V2Ray FAQ
Subscription, proxy, and connection troubleshooting

First, distinguish the interface from the software that handles connections. V2Ray usually refers to the Project V proxy ecosystem and its related core projects. v2rayN, v2rayNG, and v2flyNG are graphical clients for managing configurations; the core handles protocols, establishes connections, and forwards traffic. An open client does not mean its core is running successfully. When troubleshooting, check the startup logs first, then confirm that the selected core supports the protocol, transport, and security settings required by the node. Do not judge compatibility by the client name alone.

For desktop use, start with v2rayN and download the release for Windows, macOS, or Linux. On Android, v2rayNG with the Xray core is usually the first choice; consider v2flyNG if you need a V2Fly core environment. The three clients have different menus and import workflows, so do not assume a configuration file for one will work in another. Check your operating system first, then confirm the protocols and core features required by your subscription provider. A client manages configurations and connections; it does not provide a remote server.

Changing only the protocol name will not make a configuration work. VMess and VLESS are different protocols, and the client must match the server. Verify the credentials, port, transport, and security settings as well. VLESS does not provide transport encryption on its own and is commonly paired with security mechanisms such as TLS or REALITY. A VMess configuration also requires a full check of its security settings. Import share links in full whenever possible; do not piece together a configuration based on similar fields. Ask the configuration provider for any missing parameters.

A subscription URL retrieves and updates a group of nodes and is usually added as a subscription group. Share links beginning with vmess:// or vless:// typically describe a single node and should be imported from the clipboard. Do not paste a share link into the subscription URL field, or assume any https:// webpage is a subscription. Subscriptions may contain access credentials, so store them only on trusted devices. Hide the full URL and credentials in screenshots, verify the source before updating, and never paste private configurations into online parsing tools.

Check your device's processor architecture first. Most newer Android phones use arm64, so you can start with that package; the device's age alone is not a reliable guide. The universal package usually includes multiple supported architectures and is useful when you cannot identify your architecture or the single-architecture package is incompatible. It does not bypass Android version requirements. If installation reports incompatibility, check the minimum Android version and the signature of the installed app. Back up your configuration before installing over an existing app. Do not immediately uninstall the client to clear an error, as this may erase groups and custom rules.

Windows users can start with the cross-platform Desktop interface and choose WPF if they prefer its classic workflow. These are different interface releases, not indicators of protocol speed or node quality. Check the system requirements on the download page before installing. If a runtime is missing, install the required component according to the release instructions. Back up subscriptions and rules before switching releases, and test in a separate folder where possible. Avoid running both versions at once while they modify the system proxy, as this can cause port and settings conflicts.

Make sure you copied the complete share link, not its title, a QR code image URL, or a regular webpage. Remove any quotation marks, spaces, or line breaks at the beginning or end, then use the client's clipboard import option. If you have a subscription URL, add it as a subscription group and update it instead. If import still fails, check whether the current client and core support the link's protocol and transport settings, and review the parsing error. Do not force an import by deleting unfamiliar security fields; that can change how the connection works. Get a compatible configuration instead.

Select a node and confirm that the core starts successfully. Then enable automatic system proxy configuration on desktop, or grant VPN permission on Android. Use a browser that follows the system proxy to visit a test destination that requires a proxy, and check the client connection logs for the matching domain and outbound connection. A changed start button or VPN icon does not prove that every app is covered. With a split-routing preset such as bypass mainland China, some requests are expected to connect directly. Check a specific destination rather than relying on a single status indicator.

Automatically configure the system proxy points it to the client's local listening address, which works for typical desktop browser use. Clear system proxy removes the proxy settings. Do not change system proxy leaves existing settings untouched and is useful for manual management or testing. PAC mode uses an automatic configuration script and app support to decide which requests go through the proxy. Menu names may vary by version. Leaving the system proxy unchanged does not disable an existing proxy. Before closing the client, check system settings to make sure they do not still point to a stopped local port.

For everyday use, start with the client's bypass-mainland-China preset and adjust it to suit your needs. Global mode usually sends requests that reach the core through the selected proxy outbound; it does not automatically route every app through the core. Apps that ignore the system proxy need separate configuration or TUN. Pay attention to rule order in custom routing: specific domain or app rules should generally come before broader rules. Change one type of rule at a time and record which outbound is selected. Once a change works, move on. Avoid changing DNS and routing together, or it will be harder to identify the cause of a problem.

TUN captures traffic through a virtual network interface and can handle apps that ignore the system proxy, but routing, DNS, and exclusion rules still apply. Desktop setups may require administrator privileges, system authorization, or a supporting service, depending on the OS and client. Android typically uses the VPN permission prompt. First confirm that a regular system proxy connection works, then enable TUN to help separate node issues from permission issues. If it fails, check the logs for permission, interface, or routing errors. Do not repeatedly disable system protections or run TUN alongside another VPN traffic-capture feature.

First check which core options your client actually offers; not every client supports arbitrary switching. For v2rayN, use the options supported by your current release. v2rayNG and v2flyNG target different core environments. Back up your configuration before switching, and check that the node protocol, transport, security options, DNS, and routing rules are compatible. After startup, test a known-working node before checking split routing and TUN. Core configuration formats are not interchangeable. If a field is unsupported, switch back or convert the configuration according to the relevant instructions.

Check the full URL and confirm the subscription has not expired, been revoked, or been suspended because of an account issue. Then make sure your current network can reach the subscription service. Review the update log: a connection timeout points to a reachability issue; a login page or webpage response is usually not a valid subscription; a parsing error calls for a format compatibility check. If a direct update fails, try updating through a proxy only if you already have a working one. If your existing proxy is unavailable, try a direct update instead. Back up the group before making changes, and do not repeatedly delete and recreate it, or you may lose configurations that still work.

A successful TCPing usually means only that a TCP connection to the destination port can be established. It does not confirm proxy authentication, a successful TLS handshake, or access to the destination. Check your device's clock first, then verify the node address, port, credentials, server name, and transport path against the server settings. Finally, review the actual connection test and core logs. If only one node fails on the same network, focus on that node. If all nodes fail, check your local network, DNS, firewall, and core startup status. Do not assume the server is healthy based on one port test, or change security settings in bulk.

Temporarily disable the proxy and confirm that your basic connection still works. Then restore the client and select a known-working node. When access fails, check whether the logs show the destination domain. No request entry? Check traffic capture. A name resolution error? Check the DNS service and resolution path. An outbound is selected but the handshake fails? Check the node configuration. If only some domains are affected, check whether split-routing rules match the DNS results. You can briefly switch to the global preset for comparison, then restore your original settings. Change one option at a time to avoid mixing up DNS, routing, and node issues.

The system proxy provides an address to apps that support it; it does not force every program to use the proxy. Test with a browser that follows the system proxy first. If the browser works but one app does not, check for app-specific proxy settings, a direct-connection option, or cached settings in a background process. If the browser also fails, confirm that the system proxy points to the same local port the client is listening on, and check whether another proxy app has overwritten the setting. Consider TUN only if you need to capture more apps. If basic networking fails after you exit, clear the system proxy first, then check for leftover manual proxy or PAC settings.