How settings work / Configure the entry before the outbound route
Subscriptions, routing, and system proxy
The client window manages configuration; the core handles connections. Subscription groups store server sources. The system proxy directs apps that follow system settings to a local port, while routing rules determine where those connections go. These operate at different layers, so you don't need to change them all at once. For a first-time setup, confirm that one server entry works before adding routing rules or other connection methods.
directblockproxy
Organize subscriptions by source
Add a subscription URL under “Subscription Groups” and give the group a name that identifies its source. After updating, select that group and check its server list so you don't mistake entries from another source for the update results. A share link imports a single entry; a subscription URL keeps entries in sync. They aren't interchangeable. Subscription URLs may contain connection details, so don't share them publicly. The snippet below shows fields you may encounter in a single VMess share link; it is not a complete connection configuration.
Routing rules are usually matched from top to bottom, and the first match selects an outbound. You can start by sending private addresses direct, then add domain-set rules, and finish with an explicit default route. “Bypass mainland China” is a preset name; its actual scope depends on the rules loaded. The snippet below sends private addresses to direct; this tag must match an existing outbound. Back up your configuration before importing custom rules, and confirm that the geosite and geoip data are available. Rule names alone don't tell you what they do.
“Set system proxy automatically” changes the operating system's proxy settings so apps that follow them connect through the client. “Clear system proxy” removes that entry point, while “Leave system proxy unchanged” preserves the current settings. These options don't determine whether a destination connects directly; outbound routing is handled by the core. If an app has its own proxy settings, check that its address and port match the client's listening endpoint. The example below shows an HTTP inbound on the loopback address. You can change the port; use the value configured in your client, and don't expose it to the local network by default.
TUN mode captures traffic through a virtual network interface, which can help with apps that ignore system proxy settings. First verify the connection through a regular proxy entry, then enable “Enable TUN mode” and grant permissions when prompted. TUN affects routing tables, DNS, and virtual interfaces. If problems arise, turn it off first, restore the basic connection, and then troubleshoot. The snippet below shows interface fields in sing-box format, only to illustrate the configuration structure. Whether this configuration applies depends on the client; don't paste it directly into an Xray configuration.
The graphical interface and proxy core are separate components. The interface imports server details; the core handles protocols, transport, and routing. Before switching cores, check the protocol, TLS, and transport parameters. The same configuration may not behave identically across cores. The freedom outbound below is a common direct-connection configuration in the Xray and V2Fly ecosystems. After switching, reload and check the logs to confirm the configuration starts, then test access. Avoid changing the core, DNS, and routing all at once, or it will be harder to pinpoint the cause of a failure.
For desktop, start with v2rayN; for Android, start with v2rayNG. Consider v2flyNG if you need a V2Fly core. To move between devices, use a subscription URL or a single share link rather than copying the entire app data directory. Server parameters may be shared, but system proxy settings, virtual interfaces, and permissions must be configured separately on each device. The log fields below are examples to help identify core configuration details; the actual log location depends on the client. Before sharing a screenshot, hide subscription URLs and server connection details.
Subscriptions determine the server source, the system proxy determines the traffic entry point, and routing rules determine the outbound route.
In routing examples, direct, block, and proxy are outbound tags, not fixed protocol names. Tags can be defined in the configuration, and rule references must match the corresponding outbound. For example, a blocking outbound can use the blackhole protocol and still be named block. When copying rules, check their references too, or you may end up with “the rule saved, but the core won't start.”
DNS settings can also affect rule matching. Domain rules and IP rules see different information, and DNS resolution by an app, the client, or a remote server may follow different paths. If basic access works but some sites take the wrong route, check the destination and outbound in the logs, then review rule order and DNS strategy. Don't switch everything to global routing just to avoid troubleshooting; restore the original preset after testing.
Client downloads / Choose by operating system and processor
Choose a client for one of four platforms
Identify your operating system, processor architecture, and package format first. Similar client names don't mean their installers are interchangeable. The download page lists available options and system requirements; this page is only a platform guide, not a place to mix installer files into the homepage. If you already have a client, back up subscription groups and custom rules before updating, and note your current entry mode.
Recommended: v2rayN. The download page offers a desktop edition and a classic WPF edition. The desktop edition uses a cross-platform interface, while WPF retains the classic window layout. Before following a tutorial, check which interface you're using, as menu locations may differ. If the client won't start after installation, check the system requirements and desktop runtime first, then make sure the files were fully extracted to a writable folder.
A good fit for desktop use that calls for subscription groups, a server list, and routing options. Don't run the app from inside an archive preview window.
Choose v2rayN, then check your chip under “About This Mac.” Apple Silicon uses ARM; Intel uses x64. Don't choose based on similar-looking filenames alone. After installation, open the client and import your subscription before configuring the system proxy. If using a virtual network interface, review the permission prompt and confirm it comes from the app you just launched.
To move your configuration, use a subscription URL or share link when possible. Proxy entry points and app data folders differ between desktop operating systems.
Start with v2rayNG, which uses the Xray core. If you need a V2Fly core, consider v2flyNG. Most modern devices can use arm64; if you're unsure of your architecture, choose the universal build. After importing, select a server entry, start the connection, and respond to the system VPN permission prompt. If the connection drops, check background activity restrictions and battery settings too.
A QR code is handy for moving a single configuration; a subscription keeps the server list updated. Don't post a subscription QR code on a public page.
Choose v2rayN, select deb or rpm to match your distribution's package system, and verify whether you need x64 or arm64. A graphical desktop's system proxy and proxy settings for command-line apps are separate paths. Browser access doesn't mean every app is using the proxy. First test a basic connection in the graphical client, then decide whether other apps need their own proxy entry.
