v2rayN / v2rayNG FAQ

For desktop, start with v2rayN for Windows, macOS or Linux. On Android, v2rayNG with the Xray core is usually the first choice; consider v2flyNG if you need the V2Fly core. Check that the selected core supports the protocols, transport and security settings required by your server. These are separate applications, not different skins for the same program, so settings and import capabilities may differ. When switching, import and test one configuration first, then move subscriptions and routing rules. Don’t overwrite another client’s data directory.

Project V is the ecosystem behind related proxy tools, while V2Fly and Xray are common core families. Graphical clients manage subscriptions, edit configurations and control startup; the core handles connections, routing and forwarding. An open client window doesn’t mean the core started successfully. When troubleshooting, note the client version, core type and startup logs separately. If a configuration field is unsupported, check which core and version it requires instead of relying on the client’s name. Updating the core won’t automatically fix incorrect subscription settings.

VMess, VLESS and Trojan are proxy protocols. REALITY is a security layer in the Xray ecosystem, not a standalone node type that replaces the address, port and user ID. A connection configuration also includes transport and TLS or REALITY settings, which must match the server. Simply changing the protocol dropdown from VMess to VLESS won’t make the existing configuration work. With REALITY, check the server-provided public key, server name and shortId in particular. If a field is missing, ask the configuration provider rather than guessing values.

Links beginning with vmess://, vless:// or trojan:// are usually single-node share links. Importing one saves a connection profile. A subscription URL is usually an HTTPS address that the client fetches to retrieve a set of profiles, which can be refreshed later. Opening a subscription URL in a browser doesn’t guarantee the response is in a format your client supports; it may return a login page or an error instead. Import individual links from the clipboard, and add subscription URLs in the subscription group settings. Subscription URLs may contain access credentials, so hide the full URL and its query parameters in screenshots, logs and support requests.

Most Android phones released since 2015 should use arm64, but check the device’s supported application ABI. A 64-bit processor doesn’t guarantee that the system provides a 64-bit app environment. The universal package supports multiple architectures and is usually larger, making it a good option when you’re unsure. If installation fails, check the Android version requirement, whether the download completed and whether the package signature is compatible with the existing app. Don’t repeatedly uninstall the app to test architectures. Back up your configuration first, and remember that backup files may contain subscription URLs and connection credentials.

First identify what you’re importing: use clipboard import for a single share link, and add a subscription URL in the subscription group settings. Remove spaces, line breaks and punctuation around the URL, and make sure you haven’t copied the page title with it. Saving a group only saves the URL; you’ll usually need to update the subscription before profiles appear. If it’s still empty, check whether the URL has expired, requires login or returns a format the client supports. Don’t enter a subscription URL as a node server address. When reporting an error, include the error type but hide subscription credentials and personal configuration details.

These are different ways to route traffic. The system proxy is mainly for apps that follow the operating system’s proxy settings. TUN uses a virtual network interface, and its coverage also depends on routes, exclusions and DNS settings. When setting things up, test the system proxy on its own first, then try TUN if needed. Avoid changing multiple variables at once. Some setups can use both, but enabling both isn’t automatically better. Note your original settings before switching, and after closing the client check that the system proxy and network routes have been restored, especially if other network tools are installed.

Check the startup logs first to see whether the failure occurred during the permission request, virtual interface creation or route configuration. On desktop, follow the client’s prompts to grant the required system permissions. Windows may require administrator privileges or service mode; other desktop systems may ask you to authorize a network component. On Android, allow the VPN connection and check whether another VPN app is already using it. Don’t disable all security protections to bypass an error or delete system network adapters. If enabling TUN cuts off your network, disable it to restore connectivity, then check for conflicting tools, interface settings and routes one at a time.

The result depends on the test method. A TCP test usually only confirms that a connection to the target port can be established. A real request also involves the proxy handshake, destination site and DNS. Passing one test doesn’t prove that every app uses the proxy or that every destination is reachable. Check which test the client runs, then use the same profile to access a specific HTTPS destination and see whether the request appears in the connection log. Don’t judge usability by latency rankings alone. A test may also time out because of the test target, so check normal requests and logs instead of repeatedly switching configurations.

Mode names vary by client, so check the routes actually generated. Rule mode selects an outbound based on domains, IPs or other conditions. Global proxy usually sends captured traffic through the proxy; direct connection routes traffic without a remote proxy. Global proxy won’t automatically capture apps that aren’t connected to the client. To test, use the same destination each time, first confirm that app traffic reaches the client, then check which outbound tag matched. If global proxy works but rule mode doesn’t, check rule order, rule data files and DNS before changing the server address or user ID.

First identify what you need to keep: subscription-generated nodes, manually added nodes, or client-level routing and DNS settings. A subscription update may rebuild entries in its group, so changes made directly to subscription nodes may be lost at the next update. Copy configurations you want to maintain into a separate group, and use the client’s export or backup feature to save settings. After backing up, check that the file was actually created instead of relying only on a success message. Test compatibility with a small number of configurations before restoring everything. Exports often contain sensitive settings; store them securely and don’t share them publicly.

First distinguish system DNS, browser Secure DNS and core DNS; they may be used at different stages. If an app resolves domains itself, the core may not be able to apply domain-based rules as expected. TUN mode may also intercept DNS. Record the original values, change one setting at a time, then test the same destination and review the logs. Don’t assume that entering a public DNS address will fix every issue. Before changing domainStrategy or queryStrategy, check which values the current core supports and when they apply. Routing resolution strategy and query address-family strategy are different settings.

First check that the device can access ordinary websites, then make sure the server address, port, protocol and security settings in the profile were copied correctly. If only one profile fails, focus on that profile and the server status. If all profiles fail, check the local network, whether the core started and the system time. Connection timeouts, authentication failures and certificate errors in the logs mean different things, so note the specific error. Switching networks can help narrow down the cause, but change only one condition at a time. Don’t hide handshake errors by disabling certificate verification, and don’t mistake an accessible port for an established proxy connection.

“Connected” usually means only that the client service or local interface started; it doesn’t guarantee a successful remote connection. Open the logs, then make a web request. If no request appears, check whether the app uses the system proxy, whether the local port is correct and whether another proxy extension is taking over. If the request does appear, check DNS, the handshake and outbound errors. Turn off TUN and test using just one traffic method to reduce route conflicts. If only domain names fail, focus on DNS resolution. Don’t rely solely on visiting an HTTPS site by IP address: the certificate and site selection may depend on the domain name.

First confirm that the core is running and check the actual listening address and HTTP or SOCKS port in the client. Don’t copy port numbers from a guide. In your browser, check proxy extensions, separate proxy settings and existing connections; restart the browser and test again if needed. Command-line tools may not use the system proxy. They may require their own proxy options or environment variables such as HTTP_PROXY and HTTPS_PROXY; also check whether NO_PROXY excludes the destination. The protocol prefix must match the listening service. Old terminal environment variables can override the settings you expect, so test the browser and terminal separately. Success in one doesn’t mean the other is configured correctly.

Keep any profiles that still work, and note the error shown during the update. For a connection timeout, check the network path and whether the client supports updating subscriptions through a proxy. HTTP 401 or 403 usually means you should check authorization, expiration or access restrictions. If the request succeeds but the list is empty, check the response format and whether the subscription still contains entries. Some URLs return a web page instead of configuration data; seeing a page in your browser doesn’t mean the subscription is valid. If the subscription requires a proxy, first confirm that the profile used for the update can connect. Don’t repeatedly delete and recreate the group, or you may lose information needed to diagnose the issue.