Before you begin: Choose a client for your platform on the download page, install it, and open the main screen. You’ll also need a valid subscription URL that you’re authorized to use. The client reads the configuration and forwards traffic; it does not provide servers. For your first setup, keep the default listening port and close any other proxy or VPN apps that might alter network settings.
Privacy: A subscription URL may contain access credentials, so treat it as more than an ordinary web link. Paste it directly into the client; don’t share it in public screenshots, group chats, or online parsing tools. When troubleshooting, record only the error type and necessary settings. Before sharing a screenshot, hide the subscription URL, server addresses, and account details. If you already have a working setup, keep the existing group and create a separate test group so you can revert easily.
01 Import a subscription: Get servers to appear in the list
Check the URL: Copy the full subscription URL from your configuration provider. Make sure you haven’t included surrounding instructions, quotation marks, or line breaks. A subscription URL and a single-server share link are different: use the former in a subscription group; the latter is usually added through the clipboard import feature. Don’t identify the link by its length—follow the provider’s instructions. If you only have a single configuration, import it and continue with the mode and connection steps.
In v2rayN: Open the Subscription Group menu at the top and choose Subscription Group Settings. Create a group, enter a recognizable source name in the remarks or name field, paste the URL into the subscription URL field, and save. Return to the main screen, find the subscription update command, and run it. Some versions let you update the current group or all groups; for the first update, choose the new group so it’s easier to check the result. If menu names change between versions, look for the equivalent group management and update options.
In v2rayNG: Open the main-screen menu and choose Subscription Group Settings. Tap the add option, enter a note and subscription URL, then save. Return to the server list and use the menu to select Update Subscription or a similarly named command. Saving the URL alone doesn’t import the subscription—you must update it for the client to read its contents. If the interface offers group filters, switch to the new group so you don’t mistake existing entries for the update results.
Check the result: After the update, the server list should show selectable entries. Check that the remarks, protocol, and group match your expectations, then choose one server for the first test. Entries in the list mean the configuration was parsed; they don’t guarantee that the server is reachable or that system traffic is using the client. There’s no need to switch repeatedly between servers or change transport settings yet. Keep one test server selected to make troubleshooting easier.
Update failed? If the list is still empty, check whether the update failed to connect, the response couldn’t be parsed, or the subscription has expired. If this is your first setup and you don’t yet have a working proxy, enabling “Use proxy to update subscriptions” may rely on a connection that isn’t available yet. If you already have a working connection, you can update through it if needed. Try one approach at a time; don’t change the URL and the setting together. For more help, see Why subscription updates fail and what settings to check.
Before continuing: Once the subscription group contains entries, stop retrying the update. Select the server you plan to use and note its remarks, but don’t confuse a highlighted row with the active server; on desktop, you may need to choose Set as Active Server. Next, decide how apps will send requests to the client, then determine how those requests should be routed.
02 Choose a proxy mode: Entry points vs. routing
Know the difference: The proxy entry point determines how app traffic reaches the client; routing rules determine which outbound handles it. System proxy, TUN, and Android VPN mode are ways to capture traffic. Bypass China and global proxy usually describe where traffic goes. Enabling the system proxy doesn’t mean every app will follow it, and global routing can’t proxy traffic that never enters the client. Keep these two layers separate during initial setup.
v2rayN entry point: Find System Proxy in the main window or tray menu and locate Set system proxy automatically. Note where it is, but wait until you’ve confirmed the core is running before enabling it. This option points system-supported proxy settings to the client’s local listening address, making it a good starting point for testing in a browser. Leave TUN off for now to avoid adding a virtual network adapter, administrator permissions, and extra DNS settings to your first test. Configure TUN separately after the basic connection works.
v2rayNG entry point: Open Settings and check the operating mode. In most cases, choose VPN mode so the client can capture traffic through Android’s virtual network interface. In local-proxy-only mode, other apps won’t connect automatically unless they’re configured to use the proxy. For your first test, don’t set up complex per-app rules. If you already have them, check that the test browser is included; otherwise, the connection may appear active while the browser traffic bypasses the client.
Start with routing: Find the routing settings and use the built-in Bypass China option, or its equivalent, leaving the other options at their defaults. This mode typically sends requests matching mainland China rules directly and routes other traffic according to the configuration. The actual behavior depends on the current rules. Direct connection doesn’t mean the connection failed: under split routing, some sites are expected to connect directly. Android may use different rule names, so read the on-screen descriptions before choosing.
Test global routing: If you later need to check whether split routing is causing a problem, briefly switch to global proxy and test the same page again. “Global” applies only to traffic entering the client; LAN access and other exclusions may still follow separate rules. Restore the original routing mode after the test to avoid proxying traffic that should connect directly. Don’t switch to global routing, enable TUN, and change DNS all at once—you won’t be able to compare the results.
