V2Ray FAQ

First, distinguish the core from the client. V2Ray is part of the Project V proxy ecosystem, and V2Fly continues development of the related core. Xray is a separate core branch, and the two do not support exactly the same protocols or configuration options. v2rayN is a desktop GUI client for managing subscriptions, servers, the system proxy, and core processes; it is not a protocol. When troubleshooting, note the client, the core in use, and the server protocol. A share link’s appearance alone cannot confirm compatibility. Switching cores also cannot fill in parameters missing from the server configuration.

For Windows, macOS, and Linux, start with v2rayN. For Android, consider v2rayNG, which uses the Xray core; choose v2flyNG if you need a V2Fly core environment. Pick an installer based on your operating system and processor, then confirm that it supports the protocols used by your subscription. Each client has its own menus, configuration storage, and core versions, so you cannot import one client’s program folder as another client’s configuration. When moving between devices, adding the subscription URL again is usually simpler; then configure the proxy mode and routing separately.

A subscription URL usually retrieves information for a group of servers. A share link usually describes a single server, often as text starting with vmess:// or vless://. A native JSON configuration may contain full settings for inbounds, outbounds, DNS, and routing. Use the appropriate import option for each format; do not enter arbitrary JSON as a subscription URL. Subscription data may also be Base64-encoded, but that does not mean every client supports the same response format. If the format is rejected, ask the provider which format works with your client instead of repeatedly changing identity parameters.

The system proxy directs apps that follow system settings to a local proxy port. Routing determines which outbound handles connections that reach the core. TUN mode uses a virtual network interface to capture traffic within its configured scope. These operate at different stages: enabling the system proxy does not send every program through the core, and global routing does not capture apps that ignore the system proxy. First test the server with the system proxy. Enable TUN only if specific apps need to be captured, so you can identify the source of a problem without changing several layers at once.

If you have confirmed that your device supports 64-bit ARM apps, choose arm64. If you are unsure of its architecture, choose universal, which includes components for multiple architectures. Most mainstream phones released after 2015 use 64-bit ARM processors, but some still run a 32-bit operating system, so the purchase year alone is not enough. Check the architecture in your device information or follow the installer’s compatibility warning. If the app will not install, check available storage, the signature of any existing app, and installation permissions. Keep your subscription and settings before trying another package; do not immediately clear app data.

Open the subscription group settings, create a group, enter the full subscription URL, and save it. Then update that group from the subscription group menu. Saving the URL alone usually does not populate the server list. If the list is still empty, check the request result in the logs to see whether the URL is unreachable, the response is empty, or the format is unsupported. Remove leading or trailing spaces and line breaks when copying, but keep the URL’s query parameters. Also check whether the current group filter is hiding new entries and whether the URL has expired. Import share links from the clipboard import option, not the subscription URL field.

In v2rayNG’s subscription group settings, create a group, enter a label and subscription URL, and save. Return to the main screen and update the subscription from the menu. Once the server list appears, select an entry as the active configuration, then tap the connect button. The first time you connect, Android asks for permission to establish a VPN connection. Approve it so the client can capture traffic. If the list is still empty after updating, check the update message and selected group; the connect button does not update subscriptions. Menus may vary by version, but adding a URL, updating the list, selecting a configuration, and starting the connection are four separate steps.

Turn off TUN first, then grant elevated permissions as required by your operating system and client version. On Windows, you usually need to run the client as an administrator. On macOS and Linux, follow the client’s prompts for permissions or service setup; Windows instructions do not apply. If it still fails, check the logs for virtual interface creation errors, route write failures, or port conflicts, and temporarily quit other apps that capture network traffic. Do not repeatedly toggle the setting or leave security protections disabled. Note the original settings before making changes. If TUN fails, turn it off and verify the connection using the regular system proxy.

Set the target entry as the active server in the server list, then confirm that the system proxy or Android connection toggle is on. Highlighting a row, opening an edit window, or updating a subscription does not necessarily switch the active configuration. Visit a site you normally use and check whether the corresponding connection appears in the logs. A latency test checks only a specific test request; passing does not mean every website or app will work. A failed test may also be caused by the test URL, DNS, or your local network. Judge by actual access results rather than repeatedly switching configurations based on a single test number.

For everyday use, start with a routing mode that bypasses mainland China, then adjust individual rules as needed. Global mode is useful for temporarily checking whether routing sent a request through a different outbound. Before switching, confirm whether the menu controls core routing or the system proxy’s PAC behavior; names vary between clients and versions. Global routing affects only traffic that has reached the core—it does not force every app through it. If switching modes resolves the issue, check domain rules, IP rules, and their order instead of assuming the server is at fault. Restore your preferred everyday mode after testing.

On a trusted home network, enable connections from the local network and confirm that the local proxy port is listening. On other devices, enter the computer’s local IP address and the relevant proxy port. Do not use 127.0.0.1, which points to the device itself. Common settings include SOCKS on 10808 and HTTP on 10809, but some versions use a mixed port; check your current settings. Also confirm that the firewall allows connections from your local subnet and that router client isolation is disabled. Allow only the access you need. Do not use this on public networks or expose the local proxy port to the internet.

Note your subscription groups, routing choices, listening ports, and manually added servers. Then use the client’s backup or export feature. If your version has no such option, quit the client and back up the user configuration directory as described in its documentation. Subscription updates may replace entries generated by the subscription, so do not keep important manual changes only in those entries. Subscription URLs may contain account access parameters; store backups and screenshots securely, and remove sensitive details before sharing logs. After upgrading, verify the existing configuration before enabling new features one at a time. Avoid migrating and making major routing changes simultaneously.

Check the reason for the failure before choosing how to update. If the subscription URL is reachable on your current network, first try updating without a proxy. If it must be accessed through a proxy, you need a working active server first; then use the client’s update-through-proxy option. Do not rely on a server that has already stopped working to fetch a subscription that might replace it. If the logs show authentication failure or access denied, check whether the URL has expired, your account is active, and access is restricted. If the response is a webpage rather than subscription data, get a URL compatible with your client. Repeated retries may trigger rate limiting, so wait before trying again.

First confirm that your device can access the regular internet. Then check that the active server’s address, port, protocol, and transport settings match the provider’s details. For VMess, also verify the system date, time, and time zone. Next, check the logs to distinguish DNS resolution failures, connection timeouts, connection refusals, and TLS handshake errors; each points to a different stage. You can compare with a known working server, but do not change multiple fields at once. If the same configuration works on another network, check your local firewall, network restrictions, and DNS instead of reinstalling the client straight away.

A connected status usually means the core or network interface has started; it does not confirm that a website is reachable. Turn off TUN first, then test a browser with the system proxy and a server you know works. Check whether the target domain appears in the logs. If there is no request, check the browser’s proxy and extension settings, and whether another proxy app has overridden system settings. If a request appears but fails, check DNS, the routing rule it matched, and server connection errors. If only some sites fail, rule out problems or access restrictions on those sites. Change one setting at a time and note the original state so you can revert and compare.

Confirm that the core is running and that the system proxy points to the address and port of the current inbound. Then check whether another program has overridden the system proxy. Some apps use their own proxy settings, while others do not read system settings. Command-line tools may read only the environment variables they support, so a selected menu option does not mean all traffic is captured. First test with a browser that follows the system proxy. If an app supports manual proxy settings, enter the actual listening address, port, and protocol. Consider TUN only if you need to capture more traffic, and verify its permissions, routing, and DNS settings separately.