V2Ray Client
FAQ

V2Ray is part of the Project V proxy ecosystem, with V2Fly continuing development of its core. Xray is another core implementation in the same ecosystem. v2rayN is a graphical client for managing servers, subscriptions and routing, and for launching the core. An open interface does not mean the core is running correctly, so check core logs before troubleshooting a connection. When choosing a protocol, verify that the active core supports its transport and security settings; the client name alone is not enough.

For Windows, macOS and Linux, start with v2rayN. On Android, consider v2rayNG, which uses the Xray core; choose v2flyNG if you need compatibility with V2Fly configurations. Base your choice on the operating system, processor architecture and server configuration—not on a similar-looking interface. Subscription fields may be interpreted differently across clients. After switching, check the protocol, transport, TLS and routing settings, and avoid reusing the old local configuration directory as-is.

A subscription URL typically points to a set of configurations that you fetch by updating the subscription. Share links often start with vmess://, vless:// or trojan:// and usually describe a single server. Native JSON may contain a full configuration, including inbounds, outbounds, DNS and routing. These formats use different import options. Identify the format first, then use a subscription group, clipboard import or config-file import as appropriate. Don’t enter a subscription URL as a server address.

The system proxy sends traffic from apps that honor system proxy settings to a local proxy port. Routing determines whether connections already reaching the core go through direct, proxy or block. TUN captures traffic through a virtual network interface, with coverage depending on the platform and configuration. These settings work at different stages. If browser traffic never reaches the client, changing geosite rules usually won’t help. If traffic reaches the client but takes the wrong outbound route, check rule order instead of repeatedly toggling the system proxy.

VLESS and Trojan are proxy protocols; REALITY is a connection security mechanism. They are not three mutually exclusive options at the same level. The configuration must match the server’s protocol, transport and security settings. With REALITY, also verify parameters such as the public key, serverName and shortId. Don’t change protocols based on the name alone or convert an existing TLS configuration directly to REALITY. Import the provider’s complete link first, then check what your client and core support.

Most mainstream Android phones released after 2015 are likely to support arm64, but release date alone doesn’t confirm the architecture. Check the device’s system information and the app’s requirements. A universal package supports multiple architectures and can be worth trying if you’re unsure, though it’s usually larger. If installation fails, also check the minimum OS version, available storage and whether the existing app has a conflicting signature. Architecture isn’t the only possible cause. Back up any configuration you still need before uninstalling the old app.

The desktop edition uses a newer cross-platform interface, while the classic WPF edition uses a Windows desktop interface. Menus and some configuration options may be in different places. Windows users can choose based on their workflow and compatibility needs; there’s no need to run both editions at once. Before migrating, export your server and routing settings, then import them into the new edition and check the local ports. Don’t overwrite the old directory with new-edition data files or let both instances compete for the same proxy port.

Make sure you copied the complete subscription URL, with no leading or trailing spaces, line breaks or punctuation added by a chat app. In v2rayN, add the URL to a subscription group, then run Update Subscription; saving the group alone won’t populate the server list. If the format is unsupported, check whether the response is actually a login page, error page or subscription format the client can’t read. Import share links through the appropriate clipboard option. Don’t try to fix an expired URL by changing its encoding.

Desktop TUN creates or manages a virtual network interface and may require administrator privileges, service installation or system authorization, depending on the client version and OS. Android clients use the system VPN permission to capture traffic; approve the request in the system confirmation dialog. If it still fails, check interface-creation logs and make sure another VPN app isn’t using the interface. Test the regular system proxy first, then enable TUN to distinguish server configuration issues from interface permission problems.

On macOS, check About This Mac to see whether you have Apple Silicon or Intel, then choose the corresponding arm64 or x64 download. On Linux, check both the processor architecture and package format: Debian- and Ubuntu-based systems generally use deb packages, while Fedora and similar distributions generally use rpm. Then choose x64 or arm64. If the app won’t launch after installation, check system dependencies and app logs. Renaming a package extension won’t make a package work across architectures or package managers.

