V2Ray FAQ

V2Ray usually refers to proxy technology and related projects in the Project V ecosystem. The core engine handles protocols, transport connections and routing; GUI clients manage subscriptions, edit configurations and control startup. v2rayN is a desktop client, while v2rayNG and v2flyNG are for Android. If the interface opens, the client has launched successfully, but that does not mean the core engine is running properly. To check a connection, review the active configuration, core logs and actual access results. Don’t treat the site name, client name and core engine name as the same setting.

A client provides configuration and connection tools; it does not create a usable remote server. A subscription URL retrieves server configurations in bulk, while an individual share link usually contains one configuration. After installation, import a valid configuration you manage or are authorized to use, select a server and connect. Subscription URLs may contain access credentials, so treat them like passwords. Don’t post them in public comments, screenshots or online conversion tools. If you don’t have a valid configuration, repeatedly changing system proxy settings or reinstalling the client usually won’t fix the connection.

For Windows, macOS and Linux desktops, start with v2rayN and choose an installer that matches your operating system and processor architecture. On Android, v2rayNG with the Xray core is usually the first choice; consider v2flyNG if your existing configuration specifically depends on V2Fly compatibility. What matters is support for the protocols, transport methods and core engine your configuration requires—not how similar the interfaces look. Before switching clients, keep your existing groups and routing settings. Remove the old configuration only after testing access with the new client to avoid troubleshooting multiple active proxy entry points.

The system proxy directs apps that follow system proxy settings to a specified local entry point. Routing determines whether connections are proxied, sent directly or blocked after they reach the core engine. TUN receives traffic through a virtual network interface; its coverage depends on the client and routing settings, and it usually requires extra permissions. These are separate controls. If a browser works but other apps don’t, first check whether those apps use the system proxy. Then decide whether TUN is needed instead of switching routing to global and skipping the traffic-capture checks.

Most recent Android phones use the arm64 architecture, so an arm64 package is usually a good first choice. For older or unusual devices, or if you’re unsure of the architecture, consider the universal package, which includes components for multiple architectures. A 64-bit-capable processor doesn’t necessarily mean the device runs a 64-bit operating system, so check the system information. If a package isn’t compatible, verify the system requirements and architecture instead of repeatedly installing over it. Universal packages usually take up more download and storage space; they don’t make connections faster or bypass Android version requirements.

Make sure you copied the full subscription URL—not an information page, a single share link or text with extra spaces. Add a group in the subscription group settings, enter and save the URL, then update that group. If parsing fails, check whether the response is actually a login page, an error page or a format the client doesn’t support. Import individual share links through the appropriate import option. Don’t share the full URL while troubleshooting. Note the error type, client name and steps that failed to distinguish URL retrieval issues from incompatible configuration formats.

Saving a subscription group usually saves only the URL; it doesn’t mean the configurations have been fetched. Update the group from the subscription group menu, then check whether the list is filtered to a different group. If it’s still empty after updating, look in the logs for parsing errors or check whether the subscription source returned no content. Make sure the subscription format is compatible with the client; don’t use a single configuration as a subscription URL. Don’t delete the existing group right away. Keep the old configurations, note the update result and check the URL and response format to avoid losing settings by mistake.

On desktop, check the logs for the specific permission or virtual network adapter error, then follow the client’s instructions to authorize the required service, driver or network extension. Windows may require administrator privileges; on macOS, approve the system authorization prompt. On Linux, check the permissions required by the client rather than running the entire desktop environment with elevated privileges long-term. On Android, approve the system VPN request the first time traffic is captured, and check whether another VPN is already active. Restart the feature after granting permissions. If it still fails, temporarily use the system proxy to verify that the configuration itself works.

First decide which route the traffic needs to take. Global generally sends traffic captured by the client through the proxy. Bypass mainland China typically uses domain and IP rules to send matching destinations in mainland China directly. Direct sends traffic without using a proxy server. The exact behavior depends on the client’s presets and custom rules. For everyday use, start with a routing preset that fits your needs and check the matching rules if a particular app has problems. Global can’t force-capture apps that ignore the system proxy. After changing routes, start a new connection to avoid misleading results from existing connections.

Choose the route that can reliably reach the subscription source on your current network. If the proxy works but a direct connection to the source fails, try the client’s option to update through the proxy. If the proxy itself is unavailable, relying on it to update the subscription can create a dependency loop; try a direct connection or another working network. Menu labels vary by version—the key is to identify which route fetches the subscription. After updating, check that the groups and server details changed as expected. Don’t judge success by the button completing, and avoid repeatedly requesting the same source.

In addition to subscription groups, record custom routes, DNS settings, local listening ports, system proxy settings and any app-specific routing rules you need. Subscriptions usually provide server configurations, but don’t necessarily sync all client preferences. When migrating, use the client’s export or backup feature and make sure the target version can read that format. Backup files may contain server credentials and subscription URLs, so store them securely. On the new device, test one configuration and basic access first, then restore advanced settings one at a time. This makes compatibility issues easier to pinpoint than copying everything at once.

Changing a name in the client alone won’t make one protocol interchangeable with another. VMess, VLESS and Trojan have different protocol requirements, and client parameters must match the server. REALITY is a transport security mechanism, not a server type at the same level as the other three. When using a share link or subscription, keep the original parameters and check that the selected core engine supports the combination. If a connection fails, don’t randomly change the protocol, transport or security options; verify each setting against the server configuration. Switching protocols in the client only makes sense when the server has been updated to provide the matching parameters.

A timeout means only that the test didn’t finish within its time limit. Possible causes include the local network, server port, test target, protocol negotiation or configuration parameters. First confirm that regular internet access works, then check the system time, selected server and first relevant error in the logs. If only one test target fails, that doesn’t prove all access is down; retest with a service you actually need to reach. Keep the original configuration and test on another working network or with another known-good configuration, changing only one condition at a time so you can compare results.

Connected may only mean that the local core engine or VPN interface has started; it doesn’t confirm remote access is working. First check that the intended server is selected and the logs aren’t showing repeated errors. Then verify that the browser uses the correct system proxy or local port. If no domains work, check DNS resolution and the proxy entry point. If only some sites fail, check the routing rules and the destination service. Temporarily disable other proxies, VPNs or extensions that change network settings to compare results. Start a new connection after each change, and don’t enable the system proxy alongside multiple traffic-capture tools just to see what happens.

First make sure the client has started the core engine and is set to configure the system proxy automatically—not to clear the proxy or leave it unchanged. Then check that the proxy address and port in system settings match the current local listening entry point. If system settings are correct but one app still can’t connect, check whether it has its own proxy settings, ignores the system proxy or is overridden by a browser extension. Also check whether another proxy program rewrites the system settings when it exits. Don’t widen the local listening address to fix an issue affecting apps on the same machine. To capture traffic from other types of apps, assess TUN and its permission requirements separately.

Note whether the error is a connection timeout, certificate error, access denied or parsing failure, then check whether the subscription URL has expired or changed. For timeouts, compare direct and proxy routes. For certificate errors, check the device time and whether a network sign-in page is required; don’t disable certificate verification. Access denied may mean expired subscription credentials or request limits. If the content is retrieved but can’t be parsed, check its format and client compatibility. Keep existing configurations during troubleshooting so you don’t lose working servers by deleting a group. When sharing details, redact credentials in the URL and include only a brief error summary.