V2Ray Setup Guide

Before You Begin

Start by choosing the right installer for your device on the download page, then install and open the client. This guide assumes you already have a client; you don't need to write JSON by hand or deploy a core separately. If you're switching clients, back up your existing configuration before testing the new one. Don't delete a group you're still using just for a test.

Get a valid subscription URL from your service provider, or a complete server share link. The client manages configurations and forwards connections; installing it does not create a server account. Subscription URLs often contain access credentials. Enter them only in the subscription settings, never in public forums, and don't share screenshots that show the full URL when asking for help.

Check that your device's date and time zone are correct and that your regular network can reach the sites you normally use. Temporarily quit other apps that manage the system proxy or VPN to prevent them from overwriting each other's settings. If your device is managed by an organization, its policies may restrict proxy changes or VPN access; check your permissions first. In the four steps below, change one setting at a time and continue only after you see the expected result.

Step 1: Import a Subscription

A subscription syncs a set of server configurations to your client. After importing it, you should see server names, protocols, or groups in the list. That confirms the configurations were loaded, not that a server is currently reachable. Treat “entries appear in the list” and “the connection works” as separate checks to avoid mistaking a network issue for an import problem.

v2rayN: Add a Group and Update It

On the main screen, open Subscription Group, then Subscription Group Settings, and add a group. Enter a recognizable name in the remarks field, paste the full subscription URL into the address field, and save. Make sure the URL has no leading or trailing spaces, line breaks, or quotation marks. Use the subscription link, not your provider's login page. Return to the main screen, select the group, and update the subscription.

Some versions offer separate update options for “without proxy” and “through proxy.” For the initial setup, when you don't yet have a working connection, try updating without a proxy first. Use the through-proxy option only if you already have a working proxy and the subscription URL must be accessed through it. Repeatedly trying to update through a proxy before connecting won't help—the request still depends on a connection that isn't established.

When the update finishes, check the main screen. The group should contain server entries, and the status or logs should no longer show download or parsing errors. If the group is still empty, check that you selected the right group and entered the correct URL, then ask your provider whether the link needs refreshing or reauthorization. Don't delete and recreate the group right away; keeping the error message can help distinguish a failed request from an unrecognized response.

v2rayNG: Save the Subscription and Refresh the List

Open the menu on the main screen and go to Subscription Group Settings. Tap the add button, enter a remark and subscription URL, then save. Return to the main screen and choose Update Subscription from the menu. Saving the new entry only records the URL; you still need to update it to fetch the server configurations. After updating, switch to the relevant group and check that its entries appear.

If you have a single server share link, choose Import from Clipboard from the add menu on the main screen. Don't paste it into the subscription URL field. A single imported link usually won't receive future updates from the provider; subscriptions need to be refreshed with the update action. These options accept different input types, so using the wrong one can result in an unsupported format or an empty list.

For now, stop once you have entries you can select; there's no need to test every server yet. If an update reports a certificate, timeout, or format error, check your device's date and time, network access, and URL validity. For more help, see Frequently Asked Questions. For the difference between subscriptions, share links, and nodes, see the glossary. Once the list looks right, decide how these configurations should handle app traffic.

Step 2: Choose a Proxy Mode

“Does traffic enter the client?” and “where does it go next?” are two separate questions. System proxy, VPN, or TUN brings traffic into the client; routing rules decide whether requests that enter are proxied, sent directly, or blocked. Seeing a routing mode on the main screen doesn't mean traffic from every app is going through the client. For your first setup, choose one way to route traffic in and keep the default routing rules so you can verify the connection.

v2rayN: Configure the System Proxy and Routing Separately

Find System Proxy on the v2rayN main screen or in the tray menu. Common options include Clear System Proxy, Set System Proxy Automatically, and Do Not Change System Proxy. For your first browser test, choose Set System Proxy Automatically after connecting to a server in the next step. Do Not Change System Proxy means the client won't modify the current system setting; it doesn't turn the proxy on. Clear System Proxy removes the system proxy setting when you stop using this setup.

Next, find the routing selector on the main screen. For the initial setup, keep the client's default rules rather than importing a complex rule set. If you temporarily choose a Global routing mode to troubleshoot, it affects outbound selection for traffic that has entered the core; it won't make apps that ignore the system proxy use the proxy. Default rule names vary by version. Check what the rules do instead of inferring how all requests are handled from their names.

Leave TUN disabled for now. TUN involves a virtual network interface, routing, and permissions, so configure it separately after basic connectivity is verified. The system proxy is enough for an initial test with many browsers. Enabling TUN, changing DNS, and replacing routing rules at the same time makes it difficult to identify the cause of a failure. If you need to route more traffic, see the relevant sections in the configuration reference.

v2rayNG: VPN Mode and App Scope

In v2rayNG settings, make sure VPN mode is enabled rather than local proxy mode, which is intended for other apps to connect manually. VPN mode uses Android's system VPN interface, and Android will ask for permission the first time you connect in the next step. This VPN is a way to route traffic on your device; it doesn't replace a valid server configuration or guarantee that every request uses the same route.

Keep the default routing settings for now, and check whether app filtering is enabled. If it is, make sure the browser you're using for the test is included in the traffic scope. “Proxy selected apps only” and “Bypass selected apps” mean opposite things, so don't judge the setting by the number of checked apps. You can temporarily turn off app filtering for the initial connection test and narrow the scope later.