Before continuing: You should now have a simple setup in mind: system proxy on desktop, VPN mode on Android, and the built-in split-routing rules. If any terms are unclear, start with the glossary. Save routing priorities, DNS, and full TUN configuration for the routing section in the advanced guide. Next, start just one client with one active server.
03 Connect: Check the core and system status
Set the active server in v2rayN: Find the server you chose and use Set as Active Server in the right-click menu, or the equivalent option in your version. Some versions reload the core automatically when you change the active server, so there may not be a separate Connect button. Check the status bar or logs to confirm which server is in use and whether the core started. Then choose Set system proxy automatically from the System Proxy menu. A highlighted row alone doesn’t confirm that the core is using that configuration.
Check desktop status: The logs shouldn’t repeatedly report configuration parsing or port binding errors. If the local listening port is already in use, close other proxy apps or duplicate client instances, then reload the configuration; don’t change the server address first. If the system requests firewall access, check which app and network the prompt refers to—don’t disable the firewall entirely. If the system proxy is enabled but the core isn’t running properly, the browser may temporarily lose access. Clear the system proxy before troubleshooting further.
Connect in v2rayNG: Tap the server you want to use on the main screen to select it, then tap Connect. The first time, Android will show a VPN connection request; verify the app name and allow it. Return to the client and check that the status changes to running. Look for the VPN indicator in the system status area as well. This permission creates a local traffic tunnel; it isn’t a subscription account login. Until you allow the request, app traffic can’t reach the client this way, even if the server list is populated.
Android connection conflicts: If the connection stops immediately after you tap Connect, check whether another VPN service is running or a different always-on VPN is enabled in system settings. Battery restrictions can also affect background operation, but keep the client in the foreground for the first test and confirm that the connection works before adjusting background settings. Don’t grant every background permission at the outset; change the relevant system setting only if you see a specific issue, such as disconnections when the app is in the background.
Use logs to troubleshoot: A successful core startup and a successful connection to the remote server are two different things. If the connection times out, check the active server, subscription validity, and local network first. For certificate or handshake errors, check the system clock and verify the server name required by your configuration provider. Don’t disable certificate verification to hide an error or guess at protocol fields. If the error persists, follow the node timeout troubleshooting steps.
Before continuing: Keep the client running and avoid opening a lot of apps at once. A connection icon, Android VPN indicator, or core startup message proves only that one part has started—not that the request is reaching its destination as expected. Next, send one easy-to-identify request from a browser and compare the page result with the client’s records.
04 Verify the connection: Check the page and request path
Test in a browser: Open a new browser window and visit a known-working HTTPS page with easy-to-recognize content. Refresh once if needed. On desktop, start with a browser that follows the system proxy. If a browser extension manages proxy settings separately, disable its proxy feature temporarily or confirm that it uses the system settings. Existing tabs may reuse old connections or show cached content, so a page that was already open isn’t proof that this setup works.
Compare the records: While testing the page, check the client’s connection records or logs for the matching domain and routing result. The information shown varies by version; some clients require you to enable access logging in Settings. Enable it temporarily only if needed for troubleshooting, then turn it off. A matching request in the logs confirms that traffic reached the client. If the logs also show whether it used a proxy or direct connection, you can check whether the routing rules behaved as expected. Remove personal browsing details and configuration identifiers before sharing logs.
Check split routing: With Bypass China enabled, some pages may still show your original network address because the rules send them directly. If you use an IP lookup site to check, first confirm which route the lookup site itself uses. The address shown by one site can’t represent every app’s traffic path. For a more reliable comparison, keep the test destination the same, change one routing option, and compare the records—not just a status icon.
Troubleshoot by layer: If the client shows no matching request during the test, check the system proxy, browser-specific proxy settings, or Android per-app rules first. If there is a record but the request times out, check the active server and remote connection. If the request connects but domain resolution fails, review DNS-related messages. This order helps separate entry-point issues from server problems. For common issues, see the FAQ. For DNS changes, move on to the advanced guide rather than layering complex settings onto the initial setup.
Everyday use: Once the test succeeds, keep the working group, active server, and routing settings, then check other apps one at a time. Some desktop apps don’t follow the system proxy, so a browser may work while another app doesn’t. That doesn’t mean the subscription import failed. If you need to capture more traffic, learn how to configure TUN separately; on Android, check per-app rules first. Repeat this minimal test whenever you change servers or update the subscription.
Disconnect and clean up: Before stopping or exiting v2rayN, choose Clear system proxy from the System Proxy menu and confirm that the browser works over your original network. Then exit the client. Closing the window may only minimize it to the tray, so check the tray to see if it’s still running. On Android, tap Disconnect in v2rayNG and confirm that the system VPN indicator disappears. If pages stop loading after you exit, check for leftover system proxy settings before deleting your configuration or reinstalling the client.