v2rayN Setup Guide
Import a Subscription and Test Your Connection

Step 01 / Add a Configuration to the List

Import a Subscription

First, identify what you have. A subscription URL is usually an HTTPS link that retrieves a set of configurations. A single share link often starts with vmess://, vless://, trojan://, or ss://. Use the right import method: add subscription URLs to a subscription group so you can update them later; import single share links from the clipboard. When copying, leave out quotation marks, explanatory text, and line breaks from chat messages. A service login page URL is not a subscription URL.

v2rayN: Add a Group, Then Update the Subscription

Open v2rayN and go to Subscription Group > Subscription Group Settings. Add a group and enter a recognizable label, such as “Everyday use.” Paste the full subscription URL into the address or URL field. Leave other settings at their defaults, make sure the group is enabled, and save. Saving stores the URL but does not download configurations, so an empty main list at this point is not necessarily an error.

Return to the main window, open the Subscription Group menu, and update the subscription. If the interface offers both “Update without proxy” and “Update through proxy,” try without a proxy first if you have not connected yet. If the subscription provider specifically requires an existing proxy, establish that connection before updating. When the update finishes, select the group you just created; server configurations should appear in the main list. Continue once you see entries—do not keep switching system proxy settings while the list is empty.

v2rayNG: Save the Subscription URL, Then Update from the List

In v2rayNG, open the top-right menu on the main screen and select Subscription Group Settings. Use the add option to enter a label and subscription URL, save, and return to the main screen. Open the menu again and choose the subscription update option. If your version lets you update the current group or all groups, update the group you just added first. Wait for the update to finish and confirm that configurations appear in the list. If you only have a single share link, copy the full link and choose Import from clipboard; do not paste it into the subscription URL field.

After importing, check that the entry's protocol and label match the information from its source. The displayed name helps identify a configuration; it does not mean the configuration can connect. For now, do not edit the address, port, transport, or TLS settings: these must match the server as a set. A later subscription update may also regenerate entries you edited manually. If you need to keep custom settings, first learn how your client manages groups and configurations.

Step 02 / Separate Traffic Entry from Routing

Choose a Proxy Mode

Once configurations appear in the list, decide how app requests enter the client and which route they take. These are separate questions: system proxy settings on desktop, or VPN capture on Android, determine how traffic enters; routing rules decide what goes direct and what goes through the proxy. Switching to global proxy routing does not automatically send desktop apps that ignore system proxy settings through the client. Likewise, enabling the system proxy does not mean every request will use a remote server.

v2rayN: Start with Automatic System Proxy Configuration

In v2rayN, open the System Proxy option or the system tray menu and select “Automatically configure system proxy.” This is an easy way to observe the result during initial setup: the client writes its local listening address to the system proxy settings, allowing browsers and other apps that follow those settings to send requests through the client. The main window's status bar usually shows the current system proxy mode. Check that the label changes after you select an option; a closed menu alone does not confirm that it worked.

“Clear system proxy” removes the proxy settings from the system. “Do not change system proxy” leaves the existing system settings untouched and is useful if you manage the proxy entry point yourself, but it is not recommended as a casual choice during initial setup. Which apps use the system proxy depends on the app; some use their own network stack or separate proxy settings. For your first test, use a browser that follows system settings. Avoid enabling TUN or configuring manual proxies in multiple apps at the same time, or it will be harder to identify the source of a problem.

Routing: Start with Bypass LAN

In the routing settings, start with “Bypass LAN” to keep direct access to devices such as your local router and printer. Global proxy is useful for temporarily checking the proxy exit, but it is still limited by the traffic entry point. Direct mode does not use a remote proxy for outbound traffic, so it cannot prove that the connection is working. If you already have custom rules, note them before switching so you do not overwrite LAN or domain exceptions you rely on.

In v2rayNG, look for routing options under Settings in the menu. For initial setup, use the client's basic routing profile and make sure Direct mode is not selected by mistake. If you have enabled per-app proxy, check that your test browser is included. Some interfaces let you bypass selected apps, so selecting an app does not always mean it will use the proxy. Keep the app scope simple for your first test; add exceptions one at a time after the basic connection works.

You do not need to switch between VMess, VLESS, or other protocols, or change the core to “test speed.” Protocol, transport, and security settings are part of the subscription; changing them at random can break the connection. For details on routing rules and core options, see the routing guide in the technical reference. For now, just make sure the traffic entry mode and routing mode do not conflict, then move on to connecting.

