V2Ray FAQ
Choose a package, import a subscription, or troubleshoot a connection. Find the symptom, then change one setting at a time.
These answers cover common use cases for v2rayN, v2rayNG, and v2flyNG. Menu names may vary slightly by version; refer to your current client settings and logs.
V2Ray Basics
Know the difference between the client, core, and traffic entry point to avoid troubleshooting the wrong layer.
How are V2Ray, V2Fly, Xray, and graphical clients related?
V2Ray usually refers to the proxy tools and configuration system in the Project V ecosystem. V2Fly and Xray are related core families. The core handles protocols, transports, routing, and DNS; graphical clients manage server configurations, subscription groups, and startup options. v2rayN is a desktop client, v2rayNG uses the Xray core, and v2flyNG uses the V2Fly core. When troubleshooting compatibility, check the client name, the core actually in use, and its version. A successful import alone does not mean a feature will work.
Which should you use: v2rayN, v2rayNG, or v2flyNG?
For Windows, macOS, and Linux desktops, start with v2rayN. For Android, start with v2rayNG; consider v2flyNG if you need compatibility with V2Fly configurations. Before choosing, check the protocols, transport, and security settings required by your subscription, then confirm the client core supports them. Fields with the same name can accept different values or behave differently across cores. When switching clients, keep your existing configuration and test with a known-working profile before migrating the full subscription and routing rules.
Does installing a client give you a working connection configuration?
Installing a client prepares your device to run it; it does not provide a working server connection. You also need a subscription URL or individual configuration from a service you are authorized to use, and should check the service's validity period, server address, port, and authentication details. Subscription URLs often contain access credentials, so do not post them in public forums or include them in screenshots. After importing a configuration, select a server, start the core, and choose a suitable proxy mode. Seeing a server name does not mean a connection has been established.
What do system proxy, TUN, and routing rules control?
A system proxy provides a local proxy endpoint for apps that follow system settings, but not every program uses it. TUN captures traffic through a virtual network interface, usually covering more apps, but requires the appropriate permissions and may conflict with other network tools. Routing rules decide which outbound handles connections that reach the core, such as direct, proxy, or blocked. These operate at different layers: proxy mode determines whether traffic enters the core, while routing determines how it is handled afterward. Troubleshoot the traffic entry point first, then check routing.
Download & Installation
Check your operating system and architecture first, then choose the package format and edition.
Which Android package should you choose: arm64 or universal?
Most newer Android phones can start with arm64, but a device's age is only a rough guide; check its processor and system architecture instead. The arm64 package targets that architecture and is usually smaller. The universal package supports multiple architectures and is a good choice if you are unsure which one your device uses. If arm64 will not install, check the Android version, available storage, and source of the existing app before trying universal. Installation can also fail because of a signature mismatch or downgrade restrictions, so switching architectures may not help.
How does the v2rayN desktop edition differ from the classic WPF edition?
The desktop edition uses a newer cross-platform interface, while the classic WPF edition uses Windows UI technology. Windows users can choose based on their preferred interface and runtime environment; macOS and Linux users should look for the desktop package for their platform. Menu locations, runtime dependencies, and some features may differ, so do not rely on screenshots alone to find a button. Before switching editions, export any subscriptions, servers, and routing settings you want to keep, and retain the old configuration directory. After the first launch, check which listening port and core are actually in use.
How do you check macOS chip architecture and Linux package format?
On macOS, check About This Mac: choose arm64 for Apple Silicon or x64 for Intel. On Linux, check both the distribution's package format and the processor architecture. Debian- and Ubuntu-based systems typically use deb packages; Fedora and similar systems typically use rpm. Do not infer x64 or arm64 from the distribution name alone. If the installer reports an architecture mismatch or missing dependencies, check your system details and the package requirements. Avoid repeatedly installing different package formats or changing system security settings without a clear reason.
Will updating the client remove your subscriptions? What should you check if installation fails?
A standard in-place update usually preserves user settings, but portable, installation, and user data directories are not always in the same location. Check carefully when switching package types. Before updating, back up subscription groups, routing settings, and any custom configuration you need, then close the client. If installation fails, check system and architecture requirements, available storage, running processes, and the source and signature of the existing app. Android may block an app signed differently from replacing the installed version. Make sure your configuration is safely saved before uninstalling.
