V2Ray Setup Guide
Import a Subscription and Configure a Proxy

STEP 01 / SUBSCRIPTION

Import a Subscription

First, check whether you have a subscription URL or a link for a single server. A subscription URL is usually an HTTPS link used to fetch a list of configurations. A single-server link may start with vmess://, vless://, or trojan://. They use different import options: this guide uses a subscription group, while a single configuration should be imported from the clipboard. If you don't have a subscription, don't enter the website's home page URL in the subscription field.

If you haven't installed a client yet, visit the downloads page to choose a version for your device, then install it or fully extract the archive before launching it. Once your configuration is ready, close any screen-sharing or recording windows that could expose your subscription. Subscription links may contain access credentials. Don't post the full link publicly or leave its QR code visible in a support screenshot.

v2rayN: Add a Group, Then Update the Subscription

Open v2rayN and select Subscription Group Settings from the Subscription Group menu at the top. Click Add. Enter a recognizable name in the remarks field, then paste the full subscription URL into the address or URL field. Make sure there are no extra spaces or line breaks at either end, then save. The remarks are just a label and don't affect the connection. Leave other settings at their defaults for now.

Return to the main window and select the group you just created. From the Subscription Group menu, choose Update Subscription. Before your first connection, use the update option that says not to use a proxy, provided your current network can reach the subscription URL. When the update finishes, server entries should appear in the list. If you see only the group name and the list is still empty, you saved the URL but haven't fetched a configuration yet. The import isn't complete.

v2rayNG: Add a Subscription, Then Fetch the List

Open v2rayNG, open Subscription Group Settings from the top-right menu, tap Add, enter the remarks and subscription URL, then save. Return to the server list and choose the update subscription option from the menu. If you can choose which subscriptions to update, select only the group you just added to avoid changes from other sources complicating your first setup. Wait for the update to finish, then check that selectable servers appear on the main screen.

For a single-server link, copy the entire link and use Import from Clipboard in the main screen's add menu. Don't paste a single-server link into the subscription URL field. After importing, open the entry's edit screen and check the protocol, address, and port. A VLESS configuration may also include fields such as flow control, transport security, SNI, and public key. Check only the values supplied by your provider; don't guess based on the protocol name.

What to Expect at This Stage

You should see server entries in the list, with no subscription parsing errors reported by the client. An entry's name doesn't prove it's usable, and a successful import doesn't mean the remote server is working. If an update fails, first check that the URL is still valid and your device's clock is accurate. Distinguish a request failure from an unsupported format. Subscription formats and protocol support are separate issues; see the quick reference if you need help with terminology. Once the list is ready, set the traffic entry point and routing before connecting.

STEP 02 / TRAFFIC MODE

Choose a Proxy Mode

Keep two questions separate: how an app hands traffic to the client, and how the client routes that traffic. System proxy settings and Android VPN mode handle the entry point; routing determines whether traffic goes direct, through the proxy, or is blocked. Switching to global routing won't automatically send traffic from every desktop app through the proxy. For your first setup, use a simple entry point and avoid enabling TUN, a browser proxy extension, and another proxy app at the same time.

v2rayN: Configure the System Proxy and Routing Separately

Find System Proxy in the bottom of the v2rayN main window or in the tray menu, then select Auto Configure System Proxy. This tells the client to write its local proxy address to the system's proxy settings. Browsers and other apps that follow those settings will then send requests to the local listening port. If your operating system or desktop environment can't apply this setting automatically, configure its proxy entry point manually. Don't assume that selecting the menu option connects every app.

Next, check the routing option. If you're using the built-in rules, beginners can start with rules such as Bypass mainland China, if they suit their needs. For comparison, you can temporarily select a global proxy rule, then switch back to your usual routing afterward. Use the rule names shown in your current list. Global describes the default route after traffic reaches the core; it isn't a more powerful connection mode and won't fix incorrect server settings.

If your browser has a separate proxy extension, disable it temporarily or switch it to use the system proxy to prevent the two settings from conflicting. This guide doesn't require changing the local listening port. If you do need to enter an address manually, check the actual port in the client's current settings and use the loopback address for your device. Don't copy a number from another guide and assume it applies.

v2rayNG: Choose VPN Mode and a Routing Rule

Open v2rayNG settings and make sure VPN mode is selected, rather than proxy mode, which only provides a local proxy port. VPN mode uses Android's VPN interface to receive device traffic covered by the configuration. Android will ask for permission the first time you start it. This permission sets up a local traffic entry point; it doesn't confirm that the subscription is valid or that every request will use the remote server.

Next, check the routing settings and choose a built-in rule that suits your needs. For your first test, leave the default per-app settings in place and don't add any excluded apps. Otherwise, if your test browser is excluded, the client may appear to be running while the browser traffic bypasses the proxy. If you've already configured per-app routing, make sure the app you're testing is included before continuing.

Once the mode is set, don't rush to change DNS, Mux, or transport settings. The first goal is to establish a connection path you can understand. For more on how system proxy settings, TUN, and routing work together, see the protocol and core technical reference. For interface or permission issues, visit Troubleshooting. Next, choose a complete configuration and start the connection.

