v2rayNG Setup Guide:
Import a Subscription and Test Your Connection

01 Import a Subscription and Select a Server

First, identify what you copied. Links starting with vmess://, vless://, trojan://, or ss:// are usually individual server share links and can be imported from the clipboard. Only enter an HTTPS link in a subscription group if your service provider explicitly labels it as a subscription URL. Login pages, checkout pages, and documentation links aren’t subscription URLs and will usually return a parsing error if pasted there. Subscription links may contain access credentials, so don’t post them in public comments or screenshots.

v2rayNG: Save the Group Before Updating

Open v2rayNG, tap the menu in the top-left corner, and go to “Subscription Group Settings.” Tap the plus button in the top-right corner to add a group. Enter a recognizable name in the remarks field, paste the full subscription URL into the URL field, then tap Save. Saving only adds the URL; it doesn’t download server configurations. Return to the main screen, open the more options menu in the top-right corner, and choose “Update Subscription.” Depending on the version, you may see “Update Current Group Subscription” or an option to update without using the proxy. For your first update, try the option that bypasses the proxy so the update doesn’t depend on a connection you haven’t established yet.

After a successful update, server entries should appear on the main screen. Switch to the group you just created and tap a server to select it. Check the selection indicator rather than relying on the server name appearing in the list. If you only have an individual server link, tap the plus button in the top-right corner of the main screen and choose “Import from Clipboard,” then select the imported entry. Importing a QR code is another way to read shared configuration; a successful scan doesn’t turn it into an updatable subscription group.

v2rayN: Add a URL to a Subscription Group

In v2rayN, open the “Subscription Groups” menu and go to “Subscription Group Settings.” Add a group, enter an alias and subscription URL, then save and update that group. For the first update, use an option that doesn’t rely on the proxy. Return to the server list, switch to the group, and select a server. Use “Set as active server” in the right-click menu, or the equivalent option in your version. To add an individual server link, use the clipboard import option in the “Servers” menu; you don’t need to create an empty subscription group.

If the list is still empty after updating, copy the full URL again and check for extra spaces, line breaks, or missing query parameters. Then check whether the provider says the subscription has expired, been disabled, or moved to a new URL. If you see a certificate error, check the device date instead of disabling certificate verification. You haven’t reached proxy mode settings yet, so repeatedly switching to global mode usually won’t fix a subscription parsing error. Once a server appears and you’ve selected it, continue to the next step.

02 Choose How Traffic Enters and Is Routed

“Does traffic enter the client?” and “Which outbound route does it use?” are separate questions. On Android, VPN mode controls the first; on desktop, the system proxy does. Bypassing LAN, rule-based routing, and global routing control the second. Selecting a server alone doesn’t send traffic from every app through the proxy. Likewise, global routing can’t take over a desktop app that ignores the system proxy. For your first setup, keep things simple and check the traffic entry point and routing mode once each.

v2rayNG: Keep VPN Mode and Leave App Filtering Off

In v2rayNG settings, confirm that VPN mode is enabled, rather than a mode that only starts a local proxy port. For the first test, turn off “Per-app proxy.” Otherwise, a browser that isn’t included in the selected app list may connect directly, even when the client is connected. If you need to keep an app list, check whether “Proxy selected apps” or “Bypass selected apps” is enabled; they do opposite things. After changing these settings, you’ll usually need to stop and restart the connection for the new VPN configuration to take effect.

Next, open routing settings and choose an existing rule set labeled something like “Bypass LAN and mainland China addresses.” Names vary by version, so check the actual menu. The rule set is intended to send LAN and matching addresses direct while routing other traffic through the proxy. Before your first connection, don’t change domainStrategy, remote DNS, FakeDNS, and Mux all at once. Keep the server’s specified transport, TLS, and REALITY settings as they are; don’t treat them as performance switches.

v2rayN: Make Sure Your Browser Uses the System Proxy

In the v2rayN main window or tray menu, find “System Proxy” and choose “Set system proxy automatically” for the first test. “Clear system proxy” removes the system proxy setting made by the client; it doesn’t enable direct routing. “Do not change system proxy” may leave an earlier setting in place. Then use “Routing” to choose an existing rule set that bypasses LAN and mainland China addresses. If your browser has its own proxy extension, pause it or make sure it follows system settings to avoid conflicts between the two.

TUN can capture traffic from more apps that ignore the system proxy, but it may require administrator permissions, a virtual network adapter, and routing changes. It isn’t needed for your first browser test, so leave it off. Once the system proxy path passes the test, configure TUN separately if your apps require it. For more on client cores, traffic entry points, and routing rules, see the advanced configuration guide. After making these choices, leave the current mode as is; the next step is to connect and grant permission.

