Step 1: Import a Subscription and Populate the Configuration List
Before you begin, install and open the appropriate client: v2rayN for desktop or v2rayNG for Android. If you haven't installed it yet, choose a package for your platform on the client downloads page. The client reads configurations and forwards connections; it does not provide working servers by itself. You'll need a valid subscription URL from your service provider or a complete single-server share link. This guide uses a subscription URL, so there's no need to edit configuration files manually.
Subscription URLs are usually found in your service provider's account dashboard. They let the client fetch multiple configurations and refresh them later. Use the dashboard's Copy Subscription URL option. Don't mistake an account sign-in page, plan details, or a management page in your browser's address bar for a subscription URL. Check that the copied URL is complete, with no extra spaces, line breaks, or punctuation added by a chat app. A subscription URL may contain account credentials, so treat it like a password: don't post it publicly or include it in screenshots.
v2rayN: Add a Group, Then Update It
In the v2rayN main window, open Subscription Groups, then Subscription Group Settings, and add a group. Enter a recognizable source name in the remarks or name field, paste the full URL into the subscription URL field, and save. The group name is for local organization; the URL is what the client uses to fetch configurations. Return to the main window, select the group you created, and choose Update Subscription from the menu.
If the first-time setup offers options such as Update Subscription and Update Subscription via Proxy, start with the regular update that doesn't require a proxy. That way, the request won't depend on a connection you haven't established yet. Wait for the update to finish, check the result in the logs, and see whether configurations appear in the main list. If the list is still empty, switch to All or the relevant group to rule out filtering. Avoid adding duplicate groups, which can make it hard to tell which one is in use.
v2rayNG: Add a URL in Subscription Group Settings
On Android, open the v2rayNG main menu and go to Subscription Group Settings. Tap the add option, enter a remark and URL, then save. Return to the main screen and update the subscription from the menu. After a successful update, the imported configuration names should appear in the list. If the current group is empty, check the group filter and update notification first. Don't immediately edit the server address or port in a configuration; those settings are usually managed through the subscription.
A successful subscription update means the configurations were retrieved, not that every server can connect. If you see an invalid URL, download failure, or unrecognized response, copy the subscription URL for your client again from your provider's dashboard and check that your account is active and has data available. If it still fails, follow the subscription update troubleshooting guide to check your network and logs. Once configurations appear in the list, move to the next step; there's no need to test or edit every server yet.
Step 2: Choose a Proxy Mode and Routing Rules
With your configurations imported, decide which apps send requests to the client and how those requests are routed. These are separate layers: the system proxy or VPN determines how traffic enters the client, while routing rules determine where it goes. Selecting a configuration without setting a traffic entry point may leave your browser connecting directly. Conversely, traffic can enter the client but still be routed directly instead of through a remote server. Understanding the difference helps avoid trial and error with settings.
Start with Automatic System Proxy Configuration on Desktop
In the v2rayN main window or tray menu, open System Proxy and choose Automatic System Proxy Configuration. This points your system proxy to the client's local listening address, making it a good starting point for testing browsers and apps that follow system proxy settings. Keep the client running, and don't configure a different proxy in a browser extension. If you've used other networking tools, exit their proxy services first, then check that no manual proxy settings remain in your system.
The system proxy isn't a universal way to route traffic from every app. Some apps use their own network stack and may ignore system settings, so if a browser works but another app doesn't, that doesn't necessarily mean the server is at fault. Use a browser for your initial connection test, then troubleshoot individual apps once the basic connection works. Don't layer the system proxy, a browser proxy extension, and multiple virtual network tools just to make one app work; it makes the traffic path difficult to diagnose.
Choose a Routing Preset That Matches Your Needs
Choose an appropriate preset from the Routing menu, such as Bypass mainland China if it's available. This typically sends matching local resources directly while routing other requests according to the rules. The actual behavior depends on the rules in that version, not just the preset name. When diagnosing a page, temporarily using a more explicit proxy rule can help you compare results; restore your everyday preset after testing. Global routing only affects traffic that has already entered the client. It does not take over every app on your device.
On Android, v2rayNG mainly uses its VPN service to route traffic through the client. Check the routing options in Settings and start with a preset that fits your needs. Make sure per-app proxy settings haven't excluded the browser you're testing. Include and exclude modes work in opposite ways; if you're unsure, keep the defaults rather than selecting a long list of apps. For more on routing, see the routing and traffic-splitting glossary. You don't need to write rules to make your first connection.
TUN Mode: Consider It After Basic Connectivity Works
v2rayN's TUN mode uses a virtual network interface to capture traffic, which can help with apps that don't follow system proxy settings. It's not required for your first connection and won't fix an expired subscription or an unreachable server. Start with TUN off, test access through the system proxy, and enable it later if an app requires it. This makes it easier to tell whether a problem comes from the server or from changes to the virtual interface, routing, or DNS settings.
If you need TUN, save your work first and grant the permissions required by your operating system and client version. Some setups require administrator privileges or additional networking components. After enabling it, check the logs for errors such as interface creation failures, then test access again. Don't automatically enable both the system proxy and TUN; follow the client documentation to choose the right traffic-capture setup. For virtual adapter conflicts, DNS handling, or more advanced routing rules, see the troubleshooting guide. Keep this setup minimal until the connection works.
