V2Ray FAQ.

V2Ray is part of the Project V proxy ecosystem, with V2Fly and Xray as related core families. The core handles protocols, transport, routing, and DNS. v2rayN is a desktop GUI client, while v2rayNG is an Android GUI client; both manage subscriptions, select servers, and generate runtime configurations. When troubleshooting, note both the client version and the core currently in use: an option in the interface does not guarantee that the active core supports its corresponding field. Check which core a configuration example targets before using it; files named config.json are not necessarily interchangeable.

The client provides local configuration and connection features; installing it does not create remote servers. You’ll need a subscription URL, a server share link, or complete manual configuration details that you’re authorized to use, then import them through the appropriate option. A subscription URL typically fetches a set of configurations, while a server link describes a single one, so use the correct import option for each. If a subscription group exists but shows no servers, check its update results and filters instead of reinstalling the client. Hide subscription tokens, server credentials, and personal notes in screenshots you share.

A system proxy gives the operating system a local proxy address and mainly affects apps that follow that setting. Apps with their own network settings or direct connections may bypass it. TUN uses a virtual network interface to capture traffic that matches routing conditions, covering more traffic but relying more heavily on permissions, routes, and DNS configuration. If you’re new to this, test a server with the system proxy first, then consider TUN. Enabling TUN does not mean all traffic is proxied; client routing rules still determine the outbound route. Avoid running multiple traffic-capturing tools at once while troubleshooting.

Choose the protocol and settings supported by the server, not just by protocol name. VMess, VLESS, Trojan, and Shadowsocks use different authentication fields and security settings; transport, TLS, SNI, and other parameters must also match at both ends. Importing a complete share link is usually safer than changing protocols manually. If a subscription configuration connects successfully, don’t switch only the protocol type while keeping the old parameters. For unsupported-field errors, check client and core compatibility first. A protocol name alone does not guarantee speed, latency, or a stable connection.

First identify whether the failure occurs when saving the URL, requesting the subscription, or parsing its contents. Check that the copied URL is complete and contains no spaces, line breaks, or typographic punctuation; make sure it isn’t a management-page URL. If the URL saves but no servers appear, check the update log: a login page, error page, or unsupported format can all prevent parsing. Never post a full subscription URL in a public forum or submit it to an unfamiliar conversion site. Once you’ve verified the source, copy the original URL again and update it through the subscription group—not the single-server import field.

Most mainstream Android phones released since 2015 are good candidates for arm64, but the device’s supported ABI is what matters. A 64-bit processor does not necessarily mean the operating system can run 64-bit apps. A universal APK includes multiple architectures, making it an option when you’re unsure, but it’s usually larger. If installation fails, check the Android version, available storage, and install permissions before checking the APK architecture. For an existing app with the same name, also check for a signature mismatch or downgrade restrictions. Uninstalling may remove configuration, so export any data you need using the client’s export feature first.

Turn off TUN, then find the first log error related to permissions, virtual interfaces, or route creation. Windows usually requires administrator privileges or a service mode supported by the client. On other desktop systems, follow the client’s authorization instructions rather than applying Windows steps. Check that no other VPN or TUN tool is using the traffic-capture path, then enable TUN again as documented for your client. Disabling the firewall or all security protections is not a standard fix. If the system proxy works but TUN does not, focus on permissions, interfaces, and routes instead of repeatedly switching servers.

Use the local listener settings shown in your client; don’t copy a port from another guide. If an app requires SOCKS5, enter the actual SOCKS or compatible mixed-listener port. For an HTTP proxy, use a listener that supports HTTP. When connecting from the same device, the address is usually 127.0.0.1. Port 10808 is a common example, not a fixed value across all versions. To let other devices on your LAN connect, separately assess the listen address, access authentication, and firewall rules. Don’t expose a setup intended for local use to an external network.