03 Start the Connection and Grant System Permission

Return to the main screen and check the selected server and group again. Updating a subscription may replace or remove old entries, so the previously selected server may no longer be valid. During testing, don’t run another VPN or traffic-routing tool at the same time. Multiple apps can compete for the system VPN, proxy port, or default route, making the connection look active while requests use a different configuration. Stop any other traffic-routing connections before starting the client you want to test.

v2rayNG: Allow the VPN Connection

Tap Connect on the main screen. The first time you start the client, Android displays a system “Connection request” explaining that the app wants to set up a VPN connection. Confirm the app name, then tap Allow or OK. If you deny the request, VPN mode can’t route device traffic through the client. After granting permission, check that the Connect button shows an active state and that the system displays a VPN icon or client notification. These indicators confirm that the VPN interface is up, but don’t prove that the remote server is reachable.

Keep the client running and switch to your browser to test. If the connection stops as soon as you leave the client, first check whether its ongoing notification is still visible, then see if battery management is limiting background activity. Change the relevant battery setting only if the client is actually being stopped in the background. You don’t need to change every system permission before your first test. If the client stops immediately after launch, check its log and focus on the first startup error; that’s more useful than repeatedly tapping Connect.

v2rayN: Check That the Core Started and System Proxy Is Enabled

After you set a server as active, v2rayN usually loads its configuration and starts the core. Whether it restarts automatically depends on the version and settings. Check the log for errors such as configuration parsing failures, a port already in use, or core startup failure, then make sure “System Proxy” is still set to automatic configuration. In some versions, selecting a server starts the local listener without enabling the system proxy, so the browser may still connect directly. Minimizing the window usually doesn’t exit the client; keep it running in the system tray during the test.

If you see an error like “Address already in use,” close any duplicate client instances and restart the client. Don’t force-quit unfamiliar system processes. If the connection times out, first make sure your network can open regular websites, then try another server in your subscription that you’re authorized to use. If only one server keeps failing, ask your provider to confirm its status and connection settings. Don’t disable TLS verification as a workaround.

At this point, the client should be running and the system traffic entry point should be ready. Don’t rely on the connection icon or a latency test alone. Use a real app request to test the entire connection path.

04 Test Access and Confirm the Outbound Route

Open a page that hasn’t been loaded yet, or close an old tab and revisit the destination. A page already open may be cached, and an existing connection may be reused, so it can’t reliably test a proxy setting you just changed. Choose a destination that should use the proxy under your current rules and that you’re authorized to access, then compare it with a regular destination that should connect directly. Loading the page is only the first check; use your routing settings and client logs to confirm it took the expected path.

Check the Browser, Then Review the Logs

In v2rayNG, keep the VPN running, visit a page in your browser, then return to the client and review the logs. In v2rayN, watch the log window directly. If the current log level records connections, look for the destination domain and the actual outbound tag. direct usually means a direct connection; the proxy outbound tag depends on the generated configuration and isn’t always called proxy. Lower log levels may not show individual requests, so not seeing a domain doesn’t by itself indicate a failure. There’s no need to keep the most detailed logging enabled.

You can also check your apparent public IP, but use a trustworthy lookup site and remember that your current routing rules may send it direct. Seeing one public IP doesn’t prove that every app is using the proxy. On Android, make sure per-app rules haven’t excluded the browser. On desktop, confirm that the browser actually follows the system proxy. If the browser passes but another app doesn’t, check that app’s proxy settings before changing your subscription.

If Access Fails, Troubleshoot in the Same Order

If a page that should use the proxy fails while regular pages load, first check the active server, then look in the logs for handshake, DNS resolution, or connection timeout errors. As a temporary comparison, switch to the client’s global proxy routing mode, reconnect, and test the same destination. If global routing works but the original rules don’t, focus on rule matching or DNS resolution. If global routing also fails, continue checking the server and network. Global routing is only a comparison tool; it won’t fix an incorrect server address, port, or authentication setting. Restore your original rule-based mode when you’re done.

If all pages fail, stop the client and check whether your regular network access returns. On desktop, choose “Clear system proxy” to remove the proxy setting made by the client, then exit the program so the system doesn’t keep pointing to a stopped local listener. If your device had a work or personal proxy configured beforehand, note its settings before testing and restore them afterward. On Android, stop the VPN from the client. Once regular network access is back, recheck the traffic entry point from step two; don’t redo every setting at once while offline.

Built-in TCPing or real-connection latency tests can help compare servers, but they aren’t the same as loading a page in a browser. A reachable port doesn’t confirm that TLS, transport settings, and the destination site are all working. A timeout may also be caused by the test destination. For a successful first setup, the client stays running, the target page loads as expected, direct destinations still work, and the results match your routing settings—not a particular latency figure.

Save a Minimal, Tested Configuration

Once everything works, note the group name, active server, routing option, and system proxy status on desktop. Before adjusting DNS, TUN, or per-app proxy settings, save this working configuration. Make one change at a time, then repeat the same access tests in this section. If the connection fails after a subscription update, first check whether the active server changed; there’s no need to immediately uninstall and reinstall the client. For details on routing, DNS, and managing multiple subscriptions, see advanced configuration. To review the initial setup, return to the subscription import steps and check each one.