Step 3: Choose an Active Configuration and Connect
Your subscription and traffic entry point are ready. Now choose which configuration the client will use. Start with a server your provider marks as available and whose protocol is supported by your client. A region label only indicates the server's location, not connection quality; latency and speed tests are just snapshots. You don't need to test every server in the subscription during initial setup. Choose one and test access first to make problems easier to diagnose.
v2rayN: Set the Active Server and Check Core Status
Select a configuration in the main list, then use Set as Active Server in the right-click menu, or the equivalent option in your version. Highlighting a row doesn't always make it the active configuration, so check for an active marker or status message. The client will usually load the configuration and start or restart the core. Confirm that the system proxy still shows Automatic System Proxy Configuration and that the routing preset is unchanged, then check the latest entries in the logs.
v2rayN may not have a prominent Connect button like v2rayNG. On desktop, the active configuration, running core, and traffic entry point together determine whether you're connected. Once the startup logs show no obvious errors, test a web page; there's no need to wait for a generic Connected label. If the logs immediately report that a local port is in use, check for duplicate client processes or another proxy tool using the same listening port. Don't leave the conflict running while repeatedly switching servers.
v2rayNG: Start the Service and Approve the System Request
Select the configuration you want in the Android list and make sure the active marker moves to that entry, then tap Connect on the main screen. The first time you connect, Android will show a VPN connection request. Confirm it after checking that it came from the current client. Android's VPN is a traffic-capture interface; its presence doesn't prove the remote connection works. If Android says another VPN service is running, decide which one to keep and stop the other to avoid competing for the same entry point.
After approving the request, check the client's running status and Android's VPN indicator before testing access. If the connection stops immediately after you tap Connect, open the logs and note when the error occurred and its key wording. For configuration parsing errors, try updating the subscription or client first. For timeouts, check the network and server. For TLS errors, check the system time, hostname, and subscription settings. Don't bypass certificate verification just to hide an error; that can conceal the underlying configuration problem.
When Something Fails, Change One Thing at a Time
If your first attempt fails, keep the proxy mode and routing settings unchanged. Switch to another server in the same subscription that's explicitly marked as available, then test again. If several servers fail on the same network, switch networks and retest, noting whether the error changes. This helps isolate whether the issue is a particular server, your current network, or the client's traffic entry point. Changing the server, core, DNS, and routing all at once makes it difficult to know which change helped, even if access returns.
When asking for help, include the client name, operating system, step you reached, and key error text from the logs. Before sharing, hide your subscription URL, account details, server addresses, and identifiers. Don't post a full configuration publicly. Check the FAQ for common messages, or use the complete troubleshooting guide to work through an issue by symptom. Once the service stays running, continue to the final access test.
Step 4: Test Access and Restore Your Network When Done
A changed button color, tray icon, or VPN indicator only shows that the client is in a particular state; none proves by itself that web requests are being routed as expected. Test real access instead: can the target page load, do resources expected to connect directly still work, and does traffic follow the routing rules? Use the same configuration and settings you just tested, then add personal adjustments one at a time.
Test in a Browser First, Then Check Other Apps
Reopen your browser and visit an HTTPS page that should use the proxy. Load content you haven't opened before so you don't mistake a cached page for a working connection. Then visit a familiar page that should connect directly and confirm your regular network still works. If the browser has a proxy extension or separate proxy setting, disable it for this test so traffic uses only the system settings. On Android, also make sure the browser isn't excluded by per-app routing rules.
Watch the client logs or connection records while testing. If your version shows connection details, check the target domain, matched rule, or exit label. If it only provides basic logs, there's no need to leave verbose logging on just to find a success message. A lack of access details in the ordinary logs doesn't prove that requests bypassed the client. The best confirmation is that pages load, routing behaves as expected, and the service runs without persistent errors.
If no pages load, first confirm the client is still running and that the system proxy or Android VPN service is enabled. If only one page fails, check the routing rules and domain resolution. One website's result doesn't reflect the state of your entire connection, and repeatedly refreshing isn't a substitute for troubleshooting. If the browser works but another app doesn't, check the traffic entry point and per-app settings rather than reinstalling the client. For more complex DNS or timeout issues, see the systematic troubleshooting guide.
Stop the Service Properly to Avoid a Stale Proxy
When you're done on desktop, choose Clear System Proxy in v2rayN, then exit the client. If you're using TUN, stop that mode first as well. Some versions clear settings automatically on exit, but it's worth checking manually the first time. If regular web pages stop working after the client exits unexpectedly, open your system's proxy settings and check for a leftover manual proxy pointing to a local address. Reopening the client and clearing the system proxy is often more useful than importing the subscription again.
On Android, tap Disconnect and make sure the system VPN has stopped, then test a regular web page. Clearing the app from the background isn't the same as stopping its service normally; device background policies can also cause brief differences in status. If the connection only drops often when the screen is locked, check the app's battery and background activity restrictions and adjust them as needed. Don't change every battery-saving setting right away.
Keep Working Settings and Plan Routine Updates
After testing, note the working subscription group, active configuration, proxy entry point, and routing preset. When servers change, update the subscription first. Then check that the active configuration still exists so the client isn't pointing to a removed entry. Updating the client and updating the subscription are different: the first updates software features and compatibility, while the second refreshes the configurations from your provider. You don't need to reinstall the client before every connection.
Your basic setup is complete: the subscription updates, a configuration can be activated, the traffic entry point is clear, web access behaves as expected, and your regular network works again after stopping the service. For protocol settings, see the glossary. For a specific error, visit the FAQ or the troubleshooting guide. Keep this working setup, then try more precise routing or TUN one change at a time, repeating the access test after each change.