V2Ray FAQ

V2Ray usually refers to the proxy tools and related technologies in the Project V ecosystem. V2Fly continues to maintain the V2Ray core, while Xray is a separately developed core fork. The core handles protocol connections and traffic; v2rayN is a graphical client for managing servers, subscriptions, routing, and proxy settings, and for running the selected core. Whether a configuration works depends on whether the client recognizes its fields, the selected core supports its protocol, and the server settings match. When troubleshooting, note the client name, core, and protocol first. Avoid lumping every issue under “V2Ray won’t connect,” and don’t assume switching GUI clients will fix it.

For Windows, macOS, and Linux desktops, start with v2rayN, then choose the installer for your OS and processor architecture. The Windows download page offers a desktop edition and a classic WPF edition: the former uses a cross-platform interface, while the latter retains the classic Windows interface, so menus may differ. On Android, v2rayNG with the Xray core is the usual choice; consider v2flyNG if you need compatibility with V2Fly core configurations. Similar names do not guarantee the same configuration support, so check the server requirements. Import and verify your setup with one client before migrating, and avoid running multiple proxy services at once to prevent port conflicts or competing VPN traffic capture.

The client manages configurations and connections; installing it does not provide a working server. A subscription URL retrieves a set of server configurations, while an individual share link describes one server. Use only sources you are authorized to access. Before importing, check whether you have a subscription URL, a single-server link, or an ordinary webpage URL; a login page cannot be used as a subscription. Subscription data may contain access credentials, so treat it as sensitive and never post it publicly. If the provider requires you to sign in and regenerate the link, do so from your account page. This site provides downloads and setup guidance; check with your provider about server expiry, traffic limits, and account permissions.

System proxy settings direct apps that honor them to the client’s local proxy port; some apps may ignore these settings. Routing determines whether requests that have reached the core go direct, through the proxy, or get blocked. It does not automatically send every app through the proxy. TUN mode captures traffic through a virtual network interface and usually covers more traffic, but routing exclusions, app behavior, and system permissions still apply. For everyday browser use, start with system proxy and consider TUN only after confirming the connection works. When troubleshooting, change traffic capture and routing rules separately so you can identify what affected the result. If local network access breaks, check direct and exclusion rules too.

In v2rayN, open “Subscription Groups,” go to “Subscription Group Settings,” add a group, and enter the subscription URL. Save it, then select “Update all subscriptions (without proxy).” Menu labels and locations may vary slightly between versions; the key is to save the group before updating. When copying the URL, check for leading or trailing spaces, line breaks, Chinese punctuation, or text added by a messaging app. For a single server share link, use the import-from-clipboard option instead of treating it as a remote subscription URL. On Android, add the URL in subscription settings, then return to the list and update it. If parsing fails, first check the link type and whether the client supports its subscription format.

If your device supports arm64, choose the arm64 package. The universal package is for unknown architectures or broader compatibility and is usually larger. Most mainstream phones released after 2015 use processors that support arm64, but the device’s actual system architecture may differ, so don’t rely on purchase year alone. Check the model and system information under “Settings → About phone,” then confirm against the device specifications. If you’re still unsure, try the universal package. If the installer reports incompatibility, check the architecture and system requirements. A signature conflict usually means the installed app came from a different signing source; switching to universal will not fix it. Back up your existing configuration before making changes.

To route traffic from apps that honor system proxy settings through the client, select “Set system proxy automatically” under “System Proxy” in v2rayN, and make sure a working server is selected as active. To stop the client from handling system proxy traffic, choose “Clear system proxy.” “Do not change system proxy” does not turn the proxy off; it usually leaves the current system setting unchanged. Check the local listening port under “Settings → Parameter Settings.” The available fields vary by client version and core configuration. When setting a proxy manually in a browser or another app, use the actual listening address, port, and protocol—not the remote server address. After changing the listener settings, restart the service and check the logs to confirm the port was bound successfully.

First restore normal proxy operation, then troubleshoot TUN separately. On Windows, check whether the client needs to run as administrator. On Linux, make sure the required privilege escalation or permission setup is in place. On macOS, allow the network configuration permission requested by the system. Don’t change system directory permissions unless you understand the consequences. Android VPN authorization differs from desktop TUN: the first connection usually requires approving a system prompt. If another VPN service is active, stop it to avoid conflicts. If TUN still fails, check the logs to see whether permissions were denied, virtual interface creation failed, or route setup failed, then address that specific cause. Repeatedly toggling the setting won’t grant missing permissions.