Subscriptions & Configuration
Tell apart download failures, parsing errors, and rule-matching issues.
How can you tell a failed subscription import from a failed single-profile import?
First check whether you copied a subscription URL or a single share link, and use the matching import option in the client. Subscriptions usually need to be saved as a group before you update them; a single link is parsed directly for its protocol fields. Check that the content is complete and contains no extra spaces, line breaks, explanatory text, or webpage URL. If the subscription downloads but will not parse, check its response format and core support. If the request itself fails, check the network and whether the subscription is still valid. Never include a complete subscription URL in screenshots of logs or public reports.
How should you troubleshoot a failed v2rayN subscription update?
Start with the update log to identify a DNS lookup failure, connection timeout, access denied error, or invalid content format. Check whether the subscription URL has expired, been reset, or was copied incompletely, then verify the system clock. If the current server is no longer working, updating through the proxy may fail; try the client's direct update option. Conversely, if direct access fails, try updating through an existing working connection. Change one method at a time and keep the original group rather than clearing settings unnecessarily for what may be a network issue.
Why did my manually changed server settings revert after updating the subscription?
Servers in a subscription group are usually regenerated from remote content, so an update may overwrite local changes. To keep special settings, copy the profile to a manual group that is not managed by subscription updates, then change its transport, security, or other fields and note why. Avoid repeatedly experimenting with your only working subscription entry. After updating, check that the active server still works and that routing rules still reference valid tags. The same display name does not guarantee identical underlying settings.
Which fields should you check when routing rules do not work?
First confirm that app traffic is reaching the client, then check rule order, match conditions, and outbound tags. Standard routing rules are evaluated in order; a broad rule near the top can prevent more specific rules below it from matching. outboundTag must match an existing outbound tag, and geosite and geoip conditions depend on the corresponding rule data. Domain matching also depends on whether the app sends a domain or an IP address, as well as DNS settings and traffic sniffing. Test with one clearly scoped rule before changing all your routing settings.
Connection Troubleshooting
Check each layer in turn: network, traffic entry point, server connection, and destination access.
What do a node timeout and a connection refused error mean?
A timeout means the connection did not complete within the allowed time. Possible causes include the local network, server reachability, transport settings, or the server's response. Connection refused usually means the destination is reachable but the port is not accepting connections; an intermediate device may also be rejecting the connection. Check the address, port, and current network, then test the same profile on another available network. Review the core log to see whether the failure occurred during connection, TLS handshake, or authentication. A test result in the server list reflects only that test path and does not replace testing access from the app you need to use.
Connected, but no internet access? What should you check next?
A connected status may only mean the core or local VPN service has started; it does not confirm server authentication or access to your destination. Turn off the proxy to verify your basic network, then check the active server, authentication or handshake errors in the log, and DNS resolution. If only some sites fail, focus on routing rules and domain resolution. If all apps fail, check the entry port, core startup, and server reachability first. On Android, also confirm VPN permission, per-app proxy selection, and battery restrictions so you do not mistake traffic that bypasses the client for a server failure.
System proxy not working, or browser works but terminal does not?
Confirm that v2rayN is set to configure the system proxy automatically, then check the proxy address and port actually recorded by the system. The app's proxy protocol must match the local listening endpoint. Do not assume every version uses the same HTTP and SOCKS ports; check the current settings. Browser extensions can override the system proxy, while terminal programs may use only their own options or proxy environment variables. Check each path separately and restart programs that need to reload settings. If another process is using the port, change the listening settings and update the app's proxy configuration to match.
What if TUN will not start or Android VPN permission is not working?
Desktop TUN requires a virtual network interface and the appropriate system permissions. Read the startup log to determine whether the issue is insufficient permissions, interface creation, or a routing conflict, then follow the client prompts to grant permission or install the service. Running everything with elevated privileges is not a universal fix. On Android, v2rayNG uses the system VpnService; confirm the VPN permission prompt the first time you start it. If another VPN app is running, stop the conflicting service first. If the connection drops repeatedly, check background activity, battery optimization, and per-app selection instead of resetting all settings.