V2Ray FAQ

V2Ray generally refers to the proxy technology and tools associated with Project V. V2Fly and Xray are two commonly used core families. The core handles protocol connections, routing, and traffic forwarding, while GUI clients manage subscriptions, provide settings, and launch processes. When troubleshooting, note both the client name and the core actually in use; saying only that you use V2Ray is not specific enough. Whether a protocol or transport works also depends on the core version, how the client generates its configuration, and whether the server settings match.

For desktop use on Windows, macOS, or Linux, start with v2rayN. Android users typically choose v2rayNG, which uses the Xray core; consider v2flyNG if you specifically need a V2Fly-based option. Choose based on your device, the protocols required by your subscription, and your routing needs—not on similar-sounding names. Before importing, check that the configuration is compatible with the client you chose, and back up any working setup. After switching clients, check system proxy settings or connection permissions again; the previous client's access settings won't carry over automatically.

A system proxy is one way for apps to connect through a client; it mainly affects apps that honor the system proxy settings. Global and bypass-China modes are routing policies that determine which outbound route connections already handled by the core will use. Global mode does not automatically route traffic from every app on the device, and bypass-China mode does not guarantee that every destination connects directly; the result depends on the rules, their order, and the databases used. When testing, first confirm that the app's traffic reaches the client, then check the routing result so you don't mistake an app access issue for a routing issue.

A client provides configuration and connection features, but installing it does not create a working remote server. To route traffic through a remote proxy, you need a subscription URL, an individual share link, or complete server settings obtained through legitimate means. A subscription is a way to update a set of configurations; it is neither a protocol nor a client account. Before importing, check where the configuration came from, whether it is still valid, and which clients it supports. This site provides client downloads and technical information, but does not provide proxy nodes. Contact the relevant service provider about subscription authorization or usage limits.

First, distinguish a subscription URL from an individual share link. Add a subscription URL to a subscription group; use an option such as Import share link from clipboard for a single link. When copying, remove leading or trailing spaces, line breaks, and punctuation added by chat apps, and make sure you haven't copied a webpage URL instead. Then check the import message. If the response is a webpage or the format is unsupported, confirm that the provider's subscription format works with your client. Don't post a full subscription URL publicly; it may contain access credentials. After importing, update the group and confirm the entries appear.

Most newer Android phones support arm64, but check the app architectures supported by your device's operating system rather than relying only on the processor model or purchase date. If 64-bit apps are supported, choose arm64; if you're unsure of the architecture, universal is a fallback, though its package is usually larger. If parsing fails or installation is blocked, check the Android version, permission to install from that source, and whether an app with the same name but a different signing key is already installed. Before uninstalling an older app, export your configuration and verify the backup to avoid losing custom rules.

Check your operating system and processor architecture in system information, then choose the matching platform download. The Windows downloads distinguish the desktop edition from the classic WPF edition; macOS downloads distinguish Apple Silicon from Intel; and Linux packages depend on both the distribution's package format and the x64 or arm64 architecture. deb and rpm refer to different package management systems, not proxy protocols. If installation fails, note the package name and error message, then check supported system requirements and dependencies. Don't try to fix an installation error by randomly switching cores or overwriting the application directory.

TUN creates a virtual network interface and changes routes, so desktop clients usually need administrator privileges, a privileged helper, or the appropriate network capabilities. Turn off TUN first and confirm that a regular proxy connection works, then grant permissions as prompted by your client. On Linux, also check that the system provides a TUN device and that you have the required permissions. Android uses system VPN authorization; allow it in the connection prompt. If another VPN or network-routing app is running, stop it and try again. If authorization succeeds but TUN still fails, check the interface creation logs. Don't disable the entire firewall or permanently grant broad permissions.

Select a configuration and connect, then use a browser known to honor the system proxy to visit a site you know is reachable. Check the client's connection records or logs at the same time to confirm the request reached the core and used the expected outbound route. A connection icon usually indicates only that a process or local service has started; it doesn't prove the remote handshake succeeded. You can temporarily simplify routing while testing, then restore your usual policy. If the browser works but another app doesn't, check that app's proxy settings and connection method rather than immediately changing all your server settings.

Routing rules are usually evaluated in configuration order. A broad rule near the top can take precedence over more specific rules below it. First confirm that requests are using the active configuration, then check the conditions and tags for domain, ip, and outboundTag and review the match logs. Domain rules require the core to have domain information; if it only has the destination IP, a geosite rule may not match. Make sure the geoip and geosite data are also compatible with the configuration. Change one item at a time and restart or reload the configuration, keeping the previous rules so you can compare results or revert.

If v2rayNG disconnects in the background, check whether the system is restricting its background activity. Allow background use in battery settings as needed, and make sure system VPN authorization is still active. Some devices also require a separate autostart permission; menu names vary by Android version. For per-app settings, check whether the list means “proxy only selected apps” or “bypass selected apps.” Save your choice, reconnect, and test again. A system VPN icon does not mean every app's traffic is routed through the proxy; choosing the wrong list mode can make browsers and other apps behave very differently.

At minimum, save your subscription groups, custom servers, routing rules, DNS settings, and local listening ports. After using the export feature, confirm that the backup file was created and saved somewhere you can access. Different cores may support different protocol fields and routing syntax. After switching, test one known-working configuration before restoring complex rules. Refreshing a subscription may not restore entries you added manually. Backups may contain subscription credentials and server authentication details, so restrict access and don't post them publicly as screenshots or log attachments.

Start with the update logs and identify whether the failure is due to DNS resolution, a connection timeout, a certificate error, authorization, or content parsing. Check that the subscription hasn't expired, your device's date and time are correct, and the provider hasn't changed the URL. If updates require a proxy but the selected node is no longer working, you can get stuck in a loop: the subscription can't update and the client can't connect. If your client offers a direct update option, try it, or switch to another known-working configuration. For authorization errors, check the subscription status. Don't repeatedly retry or disable certificate validation to hide the problem.

First identify whether the timeout occurs while connecting to the server, during the protocol handshake, or when making the actual request. Check that the server address, port, transport, and TLS or REALITY settings match the provider's details, and verify your device's date and time. Then test the same configuration on a different local network, or compare another known-working configuration on the same network. Change only one condition at a time. A failed ICMP test doesn't prove the proxy is unavailable, and a successful TCP connection doesn't prove protocol authentication succeeded. If the logs show an authentication or handshake error, check the parameters before changing local routing repeatedly.

Pause TUN and complex routing first, then test a known-working configuration with the regular system proxy. Confirm the core is running and that the local listening address and port match the system proxy settings. Check whether browser extensions or other proxy tools are overriding those settings. If the logs show no test requests, first check whether the app honors the system proxy. If requests appear but name resolution fails, check DNS; if the handshake fails, verify the remote configuration. Command-line tools and some desktop apps need their proxy configured separately. If internet access still fails after you quit the client, check for system proxy settings that point to a stopped port.

Turn off TUN normally in the client and quit any other VPNs. Restore automatic DNS or your previous working network settings, then test the basic connection. If the network works until you start the client, check which outbound route handles DNS requests, whether the resolver is reachable, and whether it depends on a proxy that hasn't connected yet; avoid creating a DNS loop. If you need to restart, save your logs and configuration first, then run only one network-routing tool after reboot. Once the connection is back, re-enable routing, DNS, and TUN one at a time to identify the trigger. Don't reset everything at once, or it will be harder to find the cause.