V2Ray FAQ and Troubleshooting

V2Ray generally refers to the protocol and proxy-tool ecosystem created by Project V. V2Fly and Xray are two commonly used core families within it. v2rayN, v2rayNG, and v2flyNG are graphical clients that handle subscription management, node selection, routing, and system-proxy control; the actual connection is handled by the core invoked by the client. When troubleshooting, distinguish the client interface, core version, and server configuration rather than relying on the software name alone.

For Windows, macOS, and Linux desktops, v2rayN is the usual choice, with desktop features such as subscription management, system proxy, routing, and TUN. On Android, v2rayNG, which uses the Xray core, is generally the first option; choose v2flyNG when you need the V2Fly core or want to compare core behavior. Node availability cannot be determined by the client name alone: the key factors are the platform, supported core features, and the protocol parameters delivered by the subscription.

A subscription URL usually returns a group of nodes maintained by the service provider. Once saved, the client can update it again. vmess:// and vless:// share links usually describe only one node, and importing one does not automatically provide other nodes from the same service. Import a single-node link from the clipboard; add a subscription provided as a web address to a subscription group. Mixing the two may produce a format error or an empty update result.

System-proxy mode changes the operating system's proxy settings and mainly handles browsers and apps that follow those settings. It is simple to configure and easy to inspect. TUN mode uses a virtual network interface to handle more types of traffic, making it suitable for apps that ignore system proxy settings, but it usually requires administrator permission and may conflict with virtual machines, other VPNs, or network-filtering tools. For a first setup, verify the node with system-proxy mode before enabling TUN as needed.

First verify that the copied text is the complete subscription URL, not a webpage title, login-page address, or explanatory text containing line breaks. Then check for extra spaces at the beginning or end. Open the URL in a browser to confirm that it returns subscription data rather than a login prompt or error page. If the service requires authorization parameters, preserve the complete query string from the original URL. After correcting it, create the subscription group again; do not paste a subscription URL into the single-node import dialog.

Check whether the current network can reach the subscription URL, and verify the device date, time, and time zone because certificate connections can be affected by the system clock. If the client lets you choose a proxy method for subscription updates, test both a direct connection and the current proxy. Then close duplicate client processes, restart the client, and try again. If failures continue, record the response status, update time, and subscription-group name to determine whether the URL is invalid, authorization has expired, or the local request is being blocked.

Most mainstream Android phones and tablets released after 2015 use 64-bit ARM processors, so arm64 is a good first choice. It contains only the components for that architecture and is usually smaller. Choose the universal package if the processor architecture is unknown, the device is older, or the arm64 package reports an incompatibility during installation. The universal package supports more architectures, but its functionality is essentially the same as the arm64 package of the same version; there is no need to install both.

Move the app to the Applications folder and try opening it once so the system records the block. Then open the Privacy & Security section in System Settings and approve it in the recently blocked apps area. If prompts for local network, network extension, or proxy permissions appear during the first connection, grant access according to the mode you intend to use. If the app is repeatedly quarantined, remove the old copy and place the app again, avoiding launches directly from an archive or temporary download folder.

Start with a node whose parameters are complete and that has worked recently, then test in rule mode. Rule mode selects direct or proxied connections according to routing rules and is suitable for everyday use. Global mode sends more traffic through the current proxy and is mainly useful for identifying missing rules. Direct mode quickly restores the local network path. Record the original settings before switching modes, change one variable at a time, and test separately in a browser and the target app so you can identify the source of a problem instead of changing the node, DNS, and routes simultaneously.

Confirm that the client not only started the core but also applied the system-proxy setting. Check that the address and port shown in the operating system's proxy settings match the client's local listener. Then fully quit and reopen the target browser or app, since some programs read proxy settings only at startup. If another proxy tool, network accelerator, or management script is running, temporarily disable it so it does not immediately overwrite the setting. Finally, check for an old port left in LAN or manual-proxy options.

Desktop systems must allow the client to create a virtual network interface with administrator privileges; on Android, approve the VPN connection request shown by the system. If it still fails after permission is granted, quit other VPN or proxy programs using virtual interfaces and restart the client. On Windows, check whether relevant services or drivers are blocked by security policy; on Linux, confirm that the current account has network-management permission. After making changes, disable TUN and enable it again rather than repeatedly clicking the switch.

Keep the default DNS settings at first. Adjust only one clearly scoped routing rule and confirm that the target domain actually uses the expected exit. If routing is correct but the domain still resolves incorrectly, check whether DNS queries use a direct connection or the proxy, whether local caching is enabled, and whether the app uses its own encrypted DNS. Clear the client's DNS cache and reconnect after each round of changes. Do not import multiple rule sets and DNS configurations at once, or the logs will make it difficult to identify which setting ultimately took effect.

Switch to another node in the same subscription first to determine whether the issue affects one node or all of them. If every node times out, check the device network, system time, subscription expiry, and whether the client core starts normally. If only one node times out, verify its address, port, transport, TLS, SNI, path, and other parameters. Latency tests may not use the same connection method as real traffic, so do not rely on a single test result; compare the client logs with actual webpage access.

Disable the system proxy or TUN first to confirm that the underlying network works, then reconnect with only one traffic-capture method enabled. Check that the local listener port, system-proxy port, and app's manual-proxy port match. If domains fail but a known address responds directly, the issue is usually DNS. If every request fails, inspect the routing exit, core logs, and node parameters. Also rule out firewall blocks on the client process and stale proxy settings that were not cleared.

End any leftover process in Task Manager or Activity Monitor, then launch the client from its official installation directory. On Windows, check that the desktop runtime is complete, the configuration directory is writable, and the local port is available. On macOS, focus on first-run permissions; on Linux, launch the app from a terminal to read its error output. If the issue began after importing a configuration, back up the configuration directory, move aside recently generated files, and let the client start in a basic state before restoring settings one by one.

Confirm that you updated the subscription group currently being viewed rather than another group with a similar name. Some clients retain old nodes, merge duplicates by remark, or place new nodes in a different group, so check the update log and group filters. If the server returned the same content as before, the client will naturally add nothing. You can also remove the subscription's local cache and update again, but export custom routes and manual nodes first so they are not lost during cleanup.