V2Ray FAQ

First, distinguish the core from the client. The core handles network connections, while the client provides a graphical interface for managing subscriptions and switching modes. V2Ray is part of the Project V proxy ecosystem; V2Fly and Xray are related core projects. v2rayN is available for Windows, macOS, and Linux, while v2rayNG is for Android. Android users can also consider v2flyNG, which uses the V2Fly core. Choose based on your device's operating system, then check the service requirements—names alone don't determine compatibility.

You'll need a subscription link or a single node configuration that you're authorized to use. A subscription link retrieves a list of configurations; a node is one configuration containing a server address, port, and connection parameters. Installing a client only prepares the tool—it doesn't provide a working service. After importing, update the list, select a configuration, and start the connection. Follow the provider's instructions for any protocol, transport, or encryption requirements. Don't post subscription links publicly, and hide the full address in screenshots.

Choose a mode based on which apps need to use the proxy. A system proxy sets a proxy address in the operating system, which browsers and other apps that honor the setting typically use; some command-line tools and games don't. TUN uses a virtual network interface to capture traffic at a lower level, but requires the right permissions and routing. v2rayNG's VPN mode routes traffic through Android's VPN interface, while proxy-only mode requires apps to connect to a local proxy port themselves. Client routing rules still apply in all three modes.

Use the complete configuration supplied by your provider; don't just change the protocol name. VMess, VLESS, and Trojan are different connection protocols with different authentication fields and transport settings. Compatibility also depends on support in the client core and matching server settings, including TLS, a security protocol that protects data in transit. There is no universal speed ranking independent of the connection path. If you run into compatibility issues, check the core's supported features and the imported configuration first. Avoid changing several parameters at once.

Don't rely on a single latency value. TCPing mainly measures the time to connect to a target port; it doesn't confirm that the proxy protocol authenticated successfully. A real connection latency test typically accesses a test address through the proxy, making it closer to actual use, though results still depend on the test address. A download speed test measures throughput over a period and can't predict performance on every site. Run a real connection test, then try the site you need in a browser. If results differ, check DNS, routing rules, and the site's connection status.

Check your phone's processor architecture or device specifications first. Most newer Android phones support arm64, especially mainstream models released after 2015, but verify your device's actual compatibility. The arm64 package contains components for that architecture only and is usually smaller. The universal package supports multiple architectures and is useful if you can't identify yours. If Android reports that the package is incompatible, check the architecture and minimum OS requirements rather than repeatedly reinstalling over the existing app. Back up important settings before updating to avoid losing app data.

Copy the full link again, remove any spaces or line breaks at either end, and make sure it's a subscription URL—not an account login or help page. Save it in a subscription group, then update the subscription; pasting it into the single-node import screen may not work. If the format is unsupported, check that the response is intended for your client and isn't a webpage, error message, or configuration in another format. Also check whether the link has expired or needs reauthorization. Never submit a link containing access credentials to a public testing site.

Update the subscription in the relevant group, then return to the main list and check the selected group filter. Saving the subscription address and retrieving nodes are separate steps; saving alone won't populate the list. If the update reports success but returns zero nodes, check whether the subscription has expired, the provider has temporarily returned no configurations, or the client can recognize the response. If you have multiple groups, make sure you haven't selected an empty one. Keep your existing working configurations while troubleshooting instead of deleting all subscriptions and nodes just to refresh the list.

Select an imported configuration, tap Start, and allow the VPN connection when prompted by Android. This permission creates a local interface for routing traffic; it doesn't mean the node has passed a connection test. If no prompt appears or the connection stops immediately after authorization, check whether another VPN app is using the interface or device management policies prevent VPN connections. Stop any conflicting app before switching to v2rayNG. Use proxy-only mode only if you intend to use a local port and configure app proxies manually.

Turn off TUN, then grant the permissions required by your operating system and client version. Windows usually requires administrator privileges; macOS and Linux may require system authorization or a helper service, and the relevant settings can vary by version. Restart the client after granting access and check whether the virtual interface is created. If it still fails, review security software logs, check for conflicts with other VPN or virtual network tools, and inspect the specific error in the logs. Don't leave system protection disabled to troubleshoot, and don't apply privilege escalation steps from another operating system.

