V2Ray FAQ

For desktop devices running Windows, macOS, or Linux, choose v2rayN. For Android, v2rayNG with the Xray core is usually the best fit; consider v2flyNG if you need compatibility with an existing v2fly setup. The client manages configurations and connections, while the core handles protocols—they are not the same thing. Project V is the starting point for this open-source ecosystem, while V2Fly and Xray are separate core families. Before choosing, check the protocols, transport, and security settings your configuration requires. Similar names do not mean configurations are interchangeable.

A client is a connection tool; installing it does not provide a working server. To connect, you need at least a server address, port, authentication details, and transport and security settings that match the server. These are usually imported from a subscription URL, share link, or configuration file. Get your configuration from a provider whose service you are authorized to use, or from your own server, and make sure the service is active. Never post subscription URLs, complete share links, or logs containing account details publicly: they may include credentials that grant access to the service.

A subscription URL is usually an HTTPS link that retrieves a list of configurations. Updating the subscription fetches the latest content from that source. Links such as vmess://, vless://, trojan://, and ss:// usually describe a single server configuration. A subscription endpoint may return a Base64-encoded collection of share links, or a format the client does not support. Import a single share link using an option such as Import from clipboard; save subscription URLs in the subscription settings. A web management URL is not the same as a subscription URL, so check the source’s instructions before copying an address from your browser bar.

v2rayNG’s VPN mode uses Android’s VPN interface to route traffic from eligible apps. Proxy-only mode mainly provides a local proxy listener, which apps must be configured to use. v2rayN’s system proxy changes the desktop OS proxy settings, but not every program uses them. TUN handles traffic through a virtual network interface; what it covers depends on routing, permissions, and exclusions. Don’t turn on all these modes as a general fix. First determine how the target app sends traffic, then choose one interception method and test it.

Choose arm64 if your device runs a 64-bit ARM operating system. If you’re unsure of the system architecture, start with the universal package. It supports multiple architectures and is usually larger; it does not make connections faster. Some devices have 64-bit processors but still run a 32-bit OS, so the device’s age is not a reliable guide. Check the system architecture in device information or consult the manufacturer. When updating an existing client, also make sure the app source and signing match. If installation fails because of a conflict, export your configuration before deciding whether to uninstall the old app.

First make sure you copied the complete subscription URL. Remove leading or trailing spaces, line breaks, and punctuation added by a messaging app. In v2rayNG, add a label and URL under the subscription group settings in the sidebar, save, return to the list, and update the subscription. In v2rayN, add the URL under subscription group settings, then update that group. Menu labels may vary between versions. If you copied a single protocol share link, use the Import from clipboard option instead. If it still fails, check the error to distinguish an unreachable URL, an empty response, and an unsupported format. Don’t keep changing unrelated settings.

Check whether the subscription URL has expired, been reset, or needs to be retrieved again. Then confirm that your current network can reach the subscription service. If the client offers update through proxy and direct update options, try the one that matches your working connection; updating through a proxy requires an existing working configuration. If the update succeeds but returns no entries, clear any server keyword filter for that group, then check whether the client supports the response format. Don’t delete the whole group right away, or you may lose its label and existing settings. Note the update error, but hide any access credentials in the subscription path before sharing it.

v2rayN’s TUN mode needs to create or use a virtual network interface. If you see a permissions error, stop the connection and grant the permissions requested by the client. On Windows, restart with administrator privileges if prompted; on macOS and Linux, check the authorization prompt and client logs. On Android, v2rayNG usually uses the system VPN interface. When starting a connection for the first time, approve the VPN prompt from Android rather than following desktop TUN steps. Another VPN app may already be using the same connection slot; stop it, then grant permission and start the connection again.

Launching v2rayN does not automatically set the system proxy. Select a server and confirm the core is running, then set the system proxy from the tray menu. Check that the system proxy address and port point to the client’s current local listener. Next, make sure your browser uses the system proxy and that no extension or separate proxy setting overrides it. Some apps ignore the system proxy; configure a local proxy for them or use TUN if you specifically need it. During testing, close other proxy tools so they don’t keep changing system settings. After exiting the client, check that no proxy settings have been left behind.

Start with a built-in routing profile that works, then add rules for the domains, IPs, or apps you need. In v2rayNG, open the routing settings; in v2rayN, check the routing settings and currently enabled profile. Rules are usually matched in order, so put more specific conditions before broader ones. The default outbound handles connections that don’t match. If you use geosite or geoip entries, make sure the required resources are available and the referenced outbound tags exist. Change one group of rules at a time, restart the connection, and test the same destination. Changing DNS at the same time makes it harder to identify the cause.

Keep a DNS configuration that already works. Change settings one at a time only if domain lookups fail, routing results are unexpected, or resolution differs on a particular network. Check that the DNS server is reachable and queries use the intended outbound. FakeDNS maps domain names to synthetic IP addresses and usually needs to work with traffic interception and domain restoration; enabling it won’t fix every connection. If some apps stop working after you enable it, turn FakeDNS off, restart the connection, and clear those apps’ DNS caches. Settings vary by client and core, so don’t copy fields from a different client without checking compatibility.

After enabling per-app proxying in v2rayNG, check whether the current list means “proxy selected apps” or “bypass selected apps.” These modes do the opposite, so don’t rely on checkmarks alone. Once you’ve confirmed the mode, add one app to test, save, restart the VPN connection, then fully close and reopen the app. If it makes network requests through another component, consider how those components interact. The app list controls whether traffic enters the client; routing rules still apply afterward. Selecting an app does not guarantee that all its requests use the proxy outbound.

Confirm the service is active, then check the server address, port, protocol, transport, and security settings. A successful subscription update doesn’t prove the server is reachable; the subscription and server may use different addresses. Try the same configuration on another available network, then test another known-working configuration on the original network to narrow down the cause. In the logs, distinguish DNS resolution errors, connection timeouts, and handshake failures: check DNS for the first, the network path and server listener for the second, and security parameters for the third. Restarting the client won’t revive an expired server, and disabling security checks at random is not a safe fix.

Connected usually means only that the local proxy or VPN interface has started; it doesn’t confirm that the remote connection or DNS is working. Check the logs for repeated resolution or handshake errors, then make sure the selected server is active. On desktop, confirm that the system proxy or TUN is actually handling traffic from the target app. On Android, check that per-app proxying hasn’t excluded it. If only domain names fail, focus on DNS; if only some destinations fail, check routing rules and their outbounds. Before each test, restore a known-working configuration and temporarily disable new custom rules. Avoid stacking changes on top of settings you haven’t verified.

Enable automatic date and time in your system settings, then verify the time zone and current time. Check the server’s required serverName or SNI; these are not interchangeable with the connection address or the WebSocket Host field. A certificate may be issued to a domain name, so even when you connect by IP address, TLS verification still needs the correct name. If the configuration uses REALITY, check its specific parameters rather than changing ordinary TLS fields. Don’t make insecure connections a permanent workaround. If the certificate has expired, the name doesn’t match, or the server configuration has changed, ask the provider for the correct settings.

Stop other proxy clients first, then check the v2rayN logs for the exact listening address and port in the error. Don’t assume every version uses the same port. If the port is occupied by a program you no longer need, close that program normally, or change the local listening port in v2rayN’s parameter settings. Then update the system proxy, any separate browser proxy, and any other manually configured proxy addresses. If the internet stops working after you close the client, clear any proxy still pointing to the local listener in your system network settings, then test again. Don’t terminate unfamiliar system processes or change the port without updating the old proxy settings.