STEP 01 / SUBSCRIPTION

Import a subscription and server configuration

First, identify what you received. A URL beginning with https:// that retrieves a set of server configurations usually belongs in a subscription group. Content beginning with a protocol prefix such as vmess://, vless://, or trojan:// is usually a single share link; import it from the clipboard. These options are not interchangeable: importing a subscription URL as a single link often won't create a usable entry, and a share link in the subscription URL field can't be updated as a subscription.

v2rayN: Add a group, then update the subscription

Open v2rayN and choose Subscription Group Settings from the Subscription Group menu at the top. Add a group entry, enter a recognizable label, then paste the full subscription URL into the URL field. The label only identifies the source; it does not change server settings. Check that there are no extra spaces or line breaks at either end of the URL, save the settings, and close the window.

Return to the main window, switch to the new group, then update the current group from the Subscription Group menu. If you don't have a working connection yet, try Update subscription (without proxy) first. If your local network can't reach the subscription URL and an active server is already available, try updating through the proxy. After the update, check the server list for entries with a type, alias, address, and port. If you only see entries from an older group, confirm that the right group is selected instead of repeatedly adding the same URL.

v2rayNG: Save the subscription, then update it from the list

Open the v2rayNG menu and go to Subscription Group Settings. Tap Add, enter a label and subscription URL, then save. Saving the subscription settings does not fetch servers: return to the configuration list, open the menu, and choose Update subscription. Wait for the result message, then confirm that configuration entries appear in the list. For a single share link, copy the full link and choose Import from clipboard, then check that the entry appears.

If the result says no usable configurations were found, copy the URL again from its original source and confirm that the subscription is still valid and includes active services. Subscription URLs may contain access credentials; don't post the full URL in public comments or screenshots. Hide query parameters and personal identifiers when asking for help. Don't import rule files made for another client as node subscriptions; ask your service provider whether the format works with your client.

Step complete: The server list contains selectable server entries, not just a URL in the subscription settings window. You don't need to test every server or adjust transport and TLS settings yet. Keep the settings generated by the subscription and move on to choosing how traffic reaches the client.

STEP 02 / TRAFFIC MODE

Choose a proxy method and routing mode

System proxy, VPN mode, and Bypass mainland China are settings for different parts of the connection. System proxy or VPN mode determines whether traffic reaches the client; routing determines whether that traffic goes direct, through the proxy, or gets blocked. For your first setup, use one clear method to route traffic through the client. Running multiple proxy tools or setting a separate proxy in a browser extension can make test results hard to interpret, so close other tools that take over network traffic first.

v2rayN: Start with system proxy; leave Tun off

Choose Automatic system proxy configuration from the System Proxy control at the bottom of the main window. Some versions also offer this option in the tray icon's right-click menu. This points the system proxy to the client's local listening port. Browsers that respect system proxy settings will usually use it, but apps that make their own connections or ignore those settings may not. For your first test, use a standard browser; don't assume the entire setup is broken based on one standalone app.

Leave Enable Tun off for now. Tun captures a wider range of traffic and may require administrator permissions, a virtual network adapter, and additional routing; it isn't needed to get a browser connected for the first time. Confirm that the system proxy works before setting up Tun for specific apps. If you do need it, see the system proxy checks in the troubleshooting guide. Avoid changing several network settings during your first connection attempt.

v2rayNG: Confirm VPN mode and routing rules

In v2rayNG Settings, check the operating mode and choose VPN mode for your first setup. It routes traffic through Android's VPN interface. With local proxy mode, other apps must be configured to use the proxy themselves, so the tests in this guide won't apply directly. If per-app proxying is already set up, make sure the browser you're testing isn't excluded; otherwise it may connect directly even when the client is connected.

Next, open Routing Settings and choose rules that fit your needs. For everyday split tunneling, start with Bypass mainland China or the equivalent rule available in your version. It typically sends addresses in mainland China direct and routes other traffic according to the rules, but the actual result depends on the rule set and its order. In v2rayN, also confirm the selected routing rule using the control at the bottom of the window; setting the system proxy alone isn't enough. Global proxy doesn't necessarily mean faster—it simply sends a wider range of traffic through the proxy.

The domain strategy, such as IPIfNonMatch, affects how domains that don't match a rule are resolved and how IP rules are applied. For a first setup, keep the reasonable defaults provided by the subscription and client. Don't copy an unfamiliar set of rules just to fix one site. At this point, you should know which traffic-capture method and routing rules are active. Next, select a server and connect so you don't mistake a failure before startup for a routing problem.

