Before You Begin: Prepare the Client and Subscription
The client loads configuration, runs the proxy core, and routes traffic; the subscription provides server configurations. Installing the client does not automatically give you access to a server. Before you start, have a subscription link from a trusted source that is still valid, and make sure your current network can load regular web pages. If you have not installed the client yet, choose an installer for your operating system and processor architecture from the Download Center, then continue once installation is complete.
When you first open the client, keep the default settings. On desktop, do not run multiple proxy clients at the same time. On Android, disconnect any other VPN first to avoid conflicts over the system traffic route. Also check that your device’s date, time, and time zone are correct; significant clock differences can affect secure connections. Start with one subscription, one group, and one server. Once everything works, add other configurations so it is easier to identify what changed if a problem occurs.
Subscription links may contain personal access credentials, so paste them only into the client’s subscription URL field. Do not post the full link in public forums or share screenshots that expose the URL, user ID, or other personal details. This guide explains where to find the relevant controls and does not require you to reveal any of that information. For definitions of terms such as “subscription,” “node,” and “core,” see the glossary.
1. Import a Subscription and Update the List
First, identify what kind of link you have. A subscription URL is generally used to fetch and update a group of servers. Content beginning with vless://, vmess://, or trojan:// is usually a share link for a single server. The import options differ: add the former to a subscription group; use the import-from-clipboard option for the latter. Do not identify a link by its length alone, and do not copy surrounding instructions along with it.
v2rayN: Add a Subscription Group
Open Subscription Group from the top of the main window, go to Subscription Group Settings, and select Add. Enter a recognizable group name in Alias, then paste the full subscription URL into Address. Check for extra spaces or line breaks at either end, make sure the group is enabled, and save. The alias is just a local label; it does not change server settings and does not have to match the name used by the subscription provider.
After saving, return to the main window and update the current group from the Subscription Group menu. If you do not have a working proxy yet, choose the option to update without using a proxy. Use a proxy for the update only if your current network cannot reach the subscription service directly and you already have a working proxy. Wait for the update to finish, then select the group and check its server list. A successful result is a list of selectable configurations—not just a newly created, empty group.
v2rayNG: Save the Subscription, Then Update It
From the main screen menu, open Subscription Group Settings, tap Add, enter a remark and subscription URL, then save. Return to the main screen and select Update Subscription from the menu. If the app offers multiple update options, choose Update All Subscriptions for your first update. When it finishes, check the server list and group filter. Adding a subscription, updating the list, and connecting are three separate actions; saving the URL alone does not complete the last two.
If an update fails, read the error before trying again. A connection timeout usually means you should check whether your current network can reach the subscription service. If the response cannot be parsed, confirm that the URL returns subscription data supported by the client, rather than a login page or web instructions. An empty list may also mean the subscription has expired or the server returned no configurations. Do not keep adding duplicate groups; first check the URL and status of the existing group. Once the list has loaded, continue by choosing how to route traffic.
2. Choose a Proxy Mode and Routing
Keep two questions separate: which apps send traffic to the client, and which requests use a proxy server once they reach it. System proxy settings, VPN routing, and TUN mode mainly determine the first; routing rules determine the second. Choosing a “Global” routing preset does not automatically route traffic from every app through the client. For your first setup, keep things simple and avoid changing traffic routing, DNS, and custom rules at the same time.
v2rayN: Start by Testing Your Browser with the System Proxy
Find System Proxy at the bottom of the main window or in the system tray right-click menu, then select Set system proxy or an equivalent option. This registers a local proxy with the operating system. Only browsers and apps that follow the system proxy settings will use it. Clear system proxy removes this setting; it does not switch to another server. Do not change system proxy usually means the system setting is left as is, not that the proxy is enabled.
Start with a built-in routing preset and note its name; use its expected behavior when you test the connection. If the rules say a site should connect directly, an unchanged public IP is normal. To temporarily test the proxy route, you can choose a built-in preset that favors global proxying, then restore your usual rules. Global routing is still limited by which traffic the client captures and may be affected by special rules retained by the client.
Leave TUN disabled for your first connection. Consider using a virtual network adapter only after your browser works and you find that an app ignores the system proxy. TUN may require administrator privileges and changes to routing or DNS; it does not have to be enabled alongside the system proxy. For more on traffic capture and permissions, see How to Enable TUN Mode in v2rayN. There is no need to configure it all during your first setup.
v2rayNG: Check VPN Routing and Per-App Settings
v2rayNG typically routes traffic through the system VPN service, so you do not need to copy the desktop system proxy steps. For your first test, keep the default routing preset and check whether per-app proxying is enabled. If only selected apps are allowed through the proxy, make sure your test browser is included. If you use a bypass list, make sure the browser is not excluded. Disconnect any other active VPN first.
Once you have chosen how to route traffic, avoid changing modes repeatedly. Next, select a server and connect; this makes it easier to narrow down any issue to configuration or connection. To learn how routing by domain, IP, and outbound works, read the Protocols and Core Technical Reference after connecting successfully. This guide does not require you to write rules by hand.
