Before you begin, make sure the client is installed, you have a valid subscription URL, and your device can already access regular webpages. The client reads configuration and forwards connections; installing it does not provide a working server by itself. If you haven't installed a client yet, choose the right installer for your device on the client downloads page, then return here. If you already have a client, you don't need to delete your existing groups to follow this guide.
This guide walks through an initial setup that takes about 10 minutes, depending on your subscription and network. Each step has a checkpoint: check the server list first, then the proxy settings, and finally the access results. If something doesn't work as expected, troubleshoot that step before moving on. Changing servers, routing, and DNS all at once makes it hard to identify the cause.
Step 1: Import a Subscription
First, identify whether you have a subscription URL or a single share link. A subscription URL is usually a web address that the client fetches to retrieve a set of server configurations. A share link typically starts with a protocol such as vmess://, vless://, or trojan:// and describes one server. Use the right import option for each; link length alone won't tell you which one it is.
v2rayN: Add a Group, Then Update It
Open the “Subscription Group” menu near the top of the main window and choose “Subscription Group Settings.” Click “Add” in the settings window, enter a recognizable note, then paste the full subscription URL into the address field. The note is just for your reference; name it by source or purpose. Leave the URL unchanged: don't remove anything after a question mark or include punctuation from the end of a chat message.
Save the group and return to the main window, then update it from the “Subscription Group” menu. Since this is an initial setup and the proxy isn't connected yet, choose “Update subscription without proxy” or an equivalent option first. Use the proxied update option only if the provider explicitly requires an existing connection. Watch the status message at the bottom of the window and wait for the result rather than clicking repeatedly. Once the configurations are retrieved, select the new group and check that server entries appear in the list.
For a single share link, copy the entire link and choose “Import share link from clipboard” from the “Servers” menu. This usually creates a local entry, not a subscription that can be updated automatically. If the server settings change, you'll need to import the link again or edit the entry manually. Don't treat an ordinary webpage URL as a share link or paste a subscription URL into a server address field.
v2rayNG: Save the Subscription, Then Update It from the List
Open the side menu on the v2rayNG main screen, find “Subscription Group Settings,” tap the add option, enter a note and subscription URL, then save. Return to the main screen and choose “Update subscription” or “Update current group subscription” from the more menu; the wording varies slightly by version. For a single share link, use “Import from clipboard” in the main screen's add menu instead. You don't need to create a subscription group first.
At this stage, the checkpoint is that entries appear in the list—not that the connection works. If an update reports success but no servers appear, switch back to the relevant group, clear the search box, and check for active filters. If you see a parsing error, timeout, or empty result, keep the error message and follow the subscription troubleshooting steps in FAQ. Subscription URLs may contain access credentials. Hide the entire URL—not just the domain—before sharing a screenshot or asking for help.
Once entries appear in the list, there's no need to test every one yet. Keep one server you plan to use and move on to setting up how traffic enters the client.
Step 2: Choose a Proxy Mode
Two settings are easy to confuse: “System Proxy or TUN” controls how app traffic enters the client, while the “Routing preset” controls whether traffic is proxied or goes direct once it arrives. Enabling the system proxy doesn't mean every connection uses the same exit, and global routing won't change how apps that ignore the system proxy connect. Start with a simple setup, then expand traffic coverage after confirming it works.
v2rayN: Start with System Proxy and Default Routing
Find “System Proxy” in the main window's status bar or the tray icon's right-click menu. Common options include “Clear system proxy,” “Set system proxy,” and “Do not change system proxy.” For initial setup, choose “Set system proxy” so browsers that follow system settings connect to the client's local endpoint. “Do not change system proxy” only means the client leaves the existing setting alone; it does not enable the proxy for you.
Next, find “Routing” and choose “Bypass mainland China” or an equivalent preset. This lets connections matching the preset's rules go direct, while the remaining traffic follows its default rules. If the preset names differ, read their descriptions and stick with the client's standard routing option. Don't add a large set of custom rules before the connection works, and don't assume a rule is correct just because a particular site loads quickly.
Leave TUN off for now. The system proxy is a simpler way to test browser traffic, with fewer permissions and virtual network settings to configure. Some apps ignore the system proxy; if you later need to route their traffic, see the full documentation for TUN permissions, routing, and DNS settings. During the initial test, don't run another proxy client or VPN at the same time; they may compete for the network interface or both try to route the same traffic.
v2rayNG: Route Traffic Through Android's VPN Interface
v2rayNG generally doesn't use a desktop-style system proxy. Instead, it requests Android VPN permission when you connect. Open the routing options in “Settings” and choose a preset that bypasses local network and mainland China addresses, or keep a similar default rule. This VPN is the system's traffic-routing interface. Approving the request doesn't prove that the remote server is reachable; test actual access in Step 4.
If “Per-app proxy” is enabled, check that the browser you're testing is included. Depending on the setting, the list may mean “proxy only selected apps” or “bypass selected apps,” so make sure you interpret the checkboxes correctly. For your first test, turn off custom per-app restrictions, then restore them one at a time after the browser connects. If another VPN is active on the device, disconnect it before starting v2rayNG.