Just note your current selections; there's no need to configure every routing rule now. You should be clear about the setup: on desktop, apps that follow the system proxy will use the client; on Android, traffic will enter through the VPN interface. Keep the default routing rules on both. Next, choose one server and connect without changing anything else.

Step 3: Select a Server and Connect

Choose a server from the group you just imported, making sure its source is clear and its configuration is still valid. The server name is a label supplied by the provider; it doesn't prove that the connection works. Complete the full verification with one entry before comparing others. If the list contains both an old and a new subscription, check which group the selected server belongs to so you don't keep testing an expired configuration.

v2rayN: Set an Active Server

Right-click the target entry in the server list and choose Set as Active Server or the equivalent option. Some versions also let you switch servers by double-clicking; check the context menu and selected indicator to confirm. After selecting a server, check the status or logs at the bottom of the main screen to make sure the core loaded its configuration. v2rayN usually applies the configuration when you switch the active server, so there may not be a separate, prominent Connect button.

Once you confirm there are no startup errors, set System Proxy to Set System Proxy Automatically. This lets apps that follow the system setting use the client's local listening address. Browsers with manually configured proxies, apps with independent network settings, and command-line tools may not follow the system proxy. For the first test, use a browser that does, and don't add another proxy extension at the same time.

If the logs show a port conflict, a configuration load error, or that the core has exited, stop switching servers. Close other programs using the same listening port, or change the local listening port in the client settings, then apply the configuration again. Don't work around the problem by disabling system protection or exposing the listening address to external networks. For local use, keep the default listening scope.

v2rayNG: Approve the System VPN Prompt

Tap the server you want and make sure the active indicator moves to that entry, then tap Connect on the main screen. The first time it starts, Android will ask whether to allow the app to establish a VPN connection. Confirm that the prompt is for v2rayNG, then approve it. If you deny permission, the imported configuration won't route traffic; tap Connect again and approve the request.

After connecting, check that the client shows a running status and Android shows that the VPN is connected. If Android says another VPN is already active, stop that connection before starting v2rayNG. The system status only confirms that the VPN interface is up on your device; it doesn't prove that the remote server authenticated, DNS resolved, or the target site opened. Test an actual request in the next step.

If the client stops as soon as it starts, open the logs and check the first error. Unsupported configuration fields, missing parameters, and server timeouts require different fixes; repeatedly tapping Connect usually won't change the outcome. Try updating the subscription, then check whether your client and core support the configuration if the error persists. Before sharing a troubleshooting screenshot, hide addresses, account details, and subscription content; include only the relevant error lines.

Step 4: Verify the Connection

Start by testing a page you can normally access and whose content you can tell has updated, then try the service you actually need. Reopen the browser tab and refresh so you don't mistake a cached page for a new request. Don't start multiple speed tests or downloads at once. The goal of this initial check is to understand the request path and connection result, not compare speeds.

Compare the Page and Logs

Watch the client logs while loading the page. If the current log level includes access records, you may see the target domain, a connection being established, or the selected outbound. The format depends on the core and client settings. Not seeing individual requests doesn't necessarily mean traffic isn't reaching the client; some versions log only warnings and errors by default. First check the log options rather than changing the entire configuration just to get a log entry.

A page opening only proves that some route works; default routing rules may send it directly. To confirm the proxy's outbound, check the routing rules, the outbound record for the relevant request, and any session or network information provided by the target service. A change in your externally visible IP address can be useful supporting evidence, but it doesn't prove that every app or domain uses the same route.

Next, run a controlled comparison. Keep the same browser and page, stop traffic routing through the client, then reconnect and refresh to see whether the results match your expectations. On desktop, clear the system proxy before comparing so it doesn't point to a stopped local port. On Android, use the client's Stop button to disconnect the VPN. Some pages also open over a direct connection, so being able to access them both times doesn't automatically mean the proxy isn't working.

If It Fails, Troubleshoot One Layer at a Time

If even regular pages won't load, restore your original network settings first and check whether the basic connection still works. If the network is fine but fails when the client is enabled, check the system proxy or VPN status, active server, and subscription validity. If only certain domains fail, then check routing and DNS. Don't blame every issue on the subscription or change transport, ports, and DNS settings all at once after the first failure.

If the browser works but a particular app doesn't, first check whether the app follows the system proxy or is excluded by v2rayNG app filtering. If it works in the foreground but disconnects after running in the background, check Android's background activity and battery restrictions for the app, then adjust them according to your system's guidance. Different symptoms point to different layers; see the troubleshooting guide for the recommended checks.

Finish Up and Keep a Working Configuration

When you're done on desktop, choose Clear System Proxy in v2rayN, then quit the client if you want. Closing the window may only minimize it to the tray. On Android, tap Stop in v2rayNG and confirm the VPN has disconnected. To route traffic through the client again later, select an active server and connect; you don't need to import the subscription again.

After verifying the connection, keep the working group, routing selection, and traffic-handling mode. When you later change app filtering, update a subscription, or adjust DNS, change one thing at a time and repeat the checks in this guide. Backups may also contain server credentials, so store them somewhere you control. To learn how inbounds, outbounds, and routing work together, see the JSON configuration reference; you don't need to understand every field for everyday use.

The verification loop is complete when the configuration is imported, the traffic scope is clear, the selected server starts, requests from the target app produce results you can explain, and your original network is restored when you stop. If any step is still unconfirmed, return to the relevant section instead of adding more modes or rules.