Troubleshooting / Setup & Connections
V2Ray FAQ
Find the relevant settings by symptom. First check whether traffic reaches the client, then look at routing, DNS, and the remote connection.
These steps cover common setups with v2rayN, v2rayNG, and v2flyNG. Menu names may vary slightly by version; follow the current interface and runtime logs. Expand a question to see the answer.
New to setup? Start with the guide →Clients, cores, and traffic capture
Basics
Understand the client, server configuration, and network mode before changing settings at the wrong level.
How are V2Ray, the Xray core, and the three clients related?
V2Ray is a proxy tool in the Project V ecosystem. V2Fly continues development of related cores, while Xray is a separately developed core project. The core handles protocols, routing, and network connections; graphical clients import configurations, let you choose servers, and manage runtime status. v2rayN is for desktop systems. On Android, v2rayNG primarily uses the Xray core, while v2flyNG uses the V2Fly core. Whether a configuration works depends on the bundled core version and the fields it supports, not just the client’s name.
Do I need a subscription or server configuration after installing the client?
Yes. A client manages configurations and connections; installing it does not provide a remote service. Before connecting, get a subscription URL, share link, or server settings that you’re authorized to use, then import them into the appropriate client. A subscription usually includes multiple server entries and an update URL, while a share link typically describes one server. After importing, confirm that the service is active, the credentials are correct, and the protocol and transport settings are supported. Don’t post subscription URLs in public forums: their access tokens may let others retrieve your entire server configuration.
What’s the difference between system proxy, global routing, and TUN mode?
A system proxy sets a local proxy address in the operating system and mainly affects apps that follow that setting. Global routing is an in-client traffic policy that usually sends traffic already handled by the core through a proxy outbound. It won’t automatically route apps that bypass the system proxy into the core. TUN uses a virtual network interface to capture IP traffic within its configured scope, making it useful for apps that don’t use the system proxy. Traffic captured by TUN still follows routing rules, so enabling TUN doesn’t guarantee every connection will use a remote proxy. Choose how traffic is captured first, then decide how it should be routed.
Can I switch the protocol to VMess, VLESS, or Trojan whenever I want?
Changing only the protocol name in the client won’t work. The protocol, authentication fields, transport, and security settings must match the server’s configuration. VMess, VLESS, Trojan, and Shadowsocks use different parameter formats, and the same protocol can use different transport and TLS settings. If your subscription already provides a complete entry, keep it intact while checking compatibility. Create and test a different entry only when the server explicitly provides another set of connection details. Importing one protocol as another usually causes a parsing or handshake failure; it doesn’t convert the protocol.
Packages, import options, and permissions
Installation & Setup
Install the client and import your configuration before setting up a system proxy or granting VPN access.
Which Android package should I choose: arm64 or universal?
For most recent Android devices, arm64 is a good first choice, but check the ABI supported by the operating system rather than relying on the processor’s advertised specs. Some devices have 64-bit processors but run a 32-bit OS, so an arm64 package may not install. A universal package usually includes multiple architectures and is larger; try it if you’re unsure which architecture your system uses. It still may not support older systems. If installation fails or reports incompatibility, check the minimum Android version, whether the download completed, and whether an app with the same name but a different signing key is already installed.
What should I check first when a subscription URL won’t import?
First, make sure you copied the subscription URL—not a subscription management page, login page, or sharing instructions. Remove leading and trailing spaces, check that a messaging app didn’t break the URL across lines, then add it in the subscription group’s address field and update the group. For a single share link, use the clipboard import option for server entries instead of the subscription URL field. If the URL opens but parsing fails, check whether the response is in a format the client supports. Login pages, error pages, and configurations intended for other apps can’t be used as server lists. Keep the original URL while troubleshooting; don’t remove query parameters at random.
How do I connect after importing a configuration in v2rayN or v2rayNG?
In v2rayN, confirm that a valid entry appears in the server list, set it as the active server, check that the core starts, then enable automatic system proxy configuration if needed. Selecting a row in the list doesn’t necessarily make it the active server. In v2rayNG, select the imported configuration, tap Connect, and approve the VPN connection prompt from Android. Check the runtime log for errors, even after granting permission for the first time. A running status only means the local service started; it doesn’t confirm a successful handshake with the remote server. Verify the connection path using real traffic and the logs.
Why does enabling TUN require administrator access or VPN permission?
Desktop TUN may need administrator access, a helper service, or system authorization to create or configure a virtual network interface and adjust routes. Requirements vary by platform and client version. If TUN fails to start in v2rayN, check the logs for permission, interface creation, and routing errors, then restart or grant permission as prompted. Android clients use the system VPN service to capture traffic, so you must approve VPN access; root is usually not required. Another active VPN may cause a conflict. Don’t leave security features disabled to bypass an authorization prompt—first confirm what needs permission and why the error occurred.
