v2rayN Setup Guide
Import a Subscription and Test Your Connection

Step 1: Import a subscription and update configurations

First, distinguish between saving a subscription and fetching its configurations: saving stores the URL, while updating retrieves configurations from it. If the list is empty after saving, update it once before adding the same URL again. If your provider offers several URLs, such as a general subscription and client-specific subscriptions, use the one explicitly intended for your client.

v2rayN: Add a subscription group

Open the main window, find Subscription Group in the top menu, and open Subscription Group Settings. Add a group and enter a recognizable name in Remarks, such as “Daily use.” Paste the full subscription URL into the Address (URL) field. Make sure there are no spaces, line breaks, or punctuation added by a messaging app. Leave the other options at their defaults, save, and return to the main window.

Open the Subscription Group menu again and choose Update current subscription group, or update all subscriptions if needed. Before you have a working proxy connection, try updating without a proxy first; success depends on whether the URL is reachable from your current network. If the URL requires an existing proxy, connect through one that already works, then try updating through it. A configuration you have not imported cannot handle this request.

When the update finishes, switch to the group you just created. The main window should show the configurations returned by your provider. Check that the group name and configuration remarks look right; there is no need to edit protocol fields individually at this stage. If the response is an error message or a sign-in page, the client may report an unrecognized format. Go back to your provider and copy the correct subscription URL instead of guessing at the core type.

v2rayNG: Save the URL and update the subscription

Open the side menu, select Subscription Group Settings, and use the add option to enter a name and subscription URL. Save, return to the configuration list, and choose Update subscription from the menu. Some versions offer separate options to update through a proxy or directly; for the initial setup, choose the route that is actually available on your network. After the update, check that configurations appear in the group.

If the update reports success but no entries appear, check whether the list is showing a different group or has a filter enabled. If it reports a failure, note whether the error occurred while connecting or parsing: a connection timeout usually points to URL reachability, while a format error usually means the copied content or subscription format needs checking. Don’t keep clicking Update, and don’t use a node share link as a subscription URL. Import an individual share link using the appropriate clipboard import option; that is different from updating a subscription.

You’re ready to move on when the target group contains at least one selectable configuration. Entries in the list mean the configuration was imported, not that a connection has been established. Next, choose how app traffic enters the client and how it is routed. For an explanation of subscriptions, nodes, and share links, see the glossary.

Step 2: Choose a proxy mode and routing

It’s easy to confuse these two settings at first. The system proxy determines which apps that follow system settings send requests to the client; routing determines whether the client sends those requests directly or through a proxy. Confirm where traffic enters before choosing a routing preset. Switching to Global routing alone will not send traffic from an app that does not use a proxy into the client.

v2rayN: Enable automatic system proxy configuration

Find the system proxy option in the main window or the system tray icon’s right-click menu, then select Set system proxy automatically. This points the system proxy to the client’s local listening address, allowing browsers and other apps that follow system proxy settings to send requests to the client. Keep the default local port during initial setup. Changing it while troubleshooting can leave the system setting pointing to the wrong listening address.

Clear system proxy removes the system proxy entry set by the client. Do not change system proxy leaves the current setting untouched; it does not enable the proxy. For this guide, explicitly select Set system proxy automatically so settings left by other programs don’t carry over. Some apps use their own network settings instead of the system proxy, so they may need separate configuration even after the browser works.

Next, open routing settings and start with the common Bypass mainland China (Whitelist) preset. Destinations matching direct-connection rules connect directly; other traffic follows the preset. Its behavior depends on the rules and data files in use—it is not simply based on a website’s language. Global is useful for a brief comparison test, while Blacklist applies proxy rules to a different set of destinations. Names and rules vary by version; there is no need to create custom rules for your first setup.

v2rayNG: Keep the default app scope

v2rayNG usually handles app traffic through the Android VPN service rather than the desktop system proxy. Open Settings, find the routing options, and choose the relevant Bypass mainland China preset. If there is an option to bypass the local network, leave it enabled if you need access to local devices. If you’re new to per-app routing, keep the default app scope so you don’t exclude the browser you plan to use for testing.

This step sets the routing behavior; the VPN service starts when you tap Connect in the next step. Android generally cannot run two independent VPN services at the same time. If another network tool is using the service, stop it before continuing. There’s no need to enable custom DNS, per-app lists, and complex routing for your first setup. For more on these options, see the protocol and core reference after you’ve established a basic connection.

You should now have a clear setup: on desktop, automatic system proxy configuration with your chosen routing preset; on Android, app traffic routed through the VPN service with straightforward routing settings. Next, connect using a single configuration. Don’t change several settings at once.