Step 03 / Select a Configuration and Connect

Connect to a Server

Return to the configuration list and select an entry from a known source that is still valid. Do not confuse a subscription group with the active server: a group organizes configurations, but you still need to select one configuration to connect. A populated list does not mean you are connected; next, check the active indicator and client status.

v2rayN: Set the Active Server and Check the Core

Find the desired entry in the main list and set it as the active server from the right-click menu. Some versions also let you switch by double-clicking. Check the active indicator in the list and the log output. v2rayN usually starts or reloads the core when you enable a configuration; it may not show a separate Connect button like a mobile app. Then check the system proxy setting in the status bar and confirm it is still set to the automatic configuration mode you chose earlier.

If the log says a local listening port is already in use, close other proxy apps using the same port and reload the current configuration. Do not copy someone else's local port settings: if you change the client's listening port, you must also update the system proxy or any manual proxy settings in apps. If the log reports an unsupported protocol or transport, first check whether the client version matches the requirements of the configuration source, then consider updating the client. Reimporting the same link repeatedly will not fix an incompatible core.

v2rayNG: Connect and Grant System Permission

Select the desired configuration in the v2rayNG main list and confirm that the selection indicator moves to it. Then tap the Connect button at the bottom. The first time you connect, Android displays a VPN connection request; check the app name and allow it. This permission creates a traffic capture tunnel on your device; it does not purchase or activate a server. If you deny the request, the configuration may be imported, but the client cannot capture browser traffic as expected.

After granting permission, check the connection status in the app and look for a VPN status indicator in Android. If another app is using the VPN tunnel, stop it first to avoid the connections replacing each other. Check the status again after switching server configurations; the VPN icon alone does not prove that the new configuration has connected. If you need the client to keep running in the background, check the battery and background activity restrictions as prompted by Android. Do not change a large number of system settings before completing your first test.

A Connect button showing an active state only means the client has started; it does not prove that the server is reachable. If a TLS handshake fails, first check that the device's time and time zone are correct, then verify settings such as the server name. Do not disable certificate verification as a troubleshooting shortcut. For more help, see TLS handshake failures and certificate errors. Once the client starts without an obvious error, test it with a real website instead of relying on the status icon.

Step 04 / Verify with a Real Request

Test Your Connection

Open the browser you plan to use and visit a site you actually need that should normally be available to you. Open a new tab and refresh if needed so you do not mistake an offline page or cached content for a successful connection. First confirm that the main page loads, then try another page on the site. Seeing a title or some static content is not enough to prove that subsequent requests are working.

Compare the Website Result with the Client Logs

While loading the page, check the client logs or connection records for a new request around that time. The level of detail varies, so a missing domain name does not necessarily mean no traffic passed through. But if the browser keeps waiting and the client shows no related activity, check the traffic entry point first. On desktop, confirm that other software has not changed the system proxy and that the browser is not using a separate proxy extension. On Android, check that the VPN is still running and that per-app rules have not excluded the browser.

If the client offers a connection test, it can help check whether the configuration is working, but its test target may differ from the site you are opening in the browser, so it is not a substitute for a real visit. Checking your public IP is also only a supporting test. With global proxy routing, a browser within the capture scope will usually show the proxy exit IP. With split routing, the IP-check site itself may use a direct route, so an unchanged IP does not necessarily mean the whole proxy is down. First determine which routing rule should apply to that request, then interpret the result.

DNS: Check It Only After the Connection Is Working

Check DNS only if the client is already recording requests but the logs repeatedly report domain resolution failures. First confirm that your regular network connection works, then find the DNS settings in the client and note their current values. Do not change secure DNS in the browser, system DNS, and client DNS all at once: they handle different requests, and changing multiple settings makes results hard to reproduce. For initial troubleshooting, keep the client's defaults and check that you have not entered an unreachable DNS server.

Some browsers use their own secure DNS, which can change the path used for domain lookups. If only one browser has problems, check its settings before replacing the subscription. If multiple apps fail for the same domain, compare the results with the client logs. Before setting a custom remote DNS server, understand how DNS requests reach it; otherwise, you may create a dependency where resolving the proxy server requires using that proxy to reach the resolver. For details on DNS routing and core differences, see the technical reference. You do not need to start your first connection by writing a complete configuration by hand.

Troubleshoot in Order, Then Save a Working Baseline

If a page still will not load, check these in order: stop the connection and confirm that your regular network works; restart the client and verify the active configuration; check the system proxy or VPN capture; then review the logs for connection, TLS, or DNS errors. Change one setting at a time and retry the same site. If only one site fails while others work, narrow the issue down to that site's routing, DNS resolution, or service status instead of reinstalling the entire client.

Once website access and the logs show consistent results, record the active configuration, system proxy mode, and routing profile. This is your rollback baseline. After that, test each new routing rule, per-app exception, or DNS change on its own. When you finish using the client, clear the system proxy before quitting on desktop, or confirm that the client clears it on exit. On Android, stop the VPN with the connection button. This prevents apps from sending requests to a local proxy that is no longer running.