v2rayNG can route selected Android apps through the active proxy while letting other apps use the ordinary network. The key setting is often called Per-app proxy, with a Bypass mode option that reverses what your app selections mean. This guide explains both modes, shows how to apply and test a selection, and covers the Android VPN and battery settings that can make the result look inconsistent. Menu wording and layout can vary between v2rayNG releases, so use the setting names as landmarks rather than relying on a particular screenshot.
Use proxy-only mode when only selected apps should use the proxy; use bypass mode when most apps should use it and a few should connect directly. Open v2rayNG’s settings, enable per-app proxy, choose apps from the installed-app list, connect to a working node, and test one selected and one unselected app. If the behavior does not match the selection, check the mode, Android’s always-on VPN and lockdown options, the active VPN connection, and app-specific network settings.
1. What per-app proxy controls
On Android, v2rayNG normally creates a VPN connection using the Android VpnService interface. This does not mean it becomes a commercial VPN provider or that every app must use the same remote route. The client can decide which apps’ network traffic enters its VPN connection. Once traffic is captured, the active configuration and routing rules determine whether it goes to a proxy outbound, a direct outbound, or another configured route.
Per-app proxy is an app-level selection, not a website list. Selecting a browser does not mean “proxy only these domains in this browser”; it means the browser’s network traffic is included or excluded according to the chosen mode. Domain routing, such as sending one domain through a proxy and another directly, is a separate rule layer. If you need both kinds of control, first confirm that app selection works, then configure domain or IP routing in the client’s supported settings.
Keep these layers separate when diagnosing a problem. If an app never appears in v2rayNG’s log or connection activity, check whether it is included in the VPN selection. If its traffic reaches the client but fails at the remote connection, check the node, protocol parameters, DNS, and routing rules. A working subscription alone does not prove that every app is being routed as intended.
2. Choose proxy-only mode or bypass mode
The important question is whether the selected list means “send these apps through the proxy” or “exclude these apps from the proxy.” In proxy-only mode, selected apps are routed through v2rayNG and unselected apps normally use the regular network. In bypass mode, selected apps are excluded from the VPN path and the remaining apps are routed through it. The labels can be easy to misread because enabling bypass reverses the practical effect of the list.
Select the apps that should use the proxy. Other apps are left outside v2rayNG’s per-app VPN route, subject to Android’s VPN and lockdown settings.
Best for: a short list of apps that need a proxy
Select apps to leave out of the proxy. Apps not selected remain included in the VPN route, so review the list carefully before connecting.
Best for: proxying most apps while excluding a few
For example, if you want one browser and one messaging app to use the proxy, proxy-only mode is usually easier to audit: select those two apps and leave bypass disabled. If you want nearly all apps proxied except a local banking or home-network app, bypass mode may be more convenient: select the apps that should connect directly. The actual result still depends on whether Android permits excluded apps to use the normal network.
Android’s Always-on VPN and Block connections without VPN options are system-level controls. The latter is sometimes called lockdown. If lockdown is enabled, apps that are outside the VPN can be prevented from connecting rather than allowed to go direct. Do not interpret that outcome as proof that v2rayNG ignored the per-app setting: Android may be enforcing the system-wide block. For a clean test, temporarily turn off lockdown in Android’s VPN settings, then reconnect and compare the selected and unselected apps.
Conclusion: decide what the list represents before selecting apps
If you have only a few apps to proxy, begin with proxy-only mode. It makes the selection easier to review and reduces the chance of routing an unintended app. Use bypass mode when the majority should be proxied and you have a clear, limited exclusion list.
3. Set up the app selection in v2rayNG
Before changing app rules, confirm that v2rayNG can connect to the current node in its ordinary VPN mode. A broken node can make both selected and unselected test apps fail, obscuring whether per-app routing is working. If you have several proxy clients installed, disconnect the other VPN first: Android generally allows only one active VPN service at a time. Also note the current mode and selected apps so you can restore the original setup if needed.
-
Open settings
Open v2rayNG and tap its menu button, which may appear as a three-line or three-dot icon. Choose Settings, then find Per-app proxy or the similarly named app-selection setting. The exact menu arrangement can differ by release.
-
Enable app rules
Turn on the per-app proxy option. If the app-selection list is not available until the option is enabled, return to the settings page after enabling it. Do not confuse this setting with Android’s system-wide Always-on VPN switch.
-
Choose a mode
Leave Bypass mode off to use proxy-only behavior: checked apps use the proxy. Turn it on only when the checked apps should be excluded and the other apps should use the VPN route. Read any confirmation text in the installed release before applying the change.
