Before you start, choose the right installer for your device on the client download page, then install and open the app. You’ll also need a working subscription URL or a single connection link from your provider. The client reads configurations, starts the core, and handles traffic; it does not create remote servers for you. A subscription URL may contain access credentials, so treat it like account information. Don’t post it in public forums or include it in screenshots.
This guide covers the shortest path through a first-time setup. Menu labels may vary slightly by version; if they do, look for the functions to manage subscription URLs, update the server list, and set an active server. Keep the default listening ports and core options at first, and avoid changing several settings at once. Check the result of each step before moving on.
1. Import a subscription
A subscription URL retrieves connection configurations. It is not a browser proxy address or a server address to enter in your system network settings. Copy the complete subscription link provided by your service. Don’t use the URL for a management page, login page, or help page. If the copied text includes spaces, quotation marks, or line breaks, check it before saving.
v2rayN: Add a group and update it
Open Subscription Group in the main window’s top menu, go to Subscription Group Settings, and choose Add. Enter a recognizable name for the group, then paste the subscription URL into the address field. The name is for local reference only; the URL is what the client requests when updating. Save, close the settings window, and return to the main window with the server list.
Open Subscription Group again and choose Update Subscription. On a first setup, you may not have a working proxy connection yet, so start with the option to update without a proxy. Depending on the version, it may be called “Update all subscriptions (without proxy)” or something similar. If your current network can’t reach the subscription URL, first check that the URL works or use an available connection to update it. Don’t keep switching update options before you have a connection.
When the update finishes, the main list should show server entries for the group. Open the group and check that details such as the name and protocol match what you expect. If no entries appear, start with the update message: a failed request usually means a network or URL issue; content that can’t be parsed may indicate an incompatible subscription format or client. You’re not at the connection stage yet, so there’s no need to change routing.
v2rayNG: Save the URL, then update the list
Open the side menu on the main screen and go to Subscription Group Settings. Tap Add, enter a name and subscription URL, then save. Return to the configuration list and choose Update Subscription from the main screen menu. Saving the URL alone doesn’t download configurations; the import is complete only when connection entries appear in the list.
If you have a single connection share link rather than a subscription URL, use the option to import a configuration from the clipboard. Don’t confuse the two: a single link usually creates one configuration, while a subscription URL retrieves and updates a group of configurations. See the glossary entries on subscriptions and clients for details. After importing, select an entry; next, choose how app traffic should reach the client.
2. Choose a proxy mode
There are two separate questions at this stage: do apps send their requests to the client, and how does the client handle requests it receives? The first is the traffic entry point; the second is routing. “Set system proxy” does not send traffic from every app through the proxy, and “global routing” does not automatically send every app into the client. Choose the entry point first, then routing, to avoid thinking the setup only partially works when the connection itself is fine.
v2rayN: Start with the system proxy
For a first setup, start with the system proxy rather than enabling TUN right away. Find System Proxy in the main window or tray menu, and locate “Automatically configure system proxy” and “Clear system proxy.” The first points the system’s supported proxy settings to the client’s local listening port; the second removes those settings. You can locate these options now and enable the system proxy after the core starts successfully in the next step.
Browsers usually honor the system proxy, but some apps use their own network settings or ignore it altogether. For a straightforward test, use a browser without extra proxy extensions. Don’t enable the system proxy while also pointing a browser extension at a different port. Traffic could then use another configuration, leaving the client logs out of sync with what you see in the browser.
Next, check the Routing options. For everyday use, start with a preset that includes both direct and proxy rules; the exact label depends on the version. To isolate a problem, you can temporarily use a routing preset that sends all requests already inside the client through the proxy, then restore split routing after the test. This changes outbound routing; it does not expand which apps the system proxy can receive traffic from.
v2rayNG: Check VPN mode and app coverage
Open Settings and confirm that VPN mode is used as the entry point. It receives traffic through Android’s VPN interface, so you don’t need to enter a local proxy port in each browser. If per-app proxying is enabled, check whether the list means “proxy only selected apps” or “bypass selected apps”; the same selection can mean the opposite in each mode. For an initial test, temporarily disable custom per-app restrictions to reduce variables.
Then choose a suitable preset under Routing. The aim is to send requests that need a proxy to the proxy outbound and let requests meant to connect directly follow the direct rules—not to treat “global” as a requirement for a successful connection. Leave the protocol and transport settings from your provider unchanged; choose only the traffic entry point and routing preset. For TUN, inbounds, and outbounds, see the glossary. Save custom rules until the basic connection works, then use the routing field reference to configure them.
