Before you start, get the subscription URL from your provider and confirm your plan is active. The client reads configurations and forwards traffic; it doesn’t provide working servers by itself. Subscription links often contain access credentials, so paste them only into your own client—not into chat groups, public screenshots, or online parsing tools. If you need help troubleshooting, hide the URL, account details, and server credentials first.
Keep your network unchanged during initial setup, pause other proxy tools, and avoid changing DNS, routing, and core settings at the same time. This makes it easier to identify the cause of each result. Start with the shortest path to a working connection; for platform-specific permissions, install locations, and other details, see the installation and setup guide for all platforms.
Step 1: Import a Subscription
Subscription import has two separate steps: save the URL, then update the subscription. Adding a link in settings alone doesn’t load the servers. First, copy the complete client subscription URL from your provider’s account page, checking for any format option specific to your client. A regular webpage, plan details page, or login page won’t work. When copying, leave out quotation marks, explanatory text, and line breaks.
v2rayN: Add a Group and Update the Subscription
Open the “Subscription Group” menu at the top and select “Subscription Group Settings,” then add a group. Enter a recognizable label, such as “Daily use,” and paste the complete URL into the subscription address field. The label is for your own reference and doesn’t change the server configuration. Save and close the settings window, then return to the “Subscription Group” menu and update the current group. If the interface only offers an option to update all subscriptions, you can use that during initial setup.
Before you have a working proxy connection, choose an option to update the subscription without using a proxy. That way, the update request won’t depend on a connection that isn’t working yet. Watch the status area or logs until the update finishes, then switch to the group you just created. The server list should show configurations returned by the subscription. First, confirm the list isn’t empty; there’s no need to change protocols, transports, or ports one by one.
v2rayNG: Save a Group and Refresh the Configuration List
In the app’s side menu, open “Subscription Group Settings,” add a group, enter a label and subscription URL, and save. Return to the main screen, open its overflow menu, and select “Update current group subscription,” “Update subscription,” or the equivalent. Wait for the update to finish, select the group you added, and check that server entries appear in the configuration list. Don’t import a subscription URL as if it were a single server share link: subscriptions need periodic updates, while a share link usually adds one standalone configuration.
If the list is still empty, first check that you selected the right group. Then make sure the subscription URL is complete, your plan hasn’t expired, and the update logs don’t show a failed request. If the URL opens a login page or returns an invalid format, get a client-compatible subscription URL from your provider instead of repeatedly tapping Connect. If you need an existing proxy to access the subscription URL, first establish a verified connection, then update the subscription through the proxy.
For now, stay on the server list. Don’t share exported configurations publicly or casually change the settings supplied by your provider. For the differences between subscriptions, nodes, and share links, see the glossary. Next, choose which app traffic the client should handle.
Step 2: Choose a Proxy Mode
Proxy modes are easy to confuse with routing rules. System proxy or TUN determines how traffic enters the client; routing determines whether that traffic goes direct or through the proxy. “Global” is usually a routing policy—it doesn’t automatically make every app use the proxy. For your first setup, choose one traffic-capture method. Once your browser works, you can decide whether other apps need a different setup.
v2rayN: Start with the System Proxy
Find the system proxy option in the main window’s status bar or the tray menu, then select “Set system proxy.” This registers the client’s local proxy with the operating system. Browsers and apps that follow the system proxy settings will then send requests to it. “Clear system proxy” removes these settings; “Do not change system proxy” leaves the current settings alone—it doesn’t enable the proxy. After selecting an option, check that the interface shows the expected status.
For an initial test, you can start with the common “Bypass mainland China” routing mode: traffic matching direct-connection rules goes direct, and other traffic is handled by the remaining rules. If the page you’re testing matches a direct rule, the result won’t confirm the proxy’s exit IP. To isolate routing effects, temporarily switch to global proxy routing for comparison, then restore your usual policy. Global routing still depends on whether the app follows the system proxy.
Leave TUN disabled for now. Only look for “Enable Tun mode” in the parameter settings if the system proxy works but an app doesn’t follow it. TUN uses a virtual network interface to capture traffic and may require administrator privileges or system authorization; it also affects routing and DNS. If your network stops working after enabling TUN, turn it off and return to the verified system proxy setup. Don’t mistake a permissions issue for an expired subscription.
v2rayNG: Check Which Apps Use the VPN
On Android, the client connects through the system VPN service; there’s no need to look for the desktop’s three system proxy options. For your first connection, leave the basic app settings as they are and check whether “Per-app proxy” is enabled. If you’ve already selected apps, make sure your test browser is included. Depending on the setting, the list may include only apps to proxy or apps to bypass—read the description instead of relying on the check marks alone.
Routing settings also affect the result. Start with a preset you understand rather than adding custom domain or IP rules. If another app on the device is using a VPN connection, disconnect it before connecting v2rayNG; Android generally can’t keep two standard VPN services active at once. If the system asks for permission again after you switch apps, check the app name before approving.
