v2rayNG FAQ
Find the section that matches the problem. Check the relevant menu and current settings first, then use the logs to narrow down the cause. Change one setting at a time and retest.
Protocol Basics
Know the difference between the client, core, connection details, and proxy modes before deciding what to configure.
Should you use v2rayNG or v2flyNG on Android? Which client is best for desktop?
Start by selecting Android on the client downloads page. v2rayNG is usually the best first choice: it uses the Xray core and suits configurations that require VLESS, REALITY, and similar features. v2flyNG uses the v2fly core and can be an alternative for existing V2Fly configurations. Supported fields depend on the bundled core and its version, so a successful import alone does not guarantee compatibility. For Windows, macOS, and Linux, use v2rayN. Before switching clients, back up your configuration and confirm that the new client supports its protocol, transport, and security settings.
Why is there no configuration to connect to after installing the client?
Open the client’s configuration list and check whether you have imported connection details from a server. v2rayNG, v2flyNG, and v2rayN manage configurations and run proxy cores; installing one does not provide a remote server. You’ll need a subscription URL you’re authorized to use, an individual share link, or configuration details entered manually. These are different input types: save and update subscription URLs in a subscription group, and import individual links from the clipboard. Don’t use an account password as a subscription URL or post a full URL containing access credentials publicly.
Can VMess, VLESS, and Trojan all be used in the same client?
Check the client’s add-configuration menu, then compare its options with the protocol and transport details provided by the server. A client that supports these protocols can store multiple types of configuration, but the active one depends on your selection and routing settings. VMess, VLESS, and Trojan are different protocols; changing a name won’t convert one into another. Also check that the current core supports the chosen combination of TLS, REALITY, WebSocket, and other settings. A successful import only means the client could parse the data—it doesn’t confirm that the server parameters match. If the connection fails, check the port, user ID, transport path, and server name one by one.
How does Android VPN mode differ from a desktop system proxy?
Check the operating mode in v2rayNG settings first, then decide whether Android’s VPN permission is needed. Android VPN mode routes traffic through a virtual network interface provided by the system, but per-app selections and routing rules still apply. In proxy-only mode, apps must be configured to use the local proxy address. v2rayN’s system proxy changes the desktop’s proxy settings and only affects apps that honor them. Desktop TUN routes more traffic through a virtual network interface and requires additional permissions and routing configuration. Enabling either mode doesn’t mean every app will use the same network path.
Setup & Installation
Check package architecture and subscription updates in the order you’ll need them during initial setup. Find installation options on the Android download page.
Which v2rayNG APK should I choose: arm64 or universal?
Check your processor and system architecture in the phone’s About settings. Most mainstream phones released after 2015 can usually try arm64 first, but the architecture of the installed operating system is what matters. 64-bit hardware doesn’t guarantee that the manufacturer installed a 64-bit OS. If you can’t confirm the architecture, choose the universal package; it includes files for multiple architectures and is usually larger. If Android says the app can’t be installed, check available storage, the OS version, and whether the installed app’s signature is compatible. Don’t uninstall the old version just to try another package: export your configuration first to keep subscription groups and custom rules.
Where do I import a subscription URL? What should I do if it can’t be parsed?
In v2rayNG, open the menu and go to subscription group settings. Add a group, enter a label and subscription URL, save it, then return to the main screen and update subscriptions. Menu names may vary slightly by version. If you have a single link beginning with vmess://, vless://, or trojan://, import it from the clipboard instead of treating it as a subscription URL. If parsing fails, check for extra spaces, line breaks, explanatory text, or non-ASCII punctuation, then confirm that the URL returns subscription data supported by the client. Login pages, web-based share pages, and data in other configuration formats may not be directly importable.
Subscription update failed: should I check the URL or the network first?
Open subscription group settings, confirm that the URL is complete and the group can be updated, then check the error from the latest attempt. For an unauthorized or forbidden response, ask the URL provider whether the subscription expired or its access credentials changed. If parsing fails, confirm that the response contains configuration data, not a web page. For a connection timeout, check whether your current network can reach the URL, then try updating directly or through an available proxy if the client supports it. Avoid rapid retries, which may trigger access limits. Keep your working configurations before updating, and never share the full subscription URL while troubleshooting.
What if Android doesn’t prompt for VPN permission on first launch, or the VPN won’t start?
Make sure v2rayNG is in VPN mode, tap Start, and watch for Android’s connection request. Android generally allows only one active VPN per user or work profile. If another VPN, VPN-based filtering app, or work policy is in place, check whether it is already using the interface. In system VPN settings, see whether Always-on VPN or Block connections without VPN points to another app. Managed devices may restrict adding VPNs; contact the device administrator if needed. Proxy-only mode doesn’t route app traffic like VPN mode, and repeatedly tapping Start won’t grant the required system permission.
