First-time setup · 4 steps
v2rayN / v2rayNG
Setup Guide
Import a subscription → choose a proxy mode → connect → verify. With a valid subscription, follow these steps to finish the initial setup in about 10 minutes. Troubleshoot connection issues separately.
Before you begin, download and install the appropriate client, and get a valid subscription URL. The client reads configurations and routes traffic; it does not provide a remote service. Subscription URLs often contain access credentials, so don’t post them in public forums or paste them into online conversion tools.
Step 01
Import a subscription and select a configuration
First, check whether you have a subscription URL or a single share link. A subscription is usually an HTTPS URL that returns multiple server configurations when updated. Links beginning with vmess://, vless://, or trojan:// are usually individual share links. They use different import options. If your provider gave you a subscription URL, follow the group setup steps below; don’t paste it into a server address field.
v2rayN: Add a group, then update it
Open v2rayN and select Subscription Group > Subscription Group Settings from the top menu. Add a group, enter a recognizable name, and paste the full subscription URL into the address field. Keep the URL’s path and query parameters intact. Make sure you don’t include leading or trailing spaces, line breaks, or punctuation added by a chat app. For your first setup, leave the other update options at their defaults. Save the group and return to the main window.
Open the Subscription Group menu and select Update Subscription. If the menu offers both “Update through proxy” and “Update without proxy,” try updating without a proxy first if you don’t have a working one yet. If your subscription provider specifies a different access method, follow their instructions. When the update finishes, select the group you created. Its configurations should appear in the server list. An “Update complete” message isn’t enough on its own; confirm that the group contains selectable entries.
Select a configuration in the list, then choose “Set as active server” or the equivalent from the context menu. Don’t assume it’s active just because the row is highlighted; look for an active marker or the current server indicator in the main window. At this point, you’ve selected a configuration, but haven’t confirmed that browser traffic is reaching the client. Next, configure the system proxy and routing.
v2rayNG: Save the subscription URL, then update from the main screen
In v2rayNG, open Subscription Group Settings from the side menu. Tap Add, enter a name and subscription URL, and save. Return to the main screen, open the menu, and select Update Subscription. If your version lets you choose a group, update the one you just added. Wait for the update to finish and confirm that the imported configurations appear in the list. Tap one to make it active; the selected entry will be marked.
For a single share link, copy the full link and use an option such as “Import from clipboard” in the main screen menu. Don’t enter it as a subscription URL. A single imported link won’t receive future additions or changes to a subscription automatically. For your first setup, use the format provided by your service provider. Don’t convert it or manually edit the port, transport, or TLS fields.
At this stage, you should be able to identify which group the subscription came from and which configuration is active. Once you’ve confirmed both, move on to proxy mode settings. This makes it easier to tell whether a problem is due to a missing configuration or traffic that isn’t being routed through the client.
Step 02
Choose a proxy mode and routing strategy
The proxy mode determines which apps send traffic to the client. The routing strategy determines which outbound route that traffic uses. These settings do different jobs and can’t replace each other. Switching to global proxy routing doesn’t automatically make every app use the proxy. If an app isn’t covered by the system proxy or VPN, routing rules won’t see its requests. For your first setup, use as few settings as possible to establish a path you can verify.
v2rayN: Start with the system proxy
Find System Proxy in the main window’s status bar or the system tray menu, then select Automatic System Proxy Configuration. This points the system’s proxy entry to the client’s local listening address. Browsers and other apps that follow system proxy settings can then send requests to the client. If your browser is already open, reload the page after setup. Some apps read proxy settings only at startup, so you may need to close and reopen them.
Next, find Routing or Routing Settings. To keep LAN and mainland China addresses accessible directly, choose the matching bypass strategy. If the preset has a different name, read its description instead of choosing by number alone. While testing, don’t edit rule order, the default outbound, or domain datasets. Global proxy routing only changes where traffic already handled by the core goes; it doesn’t extend which apps use the system proxy.
This guide doesn’t enable TUN. TUN involves a virtual network adapter, permissions, and compatibility with other networking software, so configure it separately after the standard proxy path works. If an app doesn’t follow the system proxy, first check whether it’s outside the traffic coverage instead of immediately changing server settings. See Advanced Setup for how TUN works and when to enable it.
v2rayNG: Check VPN mode and routing strategy
Open Settings from the side menu and make sure the client is using VPN mode. If your version offers a “Proxy only” mode, don’t select it when following this guide for the first time. VPN mode uses Android’s VPN interface to capture traffic, which is then routed directly or through the proxy according to the client’s rules. Open Routing Settings, choose a preset that suits your needs, such as “Bypass LAN and mainland China addresses,” then return to the main screen.
If you’ve configured per-app proxying before, check that the browser you’re testing is covered. An allowlist includes only selected apps, while a blocklist keeps selected apps out of the VPN; the two work in opposite ways. For your first test, you can temporarily restore a simpler app scope, but note the original setting first so you can put it back. If you’re prompted to restart the service after changing routing, do so.
Leave DNS, traffic sniffing, and Mux multiplexing at their current defaults for now. Don’t enable several advanced options at once; turning on more settings doesn’t make a connection more likely to work. First keep the subscription configuration and proxy mode fixed, then start the service so you have a clear baseline. If you’re unsure about terms like “system proxy,” “routing,” or “DNS,” check the glossary rather than configuring a full set of rules before your first connection.