The goal at this stage is to give your test browser a clear traffic path—not to configure every app and network scenario at once. Leave LAN access settings unchanged unless you need to share the proxy with other devices. For more on system proxy, TUN, and split routing, see proxy modes and networking terms. For platform-specific permissions, see the user guide.
Step 3: Connect to a Server
You now have configurations and a traffic-capture method, so you can choose an active server. Start with an entry your provider identifies as available and suited to your needs. If the list is long, there’s no need to test every server right away. Pick a few candidates and run a real-connection speed test; start with one that succeeds. Tests send network requests, may use data, and can be affected by your network and the test endpoint.
v2rayN: Set an Active Server
Select a candidate in the server list, then look for a real-connection speed test in the right-click menu. TCPing mainly shows whether a connection to the remote port is possible; by itself, it can’t confirm a successful protocol handshake or webpage request. A real-connection test is closer to an actual proxy request, but still can’t represent every website or time of day. Don’t keep switching based on a single test result; first find a configuration that completes the test.
Select a server, then choose “Set as active server” or the equivalent option from the right-click menu. Some interfaces also activate a server on double-click; use the active indicator in your version as the source of truth. v2rayN may not have a prominent standalone Connect button—setting the active server usually reloads or restarts the core. Wait for the operation to finish, then check that “Set system proxy” is still enabled.
Open the logs or information panel and check for entries created by the action you just took. If you see a port conflict, configuration load failure, or core shutdown, fix the startup error before changing routing settings. For a port conflict, first close duplicate client instances and other proxy tools. If you need to change a local port, also check any app settings where you entered that port manually. Don’t confuse a local listening port with the remote server port.
v2rayNG: Select a Configuration and Tap Connect
In the Android configuration list, tap a candidate server and make sure the selection indicator is on the right entry. Then tap the Connect button in the lower-right corner. The first time you connect, Android displays a system VPN request; confirm it comes from v2rayNG, then allow it. Return to the app and wait for the connection status to change. The VPN icon in the status bar shows that the local tunnel is up, but you’ll need to make an actual request in the next step to confirm the remote server works.
After connecting, use the app’s connection test if available and check the logs. If the connection stops immediately, first check whether another VPN service has taken over or system permission is still pending. If it disconnects only after the screen has been off for a while, check battery management and background activity permissions. Don’t change every background permission before you’ve made a successful first connection.
On either platform, change one variable at a time. If a test fails, try another server in the same subscription without changing the proxy mode. If it still fails, check the subscription’s expiry, system time, and logs. A significant clock error can affect secure connections. If none of the candidates connect, follow the troubleshooting steps in the FAQ. Don’t change the transport settings provided by your service provider without a clear reason.
Step 4: Verify the Connection
A connected status in the client is the starting point, not the final check. A reliable test should answer three questions: Is the local proxy running? Are browser requests reaching the client? Are requests that should use the proxy completing through the remote server? Keep the active server unchanged, open a new browser tab, and visit an HTTPS page that you expect to access through the proxy. Wait for the page content to load.
Check the Page, Logs, and Exit IP
If the page loads, return to the client and check the logs for the request you just made. The details shown depend on the log level: some levels show only errors, while others include the destination domain and outbound route. A missing domain in the logs doesn’t necessarily mean the request never reached the client. But if you see recurring connection refusals, timeouts, or DNS errors, use the timestamps to investigate. Don’t upload full logs containing credentials to a public site.
To check the exit IP, compare results from the same trusted IP lookup service before and after connecting. Focus on whether the result matches the expected server and routing mode, not whether the map pin is exact. IP geolocation databases can disagree. Also, if the lookup page matches a direct-connection rule, it may show your local network’s exit even when other requests use the proxy. Check your routing rules first; then, if needed, temporarily switch to global proxy routing and test again.
If a webpage won’t load, first check that your browser doesn’t have a separate proxy extension or manual proxy setting that overrides the system proxy. If only the browser works on desktop and other apps don’t, check whether those apps follow the system proxy before considering TUN. If only some apps fail on Android, check the per-app proxy settings. One app’s result doesn’t prove that the entire subscription is unusable.
Finish Based on the Results and Keep the Working Setup
If the logs show no sign of a request, return to Step 2 and check the traffic-capture method. If a request reaches the client but keeps timing out, return to Step 3 and check the active server. If the group is empty or the update failed, return to Step 1 and check the subscription. This pinpoints the failing stage and avoids reinstalling the client and changing DNS at the same time, leaving you unsure what actually fixed the issue.
After verification succeeds, restore your usual routing policy and revisit the target page to confirm it still works as expected. Make a note of the working group label; there’s no need to put the full URL in a public document. Subscription updates may replace or remove servers. If a previously working entry stops working, update the group and choose an active server again rather than relying on an outdated configuration.
Finally, test that your network recovers when you disconnect. On desktop, select “Clear system proxy,” turn off TUN if enabled, and then exit the client. Confirm that your regular network connection works. If it doesn’t after an unexpected shutdown, check whether the system still has a manual proxy pointing to a stopped local port. On Android, tap Disconnect and confirm the VPN icon disappears. Next time, reconnect without creating the same subscription group again.