V2Ray FAQ

For desktop systems, choose v2rayN on Windows, macOS or Linux. It manages nodes, subscription updates, routing and system proxy settings. On Android, v2rayNG is the first choice and uses the Xray core; v2flyNG is an alternative built on the V2Fly core. Choose a client for your device, then check the protocols and transport settings required by your provider. You do not need to install every client to use the same subscription. A client is a local configuration tool; it does not generate working nodes. After downloading one, you still need a subscription URL or share link obtained through legitimate means. Back up any existing configuration first so custom routing rules are not lost when switching clients.

A subscription URL is usually an HTTPS address that the client requests to retrieve a list of nodes, which can be refreshed later. Share links such as vmess:// and vless:// usually describe a single node, including its server, port, credentials and transport settings. They use different menus: save a subscription URL to a subscription group, then update it; import a single-node link from the clipboard. Don’t use a regular webpage URL as a subscription or paste a share link into the subscription URL field. Subscription URLs may contain account credentials, so treat them like passwords and never include them in public screenshots. Updating a node list does not renew your account or reset its usage limits.

No. The system proxy determines whether apps that honor the system proxy send requests to the client. Routing rules determine which outbound connection handles requests that have reached the core. TUN receives eligible traffic through a virtual network interface. Global routing does not force an app that ignores the system proxy to use the proxy, and it does not enable TUN. When troubleshooting, first confirm that app traffic reaches the client, then check whether routing sends it through the proxy outbound. For everyday browsing, start with the system proxy and rules that bypass mainland China. Consider TUN only if an app does not honor the system proxy. Don’t change all three layers at once, or it will be hard to tell where the problem lies.

Project V provides background for understanding the V2Ray ecosystem. V2Fly continues community maintenance of the V2Ray core, while Xray is a separate core lineage developed from related code. The core handles protocols, transport, DNS and routing; graphical clients such as v2rayN and v2rayNG generate configurations and provide the user interface. Sharing a protocol name does not mean every new parameter works across all cores. If an imported configuration contains unsupported fields, check the client and core capabilities, then confirm your server’s requirements. Renaming the core alone will not resolve compatibility issues; transport settings, security options and related extensions must also match.

Choose arm64 for a phone running a 64-bit ARM system; most recent mainstream Android devices fall into this category. The universal package supports multiple processor architectures and is usually larger, making it a fallback when you’re unsure of the device architecture. A 64-bit-capable processor does not guarantee that the installed operating system is 64-bit, so don’t rely on the device’s purchase date alone. If the arm64 APK is reported as incompatible, check the system and processor details before trying the universal version. Installing over an existing app can also depend on its signature, Android version and installed build. If installation fails, note the full error before removing the existing app. Before reinstalling, export your configuration or save the subscription URL.

In v2rayN, open “Subscription Group Settings,” add a group, enter a label and subscription URL, and save. Then update it from the “Subscription Group” menu; depending on the version, you may be able to update through the proxy or directly. In v2rayNG, open “Subscription Group Settings,” add a group and URL, return to the main screen, then select “Update Subscription.” Menus vary by version, but the process is the same: save the URL, update the node list and choose a node. To import a single share link, use “Import from Clipboard” or the equivalent option; you don’t need to create a subscription group. Check the node’s server and transport type after importing. A subscription label is just a label—it doesn’t tell you whether the configuration works.

v2rayNG’s VPN mode uses Android’s VPN interface to receive traffic. When you connect for the first time, Android displays a connection request; approve it to create the interface. This permission is not a subscription login and does not mean the node is connected. If the connection stops immediately after approval, close any other app using the VPN interface and try again. Typically, only one such connection can run in the same user profile at a time. If only some apps bypass the proxy, check “Per-app proxy” and its allowlist or exclusion mode. If the connection drops in the background, review Android’s battery and background-run restrictions for v2rayNG. Change only what’s needed and check the result; there’s no need to disable every system restriction at once.

TUN creates a virtual network interface and changes routing, so it usually needs more permissions than the regular system proxy. On Windows, exit the client and restart it as an administrator if your version requires it. On macOS and Linux, follow the authorization or service-installation prompts shown by the client; Windows instructions do not apply. After startup, check the logs to confirm that the virtual interface and routes were created successfully. If an error indicates that the interface is already in use, stop other traffic-capturing software first. If you don’t need traffic interception, turn off TUN and test the node with the system proxy. Don’t bypass errors by disabling system protection or granting unrestricted write access to the entire configuration directory. Grant only the permissions required.

