V2Ray Setup Guide

Before You Start: Prepare the Client and Connection Details

If you haven’t installed a client yet, visit the client downloads page to choose the right option for your device, then return here. The desktop instructions use v2rayN, and the Android instructions use v2rayNG. For your first setup, stop any other proxy or VPN apps that are managing network traffic to prevent conflicts between system proxy addresses, virtual interfaces, and routing settings. Don’t run two instances of the same client at once.

The client manages connection settings but does not provide a remote server. Before continuing, get a valid subscription URL or a share link that matches the server. A subscription URL is usually a web address that returns one or more configurations when updated. A share link often starts with vmess://, vless://, trojan://, or ss:// and describes a single connection. These use different import options, so first identify which type you have.

A subscription URL may contain a personal access identifier, and a share link may include authentication details. Don’t post the full contents in public forums. When sharing a screenshot, hide the URL, password, user identifier, and QR code. For terms such as “subscription,” “core,” or “system proxy,” see the quick reference. This guide covers only the steps needed to make your first connection.

Step 1: Import a Subscription

Copy the complete subscription URL, taking care not to include explanatory text, line breaks, or trailing punctuation. If the source page shows both a “subscription URL” and a QR code for an individual configuration, check what the copy button selects instead of guessing from the link length. After adding a subscription, you also need to update it; saving the URL alone doesn’t generate a server list automatically in every client version.

v2rayN: Add a Group, Then Update the Subscription

Open the v2rayN main window and find the subscription group menu at the top, then open “Subscription Group Settings.” Add an entry, enter a recognizable group name in the remarks field, paste the URL into the subscription URL field, and save. Return to the main window. For your first setup, keep the default update interval, conversion, and filtering options to avoid affecting the import.

Open the subscription group menu again and choose the option to update the current group or all subscriptions. Some versions offer separate options to update through or without a proxy. If you don’t have a working connection yet, try updating without a proxy first. If the URL is unreachable on your current network, you’ll need a working connection before you can try updating through a proxy. Don’t click repeatedly; wait for the update to finish, then check the result.

After the update, the main list should show configurations in the group. If it’s still empty, check that the selected group filter and search box aren’t hiding entries, then confirm the URL was copied in full, the subscription is still valid, and the update didn’t report an error. Opening a subscription URL like an ordinary webpage may display encoded text or download a file. That doesn’t mean it’s meant to be read in a browser, and its authentication details should not be shared.

v2rayNG: Save Subscription Settings, Then Update the List

Open v2rayNG, tap the top-right menu, and go to “Subscription Settings.” Use the add option to create a subscription, enter a remark and URL, then save. Return to the configuration list and select “Update subscription” from the menu. If the app offers group selection, switch to the group you just added and check that its configuration names appear. Don’t change protocols, ports, or security options in bulk; imported values should match the information provided by the server.

For a single share link, you don’t need to create a subscription group. Copy the entire link, then choose an import-from-clipboard option from the server menu in v2rayN or the add menu in v2rayNG. The imported link appears as a separate configuration, but unlike a subscription, it usually won’t change when you update subscriptions. The key sign that this step is complete is a selectable configuration in the list—not successful internet access. Next, decide how app traffic will reach the client.

Step 2: Choose a Proxy Mode

Keep two things distinct: the system proxy or VPN interface determines which requests reach the client; routing mode determines which outbound path the client uses for those requests. When you see options such as “rules,” “global,” or “direct,” first check which settings section they belong to. Switching routing to global does not make every desktop app use the proxy automatically. Requests that never reach the client cannot be handled by its routing rules.

v2rayN: Start with the System Proxy and Preset Routing

In the v2rayN main window’s status area or system tray menu, find “System Proxy” and choose “Set system proxy” or a similarly named enable option. This usually points the system proxy to the client’s local listening address; you don’t need to enter a remote server address manually in your browser. Then check the routing settings and start with a preset, such as rules for bypassing the local network or routing by region. The exact names depend on the version.

For your first test, leave TUN off and use a browser that follows system proxy settings to keep troubleshooting simple. The system proxy doesn’t cover every program: some apps have their own proxy settings, while others don’t use system settings. If a browser works but another app doesn’t, check that app’s network settings before assuming the server is down. If you need to capture more traffic, see the protocol reference and the client’s settings guide.

v2rayNG: Check Routing and App Coverage

In v2rayNG, find “Routing Settings” in the menu or settings and keep a preset suitable for everyday use to start with. Don’t rush to edit custom domain or address lists. A common bypass-LAN rule lets local devices connect without using a remote outbound path; check the interface descriptions to understand other rules. If per-app proxying is enabled, confirm that your test browser is included—and check whether the list means “proxy only these apps” or “bypass these apps.”