For TUN mode, also check permissions and how your system manages networking. Don't broaden the listening address to fix a local port configuration problem.
The client provides connection tools, but you'll need to obtain your own server configuration. Installing the client doesn't give you a working server. If the list is empty, first get a subscription URL or share link that you're authorized to use. The steps below are for a first-time setup and for returning to a known-good baseline after making several changes.
Import configuration and check its source
Open v2rayN, add a subscription URL under “Subscription Groups,” save it, and update the subscription. If you only have a single share link, copy it and press Ctrl+V in the main window to import it. The two methods update differently: subscriptions sync from their source, while single links usually need to be replaced manually. After importing, check the protocol, address, port, and transport details. Confirm the expected entry appears in the list, then select the server you want to use.
If the list is still empty after updating, check that you copied the full URL and that a filter isn't hiding the current group. Don't keep adding the same subscription to try to fix it, and don't show a full subscription URL in a public screenshot. On Android, use the client's import menu for the same task; button locations depend on the current interface.
Configure the entry point, then choose a routing preset
In a desktop client, select “Set system proxy automatically” to send apps that follow system settings through the local proxy port. Then choose a routing preset. With “Bypass mainland China,” destinations matching direct rules can connect directly; with “Global,” be aware that the preset may still retain special rules. System proxy and global routing are separate switches: enabling one does not configure the other.
For the first test, keep the default DNS and regular proxy entry; don't add TUN mode yet. If an app has its own proxy settings, check whether they override the system settings. On Android, grant VPN permission when prompted to start the connection, then check the client status and test access.
Open the target page and check the logs
Use a browser that follows the system proxy to visit the target, check that the page loads fully, then review the client logs. TCPing only indicates whether a particular TCP connection is reachable; it can't replace a real test involving the protocol handshake, TLS, and access to the destination. If the numbers look normal but the page won't open, check the server parameters, system clock, DNS resolution, and selected outbound instead of repeatedly reordering entries based on the test result alone.
Change one variable at a time, reload, and revisit the same destination to make comparisons easier. When you're done testing and ready to quit the desktop client, clear the system proxy first, then close the app. Otherwise, apps may keep connecting to a local port that is no longer listening. For further troubleshooting, record the error text and steps you took; that's more useful than simply saying “it won't connect.”
Open-source ecosystem / Distinguish projects, cores, and interfaces
How Project V, V2Fly, and Xray relate
“V2Ray” is often used as a broad name for a set of proxy tools, but project background, cores, and graphical clients are best understood separately. Project V is the project behind related networking tools and technologies; V2Ray is one of its widely used core components. The V2Fly community continues V2Ray-related development, while Xray branched from this ecosystem and has developed its own features and configuration support. Similar terminology doesn't mean every field is interchangeable.
The core handles connections; the client organizes the controls
The proxy core handles protocol handshakes, transport, DNS, and routing. The graphical client organizes these capabilities into menus, server lists, and settings screens. v2rayN provides a desktop configuration interface and can select supported cores; v2rayNG is for Android and uses the Xray core; v2flyNG is an Android alternative using the V2Fly core. Choose based on your device and server requirements. A client name isn't a protocol name.
For example, VMess, VLESS, and Trojan are connection protocols; WebSocket is a transport method; TLS is a connection security setting; and REALITY support depends on the core and configuration. Share links bundle these parameters together, while the interface presents them as separate fields. When troubleshooting, check each field against the server details rather than assuming a matching protocol name means the configuration is complete.
Treat open-source licensing and configuration responsibility separately
All three graphical clients are open-source software, but clients, cores, and rule data may use different open-source licenses. When reading, modifying, or distributing source code, follow the license included with each component. For example, the V2Ray core from V2Fly and the Xray core use MPL 2.0; that doesn't mean every graphical client uses the same license. Clients are free connection tools; server resources and subscription services are separate.
Open source describes the code and its licensing; it doesn't tell you whether a particular configuration source is trustworthy. Subscription URLs may contain access credentials, and share links may include connection secrets. Keep backups secure and remove this information before sharing logs or screenshots. Subscription conversion adds another step where configuration is processed. If you're simply moving a configuration to another device, try the client's built-in subscription or share-link import first.
Check the interface, core, and rules separately when updating
A client update may change the interface, how configurations are generated, or which components are included. A core update may change protocol behavior or supported fields. Rule data updates can change which domains and addresses match. So updating the client doesn't necessarily update all configuration data. Back up first, read the relevant release notes, check that the client starts after updating, test destinations that previously worked, and then verify your custom routing rules.
If a configuration starts misbehaving after an update, restore a backup first to see whether the change caused the issue. Don't repeatedly overwrite the entire data directory before identifying the cause, and don't replace it wholesale with another device's directory. To use the setup on another device, move the server connection details and configure system proxy, permissions, and TUN separately. This keeps each configuration boundary clear.
Configuration migration, proxy modes, and startup troubleshooting
After verifying a basic connection, add settings to address specific needs. To share a configuration between a computer and phone, first compare the limits of subscriptions, share links, and backups. If traffic is bypassing the proxy unexpectedly, distinguish system proxy settings from routing rules. If the client won't open, start by checking its runtime environment. Each article covers one scenario, making it easier to follow, reproduce, and undo the steps.
Compare sharing a subscription URL, a single-server link or QR code, and importing a configuration backup. Learn the trade-offs when moving between v2rayN and v2rayNG.
Explains how system proxy settings and routing presets are separate, then compares traffic flow, use cases, and common misconfigurations for Global and Bypass mainland China.
Troubleshoot crashes in order of likelihood, from desktop runtime versions, extraction-folder permissions, and security software blocks to corrupted configuration files. Each section includes steps you can follow.