First-time setup / 4 steps
Import a subscription and test your connection
Follow this order: import a subscription → choose a routing mode → connect → verify traffic. First, get one connection working before adjusting split tunneling, DNS, or Tun settings.
Before you start, install the right client and get a valid subscription URL. Haven’t installed one yet? Browse clients →
Allow about 10 minutes to read and follow these steps. Actual setup time depends on subscription validity, network conditions, and system permissions.
Step 1 / Configuration source
Import a subscription
A subscription URL retrieves and updates server configurations. It is not an installer and does not establish a connection by itself. After installing the client, you’ll usually need to import server details manually. Copy the full subscription URL from your service’s account page—not the page title, login URL, or explanatory text. Subscription URLs often contain access credentials, so treat them like account details: don’t post them publicly or include them in screenshots.
If you only have a single share link that starts with a protocol name, use an option such as “Import from clipboard.” If you have a subscription URL for regularly updating a server list, add it using the group method below. The import options may differ. Scanning a QR code is another way to import a configuration, but you still need to check its source, validity, and protocol compatibility.
v2rayN: Add a group and update it
Open v2rayN and select Subscription Group > Subscription Group Settings from the top menu. Choose Add, enter a recognizable name for the group, and paste the full URL into the subscription address field. The name is only for identification on this device; it does not change connection settings. Keep the other options at their defaults for your first import. In particular, leave server filters blank: a filter can hide entries even when the subscription updates successfully.
Save the settings and close the group window. Back on the main screen, select the new subscription group, then choose Update Current Group from the subscription menu. If you don’t have a working connection yet, try updating without a proxy first. If your network can’t reach the subscription URL, check the access method provided by its source instead of randomly changing DNS, the core, or routing settings. Wait for the update to finish, check the notification or logs, then look for entries in the server list.
After the update, check which group is selected on the main screen. Servers may not appear if another group is active or an old search term is still in the search box. Clear the search, switch to the new group, and select a server entry. For now, just confirm that an entry is present; you don’t need to test every server. A server-list test result also doesn’t guarantee that websites will load in your browser.
v2rayNG: Add a subscription and refresh the list
Open v2rayNG and select Subscription Group Settings from the top-right menu. Tap Add, enter a name and subscription URL, then save and return to the main screen. Open the main menu and choose Update Subscription or the corresponding group update option. Saving the URL in settings does not confirm that server configurations have been retrieved; check for server entries on the main screen.
If the update reports success but the list is empty, check the selected group, make sure the URL is complete, and confirm that the subscription is still valid. A parsing error may mean you copied a login page, an error response, or a subscription format the client doesn’t recognize. Go back to the subscription provider and copy the URL intended for your client—don’t paste an entire webpage into the configuration field. When the list appears, tap an entry and confirm that the selection indicator moves to it.
Save multiple subscription groups, update schedules, and filtering rules for after you’ve established a connection. See the Advanced Configuration Guide. For your first setup, keep one clearly named group so it’s easier to trace any issues to the right configuration.
Step 2 / Traffic coverage
Choose a routing mode
First, separate two questions: does an app’s traffic reach the client, and which outbound does the client use for that traffic? A system proxy, VPN routing, or Tun handles the first question. Routing modes such as Global or Bypass mainland China handle the second. So Global does not mean every app is being routed through the client; it generally determines how traffic that reaches the client is routed.
v2rayN: Start with the system proxy and Bypass mainland China
Find the routing mode in the status bar at the bottom of v2rayN’s main screen or in the relevant menu. For your first setup, choose Bypass mainland China. This mode typically sends domains and IP addresses identified as belonging to mainland China directly, while routing other requests according to the proxy rules. The result depends on the rules bundled with the client and your current configuration. Classification is not based on a webpage’s language, and regional rules won’t identify every domain accurately.
Next, find the System Proxy option and note where to enable Set system proxy automatically; you’ll turn it on when you connect. This setting updates the proxy configuration supplied by your operating system. Browsers and other apps that follow those settings will send requests to the client. Leave Tun off for your first setup to avoid extra variables such as virtual network adapters, administrator permissions, and additional routes.
If your browser has a proxy extension, pause its separate proxy rules or confirm that it uses the system proxy. An app configured to use a different proxy can bypass the current setup even when v2rayN’s system proxy is enabled. Don’t enter a port manually for now. If an app requires manual proxy settings, use the listening address and port shown in the current client settings—not numbers from another guide.
v2rayNG: Check routing and per-app settings
In v2rayNG settings, find the routing options and choose the Bypass mainland China preset for your first setup. If you’ve changed per-app proxy settings, make sure the browser you’re testing is included. To start, disable any custom app filters so the browser isn’t accidentally excluded; once the connection works, narrow the coverage as needed. Routing presets and per-app settings are separate conditions, so check both.
When connected, the Android client uses the system VPN interface to route eligible traffic. You don’t need to copy the desktop system proxy steps. If another VPN app is already running, disconnect it before starting v2rayNG. Avoid running multiple apps that control network routing at the same time, as they can interfere with each other’s connection status and traffic routing.
You’ve now identified how the app you’re testing will be routed and which routing mode to use. Next, start the selected server and check that the client is actually running.