STEP 03 / CONNECTION

Select a server and connect

A server in the list isn't necessarily the one you're using. Choose an entry that your service provider still maintains and that has complete protocol settings. If several aliases look similar, check the group and address to avoid picking an entry left over from an old subscription. There's no need to switch servers repeatedly at this stage. Stick with one so you can relate the logs, browser results, and any setting changes to the same target.

v2rayN: Set the active server and check the core logs

Right-click the target entry in the server list and choose Set as active server, or the equivalent option in your version. The client usually reloads the configuration and starts the core; a selection mark or status change indicates which entry is active. Clicking a row may only select it for editing or testing, not make it the active server. Confirm the change from the menu and status rather than relying on the row highlight.

Open the log panel and check the entries generated after switching servers. Core configuration errors, occupied listening ports, and missing files are often reported right away. If startup fails, the system proxy may still point to the local port, but the browser won't have a working forwarding service. Fix startup errors before changing browser settings. Once the core starts, confirm that Automatic system proxy configuration is still enabled at the bottom of the window; another app or a previous exit may have changed it.

If the interface doesn't show an obvious change, confirm the active server, choose Restart service once to reload it, then check the new log entries. Don't click restart repeatedly; waiting for one attempt to finish makes errors easier to identify. For details on log fields and configuration errors, see the troubleshooting guide. Before moving on, make sure the core starts and doesn't exit immediately.

v2rayNG: Tap Connect and approve the system request

Tap the target entry in the configuration list, then tap the Connect button at the lower right. On first launch, Android displays a VPN connection request. Confirm that the request is from the client you just installed before approving it. Approval only lets the client create a VPN interface; it doesn't confirm that the server is reachable. After connecting, check the client status and the VPN indicator in the system status bar. If the button quickly returns to a disconnected state, check the client logs for details.

If another VPN service is running, Android may ask whether to replace the existing connection. Check whether it's needed for a work profile or another app before deciding; don't replace it without knowing what it does. If Android doesn't show a permission prompt, don't repeatedly clear app data—it may already be authorized. Check the connection status and logs first. Once connected, keep the client in the foreground for an initial access test; set up background operation after that works.

Step complete: v2rayN has an active server, the core is running, and the system proxy is enabled; or v2rayNG is connected and has created a system VPN interface. This confirms that the local connection is ready, not that the remote server is reachable. Test access next; use the client's test button only as an additional check.

STEP 04 / VERIFICATION

Check that access and routing work

Open a new browser tab and visit a site that normally works directly to confirm your basic connection is still available. Then visit a site that should use the proxy and is known to be online. Use a fresh page and reload to avoid mistaking a cached page for a new successful connection. A single failure may be caused by the site itself; try another independent site before deciding that the whole connection is down.

Compare browser results with the logs

While the page loads, check the client logs for the domain or address you visited and its outbound tag. Common tags include direct for a direct connection and proxy for proxy traffic, but labels depend on the configuration and may vary between versions. If the current log level doesn't show access entries, don't assume that no traffic flowed. Check the log settings and system proxy status; if needed, temporarily enable a more useful log level for troubleshooting, then restore it after the test.

If the direct site opens but the site expected to use the proxy doesn't, keep the server unchanged, switch temporarily to global proxy, and try again. If global mode works but split routing doesn't, check rule matching, domain resolution, and rule set updates first. If neither mode works, check remote reachability, whether the subscription has expired, and any handshake errors in the logs. Restore your original split routing after the test so you don't leave a diagnostic setting in place.

You can also briefly disconnect for comparison: in v2rayN, choose Clear system proxy before stopping the service; in v2rayNG, disconnect the VPN. Compare the same site before and after connecting, keeping in mind that the browser may reuse an existing connection. If needed, close and reopen it. Some sites are expected to connect directly under split routing, so an unchanged exit IP doesn't necessarily mean the client isn't working. Check which rule matched that destination.

Troubleshoot app differences after confirming the connection

If the browser works but a desktop app still can't connect, check whether the app supports the system proxy and whether it has its own proxy settings. Don't reinstall the client just because one app doesn't follow the system proxy. If only some Android apps work, check the per-app proxy allow and block lists and confirm that the app you're testing is covered. For DNS, Tun, or custom routing changes, follow the step-by-step troubleshooting guide and change one setting at a time.

If a test produces a certificate or handshake error, first check that the device's date, time, and time zone are correct, then verify the server settings provided by your service provider. Don't disable certificate validation just to dismiss a warning, and don't change SNI, transport paths, or ports without a reason. If the connection stopped working after a subscription update, compare the settings before and after the update, but don't share configurations or logs containing identifying details.

Record the group, active server, traffic-capture method, and routing mode that worked so you have a baseline for future troubleshooting. Before exiting v2rayN, clear the system proxy so the system doesn't keep trying to use a local listener that has stopped. When you're done with v2rayNG, tap Disconnect and confirm the VPN is no longer active. The four steps—import, choose a mode, connect, and test—complete the setup; there's no need to add complex settings just to get connected for the first time.

V2Ray setup guide