V2Ray FAQ

v2rayN is a graphical client for managing configurations, subscriptions, and proxy modes. Xray and V2Fly are proxy cores that handle connections, while a subscription is a set of configuration endpoints maintained by a service provider. Importing a subscription does not connect you to a proxy automatically: you still need to choose an available node and decide how your browser, terminal, or other applications will connect to the local proxy.

For Windows, macOS, and Linux desktops, start with v2rayN; Android devices generally use v2rayNG. Both are graphical clients, but their packages, system permissions, and connection methods differ, so configurations cannot be mixed solely by file format. Before choosing, check the operating system and processor architecture, then confirm that the required protocols are supported by the client and core.

No. The system proxy determines whether applications that read system proxy settings connect to v2rayN’s local listener. Routing rules choose direct, proxied, or blocked exits after traffic enters the core. TUN expands application coverage through a virtual network interface. When troubleshooting, first determine whether traffic reaches the client, then inspect the routing result so an access failure is not mistaken for a routing-rule error.

Importing a subscription only adds the configuration entries supplied remotely to the client. It does not determine which entry is currently available or change network settings for every application. After importing, update the subscription and confirm that the configurations appear, choose a node as the active server, and then enable the system proxy or another connection method as needed.

VLESS and VMess are proxy protocols, while the transport method describes how a connection is carried, such as TCP, WebSocket, or gRPC. Settings such as TLS and REALITY cover connection security and server identity parameters. Every client value must match the server configuration; sharing the same protocol name does not make it safe to change the port, transport, server name, or other fields arbitrarily.

First check the Windows version and processor architecture, then decide whether to use the desktop build or the classic WPF build. After installing or extracting it, place the program somewhere the current account can read and write normally, and avoid launching multiple copies. On first run, verify that the client interface opens completely and the core starts successfully before importing subscriptions or enabling the system proxy.

Add the address under subscription groups or subscription settings, save it, and run an update. If the provider gives you a single share link, use the import-from-clipboard or configuration-scan entry instead of pasting a single-node link into the subscription URL field. After importing, confirm that the server list contains the new entries and select one configuration as the active node.

Confirm that the copied content is complete and that the address has no leading or trailing spaces, line breaks, or non-ASCII punctuation. Determine whether you received a subscription URL or a single-node share link. Then check in a browser whether the address is still reachable and whether the service account has expired. If the client reports a format error, ask the configuration provider to verify the response; repeatedly changing proxy modes usually will not fix malformed subscription data.

Most recent mainstream Android phones use arm64, so the arm64 package is usually the best first choice and is often more compact. Choose the universal package if you cannot confirm the processor architecture, the device is older, or the arm64 package reports incompatibility. The main difference is the range of processor architectures included, not the supported proxy protocols or subscription features.

v2rayNG uses Android’s VpnService interface to pass application traffic to the local proxy, so Android requires system authorization when the first connection starts. The operating system displays and manages this permission. If another VPN connection is already active, disconnect it first to avoid conflicts. If connection still fails after authorization, check the node configuration, network conditions, and per-app proxy scope.

First confirm that the browser reads the Windows system proxy. Some browsers, extensions, and portable applications keep independent proxy settings and bypass the system configuration. Then check that v2rayN’s local listener is running, an active node is selected, and the browser’s port matches the client. If other applications that use the system proxy also fail, inspect the node connection and core messages.

Many command-line programs do not automatically read the Windows system proxy, or they recognize only their own options and environment variables such as HTTP_PROXY and HTTPS_PROXY. Check the specific program’s proxy options first, then point it to the HTTP or SOCKS port actually listening in v2rayN. After changing the local listener port, update the old port in terminal scripts and environment variables as well.

Consider TUN when the target application does not support manual proxies, does not read the system proxy, and genuinely needs its traffic routed through the client. Before enabling it, verify a basic connection with the system proxy; otherwise node, DNS, permission, and routing issues become mixed together. TUN can also conflict with other virtual adapters, security software, or enterprise network policies, so rule out those causes one by one.

First confirm that the target application’s traffic has entered v2rayN; traffic that never reaches the client will not pass through the core’s routing. Then check rule order, domain-matching behavior, the destination address, and the final default rule, because the first matching rule affects later decisions. For domain-based rules, also verify the DNS result so the connection is not actually made to an IP while the rule matches only the domain.

It depends on whether v2rayNG is set to include mode or exclude mode. Include mode normally sends only selected apps through the proxy, while the rest use their normal network path. Exclude mode lets selected apps bypass the proxy. After changing the list, reconnect and test with the target app; the client’s connected status alone does not show which application traffic is covered.

Some applications reuse established long-lived connections, so switching nodes does not immediately replace those sessions. Close the relevant page or application connection and send the request again; if necessary, disconnect and restart the client connection. Also confirm that the active node actually changed rather than merely being highlighted in the list without being set as the active server.

First determine whether every subscription fails or only one URL. For a single failing URL, check its validity period, account status, and response format. If all subscriptions fail, check the system clock, DNS, current network, and the proxy settings used by the client to access subscriptions. Do not delete existing configurations first; keep the current nodes and test the subscription URL separately to limit the scope of troubleshooting.

A timeout means the test request did not finish within the allotted time, but it does not by itself prove that a particular field is wrong. Check the local network first, then verify the server address, port, user ID, transport method, TLS server name, and system time. If every node in the same subscription times out, also consider an invalid subscription configuration, DNS problems, or a core that did not start correctly.

Connected only means that the client completed a startup or interface state; it does not mean the target application’s request succeeded. Test with a browser known to read the system proxy, then check the active node, local listener, routing rules, and DNS. If only one application fails, inspect that application’s proxy settings. If every application fails, review core startup and node-connection messages.

TUN needs to create or control a virtual network interface and may require elevated permissions. Exit duplicate client instances, then launch the client with an account that has the required permissions for the operating system, and check whether security software is blocking the virtual adapter component. If the device is managed by organizational policies, do not bypass those restrictions; use an approved system proxy or in-app proxy instead.