For Android proxy troubleshooting, first grant VPN permission, then address background restrictions, and finally configure which apps use the VPN. This guide is for anyone whose first connection is blocked, whose connection drops after the screen locks, or who wants only certain apps to use the proxy. Follow the checks in order to distinguish a VPN that never took over traffic from a stopped service or an excluded app—without repeatedly changing servers.
Grant VpnService permission: establish the system traffic path
v2rayNG uses the Xray core to handle proxy connections. In VPN mode, it uses Android's VpnService to create a virtual network interface and route traffic from included apps through the client. The system's connection request asks permission to manage traffic on this device; it is not a subscription sign-in and does not mean the remote server is reachable. Approve the request on first launch. While permission remains valid, you usually won't be prompted again.
Usually, only one VPN can be active for a user or work profile at a time. If another local-VPN-based network filter is running, launching v2rayNG may replace its connection. Likewise, when another app takes over the VPN, v2rayNG's connection will be interrupted. Work profiles may also be subject to organization policies, so don't rely on the connection status in your personal profile alone.
-
Confirm the operating mode
Open Settings in the v2rayNG side menu and look for the VPN or operating mode option. Make sure VPN mode is selected, not proxy-only mode. The setting may have a different name in some builds; proxy-only mode does not automatically route traffic from other apps.
-
Select a configuration
Return to the main screen, select an imported server configuration with all required settings, then tap the connect button in the lower-right corner. Importing a subscription adds configurations to the list; it does not start the service.
-
Allow the VPN connection
When Android displays the VPN connection request, tap Allow or OK. If you tapped Cancel by mistake, return to the main screen and try connecting again. Don't treat denied permission as a server timeout.
-
Check the system status
Open Settings → Network & internet → VPN and confirm that v2rayNG owns the active connection. Manufacturers may list VPN under Connections & sharing or More connection settings. You can also search Settings for “VPN.”
-
Test access
Use a browser included in the proxy settings to open the target site, then check the client logs. A connected VPN only confirms that the local interface was created; remote address, TLS, DNS, or routing issues can still prevent access.
Battery settings: fix drops after the screen locks
If the connection works with the screen on but stops after the device has been locked for a while, first check whether the service is still running rather than changing protocols. Android battery optimization, manufacturer background controls, and manually clearing recent apps can affect the process. Network changes or sleep may also interrupt an existing connection without stopping the service entirely. These cases require different fixes.
The paths below are based on a near-stock Android interface. Menu names vary by manufacturer, but look for the same permissions: allow background activity, remove battery restrictions, and allow background data if needed. Whitelisting reduces the chance of restrictions; it does not guarantee the service will run indefinitely or fix remote connection problems.
- Battery usage restrictions: Long-press the v2rayNG icon → App info → App battery usage or Battery → select Unrestricted. If the page has an Allow background usage option, make sure it is enabled too.
- Battery optimization list: On some devices, go to Settings → Apps → Special app access → Battery optimization. Switch to All apps, find v2rayNG, and select Don't optimize. The exact relationship between this and the previous setting depends on the system.
- Manufacturer background controls: Search Settings for Autostart, Background activity, or App launch management. If v2rayNG is restricted automatically, allow it to run in the background. Check autostart separately only if you need the service to resume after a device restart.
- Background data: Under App info → Mobile data & Wi-Fi, check Background data. If Data Saver is enabled, also check whether v2rayNG needs permission for Unrestricted data usage.
- Notifications: On Android 13 and later, check notification permission under App info → Notifications. Notifications can help you monitor service status, but a hidden notification doesn't mean the VPN has stopped. Check the system VPN page instead.
| What you observe | Check first | Next step |
|---|---|---|
| System VPN connection disappears after locking the screen | Service stopped, background restrictions, or another VPN took over | Relax battery restrictions and check that another VPN isn't starting automatically |
| VPN remains connected, but access fails after switching networks | Stale connection, DNS issue, or remote reconnection | Save the logs, then stop and restart the connection to compare |
| Notification disappears, but VPN remains connected | Notification permission and notification categories | Check notification settings; don't use notifications alone to determine whether the service is running |
| Only one app fails after the screen locks | That app's background data and battery restrictions | Check system permissions for both the target app and v2rayNG |
Bottom line: check the service status before changing battery settings
On the same network, test access once with the screen on and again after 10 minutes with it locked. Note whether the VPN is still connected and whether the service restarted. Ten minutes is a repeatable troubleshooting window, not a fixed system timeout. Change one setting at a time so you can tell what made a difference.
Per-app proxy: bypass mode vs. proxy only selected apps
Per-app proxy settings determine which apps send traffic into the VPN; core routing determines which outbound route that traffic takes. These are separate layers. Selecting an app doesn't guarantee every connection will use the remote proxy: a core routing rule may match a direct outbound instead. Conversely, apps excluded from the VPN generally use the system's regular network and aren't handled by that VPN's core routing rules.