In the v2rayN server list, select an entry, open its context menu, and run a TCP test or real connection test using the option available in your version. A TCP test checks connectivity to the server port; it does not confirm protocol authentication, access to the target site, or the full proxy path. A real connection test sends a request to a test address through the proxy, which better reflects everyday use, but results also depend on the test address. For a fair comparison, use the same test type, network, and target address; don’t rank results from different test types together. After a failure, try the same configuration with a site you actually need, then check the logs. Lower latency does not necessarily mean faster downloads; throughput and stability need to be assessed separately.

To send common sites in mainland China direct while routing other traffic according to proxy rules, start with “Routing → Bypass mainland China.” To check whether routing caused an issue, switch temporarily to “Global” for comparison. Here, “Global” describes the routing policy; it does not mean every app is already covered by system proxy or TUN. Preset behavior also depends on the rules, domain information, and availability of the rule database, so the mode name alone cannot tell you how each request will be routed. Change one setting at a time, reload the target page, and check the logs. If only a few sites need special handling, add explicit domain rules and check their order relative to existing rules.

Put manually added servers in a separate group rather than mixing them with automatically updated subscription entries. An update may rebuild server records in the affected group, and manually changed aliases, addresses, or other fields may not be retained; behavior depends on the client settings. To keep changes long term, copy them to a separate manual group first and note which fields differ from the subscription values. After updating, check that the active server is still the one you expect, then test an actual connection. Export any configuration you need before removing duplicates. Servers removed from a subscription may already be unavailable; keeping a copy preserves the configuration, not the server’s availability.

You can move a subscription URL or a configuration export supported by the client, but don’t assume the entire program folder will work across operating systems. Install the appropriate client on the new device, import and update the subscription, then configure system proxy, listening ports, TUN permissions, and routing for the new OS. When moving between clients, a single share link usually contains only server connection parameters; it may not include groups, routing rules, DNS settings, or UI preferences. Record important rules separately and check each one is supported by the destination client. Exported configurations may contain server credentials, so transfer them through a controlled channel and delete temporary copies afterward. Simultaneous connections across devices may also be limited by your server account.

Open the subscription group settings and confirm the URL is complete and the group is enabled. Then check whether the update reported a network, permission, or parsing error. If your current proxy is unavailable, first try “Update all subscriptions (without proxy).” Use an update through the proxy only if the subscription URL requires it and the current proxy works. If access is denied or the link has expired, check your account and whether the subscription URL was reset; don’t keep retrying. If the download succeeds but no entries appear, check whether the response is a login page, an error message, or a format the client does not support. Finally, clear any server list filters and switch to the “All” group to rule out entries being hidden by the interface.

Check the logs to see where the timeout occurs, then narrow it down by layer. If the client cannot connect to the server address and port, check your network, server status, port, and firewall. If a connection is established but fails during TLS or protocol negotiation, check the device time, server name, transport, and authentication parameters. Don’t disable certificate verification to hide a server name or certificate configuration issue. Testing another known-working configuration on the same network, then the original configuration on a different network, can help isolate the cause—but one successful or failed test does not establish long-term status. If several configurations fail at once, check the local network and core startup first. Keep the exact error message; it’s more useful than just noting “timeout.”

First check whether “connected” only means the core or VPN service has started; it does not confirm server authentication or successful access to your destination. Open a page that should definitely go through the proxy and check whether a matching request appears in the logs. If there are no requests, check system proxy settings, the app’s own proxy settings, or TUN coverage. If requests appear but fail with a resolution error, check DNS settings and whether the relevant servers are reachable. If only some sites fail, check routing rules, the target service, and protocol settings. Test one page expected to connect directly and one expected to use the proxy rather than relying on a single site. If the browser is using an old connection, fully quit and reopen it. Don’t change the server, DNS, and routing mode all at once while testing.

Confirm the core is running and look for a successful local listener entry in the logs. If the address is already in use, close duplicate client instances and any other proxy using the same port, then restart the service. If you need to run multiple programs at once, assign each a different listening port and update any apps configured manually. If the core is running but the browser generates no requests, check whether another program has overwritten the system proxy and whether the browser uses its own proxy settings. Some apps ignore system proxy settings; configure the proxy in the app itself or use TUN after confirming the required permissions. Before finishing, make sure the system proxy still points to an active listening port so the client doesn’t leave behind a broken proxy address when it exits.