v2rayNG can route selected Android apps through its VPN connection while leaving other apps outside that connection. The setting is useful when only a browser or a few work apps need the proxy, but it is easy to confuse app selection with server routing: choosing apps controls which traffic v2rayNG receives, while the selected node and routing rules control what happens after traffic reaches the client. Menu labels vary between releases, so confirm the setting on your installed version rather than relying on screenshots from another build.
This guide explains how v2rayNG per-app proxy selection works, how to choose between including selected apps and excluding selected apps, and how to check the result without changing your node configuration. It is for Android users who want some apps to use the proxy and others to connect normally. You’ll also learn what to check when an app is missing from the list, traffic still appears direct, or another VPN prevents v2rayNG from connecting.
1. What per-app proxy controls—and what it does not
On Android, v2rayNG normally captures eligible device traffic through an Android VPN service. Per-app proxy settings determine which installed apps are included in or excluded from that capture. This is different from configuring a system-wide HTTP proxy: an app does not have to offer its own proxy field for Android’s VPN-based capture to apply.
Think of the setup as two separate decisions. First, Android and v2rayNG decide whether an app’s traffic enters the VPN connection. Then v2rayNG’s active profile and routing rules determine whether that traffic goes through the selected proxy, connects directly, or is handled another way. Selecting an app does not create a server, change the node protocol, or guarantee that every destination used by that app will use the remote proxy.
| Layer | What it controls | What to check |
|---|---|---|
| App selection | Which apps are captured by v2rayNG’s Android VPN connection | Per-app mode and checked apps |
| v2rayNG profile | Which node or configuration is active | Selected profile and connection status |
| Routing rules | Whether captured requests use proxy, direct, or another outbound | Routing mode and connection log |
| App networking | How an app handles connections, DNS, and its own network restrictions | Test the app itself and compare with another app |
This separation helps avoid a common false diagnosis. If an app is outside the selected VPN set, changing the node or switching routing presets will not pull its traffic into v2rayNG. If the app is captured but a destination matches a direct rule, changing the app list will not make that destination use the proxy. Identify which layer is responsible before changing several settings at once.
2. Choose inclusion mode or exclusion mode
v2rayNG releases may present app selection as an inclusion list, an exclusion list, or a mode selector paired with a list. Read the mode label before checking apps: the same checked box can mean “route this app” in one mode and “leave this app out” in another. Some builds place the option under a per-app proxy or VPN settings section; the exact menu nesting and wording can differ.
Choose the list mode before selecting apps
Include selected apps
- Only the apps you select should enter v2rayNG’s VPN capture.
- Useful when a small, known set of apps needs the proxy.
- After installing another app, add it only if it should also be captured.
Exclude selected apps
- Most eligible apps remain captured, except those you select to bypass.
- Useful when nearly everything should use v2rayNG but a few apps should not.
- Review the list after changing devices or restoring app settings.
If you want only two or three apps proxied, inclusion mode is usually easier to audit. If you want nearly all apps proxied, exclusion mode may require less list maintenance.
Before saving, check whether the list contains app names, package names, or both. Android can install different versions of an app under separate profiles, and a work-profile copy may appear as a separate entry. Selecting the personal-profile app does not necessarily select its work-profile counterpart. Likewise, an app that has not been installed for the current user may not appear in the list.
Do not assume that changing this list will switch Android’s active VPN automatically. Android generally permits one active VPN service per user or profile at a time. If another VPN is connected, disconnect it before starting v2rayNG, then confirm that Android shows v2rayNG as the active VPN. The exact system indicator depends on the Android version and device interface.
3. Configure app selection in v2rayNG
Use the steps below as a reliable sequence rather than as a promise that every release has identical labels. On many builds, per-app controls are in the v2rayNG settings, often within a VPN-related section. If the wording differs, open the settings pages and look specifically for “Per-app proxy,” an app-selection list, or a mode such as “Allow” and “Disallow.” Do not change a core protocol or server field to compensate for an app-selection issue.
-
Connect one node
Open v2rayNG, choose a known working profile, and start the connection. Confirm that the app reports a connected state before changing the per-app list; this gives you a working baseline for later tests.
-
Open app routing
Tap the menu or settings control, open “Settings,” and look for “VPN settings” or “Per-app proxy.” Menu names and nesting vary by release. If a setting has an enable switch, turn it on before opening the app list.
-
Choose a mode
Select whether the checked apps are included in VPN capture or excluded from it. Read the explanatory text on the screen; do not infer the mode from the checkbox state alone.
-
Select the apps
Find each target app by its displayed name, check it, and review the full list before leaving the page. For a work-profile app, select the entry belonging to that profile if it is listed separately.
