V2Ray System Proxy vs. Global and Bypass Mainland China Modes: Choose the Right Proxy Setup

System Proxy vs. Routing Modes: Two Separate Controls

Selecting a node in v2rayN doesn’t mean every app is using it. The client must start a local proxy listener, and apps must send connections to it through the system proxy, manual proxy settings, TUN, or another method. Once traffic reaches the core, routing rules determine whether it uses a proxy outbound, goes direct, or gets blocked.

So “Set system proxy” and “Global” aren’t alternatives. The former usually changes the operating system’s proxy settings; the latter is typically a routing preset provided by the client. The V2Ray or Xray core applies the actual rules, while the client determines the mode names and preset contents shown in its interface.

System Proxy Coverage: Browsers, Terminals, and TUN

On Windows, check the manual proxy settings under Settings → Network & Internet → Proxy. In v2rayN, the usual path is right-click the tray icon → System Proxy → Set system proxy. Labels may vary between versions, so follow the options shown in your client. After setup, the system proxy address and port should match the client’s active listener.

Browsers that honor the system proxy usually use this route, but apps can have their own proxy settings. Command-line tools may read only command-line options or environment variables. The system proxy’s bypass list can also send some addresses around the local listener. If one app works, that doesn’t prove another app is connected.

These values are examples, not defaults for every version. In v2rayN, look under Settings → Parameters for local listener port options. Some versions use a mixed listener, in which case HTTP and SOCKS may share a port. Don’t copy the examples and then assume a connection failure is caused by the node.

• Proxy just one app: Enter the actual proxy type, 127.0.0.1, and listener port in the app. You may not need to change the system proxy.
• Proxy everyday apps such as browsers: Enable the system proxy and check whether browser extensions or app-specific proxy settings override it.
• An app ignores proxy settings: Consider TUN, then check administrator permissions, the virtual interface, DNS handling, and route exclusions.
• Connect other devices to this computer: A loopback address isn’t accessible to devices on your local network. Exposing a listener requires access controls and firewall rules; simply changing the address to listen on every interface isn’t a complete setup.

Global vs. Bypass Mainland China: Choosing a Daily Routing Mode

Global usually sends business connections that reach the core through the proxy outbound. It’s useful for short-term troubleshooting, testing a node, or routing all relevant traffic to services that require a proxy. It doesn’t mean all traffic from the device goes through the proxy, nor does it automatically send every operating system DNS query through the node. Client presets may still keep exceptions, such as direct connections to local addresses.

Bypass Mainland China typically combines rules for mainland Chinese domains and IPs with a proxy outbound as the default: connections matching mainland China criteria go direct, while the rest use the proxy. Check the actual rules in the active preset to see whether it also includes direct access to local networks, ad blocking, or other exceptions; don’t infer these from the mode name alone.

Whether a node uses VMess or VLESS doesn’t change how these two layers work. The protocol defines how the client communicates with the server; the system proxy controls how apps connect to the client; routing determines which outbound handles each connection. Subscription updates mainly refresh node details and aren’t a general fix for local connection issues.

Bypass Mainland China Isn’t Matching: Check Rule Order and DNS

Common routing configurations evaluate rules in order. If a broad proxy rule appears before the mainland China direct rules, later conditions may never be reached. For services deployed across regions or using a shared CDN, IP geolocation alone may not produce the expected result. Check the service domain, DNS results, and actual destination address together.

1. Check app access. Make a new request and confirm that the local listener receives it. System proxy exceptions and an app’s own direct-connection settings can bypass the core entirely.
2. Check whether the domain is visible. If an app supplies only a resolved IP address, domain rules may not be available for matching. Traffic sniffing can provide domain information for some protocols, but it won’t cover every connection.
3. Check rule order. Put specific domain exceptions before broad matches and verify that the target outbound tag exists. Back up custom rules before changing them, and edit one at a time.
4. Check the resolution strategy. The core’s domainStrategy affects whether IP matching conditions are added for domains during routing. It isn’t a system DNS switch, and its meaning can’t be carried over directly to another core’s configuration format.
5. Check rule data files. If you use conditions such as geosite:cn or geoip:cn, make sure the required rule data is available. Resource versions and category coverage can both affect matches.

Consider DNS alongside the traffic route. Incorrect local resolution may send connections to unreachable addresses, while remote resolution may not suit services that should connect directly in mainland China. Record the original settings first, then change either DNS or routing one item at a time. Changing the node, DNS, and mode all at once makes it hard to identify the cause.

Desktop and Android: Same Routing, Different Ways to Connect

Desktop clients typically use the system proxy or TUN. On Android, v2rayNG usually creates a local virtual interface through VpnService to capture traffic, then routes it through the Xray core. v2flyNG uses the V2Fly core; check the client you’re using for its rule interface and supported protocols rather than assuming it has all the options found in another client.

For example, an Android app excluded from traffic capture may still connect directly even when routing is set to Global. Conversely, an app included in the capture scope won’t necessarily send every connection through the node: direct rules in Bypass Mainland China still apply. After changing the per-app list, stop and restart the connection, then reopen the app to test.

Testing and Troubleshooting: Compare the Same Request

Choose a target that reliably reproduces the issue, then keep the node fixed while comparing results. The command-line examples below assume the two local listeners described earlier. Use them only if the client actually provides HTTP and SOCKS services on those ports. The example domain is for illustrating request syntax; for troubleshooting, replace it with the site where the problem occurs.

# HTTP listener: use the port configured in your client
curl --proxy http://127.0.0.1:10809 --connect-timeout 10 --max-time 30 --head https://example.com/

# SOCKS listener: resolve the destination domain through the proxy
curl --proxy socks5h://127.0.0.1:10808 --connect-timeout 10 --max-time 30 --head https://example.com/

The 10-second value is the connection timeout; 30 seconds is the limit for the entire request. Neither is a measured speed. Unlike local DNS resolution, socks5h resolves the domain through the proxy, so keep that difference in mind when comparing results. An HTTP error status may still mean the connection succeeded. Check the response and logs rather than treating every non-success status as a node failure.

1. Keep the node fixed and specify the proxy explicitly. If the local port connection fails, check that the core is running, the port is correct, and no other process is using it.
2. Keep the target the same and switch routing modes. If Global works but Bypass Mainland China doesn’t, check direct-routing conditions, domain classification, and DNS results first. Also rule out a temporary issue with the destination service.
3. Test the app after confirming the explicit proxy works. If the same target works in a terminal but not in a browser, check the browser’s active proxy settings, extensions, and system bypass list.
4. Start a new connection and check again. Existing long-lived connections may keep using the old route. After changing rules, make a new request and restart the target app if needed. If logging is off, temporarily enable access logs, then restore your usual log level once you’ve found the issue.

For more on the terminology, see the Glossary. For the full setup sequence, see the User Guide. Recording a reproducible target, the actual port, and the matched outbound is more useful for troubleshooting than simply noting that “Global is on.”