If you want websites in mainland China to connect directly and other traffic to follow routing rules, start with a Bypass Mainland China rule set. Global mode can help test whether routing rules are causing an issue, but check how the active rules handle traffic such as private addresses. After switching modes, confirm the configuration has reloaded and test the same site again. Global mode doesn’t mean every app is using the proxy: apps that ignore system proxy settings may still connect directly. Check the app’s proxy settings or TUN capture first.

If your current network can reach the subscription service directly, use Update Subscription (Direct). If direct access fails and you already have a working proxy, try updating through the proxy. These options change the network path used to fetch the subscription; they won’t fix an expired URL or an error response from the server. Before switching, note the specific error in the logs, such as a resolution failure, connection timeout or HTTP status code. Avoid repeated rapid refreshes, which may trigger the subscription service’s rate limits.

In routing settings, add a domain match and choose the direct outbound. For example, domain:example.com matches the domain and its subdomains, while full:example.com matches only the exact domain. Xray routing usually checks rules from top to bottom, so put specific exceptions above broader rules that might match first. Save and reload the configuration, close existing connections, then revisit the site and check the outbound tag in the access log. Don’t rely only on whether a page loads to confirm a rule matched, and don’t confuse the system proxy bypass list with the core routing table.

Start by transferring the subscription URL or a configuration exported by the client, then check the current servers, routing rules and DNS settings. System proxy, TUN permissions, startup behavior, local ports and per-app routing depend on the device, so verify them again on the new one. Full backups aren’t necessarily compatible across clients; importing a share link doesn’t mean a client can read another app’s database. Backups may contain server credentials and private subscription URLs. Store them securely and delete temporary copies after migration.

If the system still points to a local proxy port that closed when the client exited, the browser will keep trying to connect to it. In v2rayN, clear the system proxy before exiting normally. If you used TUN, also confirm that the virtual interface and related routes have been restored. If the client is already closed, check for a manual proxy in your system network settings. Don’t clear proxy settings managed by other software or your organization. Once restored, restart the browser and test both your local network and a regular website.

First, check what the test actually measures. A successful TCP connection only means the target port is reachable; it doesn’t confirm a protocol handshake or successful web request. A timeout in one test alone doesn’t prove the server is down. Check the server address, port, system clock and current network, then verify the protocol, transport and security settings. Logs can show whether the issue is a resolution failure, connection refusal or handshake error. If needed, compare results on another network. Change one setting at a time and keep the original configuration so you can identify the cause.

Connected usually means only that the local service or VPN interface has started—not that the remote connection works. First, check the core logs for a successful startup. Then confirm the app is using the system proxy or VPN, and watch for request entries when you open a site. No entries? Check how traffic reaches the client. Entries with errors? Check the server handshake, DNS and routing. Test with one browser and one website, and temporarily disable extensions that might change proxy settings or override the system configuration.

In the status bar, select Set system proxy automatically, then confirm the core started successfully and the local listening port isn’t in use. Open your system network proxy settings and check that the address and port point to the current instance. If the values change back shortly afterward, check for other proxy software, browser extensions or device management policies. Some apps ignore the system proxy and need their own proxy settings or TUN. Repeatedly changing routing modes won’t help if the app’s traffic never reaches the client.

Keep your existing working configuration and note the update error first. Then check whether the URL has expired, the device clock is correct, the domain resolves and your current network can reach the subscription service. For HTTP 401 or 403 errors, check authorization and service status first; for timeouts, focus on the network path. If the request succeeds but the content can’t be parsed, check its format. If you have a working server, compare direct and proxy updates. Don’t share the full subscription URL or assume an empty old list means you need to reinstall the client.

On the same network and in the same browser, compare a working site with an affected one. Then check the affected domain’s resolution errors and routing logs. If temporarily switching to a global rule fixes the issue, check for a direct or block rule matching earlier. If the logs show a domain resolution failure, check whether the client’s DNS settings, browser secure DNS and TUN DNS capture are interfering with each other. Change one setting at a time, clear the cache, start a new connection and test again. If a page loads but some content doesn’t, check the resource domains too—not just the main domain in the address bar.