Step 3 / Core and system permissions
Connect
Return to the server list and confirm which entry is selected. In some desktop versions, a highlighted row is not the same as the active server: clicking a row may only select it without switching the current connection. For your first setup, explicitly choose Set as active server, then check the status bar and logs. If you’ve just changed routing settings, wait for the client to reload before testing.
v2rayN: Set an active server and enable the system proxy
Double-click the server entry or choose Set as active server from its right-click menu, depending on the options in your version. Confirm that the active server shown on the main screen has changed and that the logs show the core starting. If your version requires you to start or restart the service manually, do so. The interface may not have a single Connect button; check that the server is active and the core is running.
Once the core has started, set System Proxy to Set system proxy automatically. Keep v2rayN running while you test in your browser. Closing the window may minimize the client to the tray, or behave differently depending on its settings. Check the tray icon and status so you don’t mistake an exited app for one running in the background. If the client exits while the system proxy remains enabled, your browser may keep sending requests to a local service that no longer exists.
If the logs repeatedly report a port conflict, close other clients of the same type and restart the current service. If you see a configuration parsing error or an unsupported protocol, check with the configuration provider that the settings are compatible with your current core. Don’t delete unfamiliar fields to dismiss the warning. See Protocols and Core Engines for details on how protocols, transports, and cores work together. For now, focus on starting the original configuration successfully.
v2rayNG: Connect and approve the VPN request
On the v2rayNG main screen, tap the server you want to use, then tap Connect. The first time you connect, Android will show a VPN connection request. Check that the app name matches what you just opened, then allow the request. If you deny permission, the client can’t create the system VPN connection. Return to the main screen and tap Connect again to retry; there’s no need to import the subscription again.
After connecting, check the button, the status shown in the app, and the system VPN indicator. These show that the service has started or the VPN connection is active; they don’t guarantee that the remote server is reachable. The built-in connection test can provide a useful clue, but a failure may be caused by the test address. Verify the connection with an actual browser request. If the client stops immediately after connecting, look for the first clear error in the logs.
Keep the client running normally in the foreground or background during your first test; don’t immediately clear it from recent apps. If it disconnects only after the screen turns off and reconnects when you reopen it, check the device’s background activity and battery restrictions for the app. Don’t change every battery setting up front. First confirm that the issue only occurs in the background so you avoid unrelated changes.
Step 4 / Real-world access
Verify the connection
Check both whether a site loads and whether its traffic takes the expected route. A changed Connect button doesn’t confirm that your browser is using the client. A page loading doesn’t prove it went through the proxy either; it may match a direct-connection rule. Choose one site you use regularly that should be proxied under your current rules, plus one that would normally connect directly. Open both in the same browser.
Compare results with the connection off and on
First, note what happens while disconnected. Then connect and request the same pages again. For v2rayN, set System Proxy to Clear system proxy before testing while disconnected; quitting the app alone is not enough. For v2rayNG, tap Disconnect. When you’re done, reconnect using the steps in Connect. If browser caching makes the results hard to judge, try a new private window, though it may still follow the browser’s own proxy settings.
With the connection on, check whether the target page loads and look in the client logs or available connection records for the request. You can only identify the outbound if the current log level includes that information. Don’t assume traffic routing failed just because the default logs don’t show each request. If the domain and outbound tag are visible, confirm they match your routing rules: traffic set to connect directly should go direct, and traffic that needs a proxy should use one.
To check your external IP, use an exit-IP lookup service you trust and compare the results before and after connecting. Make sure the test site itself is covered by the proxy. In Bypass mainland China mode, a lookup site that connects directly may show your usual IP; that doesn’t mean all traffic is bypassing the proxy. Likewise, a changed IP doesn’t prove that every app on your device is routed through it. Your conclusion applies only to the requests you actually tested.
Troubleshoot in this order
If nothing loads after you connect, first check whether traffic is reaching the client. On desktop, check that the system proxy is enabled and that the browser follows system settings. On Android, check that the VPN is still connected and that per-app rules haven’t excluded the app you’re testing. Don’t switch servers yet: if the app’s traffic never reaches the client, changing servers won’t help.
If requests reach the client but connections to the remote server keep failing, check that the selected server is still valid, whether the subscription needs updating, and whether the device’s date and time are correct. Try another working configuration from the same subscription, changing just one condition at a time. If the logs show a timeout, handshake, or authentication error, note the specific error type. When sharing it, hide the subscription URL, account identifiers, and server credentials.
If some sites work and others don’t, check routing rules and DNS. Don’t switch to Global and leave it there. Temporarily changing the routing mode can help determine whether the rules are causing the issue, but restore the original mode when you’re done testing. For DNS, Tun, rule priority, and custom outbound settings, see the Advanced Configuration Guide. Avoid troubleshooting multiple layers of network settings during your first connection.
Save your settings and disconnect cleanly
Once browser access and both proxied and direct destinations behave as expected, note the subscription group, routing mode, and traffic coverage that worked. After updating a subscription, the active server entry may change, so verify what’s selected instead of assuming the previous setup still applies. Exported configurations and backups may contain connection credentials; store them securely and don’t share them as ordinary attachments.
When you’re done, clear the system proxy in v2rayN before exiting the client if needed. In v2rayNG, tap Disconnect. Restore any proxy settings you manually changed in your browser or other apps as well. That completes the first-time setup: the configuration is imported, traffic coverage is clear, the service starts, and a real request has been tested.
Continue to advanced configuration Back to subscription import ↑