Open Per-app proxy in the v2rayNG side menu, enable the per-app option, then check Bypass mode and select apps. In some builds, the option is under Settings and labels may vary slightly. Follow the switch description: with bypass enabled, selected apps are excluded; with bypass disabled, selected apps are allowed into the VPN.
Proxy only selected apps
RecommendedEnable per-app proxy, turn off Bypass mode, and select only the apps whose traffic should enter the VPN. Start with one browser to keep the scope clear and make it easier to verify that the traffic path and routing work as expected. This is recommended for an initial test, not necessarily for everyday use.
Best for: proxying only a few apps or troubleshooting one app's network access.
Bypass selected apps
Enable per-app proxy and turn on Bypass mode, then select the apps that should stay outside the VPN. Other apps are included in the VPN. Newly installed apps will usually be included too, so check the configuration afterward.
Best for: routing most apps through the VPN while letting a few local-service apps use the regular network.
- Don't confuse what a selection means: Toggling Bypass mode changes the meaning of the app list. Choose the mode first, then review each selection to avoid getting the opposite of the intended result.
- Restart the connection after making changes: The per-app list is usually applied when the VPN interface is created. Stop and restart the v2rayNG connection, then fully close and reopen the test app to avoid reusing an existing connection.
- Check app identity: Cloned apps, work profile apps, and personal profile apps may have different network identities. Selecting the personal app doesn't necessarily include its work profile or cloned copy.
- Review the list after reinstalling: After reinstalling an app, changing its package name, or switching profiles, check the list again. Don't assume a selection still applies based on the app's name on your home screen.
Per-app settings and split routing: troubleshoot from app to outbound
If one browser works but another app doesn't, check the app entry point, selection list, routing, and remote connection—in that order. Don't change DNS, subscriptions, and per-app settings all at once; even if access returns, you won't know which change helped. For a useful comparison, have both apps access similar destinations. Different services can have different reachability, which doesn't by itself prove that split routing is wrong.
| Layer | What to check | Common misdiagnosis |
|---|---|---|
| System VPN entry point | Whether permission was granted, the service is running, or another VPN replaced it | Assuming an imported configuration means the connection is active |
| Per-app selection list | Whether per-app mode is enabled, Bypass mode is on, and the target app is selected | Treating the bypass list as the proxy list |
| Core routing | The matching domain or IP rule and its outbound tag | Assuming traffic entering the VPN must use a proxy outbound |
| Remote server and DNS | Connection timeouts, TLS errors, and DNS lookup results | Blaming Android permissions for a server connection failure |
For example, if you choose Proxy only selected apps and select just a browser, first confirm that the browser can establish a new connection. Then check the destination address and outbound details in the logs. Log details depend on the log level and core output; the absence of a destination entry alone doesn't prove the app never entered the VPN. The app may be using cached data, keeping an old connection open, or not making a new network request at all.
FAQ: VPN permission, background activity, and app list
Why don't I see a permission prompt when I tap Connect?
First, check Settings → Network & internet → VPN for an existing v2rayNG connection; if permission is still valid, Android won't prompt again. If there is no connection, check whether the client is in proxy-only mode, see whether another VPN is set to Always-on, and then review the client startup logs.
Why does the connection still drop sometimes after I set the battery usage to Unrestricted?
Battery settings address only some background restrictions. First distinguish between the VPN disappearing and the VPN staying connected while pages time out, then check manufacturer background controls and network changes as appropriate. During testing, don't clear v2rayNG from recent apps or tap Force stop in App info; that explicitly stops the service.
Why isn't an app using the proxy after I select it?
Open Per-app proxy and check Bypass mode first. If it's enabled, selected apps are excluded. To route only that app through the VPN, turn Bypass mode off and leave the app selected. Then stop and reconnect, and reopen the target app. If the problem continues, check whether core routing is sending its traffic directly.
Why can't a banking app connect even after I bypass it?
First, check whether Block connections without VPN is enabled in the system VPN details, then confirm the app's mobile data permission. Some apps may restrict access when they detect a VPN on the device; excluding them from per-app routing doesn't necessarily change that detection. Stop the VPN and test again to see whether the issue is related.
Can I switch to v2flyNG and keep all my settings?
v2rayNG uses the Xray core, while v2flyNG uses the V2Fly core; supported protocols and configuration fields aren't identical. Switching clients isn't a fix for background restrictions. Before switching, confirm node compatibility and review system permissions, battery restrictions, and the per-app list in the new client.
After troubleshooting, keep a short record of your Android version, operating mode, per-app setting, Bypass mode setting, and whether the system VPN was still connected when the issue occurred. Before sharing logs, remove subscription URLs, credentials, and anything that could identify your usage. This information makes it easier to narrow down the problem than simply saying “it won't connect.”