This routing setup usually sends local network traffic and mainland China destinations identified by the rules directly, while handling other destinations according to the proxy rules. It’s useful when you need access to both local services and external websites. Routing depends on domain and IP data and on rule order—not on the language shown on a webpage. The core checks rules in order, so an earlier rule may decide the outbound connection first. A custom rule in the wrong position can prevent later rules from taking effect. If a website takes an unexpected route, check the destination and outbound connection in the logs, then review custom domain rules, DNS and rule data. If a local printer or intranet service is unreachable, check the direct-connection rules for private IP ranges first; you don’t need to switch all traffic to global proxy mode.

The system proxy works only with apps that read and honor that setting. Some apps have their own proxy options, some command-line tools use environment variables, and others ignore the system proxy entirely. First, verify the current node in a browser. Then check the target app’s network settings to see whether it uses the system proxy. If you need to enter the address manually, use the local address and port the client is actually listening on, and choose the correct protocol—HTTP or SOCKS. Don’t enter a port for one protocol in the other protocol’s field. Use the port shown in the current client settings, not one from an old guide. If the settings are correct but the app still bypasses the client, consider TUN. Restore temporary settings after testing to avoid stacking two proxies the next time you start up.

Mux reuses connections, but its effect depends on the protocol, server and network conditions; it isn’t a universal speed boost. Some configuration combinations don’t work well with Mux. If connections drop or a particular site behaves unexpectedly, try disabling it for comparison. Sniffing extracts destination information from supported traffic to help domain-based routing, but it must work with the client-generated routing and DNS settings. If you don’t have a specific need, start with the client defaults and change settings individually to address a known issue. Change one setting at a time, reconnect, test the same site and check the logs. Don’t enable Mux, sniffing and TUN together when a node isn’t working—three switches at once make troubleshooting a guessing game.

Before switching clients, save your subscription URL, manually added nodes, custom routing rules, DNS settings and per-app proxy settings. Exported files may contain credentials, so store them securely. Successfully importing a subscription does not mean your custom rules were migrated; check them individually after switching. When asking for help, share only your operating system, client name, steps that trigger the error and logs with sensitive details removed. Redact subscription tokens, UUIDs, passwords, private keys and complete share links. Check screenshots for QR codes and clipboard previews, too. If subscription credentials have been exposed, reset them with your provider; deleting a post does not invalidate the old URL. The error type and time are usually enough to help diagnose the issue—you don’t need to share your full configuration.

First, identify whether the failure happened while saving the URL, downloading its contents or parsing the nodes. Check for leading or trailing spaces, line breaks or non-ASCII punctuation in the pasted text, and make sure you didn’t use an account-management page URL. A subscription URL should return node data supported by the client, not a login page or webpage error. Opening it in a browser does not prove that its format is valid. Ask your provider to confirm that the URL works with v2rayN or v2rayNG and that your account is active. If the log reports an unsupported protocol or field, check the client version and core. Don’t delete security parameters just to get past parsing. Import a single-node share link from the clipboard; use a subscription group for a subscription URL. Mixing up these entry points can also cause errors.

An update can fail because the URL is invalid, the account has expired, the subscription server is down, DNS lookup failed or your current network can’t reach the subscription service. If v2rayN offers both proxied and direct update options, try updating through a known-working node, then compare the result with a direct update. If the current node is down, a proxied update may fail too. In v2rayNG, check the subscription update settings available in your version. For TLS errors, check the device clock and server certificate; don’t disable certificate verification. Keep the existing node list before retrying so you don’t lose a working configuration by deleting the group. If your provider reset the URL, replace the old one instead of repeatedly trying to update it.

First, make sure your device can access regular websites, then check the node’s server address, port and device clock. Note that tests differ: a successful TCP connection only means the port is reachable. A real connection test also involves the protocol handshake, DNS and test destination, so the two results are not interchangeable. Compare against a node you know is still active, and try a different network if possible. If only one node fails, check its status and settings. If all nodes fail, check the local network, DNS, firewall and client logs. For handshake errors, verify the UUID, TLS, serverName and transport settings. Restarting may clear some temporary state, but it won’t fix an expired account or incorrect configuration.

“Connected” usually means only that the local service or VPN interface has started; it doesn’t prove the remote node is working. Test the selected node first. Then confirm that desktop apps are using the system proxy, and that Android’s VPN permission is granted and the target app isn’t excluded by per-app rules. Next, check the logs: no destination requests means check the traffic entry point; requests with outbound errors mean check the node and handshake settings; failures limited to domain lookups point to DNS; issues with specific sites point to routing or the destination service. Temporarily use simpler routing for comparison, then restore your original settings. Stop other proxy tools to avoid port or virtual-interface conflicts. Change one condition per test and retry the same destination; it’s easier to diagnose than switching every setting at once.