A TCP latency test usually shows only that a connection to the target port can be established. It does not verify authentication, TLS, proxy egress, or DNS. A connectivity test is closer to a real request, but only shows whether its test target was reachable at that moment. First confirm that the active server is the one being tested, then check whether the system proxy or TUN is working and look for new log entries when you visit a website. One failed test address doesn’t necessarily mean the server is unusable, and a latency reading doesn’t prove every site will work. Check browser access and actual egress changes together to assess the connection.

Rule mode selects an outbound route based on conditions such as domain or IP, making it useful for everyday split routing. Global proxy mode usually changes the default route to the proxy, which can help you check whether routing rules are affecting access. Direct mode usually sends traffic straight to its destination. Mode names and coverage vary between clients, so check the specific routing rules too. When troubleshooting a site, briefly switch to global proxy for comparison, then restore your original setting. Global proxy does not capture every app: the system proxy or TUN determines which traffic enters the client, while routing mode determines where that traffic goes.

Subscription updates usually rebuild or merge server entries based on the content returned by the provider. The exact behavior depends on the client version and group settings. If the provider changes a server’s name, address, or identifier, its previous sort order, notes, or active selection may not be preserved. Note your current configuration before updating; afterward, confirm the active server and run a connectivity test. Keep manual configurations you need long-term in a separate group instead of mixing them with auto-updating subscription entries. Don’t assume the first server in the list is still the one you used last time.

Note how things work before enabling the proxy, then activate the server you want, visit a test page in your browser, and compare the egress IP. Check the logs for the corresponding request too. Results can vary with IPv4, IPv6, and routing policies, so a single lookup can’t verify every app. On Android, check VPN permission and per-app routing to ensure the test app isn’t excluded. Before exiting, turn off the system proxy or TUN and confirm normal network access has returned. If an abnormal shutdown leaves the system proxy enabled, restore its previous value in your network settings; there’s no need to reset the entire network immediately.

An import failure may mean the URL or its contents can’t be recognized. An update failure usually happens when an existing group requests content from the remote server. Check the logs to distinguish DNS lookup failures, connection timeouts, certificate errors, and HTTP status codes, then check whether the subscription expired or was reset. Make sure your device’s clock is correct, then choose direct updating or updating through an available proxy based on your network. If the proxy is down but you rely on it to fetch the subscription, you can get stuck without a way to recover. Keep any working servers and don’t clear all configuration first. Avoid repeated rapid requests, which may trigger server-side limits.

First turn off any mode that captures traffic. Confirm that your basic network connection and ordinary DNS lookups work, then check the system clock and whether the network requires a browser sign-in. Next, verify the subscription and test the same server’s port and actual connectivity separately. Look for connection refused, handshake failure, or authentication errors. If every server times out only on one network, compare results on another network you’re authorized to use. If only some servers fail, check their server status and settings first. Don’t change DNS, transport, and routing all at once; otherwise, even if things start working, you won’t know what fixed it.

“Connected” may only mean the local core or Android VPN service has started; it doesn’t confirm that remote authentication and forwarding succeeded. Check for core errors first, then test the remote connection. If the link works, check whether the target domain fails to resolve and which outbound route the request actually used. If temporarily switching to global proxy restores access, review your split-routing rules and their order. If the logs show DNS timeouts, check the DNS server’s route and whether it’s reachable. Don’t rely on accessing a website by IP address over the long term: HTTPS certificates and virtual hosting also depend on the domain name.

Check that the system proxy points to the current client’s listener address and port, and confirm the client core is still running. Browser extensions, built-in app proxies, proxy bypass lists, and existing connections can all affect the result. Restart the app you’re testing after making changes. If its requests don’t appear in the logs, it may not follow the system proxy. Configure a compatible HTTP or SOCKS5 proxy in the app, or consider using TUN. If requests do appear but access fails, check the matching routing rule and remote errors; don’t mistake a failure inside the client for a system proxy that isn’t working.