STEP 03 / CONNECTION

Choose a Server and Connect

Start with a server whose source is clear and whose settings are complete. For your first attempt, don't switch between multiple entries or change the protocol and routing at the same time. That way, if the connection fails, you can investigate under the same conditions. A region or purpose in the server name is just a label supplied by the provider; it doesn't confirm protocol compatibility or a successful connection.

v2rayN: Set the Active Server and Check That the Core Starts

Select the desired entry in the server list, then choose Set as active server from the right-click menu. Some versions also let you double-click an entry; follow the menu prompts. Make sure the active marker has moved to that entry, then check the information or log area at the bottom of the window. Normally, the client loads the configuration and starts the corresponding core. If you see a port conflict or a process startup error, the local entry point isn't ready yet.

If your subscription provides a VLESS configuration with REALITY, use a core that supports this combination; Xray is a common choice. Don't switch to another core just because the interface offers the option. A client displaying a field doesn't mean every core accepts the same configuration. Keep the subscription's parameters as provided, don't enable Mux on your own, and don't change TCP to another transport without a reason.

Once the active server is set, check that Auto Configure System Proxy is still in the expected state. The desktop client may not have a separate Connect button: loading the active configuration, starting the core, and enabling the proxy entry point are all part of the process. Closing the main window may only minimize the client to the tray. Keep it running while testing; don't quit before opening your browser.

v2rayNG: Select an Entry and Approve System Access

Tap the target server entry on the main screen and confirm that it's selected, then tap the connect button at the bottom. The first time you start a connection, Android displays a VPN connection request. Confirm that v2rayNG is the app requesting access, then approve it. If you denied access earlier, return to the client and tap Connect again; you don't need to delete and re-import the subscription. If Android says another VPN connection is active, check whether you can stop the other app before continuing.

After starting, check the client's status and the Android VPN indicator. These show that the local traffic capture service is running, but don't prove that the remote handshake succeeded. Some devices restrict background activity, so keep the client in the foreground during your first test. Once the connection is confirmed, adjust battery settings if needed. Don't change background permissions, DNS, and routing all at once; otherwise, it will be hard to tell which change made a difference.

Distinguish Startup Errors from Remote Connection Errors

Handle local issues such as an occupied port, insufficient permissions, or a configuration parsing error on the device first. A connection timeout, authentication failure, or handshake error calls for checks of server reachability, account validity, system time, and security parameters. If the log shows an error, note when it occurred and what type it was. Don't share logs that expose subscription credentials. Once startup errors are resolved, move on to the final step and test real traffic instead of relying on the connection icon.

STEP 04 / VERIFICATION

Test Whether the Proxy Works

Your test needs to answer two questions: can you access the site, and is traffic taking the expected route? A page may load because the routing rule sent it direct. The client may show as running even if only its local service has started. For your first test, use the same server, network, and mode you just selected. Avoid changing conditions repeatedly while testing.

Check the Browser First, Then Review Connection Logs

Open a new browser window, visit a familiar HTTPS site that normally works, and reload the page. Don't rely on a tab that's already open; browser cache and existing connections may preserve earlier results. First confirm that the page actually refreshes, then test another independent site. One site failing doesn't prove the entire proxy chain is down.

Next, check the client's connection records or logs for requests at the time of your test and look for routing or outbound details if the current log level shows them. If routine logs don't list individual requests, don't treat the lack of detail as a fault. You can temporarily increase logging using the client's diagnostic options, then restore the previous setting after testing. An external IP lookup is only supporting evidence: direct-routing rules, shared egress, and the lookup site itself can all affect the result.

Check the Browser and Other Apps Separately

In v2rayN, once the browser works, open other apps you need to use. If only one app fails, first check whether it follows the system proxy or has its own proxy settings. System proxy settings don't automatically cover every program. If you need to capture more traffic, learn about TUN permissions and routing before enabling it; don't change the entire subscription to fix one app.

In v2rayNG, first make sure the app you're testing isn't excluded by per-app routing rules. If it was already running before you connected, fully close it and reopen it so it establishes a new connection. If the browser works but another app doesn't, the cause may be the app's DNS, connection reuse, or protocol. Establish a baseline with the browser before troubleshooting individual apps; it's easier than changing several options at once.

Stop the Connection and Check What Happens

When testing is complete, select Clear System Proxy in v2rayN before quitting the client. If you stop the core but leave the system proxy pointing to a local port, the browser may lose access because no local service is listening. After clearing the setting, check that your network behaves as expected. If your device originally used a proxy configured by your organization or another app, note the original settings first and restore them if needed.

In v2rayNG, tap Stop, confirm that the Android VPN indicator disappears, and reload the test page. Interpret the before-and-after results in light of your routing rules: a site that normally uses a direct connection may show no change, which is expected. The purpose of disconnecting is to check how the client starts and stops traffic capture, not to make every page behave differently.

If Verification Fails, Narrow Down the Cause Step by Step

If no websites load, first check that the local entry point is running and that system proxy settings or VPN permission are active. Then check the active server and logs. If only domain names fail, investigate DNS and routing. If only one server entry fails, try another configuration without changing the mode. Change one setting at a time and note what happens before and after. Don't start by clearing all your settings.

Your first setup is complete when the subscription updates, a server is selected, the client runs normally, the browser reloads, and traffic follows the expected route. You can then restore your usual routing rules and configure app coverage if needed. For more troubleshooting steps, see Troubleshooting; for protocol fields and core compatibility, see the technical reference. That's the end of this guide. Next time, you usually only need to check the active server, start the entry point, and run a quick browsing test.