-
Save and retest
Use the page’s confirmation or save control if one is shown, return to the main screen, and reconnect if the client requests it. Test one selected app and one unselected app separately, then review v2rayNG’s connection log.
For a clean test, use two apps with a clear difference in expected behavior. For example, select a browser in inclusion mode and leave a second browser unselected. Close both apps completely before testing, reopen the selected browser, and check whether a new connection appears in the v2rayNG log. Then repeat with the unselected browser. A stale page, cached response, or an already-open network connection can make a correct setting appear ineffective.
Keep the test focused. Do not simultaneously change the server, routing preset, DNS options, and per-app mode. If the result changes, you would not know which change mattered. Record the active mode and the names of the test apps, change one setting, reconnect, and repeat the same check.
4. Verify the result and isolate common problems
A connected indicator confirms that the client has started a VPN connection, but it does not prove that every app is included or that every destination uses the proxy. Verify app capture and proxy routing separately. A connection log can help confirm that requests from an app reached v2rayNG; a direct-routing rule may still send a captured request outside the proxy outbound.
| Symptom | Likely layer | Next check |
|---|---|---|
| Selected app behaves as if v2rayNG is off | App selection or VPN capture | Confirm inclusion/exclusion mode, save the list, reconnect, and relaunch the app |
| Unselected app also appears in the log | List mode or profile scope | Check whether the list is an inclusion or exclusion list and confirm which Android profile is active |
| App is not listed | Android app inventory or user profile | Install or enable the app for the current profile, then reopen the selection page |
| App reaches some destinations but not others | Routing rules, DNS, or app behavior | Compare destinations and inspect the active routing rules and log entries |
| v2rayNG cannot start its VPN connection | Android VPN service conflict or permission | Disconnect another VPN and approve the Android VPN connection prompt |
- Missing app: Check that the app is installed and enabled for the Android user currently running v2rayNG. If the device has a work profile or another user profile, open the matching profile and check its app list. Restarting v2rayNG or reopening the selection page can refresh the displayed inventory, but it cannot show an app that is unavailable to that profile.
- Wrong apps are routed: Re-read the mode label and test with only one checked app. In inclusion mode, an empty or incomplete selection may leave the intended apps outside capture. In exclusion mode, selected apps are the exceptions, so the same selection produces the opposite result.
- No VPN connection: Check whether another VPN service is active, then disconnect it and start v2rayNG again. If Android displays a VPN permission confirmation, approve it. A connected client screen and the Android VPN indicator should agree before you test app traffic.
- Captured app still uses a direct route: Inspect the active routing preset and the log entry for the destination. Per-app proxy only controls entry into the VPN capture; it does not override a direct rule that matches later in the routing process.
- Only one app seems broken: Force-close and reopen it, test a different destination, and compare with another app. Some apps reuse existing connections, apply their own network restrictions, or use networking paths that behave differently. A single app failure is not enough to conclude that the node or app list is wrong.
Diagnose in order: capture first, routing second
If no request from the selected app appears in the v2rayNG log, recheck the app list, mode, Android profile, and active VPN. If the request does appear but the destination behaves unexpectedly, investigate routing and DNS rather than changing the app selection again.
5. FAQ: common questions about per-app proxy
“I checked an app, but it still connects directly. What did I miss?”
First verify whether the checked list means “include” or “exclude” on your build. Then save the setting, reconnect v2rayNG if needed, and fully close and reopen the app. If its request appears in the log, inspect routing rules; app selection does not force every destination through the proxy outbound.
“Why can’t I find an app in the selection list?”
Confirm that the app is installed and enabled for the same Android user or profile as v2rayNG. Work-profile copies may be separate entries. Reopen the selection screen after confirming the app is available to that profile; menu refresh behavior differs by release.
“Can I use per-app proxy while another VPN is connected?”
Android generally allows one active VPN service per user or profile. Disconnect the other VPN before starting v2rayNG, then confirm that v2rayNG is the active VPN. If a device uses separate profiles, check the VPN state in the profile where you are testing.
“Do I need to edit the node or change the routing preset?”
Not to select which apps enter v2rayNG’s VPN capture. Start with the per-app mode and app list. Change routing only when the app’s requests reach v2rayNG but a destination is sent through an unexpected outbound; change node settings only when the connection itself fails for multiple apps.
Once the test passes, keep the list intentionally small and revisit it when you add apps, change Android profiles, or update v2rayNG. Inclusion mode is often simplest for a short list of apps; exclusion mode is often simpler when nearly all apps should use the VPN. In either case, the reliable check is the same: confirm the mode, confirm that Android has v2rayNG active, and then verify the target app’s traffic in the log.