By the end of this step, you should be clear on two things: on desktop, the system proxy sends browser traffic to the client; on Android, the VPN interface routes traffic through it. The routing preset then determines how the client handles those connections. Once that's clear, start the server connection; there's no need to change the local listening port in advance.
Step 3: Start the Connection
Return to the server list and select an entry from a known source with a complete configuration. Any region or route in its note is just information provided by the source, not proof that the server works. For your first run, don't change settings while running a batch speed test. Use one entry to test the full access flow, then compare other entries later.
v2rayN: Set the Active Server and Check Its Status
Right-click the entry you plan to use and choose “Set as active server” or the equivalent option. A highlighted row doesn't necessarily mean its configuration is active; check the active indicator, status bar, or current server details. Some interfaces also let you confirm with Enter. If you're unsure how a shortcut works, the right-click menu is clearer.
v2rayN usually starts or reloads the core when you switch the active configuration; it may not have a prominent “Connect” button. Check the status or log area at the bottom of the window for repeated errors such as startup failure, configuration parsing failure, or a port conflict. Then confirm that “System Proxy” is still set to “Set system proxy.” A running core and a browser using it are two separate conditions.
If you see a local port conflict, first close any other client instances and proxy apps, then try reloading the current configuration. Don't change ports at random: the browser or system settings may still point to the old endpoint. If the logs report an unsupported protocol or configuration field, check whether the client version supports the subscription requirements before changing the server address, transport settings, and core type all at once.
v2rayNG: Select an Entry and Approve the System Request
Tap an entry on the Android main screen and make sure it shows as selected, then tap the Connect button at the bottom. The first time you connect, Android displays a VPN connection request. Confirm that the request is from the v2rayNG app you just installed, then approve it. If you denied the request, the client can't route device traffic normally; tap Connect again and approve it.
After starting the connection, check the button state, system notification, and client status messages. A VPN icon only shows that the routing interface is active; it doesn't guarantee that a server in your subscription is reachable. If the app offers a connection test for the current configuration, you can run it for extra information, but don't take it as proof that every app is using the proxy successfully.
If the connection stops immediately after starting, check the client logs and system permission prompts first. If it disconnects only after the screen has been locked for a while, check system restrictions on background activity and battery use. There's no need to grant every background permission before your first connection; address the restrictions based on what actually happens. Once it starts without persistent errors, leave the client running and open a browser for the final step.
Step 4: Verify It Works
Check the connection in this order: basic network access, the target site, then client logs. A connection icon alone can't tell you whether traffic went direct, through the proxy, or through an app's own connection. Likewise, a site failing to load doesn't tell you whether the server or the site is at fault. Pick two familiar webpages you're allowed to access: one to test regular connectivity and another to test the expected proxy route.
Cross-Check Browser Results Against the Logs
Open a regular webpage first to make sure changing proxy settings hasn't cut off basic access. Then open a new browser tab and visit a site that should use the proxy. Perform an actual action, such as opening another page on the site or submitting a search. This is a better test than leaving a cached homepage open, though you'll still need to check the client logs to see how the request was routed.
Return to the client and check the logs. If the current log level records destination requests, look for the domain you just visited and how it was handled to see whether the request reached the client and went through the proxy. Fields vary by core and log level, so missing individual access records don't necessarily indicate a problem. Don't keep changing settings to find a particular log line. Detailed debug logs aren't needed for everyday use.
If you need to check the exit IP, use a network information page you trust, but keep routing rules in mind: if the page is set to go direct, it may show your local network's IP. An unchanged IP doesn't immediately mean the client isn't working. First confirm which route the page used, then interpret the result.
If It Doesn't Work, Check One Thing at a Time
If regular webpages also fail, clear the system proxy on desktop or disconnect the client on Android, then check whether basic network access returns. If it does, check the active server and local runtime errors. If regular pages work but the target site doesn't, confirm that the server is still valid, then test another known-working entry. Change one thing at a time and note the results before and after.
If the desktop browser has no corresponding access records, check the system proxy state and whether a browser extension has set a different proxy. If only one Android app fails, check which way the per-app proxy selection works. A successful subscription update only means the configuration was retrieved; it doesn't mean every server in it is reachable. A successful connection test doesn't mean every site will follow the same route. See the FAQ for more error messages.
Once the connection works, keep track of the active group, server, and routing preset; there's no need to edit config.json manually. GUI clients may regenerate the configuration when they restart or switch servers, so edits to generated files can be lost. For advanced routing, TUN, or configuration details, see the complete setup guide for all platforms. Keep first-time setup separate from advanced customization.
Finish by practicing a clean disconnect. In v2rayN, switch “System Proxy” to “Clear system proxy” before exiting, so apps don't keep trying to use a local endpoint that has been shut down. In v2rayNG, tap Disconnect in the client and confirm that the connection notification or system VPN status disappears. If the device is configured to use an always-on VPN or to block connections without one, check those system settings too. Next time, restore access in this order: confirm the active server, enable traffic routing, then test a webpage.