On Android, the VPN interface sends device traffic to the client, but routing can still send some requests direct. So a VPN indicator does not mean every connection passes through a remote server. For the first test, keep the default app coverage to reduce the chance of excluding the app you’re testing. Don’t fine-tune routing yet; just note which rules are selected. Once you connect in the next step, you can check whether they work as expected.

Step 3: Select a Configuration and Connect

Return to the configuration list and choose one you know is still working. A configuration name is just a label; it does not guarantee speed, protocol support, or availability. You don’t need to test every entry for your first connection. Stick with one configuration until you’ve verified it, so you can tell which change made a difference. If the details came from a subscription, start with the imported configuration and don’t change the port, transport, or security fields just to make it connect.

v2rayN: Check the Active Server and Core

In the server list, right-click the entry you want and choose “Set as active server” or the equivalent option. Some versions also let you double-click an entry; follow the prompt in your version. Check the active indicator and window status to make sure the intended entry is selected. v2rayN usually applies the settings and runs the core when you switch the active configuration. If your version has a start or restart service option, use it once after saving the configuration; there’s no need to repeatedly exit the whole app.

Next, check that the system proxy is still enabled and open the log or information panel. If you see errors such as a port conflict, an invalid configuration, or a core startup failure, fix the local issue first: requests may not have reached the server yet. Make sure another instance of the client isn’t running, then restart the service if needed. Don’t assume the core is working just because the window is open, and don’t switch protocols to mask a configuration error.

v2rayNG: Start the Service and Approve the VPN Prompt

Tap the configuration you want so it’s selected, then tap the start button on the main screen. On first use, Android usually asks whether to allow a VPN connection. Grant permission after confirming the request comes from v2rayNG, which you just opened. Return to the app and check the status and button, then look for the VPN indicator in the system UI. If Android says another VPN is already running, stop that connection and start this client again.

Android battery settings can affect background operation. For the first test, keep the client in the foreground. Once the connection is working, allow any background activity it needs in system settings. A “started” status means the local service or interface is running; it does not guarantee successful authentication with the remote server. You can use the client’s connection test as an initial check, but even a passing result should be followed by a real app access test in the next step.

Step 4: Test Real-World Access

Open a new browser tab and visit a page you actually need, then try a page that normally connects directly. Check whether each page loads, links within it open, and any certificate or DNS errors appear. Don’t rely on an old tab: caching can make a page continue to show its previous content after the network path changes. If you see a certificate warning, don’t disable certificate checks to continue testing; check the device’s clock and connection settings first.

Then return to the client and check the logs. If the desktop client shows no matching requests, first check whether the browser follows system proxy settings, whether another app changed the system proxy, and whether the browser has its own proxy configured. If the test app on Android sends no traffic to the client, check that the service is still running and that the app hasn’t been excluded by per-app proxy rules. Requests that never reach the client and requests that reach it but fail to connect are different problems and should be troubleshot in a different order.

If requests appear in the logs but keep timing out or fail authentication, check that the right configuration is active, the subscription is up to date, and the device date and time are correct. Authentication failures usually mean you need to verify the connection details provided by the server; changing routing rules won’t fix them. Timeouts may involve the server, network path, or connection parameters. Note the exact error and change only one related setting at a time. Don’t change the core, enable TUN, and switch configurations all at once, or it will be hard to reproduce the problem.

If the logs show routing or outbound details, use them to tell whether a request went direct or through a proxy. Some versions require a different log level to show more detail; missing entries alone don’t prove the connection failed. In rule-based mode, two pages may use different outbound paths as intended. A client connection test typically checks only one type of request, so it can’t confirm that every website, app, or transport is working.

You can also make a brief before-and-after comparison: on desktop, clear the system proxy; on Android, stop the client. Then retry the request in a new tab, compare the access results and client logs, and restore your preferred setup. If the page opens in both states, that doesn’t necessarily mean the proxy wasn’t used—some sites are reachable directly. Consider whether requests reached the client, which outbound path was selected, and whether access worked, rather than checking only whether the page appeared.