3. Connect and check startup status
Importing configurations doesn’t mean one is in use, and seeing a test result in the list doesn’t mean app traffic is going through the proxy. Before connecting, identify the active configuration and confirm the client has started the core with it. Close other proxy or VPN apps that are capturing traffic to prevent them from overriding system proxy settings or occupying Android’s VPN slot.
v2rayN: Set an active server
Select the server you want in the list, then choose Set as active server from the right-click menu. Some versions also let you double-click an entry. Check the active indicator and status details at the bottom to make sure you didn’t select a server with the same name in another group. If the client is already running, changing the active server usually reloads or regenerates the configuration. Wait for startup to finish in the logs before testing access.
Open the log panel and look for errors such as configuration parsing failures, a port already in use, or a core that failed to start. If a port is occupied, don’t just keep clicking Restart. First check whether the client is running twice or another app on your device is listening on the same port. Close duplicate processes and try again; this makes the cause easier to identify than changing several listening ports at once.
Once the core is running, set System Proxy to “Automatically configure system proxy.” If you’ve left it on “Clear system proxy,” your browser may still connect directly, even though the core is running and won’t receive its requests. You can minimize the window to the tray while using the client, but don’t confuse minimizing with quitting: quitting stops the local listener.
v2rayNG: Confirm permission and connection status
Tap the target entry in the configuration list and check that it’s selected, then tap Connect on the main screen. The first time you connect, Android will show a VPN connection request; review the system prompt and confirm. The client can receive app traffic through this interface only after you grant permission. If you cancel, tap Connect again and approve the request instead of changing the subscription.
After startup, check the client’s connection status, the system VPN icon, or its persistent notification, and review the logs. The system indicator means the traffic capture interface is active; it doesn’t guarantee the remote server is reachable. If the connection drops soon after you switch apps, check Android’s background and battery restrictions for the client and allow it to run continuously in your device settings. Confirm that it stays connected before testing access, so a background shutdown isn’t mistaken for a server issue.
4. Verify the connection
Check both app access and how the client handles traffic. A latency test reflects only the connection used by that test; it can’t prove that every app and domain is handled as expected. Open the browser you chose earlier, visit a site that should use the proxy, reload the page, and check the client logs for the corresponding request. Use a new tab where possible so you don’t mistake cached content for a live connection.
Compare the result with the outbound route
If the logs show routing decisions, check whether the request used the proxy outbound or the direct outbound. With split routing, some sites should connect directly; a page loading normally doesn’t prove the proxy is working. Test a site expected to use the proxy, then one expected to connect directly, and compare the results with your routing rules.
For a closer check, use the same browser to open a trusted IP lookup site and note the result with the proxy enabled. If it won’t disrupt other tasks, temporarily disable the entry point, compare the result, then reconnect. On desktop, clear the system proxy; on Android, stop the VPN connection. The lookup site may itself be routed directly, so if the IP doesn’t change, check which rule matched before assuming all proxied requests are failing.
Finally, test the apps you actually need. If the browser works but a desktop app behaves the same as before, first check whether it uses the system proxy or has its own proxy settings; don’t reinstall the client straight away. On Android, check whether the per-app list excludes the app. Consider advanced options such as TUN only after confirming that the current entry point doesn’t cover the traffic you need.
If it’s not working, check in this order
First, check the entry point: do requests from the app appear in the client logs? If there are no relevant entries, check the system proxy, VPN permission, browser extensions, and per-app coverage. Second, check routing: did the request reach the client but go to a direct or blocked outbound? Third, check the connection: if it matched the proxy but timed out or failed to handshake, check the active server, network connectivity, device time, and connection settings. Check DNS last to avoid changing the entire DNS configuration too soon.
If you want to try another server, keep the same browser, test site, and routing rules, and change only one server at a time. Note whether the issue is a DNS resolution failure, connection timeout, or certificate error; this is more useful than repeatedly updating the subscription. Before sharing logs, redact subscription URLs, user IDs, connection credentials, and any destinations you don’t want to disclose.
Once the basic setup works, keep it and add rules one at a time. Subscription updates usually refresh the group entries, so manual changes to those entries may be overwritten. Manage important custom settings through the client’s separate configuration options. To understand the generated configuration, see the config.json field reference and check inbounds, outbounds, routing, and dns in order. There’s no need to rewrite the whole configuration for a first connection.