In the routing settings, choose a preset that fits your needs, such as bypassing local network and mainland China addresses. Then check for custom rules with higher priority. Routing rules determine whether connections go direct, through a proxy, or are blocked. They're usually matched in order, so an earlier rule may override a later one. For printers, router admin pages, or intranet services, verify that their addresses are set to go direct. Reconnect after changing rules before testing; existing connections may continue using the old route, so they don't show whether the new rules work.

Open v2rayNG's per-app proxy settings and check whether the current option proxies only selected apps or bypasses them—the two options do the opposite. Select the apps you want, save, then stop and restart the connection for the new scope to take effect. Test with only the target app open so other apps don't affect the results. System components may handle downloads or DNS lookups on an app's behalf, so selecting an app by name may not capture all its traffic. If something doesn't work, restore the default scope to confirm the node works, then narrow the scope one app at a time.

It can, depending on the client version and how it manages configurations. Subscription nodes usually follow the content returned by the provider, so an update may recreate entries or overwrite fields. If you need to keep a change, copy the node to a separate configuration and note why you changed it before updating the original subscription group. Don't change transport or security settings you don't understand; doing so can break the connection. After updating, check that the selected configuration is still there. Two nodes with the same name may have different settings, so test the connection to confirm.

Choose one node and run a real connection test, then visit the sites you normally use and, if needed, run a short download speed test. Keep the network and test targets the same so you can compare results. Don't run speed tests on many nodes at once and treat them as a measure of everyday performance: testing uses bandwidth and may add load to the server. If only one site is slow, check its routing and DNS instead of replacing every configuration. Keep a verified working configuration for comparison and change one thing at a time.

Turn it on only when other devices on the same local network need to connect to this device's proxy. Before enabling it, check the listening address, proxy port, firewall scope, and access controls so you don't expose the local proxy to unintended devices. Other devices must also be configured manually with this device's local network address and the relevant port; the switch won't set up their proxies for them. If you only use the proxy on this device, leave it off. Review the setting when you connect to a public network. Sharing a proxy on a local network doesn't securely sync subscription configurations to other devices.

Turn off the proxy and confirm the local network can access the internet. Check that the device clock is correct, then update the subscription. Test one configuration at a time and verify the server address, port, and account status. If every node times out on the same network, try a trusted network for comparison; if only one node times out, check that node or the server. A connection timeout in the logs only means an operation didn't finish within the allowed time—it doesn't identify which end failed. Keep the original error text and don't start by reinstalling or clearing your configuration.

Confirm that the client core is running, then test DNS resolution and the proxy exit separately. A connected status may only mean that the local service or VPN interface started; it doesn't confirm that the remote connection works. Check that you've selected the right configuration, the browser is using the intended proxy, and routing sends the target traffic through the correct exit. If only domain names fail, focus on DNS, the service that resolves domain names to addresses. Save your existing settings before changing DNS, and check how resolution requests are routed. Avoid changing the proxy, routing, and DNS at the same time.

Test with a browser that follows the system proxy setting to determine whether the whole proxy chain is failing or only specific apps are bypassing it. Some apps have their own proxy settings; some command-line tools read only environment variables; and others use connection methods that the system proxy doesn't cover. Check the app's network settings and confirm its local proxy port matches the client. If you need to capture more traffic, consider TUN and recheck permissions and routing. Turning on the system proxy doesn't force every app or protocol through it.

Keep your existing nodes and subscription groups; don't repeatedly delete and recreate them. Note the update error, then check the link's expiration, account status, current network, and whether the update request needs to use your existing proxy. Some client versions offer alternative subscription update methods; try them if needed after confirming that your existing connection works. If you get a certificate error, check the device clock and subscription URL. Don't hide the problem by bypassing certificate verification. If the server is temporarily unavailable, try again later. A failed update doesn't necessarily mean existing nodes have stopped working.

Record the client and OS versions, the mode in use, and when the issue occurred, then check the logs for that time. For desktop crashes on launch, check the runtime environment, file permissions, and whether the archive was fully extracted. For Android background disconnects, check battery optimization, background restrictions, and other VPN apps. Increase the log level briefly only if needed, then restore normal settings after reproducing the issue to avoid collecting excess information. Remove subscription URLs, credentials, and personal network details before sharing logs. Save a copy before resetting settings, and first try reverting your most recent changes.