3. Select a Server and Connect
Choose a server from the subscription group you just imported. Names, region labels, and test results in the list can help, but they do not guarantee how a server will perform when you browse. If you have no specific requirements, start with a commonly used server from the subscription. Do not edit the address, port, or user ID generated by the subscription; these must match the server configuration, and changing them at random will usually break the connection.
v2rayN: Set the Active Server and Check the Core
Select the target row in the server list and choose Set as active server, or the equivalent option, from the right-click menu. Some versions also let you double-click a server. Check the active-server indicator and status at the bottom of the window rather than relying on the selected row’s background color. After switching servers, the client usually reloads or starts the core. Then confirm that the system proxy is still set to automatic configuration.
Open the logs or the information area in the main window and look for clear errors such as configuration load failures, a listening port in use, or the core exiting. A running core means only that the local service has started; it does not mean the remote server is reachable. Some connections are not established until a browser sends a request. Keep the client running and proceed to the final access test rather than switching servers just because the logs do not yet show a remote connection.
v2rayNG: Connect and Allow the VPN Request
Tap a server entry to select it as the current configuration, then tap Connect on the main screen. On the first connection, the system will show a VPN connection request. Confirm that it comes from the client you are using, then allow it. If you denied or dismissed the request, the client cannot route traffic even if a server is selected. Tap Connect again and follow the system prompt to grant permission.
After connecting, check the client’s connection status and the system VPN indicator, then review the logs for startup errors. The system indicator only confirms that the VPN service is running; it does not prove that the server is reachable. If the connection drops immediately after you grant permission, check the logs and make sure another VPN service is not competing for the connection. Check background-running and battery restrictions only if the connection later drops when the screen locks or the system stops the background service.
Keep protocol fields consistent: With VLESS and REALITY, settings such as PublicKey, ShortId, SNI, fingerprint, and flow control must match the server requirements. Do not fill in a blank field just because it looks incomplete; whether it is required depends on the actual configuration. If you have questions about the subscription, check with the configuration provider instead of guessing at values.
If the logs clearly report an unsupported configuration, first check whether your client and core support that protocol combination, then consider updating the client. The same protocol name does not mean every implementation supports the same features. For differences between V2Fly and Xray, see the technical reference. To get started, you only need to confirm that the current configuration loads successfully.
4. Verify the Connection and Keep Your Settings
Once connected, open a new browser tab and visit an HTTPS site that you expect to access through the proxy. First check that the page loads fully, then try another page so a cached result is not mistaken for a successful connection. Keep the same server and routing preset during the test. Do not change DNS, enable TUN, or switch networks at the same time, or you will not know which setting affected the result.
Use Access Results and Connection Logs to Diagnose Issues
Return to the client and check the logs or connection records from the test. If your version shows matched rules and outbound details, check whether the request reached the client, matched the expected rule, and was routed through the proxy or directly. The amount of detail varies by version. A missing domain in the logs does not by itself prove that traffic never reached the client; consider the page result, error messages, and current routing settings together.
If needed, use a trusted public IP lookup site to compare your exit IP before and after connecting. First make sure the lookup site itself uses the proxy under your current rules; otherwise, an unchanged IP does not prove the connection failed. Conversely, a different IP on one page does not prove that every app is using the proxy. Desktop browsers may have their own proxy extensions, and Android may have per-app restrictions, so test the apps you actually need as well.
If Something Goes Wrong, Troubleshoot in Order
- Check the subscription first: Make sure the server is in a group that updated successfully, the subscription is still valid, and the server is not hidden by a group filter. If the update failed, resolve the configuration-fetch issue first.
- Then check the server: Keep the traffic routing mode unchanged and switch to another server in the same subscription. If only one server fails, check that server’s status and configuration first.
- Next, check traffic routing: On desktop, check the system proxy; on Android, check the VPN status and per-app scope. If the browser works but another app does not, first confirm that the app supports the current routing method.
- Finally, check DNS and the destination: If the logs report a DNS resolution failure, check your network and DNS settings. If only one site has a problem, check the site’s status and routing rules. Do not jump straight to reinstalling the client.
Connection timeouts, handshake failures, and authentication failures have different causes. For a timeout, check the network path and server reachability. For a handshake failure, review the security layer, system time, and related fields. For an authentication failure, confirm that the configuration is still valid. Note when the error occurred and what you were doing. Share only the necessary log entries, with subscription URLs and personal fields removed. For in-depth protocol troubleshooting, see the technical reference rather than changing settings at random during your first connection.
Once Connected, Make Changes One at a Time
After confirming that your browser and target apps work as expected, note the subscription group, active server, traffic routing mode, and routing preset in use. Change one setting at a time and retest with the same pages. Updating a subscription refreshes the configuration; it does not fix every network issue automatically. Before changing modes, determine whether the app is not being routed through the client or whether its traffic reaches the client but takes the wrong outbound route.
When you are done, clear the system proxy in the desktop client before exiting, so the system does not keep pointing to a stopped local proxy. On Android, disconnect the VPN using the client’s Disconnect button. If you also enabled TUN, turn it off in the client and confirm that network access has returned to normal. This makes it easier to tell a basic network problem from a proxy configuration issue next time.
Your first setup is now complete: the subscription list updates, the active server loads, app traffic reaches the client, and access matches the routing rules. Next, use the glossary to learn key terms or consult the technical reference for help choosing protocols and cores. If your setup is working, there is no need to reset everything just to try more options.