-
Select installed apps
Open the app list and select one or two apps for the first test. Use the displayed app names and icons to distinguish similar apps. If an app was installed after you opened the list, refresh or reopen the list so v2rayNG can display the current installed-app set.
-
Reconnect and verify
Save or leave the settings page, return to the main screen, select a known-working node, and start the VPN connection. If the client was already connected when you changed the rule, disconnect and reconnect so the new app selection is applied to a fresh VPN session.
On recent Android versions, the first connection may display a system confirmation asking permission to set up a VPN. Approve the request only for the client you intend to use. If Android reports that another VPN is already active, disconnect that service before retrying. A key or VPN status indicator confirms that Android has an active VPN interface; it does not by itself prove that the selected app reached the destination through a working proxy.
4. Test both sides of the selection
Use one app that is selected and one that is not selected. Keep the test simple: open the same kind of public HTTPS page in each app, or use a network feature that reliably makes a new request. Record which app was selected, whether bypass was enabled, whether v2rayNG showed an active connection, and the time of each test. Avoid changing the node, mode, and app list at the same time; otherwise, a changed result will not tell you which change mattered.
- Proxy-only test: Select a browser, leave bypass disabled, and reconnect. The selected browser should use the proxy route. An unselected app should normally use the regular network, unless Android lockdown blocks traffic outside the VPN.
- Bypass test: Enable bypass and select the app that should connect directly. Reconnect. That selected app should be excluded from the VPN route; an unselected app should remain included.
- Compare the public exit: If you use a public IP-check page, open it in both apps and compare the reported address with the direct connection and the active proxy connection. Do not treat the IP result alone as a complete DNS or privacy test.
- Check client activity: Where the installed v2rayNG release provides connection or log details, generate a fresh request in the test app and look for activity at that time. No matching activity can indicate that the app did not enter the client’s VPN path; activity followed by an error points toward the node or routing layer.
Some apps reuse existing connections, cache pages, or use multiple network processes. Force-close and reopen the test app after changing modes, then make a new request. A cached page can appear to work without proving that a new connection used the intended route. For a more controlled test, compare two apps that are known to make a fresh HTTPS request, and repeat the check after disconnecting and reconnecting v2rayNG.
App selection applies to traffic generated by the selected Android package. It does not necessarily cover a separate helper app, browser engine, download manager, or another package that performs a task on its behalf. If one function in an app follows the rule but another does not, identify which installed app actually generates the network request before changing the selection.
5. Troubleshoot rules that do not apply
When the result contradicts the selection, first verify the mode and the list rather than editing node parameters. A single enabled bypass checkbox reverses the meaning of selected apps. Then check that v2rayNG is the active Android VPN, the connection was restarted after the change, and no Android lockdown setting is blocking apps that should go direct. Work through one item at a time and repeat the two-app test.
Selected app still connects directly
Likely cause and fix: Bypass mode may be enabled, which excludes selected apps instead of proxying them. Turn bypass off for proxy-only behavior, confirm the app remains selected, then disconnect and reconnect v2rayNG before testing again.
Unselected app has no network access
Likely cause and fix: Android’s Block connections without VPN or lockdown option may prevent apps outside the VPN from connecting. Temporarily turn off lockdown in Android’s VPN settings, reconnect, and test the unselected app. Review the security consequences before leaving lockdown disabled.
No app can connect after selecting a node
Likely cause and fix: This may be a node, DNS, or VPN-service problem rather than an app-selection rule. Turn off per-app selection temporarily, connect to the same node, and test one app. If it still fails, check the node parameters and v2rayNG logs before rebuilding the selection.
The app I need is missing from the list
Likely cause and fix: The list may not have refreshed since the app was installed, or you may be looking at a differently named package. Reopen or refresh the list, check the installed app’s icon and name, and update v2rayNG if its release offers a relevant compatibility fix.
Battery management can also interrupt testing. Android manufacturers may restrict background activity differently, and an aggressive battery setting can stop the client or the test app after the screen turns off. If the rule works while the screen is on but stops later, check the device’s battery settings for v2rayNG, allow the client to run in the background where appropriate, and retest after a short screen-off period. Do not change unrelated network settings until you can reproduce the failure.
Finally, remember that app routing and domain routing solve different problems. If the selected app reaches v2rayNG but only certain sites fail, inspect the active node, DNS behavior, and core routing rules. A subscription may contain VMess or VLESS nodes with different transport and security parameters; changing the app list cannot correct a mismatch in those connection settings. Keep the app selection stable while testing one node or routing change at a time.