Tips & Usage
Once the connection works, adjust routing, app coverage, and background activity as needed. Keep a restorable copy of your configuration before each change.
Which routing domain strategy should I use: AsIs, IPIfNonMatch, or IPOnDemand?
Open routing settings and check the domain strategy, then choose based on whether your rules match domains or IP addresses. AsIs doesn’t resolve domains specifically for routing. IPIfNonMatch attempts a lookup when no domain rule matches, then checks IP rules. IPOnDemand resolves a domain when a rule requires IP information. If you mainly route by domain, keep the default strategy unless you need IP rules to refine the decision. This option controls when routing performs lookups; it isn’t the client’s overall DNS configuration. After changing it, test the same destination and check rule order and the default outbound route. Avoid changing multiple variables at once.
How can I route only some Android apps through the proxy?
In v2rayNG settings, enable per-app proxying and check whether the list uses an allowlist or bypass mode. Allowlist mode generally routes only selected apps through the VPN; bypass mode generally excludes selected apps. Check the current version’s on-screen guidance to confirm how it works. Save your changes, stop and restart the VPN, then force-close and reopen the app you’re testing so existing connections don’t affect the result. Per-app selection determines whether traffic enters the client; routing rules still apply afterward. Check the list again after installing apps, and remember that system component traffic may not appear under the foreground app’s name.
The connection drops when my phone locks. Which background settings should I check?
In system app settings, find v2rayNG and review its battery usage, background activity, and mobile data restrictions. If the system frequently stops the service, allow background activity using the options available on your device; adjust battery optimization only if necessary. Menu locations vary by manufacturer. Lock the phone for a while, then unlock it and check whether the client service is still running instead of relying on the status bar icon. If the connection drops only when switching from Wi-Fi to mobile data, check the new network and whether the service needs to restart. Allowing background activity won’t fix a server disconnect or an unreachable network, and disabling every power-saving feature at once isn’t recommended.
What should I back up before changing phones or upgrading the client?
Use the client’s export or backup feature to save subscription groups, manually added configurations, custom routing, and DNS settings. Check exactly what the backup includes. Some share options export only the currently selected connection and aren’t a full backup. When switching clients, don’t assume their settings files are interchangeable; restore using a compatible share format or re-enter the parameters instead. Backups may contain user IDs, subscription credentials, and server details, so store them somewhere secure. Once you’ve confirmed that connections and routing work on the new device, remove data from the old device and any temporary transfer files.
Troubleshooting
Check local service startup, the remote connection, and app access separately. A normal-looking status icon doesn’t guarantee that the entire connection is working.
A node connection times out. How can I tell whether it’s a network issue or a configuration error?
With the proxy stopped, first confirm that your device can reach ordinary sites allowed on the current network. Then start the client and check its logs. If only one configuration times out, check its server address, port, and server status. If several configurations time out, check the network, DNS, and whether the client started correctly. Probe results in the list don’t necessarily reflect real app connections, so compare them with an actual connection attempt and the logs. If switching networks fixes the issue, the original network path may be the cause. If the logs show a handshake or authentication failure, check the parameters instead of changing local ports or routing settings at random.
The client says it’s connected, but websites won’t load. What should I check, and in what order?
First confirm that the selected configuration actually works. “Connected” may only mean the local VPN or core has started; it doesn’t necessarily mean the remote handshake succeeded. Next, check that the browser is included in the per-app list, that routing sends the destination through the expected outbound, and that DNS requests get a response. Change one setting at a time and retest the same URL. If only one app fails, check whether its own proxy, Private DNS, or Secure DNS settings affect requests. If every app fails, check the logs for connection, resolution, and handshake errors. Restore temporary changes when you’re done, and don’t leave broad test rules in place.
What should I do if the v2rayN system proxy doesn’t work or TUN reports insufficient permissions?
First confirm that the v2rayN core is running, then check that the system proxy points to the address and port the client is actually listening on. Starting the core and enabling the system proxy are separate steps. Apps that ignore system proxy settings need to be configured separately, or you can use TUN once you understand its effects. If TUN reports insufficient permissions, grant the permissions required by your OS and client. Windows may require administrator privileges; on macOS and Linux, follow the system prompts. After granting permission, check that the virtual interface and routes were created successfully. If it still fails, disable other VPN or TUN tools before trying again. Don’t stack multiple modes that take over network traffic.
How do I troubleshoot a TLS certificate error or core startup failure in the logs?
Open the client logs and find the first clear error after the latest startup. For TLS certificate or handshake errors, check the device’s date, time, and time zone first, then verify that the server name, SNI, transport, and server certificate match. Don’t treat skipping certificate verification as a standard fix. For core startup failures, check the configuration syntax, whether the current core supports the relevant fields, and whether another process is using the local listening port. If you recently changed a custom configuration, restore a backup and test again. When sharing logs, include only the relevant error lines and redact subscription URLs, user IDs, and access credentials.