widely used — that would circle you right back to the mistake this article criticized at the very beginning: handing your trust to an operator you fundamentally don't understand.
As for commercial VPNs like Proton VPN, as I said earlier, they're a different species — a Swiss company, open-source clients, a no-logs policy that has passed independent third-party audits for years running (the auditors inspect its production servers on-site), and in 2025 it picked up SOC2 Type II and ISO 27001. What you trust is an institution with a legal entity, with accountability, one that repeatedly lays itself open for inspection. If your needs are mainly everyday privacy (blocking ISP snooping, public WiFi security, blocking ad tracking), it's a very solid choice. But note that its focus is privacy, not wall-crossing — what it gives you is shared IPs, fixed protocols, and very limited room for customization, and the server IP ranges of well-known VPNs like this are often priority targets for the firewall. As a positive foil for the "trustworthy operator" it's clean, but for the specific need of "wall-crossing + clean exclusive IP + custom protocols," it's still not the optimal solution.
One Sentence
This article really comes down to one sentence: don't unconditionally entrust your internet access to a stranger you can't hold accountable.
A jichang sells you this trust — cheap in price, hidden in cost. Self-hosting lets you take this trust back into your own hands, at the price of a little time and a little learning. And that little cost is being rapidly flattened by AI.
You don't necessarily have to go build a server today. But at least, the next time you're about to pay for an unfamiliar service and install its client into your system, pause for a second and think: with this one move, what exactly am I handing over, and to whom?