Step 3: Select a configuration and connect

Choose a currently valid configuration from the subscription group you just imported. Don’t select entries that only show plan details or expiration reminders as connection targets; check your provider’s documentation if a remark is unclear. Subscription configurations usually include the protocol and connection parameters. Don’t switch VMess to VLESS or change the transport manually just to try to make it faster.

v2rayN: Set an active configuration and check the core

Select the target entry and choose Set as active server from the right-click menu, or use the equivalent activation option. Some versions also activate a configuration on double-click; check the active indicator in the list rather than relying on the selection highlight. The client will usually start or reload the core for the active configuration. If the interface has a separate Start option, follow its instructions. Then confirm that automatic system proxy configuration is still enabled.

Open the log panel and review the new entries from this attempt. Messages about the core starting or a local listener being established show that the client has begun running, but do not by themselves prove that the remote connection works. If a port is already in use, close other proxy programs or duplicate client instances, then try again. If the configuration contains unsupported fields, update the client and check which subscriptions it supports; don’t blindly test different cores at the same time.

The local listener is for apps on this device; you do not need to enable Allow connections from the LAN for initial setup. Keep the default local-only listening scope. Closing the window may minimize the client to the system tray rather than exit it. Keep the client running during testing and check the tray icon to confirm it’s still active in the background.

v2rayNG: Approve the Android VPN request

Tap the target entry in the configuration list and confirm that its selection indicator has moved to that configuration. Then tap Connect. The first time you connect, Android displays a VPN connection request. Read the prompt, make sure it comes from the client you just opened, and approve it. If you cancel, the client cannot receive the intended app traffic; tap Connect again and approve the request.

After connecting, check the client status and the Android VPN indicator. They show that the local service is running, not that the remote endpoint in your subscription is reachable. If the button immediately returns to the stopped state, check the latest error in the logs. If it disconnects after running for a while, check whether the system is restricting background activity. Test with the client in the foreground first, then allow the background activity it needs once the basic connection works.

At this point, the active configuration, proxy entry point, and local service should all be in place. Don’t run batch speed tests or test every configuration yet. First, test a real web request; it tells you more than the running icon alone.

Step 4: Verify that requests are routed as expected

Open the browser you plan to use for testing, open a new tab, and visit a page you’re authorized to access and can normally use to check your connection. Use a fresh page or refresh it to avoid seeing cached content. First confirm that a regular web page loads, then test the site you’re interested in. A single site may fail because of the site itself, your account, or that particular route; it doesn’t necessarily mean the whole client is broken.

Check the page and logs together

On desktop, first make sure the browser follows system proxy settings and that no extension or browser-specific proxy setting overrides them. On Android, confirm that the browser is included in the VPN app scope. While the page loads, check whether the client logs show a new connection at the same time. If the current log level does not show access requests, the absence of a log entry is not enough to conclude that traffic never reached the client. Consider the browser settings, connection status, and a temporary log-level adjustment together.

If the logs show routing or outbound details, check whether the request used the expected proxy route. With Bypass mainland China routing, some destinations connect directly, so opening a direct-routed site does not prove that proxy routing works. For a comparison, briefly switch to Global routing, refresh the same page, then restore the original preset. Change just one setting at a time, and note the results before and after.

You can also use a trusted IP lookup page to compare your apparent public IP before and after testing. A changed IP does not prove that every app is covered, nor does it tell you how DNS is handled. Connection or latency tests built into the client are also only indicative; they may test just one handshake type or a single endpoint. If a test succeeds but a web page won’t load, check the browser’s traffic path, domain resolution, and routing.

Troubleshoot connection issues in order

If there are no configurations, return to step 1 and check whether the subscription actually updated. If there are configurations but the core won’t start, address the startup error in the logs first. If the core is running but the browser behaves the same, check automatic system proxy settings or the VPN app scope. If the request reaches the client but times out, try another valid configuration from the same subscription. This order separates import issues, local traffic-routing issues, and remote connection issues.

For certificate or time-related errors, first check that the device’s date, time, and time zone are correct. Don’t bypass the warning by disabling certificate verification. For DNS resolution errors, keep the original error and check whether another network tool changed your DNS settings; don’t add several unfamiliar DNS addresses at once. Focus on logs from the current attempt—a failure in an older log entry may not reflect the current status.

If only one app fails while the browser and client logs look normal, check whether that app uses the system proxy, has its own proxy settings, or is excluded from the Android per-app VPN scope. When asking for help, provide the client name, operating system, step where the error occurred, and error text with sensitive details removed. Hide the full subscription URL, personal identifiers, and authentication fields; don’t post the entire configuration publicly.

Once everything works, keep the working configuration and routing preset, then adjust other apps as needed. Update the subscription when its contents change. If it expires or authentication fails, check its status with your provider instead of repeatedly reinstalling the client. Before quitting v2rayN, clear the system proxy so it no longer points to a stopped local service. On Android, disconnect the VPN using the client’s Stop button.

That’s the end of this first-time setup guide. To understand terms such as VMess, VLESS, and Xray in your subscription, see the glossary. To compare protocol designs, core compatibility, and use cases, read the protocol and core reference. When setting up another device, choose an installer from the client download page; don’t copy the system proxy port or app scope settings from another device without checking them.