Step 03
Connect and check the status
Before connecting, check the active configuration again so you don’t record test results against a different server. Close other proxy clients during your first test. On Android, also check whether another app is using the system VPN connection. Multiple tools changing system proxy or traffic routing settings can make the actual traffic path differ from what the interface shows. Resolve overlapping traffic capture first; repeatedly switching configurations is less effective.
v2rayN: Check the core and system proxy status
In v2rayN, setting an active server usually starts or reloads the core, so there may not be a single, prominent Connect button. Check the main window’s log area for repeated configuration load failures, process exits, or local port conflicts. If you’ve switched servers but the status hasn’t updated, use the corresponding Restart Service option in the menu, then check the new log entries.
Then confirm that System Proxy still shows “Automatic System Proxy Configuration,” not “Clear System Proxy.” An open client window doesn’t mean system requests are reaching it. Don’t copy someone else’s local port into your browser settings: ports and listening types can vary by version. Find the actual values in your client’s settings or status bar. With automatic configuration, you generally don’t need to set up a separate proxy in the browser.
If your system firewall prompts you about network access, first confirm that the program path matches the client you just installed, then grant permission as needed for your use case. A local proxy usually doesn’t need “Allow connections from LAN.” Don’t disable the entire firewall or change the local listening address to all network interfaces just to troubleshoot. These steps increase exposure and may not fix a remote connection problem.
v2rayNG: Allow the VPN connection
Return to the v2rayNG main screen and tap Connect. The first time you start it, Android will show a VPN connection request. Confirm that v2rayNG is the app requesting access, then allow it. If you deny permission, the client can’t use the VPN traffic-capture method covered in this guide. When the system dialog closes, the Connect button or status area should show that the client is running. Android may also display a VPN indicator.
A VPN indicator only confirms that the local tunnel is up; it doesn’t mean the remote server is reachable. Check the client logs or status messages for details. If an error appears, note its exact wording and when it occurred. If the VPN can’t be created, first check for other VPN apps, Android’s always-on VPN setting, or device management restrictions. Don’t start by changing the subscription password or transport settings.
If the service stops shortly after starting, keep the client in the foreground while you run an initial test. Check the app’s battery and background restrictions only if the problem occurs after locking the screen or switching away. Don’t change background settings, DNS, and routing all at once during your first connection; you won’t know which change affected the result.
Step 04
Verify that the proxy is working
Verification should answer two questions: is the app sending requests to the client, and is the client choosing the expected outbound route? A “Connected” status or a single built-in test doesn’t replace testing with an actual app. Keep the selected configuration and routing unchanged, then test in the same browser. This avoids conflicting results from apps with different proxy settings.
Load a page, then check the traffic path
First, open a known-good HTTPS page to confirm that basic network access still works. Then open a site that should use the proxy under your current routing rules, and reload it rather than relying on an already-open tab. Cached content can appear without a new network request, so use a new tab or private window. If needed, fully close and reopen the browser.
In v2rayN, test with a browser that follows system proxy settings. Check whether the browser has a separate proxy extension or custom proxy configuration that overrides them. If it does, correct client status may not affect the browser. In v2rayNG, confirm that the browser isn’t excluded by per-app proxy rules and that the VPN remains active while you test.
Next, check the client logs generated during the test. If the current log level includes access records, look for the target domain and outbound tag to see which route the request took. If no access record appears, don’t assume there was no traffic; the current log level may not show it. Logs can contain destinations or configuration details, so remove sensitive information before sharing them for troubleshooting.
To check the exit IP, you can compare results from a trusted IP lookup service before and after connecting. Keep in mind that the lookup request is also affected by routing: if it matches a direct-connection rule, seeing your local exit IP is expected and doesn’t disprove the proxy path for other destinations. With split routing, different sites use different outbound routes by design. Treat an exit IP comparison as supporting evidence and check it alongside the routing rules and actual site access.
If it fails, troubleshoot in this order
If no pages load, stop the proxy and check whether basic network access returns. On desktop, use Clear System Proxy in the client before testing. On Android, disconnect the VPN. Closing a window may only minimize the client to the system tray without stopping the service. If basic network access is still broken, fix that first. If it works until you start the proxy, check the active configuration, local service, and traffic-capture mode.
If regular pages load but a site expected to use the proxy times out, first confirm that the selected server is still the one you chose. Then check the logs for a specific error. Verify the system date and time, make sure the subscription is still valid, and try another working configuration from the same subscription. Change one thing at a time and note the result. Don’t disable TLS or rewrite transport settings without instructions from your provider; that could turn a working configuration into a different one.
If only one app fails while the browser works, check whether that app follows the system proxy or is covered by the Android VPN. You may not need a different server. For TUN, DNS, FakeDNS, or custom routing, follow the Advanced Setup guide and configure one option at a time. Keep the configuration here to the minimum needed to reproduce the issue.
Keep the working setup before making more changes
Your initial setup is complete when the target page loads, basic access still works, and routing behaves as expected. Note the active group, routing strategy, and proxy mode, then keep these settings while you use the client. When your subscription provider changes the configuration, update the subscription; you don’t need to reinstall the client each time. If behavior changes after an update, first check whether the active server changed.
When you’re done, clear the system proxy in v2rayN before exiting the client if needed. In v2rayNG, tap the connection button to disconnect the VPN. To reconnect later, select the current configuration, confirm the mode, connect, and verify. For a specific error, see Troubleshooting. Once the connection is stable, explore the subscription groups, routing, and DNS chapters in Advanced Setup.