Group management, app traffic capture, and rule testing
Tips & Usage
Keep a working configuration as your baseline. Change one type of setting at a time, then test with a new connection.
How should I organize multiple subscriptions to avoid a mess after updates?
Create a separate subscription group for each source, add a clear label and update URL to each group, then check its auto-update and server-filter settings. Don’t repeatedly import multiple sources into the same temporary group, or it’ll be hard to tell where entries came from after an update. Changes to subscription-generated server settings may be overwritten during the next update. If you need to customize an entry, copy it as a separate manual entry and note its purpose. After updating, check that the active server is still available and select it again if needed. Groups organize configurations; they don’t automatically choose which routing rules apply to their traffic.
Some apps still connect directly after I enable the system proxy. What should I do?
First check whether the app uses the operating system’s proxy settings. Some apps use their own network stack and need an HTTP or SOCKS proxy configured in the app. Command-line tools may also need proxy environment variables set separately. Use the current address and port shown in the client, and don’t mix up the HTTP and SOCKS ports. Restart the app after changing settings so it doesn’t keep reusing an existing connection. If the app has no proxy option, consider TUN and check whether process- or address-based bypass rules exclude it. One app connecting directly doesn’t mean the entire client is broken.
Why don’t my routing rule changes seem to take effect?
Confirm you edited the active routing configuration and saved and applied it, or restarted the core. Rules are usually evaluated from top to bottom, so an earlier broad rule can override a later, more specific one. Put domain exceptions before the relevant category rules. Then check that outboundTag points to an existing outbound and that the geosite and geoip data are available. If the app has already resolved a domain to an IP address, a domain rule may not have enough information to match; check DNS and sniffing settings as well. Close the app’s existing connections before testing, then use the logs to see which outbound handles the new connection.
What information should I include in logs when testing or asking for help?
Note the client name, operating system, traffic-capture mode, and steps to reproduce the issue. Temporarily choose a log level that’s useful for troubleshooting. Clear old logs, reproduce the issue once, and keep the relevant lines from core startup through the failure—especially the first specific error and its surrounding context. Before sharing logs publicly, redact subscription URLs, credentials, personal directory paths, and server addresses you shouldn’t disclose. Check screenshots for the same details. Don’t share only the final timeout message; it may be caused by an earlier configuration error. Once you’ve identified the problem, restore your usual log level to avoid accumulating detailed records of accessed destinations.
Local network, DNS, and remote connections
Troubleshooting
Find which layer is failing first. Starting the service, reaching the remote server, and accessing a website are three separate checks.
How should I troubleshoot a v2rayNG connection timeout?
Stop the proxy first. Confirm the device’s local network works and the system date and time are correct. Check that the subscription is still valid, update the configuration, and make sure the selected server hasn’t been removed. Compare the entry with the original settings: address, port, protocol, transport path, and TLS options. Don’t replace serverName without a reason. Testing another known-good configuration on the same network can help distinguish a server issue from a local network issue. If every configuration fails, check for interference from other VPNs, Private DNS, or security apps. Change one setting at a time and keep the relevant logs so you can tell what made a difference.
It says connected, but I can’t access the internet. How do I tell if it’s DNS or routing?
“Connected” may only mean the local proxy or VPN service is running. Check the logs for a failed remote handshake, DNS resolution error, or routing rejection, then test sites that should connect directly and through the proxy. If the logs show DNS timeouts, check whether the DNS server is reachable, which outbound handles DNS requests, and whether Private DNS is interfering. If the domain resolves but the connection still fails, investigate routing and the remote service instead of repeatedly changing DNS. A failed attempt to access an HTTPS site by its IP address doesn’t prove the network is down; certificates and virtual hosting can affect the result.
My subscription used to update, but now updates fail. What should I do?
Keep your existing working configurations; don’t delete the entire subscription group. Check whether the URL has expired, the source has changed, and whether the response is an access denial, network timeout, or parsing error. If the client lets you update through the proxy, try that route when you already have a working connection. If both direct and proxied updates fail, check the source service’s status. An empty response or a login page usually points to a subscription access or URL issue, not a protocol problem. Turn off frequent automatic retries while troubleshooting to avoid triggering request limits. Once it’s working again, set a reasonable update interval.
What should I do if the network acts up after I exit the client, or a local port is already in use?
Check whether the system still points to a local proxy that has stopped. If it does, clear the leftover manual proxy settings and check whether the network recovers. If you used TUN, make sure traffic capture by the virtual interface has stopped; if needed, exit normally and restart to restore routing. If a port is in use, check for duplicate client instances or a leftover core process, then close extra instances normally. If you need to change the local port, update the proxy address and port in the app too. Don’t terminate unknown system processes or change the local listening address to bind to every network interface; either can create new problems or expose the proxy more widely.