FAQ / Setup & Troubleshooting
V2Ray FAQ
Subscriptions, proxy modes & connection troubleshooting
Find answers by where the problem occurs. Check the configuration input first, then confirm the core is running, and finally verify that the app's traffic enters the proxy. Change one setting at a time to help isolate the cause.
Configuration source → Core status → Traffic entry point → Routing & DNS
This page covers 16 questions. Select a question to expand its answer; select it again to collapse it. For a first-time setup, start with the getting started guide. If you already have an error, note its key terms from the logs and compare them with the answers here.
Clients & cores
Basics
Distinguish the client, core, and remote service first to avoid changing settings in the wrong place.
What do V2Ray, Xray, and v2rayN each do?
V2Ray is part of the Project V proxy technology ecosystem, with V2Fly and Xray as related core families. The core handles protocols, establishes connections, and applies routing. v2rayN is a graphical client that stores subscriptions, lets you choose servers, generates configurations, and manages the core. When troubleshooting, first determine whether the interface opens, the core starts, and a connection can be established; each points to a different set of checks. The same protocol name does not guarantee support for every newer field. Before importing a configuration, confirm that your client and the core it actually uses can recognize it.
Which client should I use on desktop or Android?
For Windows, macOS, and Linux desktops, start with v2rayN. The Windows download section also offers Desktop and the classic WPF interface; choose based on your workflow and system requirements. For Android, start with v2rayNG, which uses the Xray core. Consider v2flyNG only if an existing configuration specifically depends on the V2Fly core. Choose based on platform, processor architecture, and configuration compatibility—not similar-looking names. Before switching clients, keep your subscription URL and any essential routing notes, then test the import. Do not assume full backups can be restored across different clients.
Why are there no servers after installing the client?
The client manages configurations and connections; installing it does not provide a remote service. Use a subscription URL you are authorized to access, or import a single configuration supplied by the server administrator, then select a server and connect. Check which subscription group is selected on the main screen so you do not mistake an empty group for an import failure. Subscription URLs may contain credentials, so do not post them publicly or share the full QR code. This site provides client guides and configuration tutorials, not working server nodes. Your configuration must remain valid before you can troubleshoot proxy modes and network connectivity.
What is the difference between system proxy, global routing, and TUN mode?
The system proxy determines whether apps that follow system settings send requests to the local proxy. Routing rules determine which outbound handles requests once they reach the core. TUN uses a virtual network interface to capture eligible traffic. These operate at different stages: switching to global routing does not automatically make every app use the system proxy. For an initial setup, leave TUN off and use the system proxy to verify that a browser can reach the target. Then troubleshoot apps that do not follow system proxy settings. If only one app has connection issues, check how it connects to the proxy instead of repeatedly changing routing modes.
Imports, architecture & permissions
Setup
Start with the input type and local environment. Import failures, installation problems, and core startup failures need to be handled separately.
Where should I start when v2rayN cannot import a subscription?
First identify whether you have a subscription URL, a single share link, or a webpage URL. Add and save subscription URLs in the subscription group settings, then update the subscription. Single share links are usually imported from the clipboard. Remove leading or trailing spaces and line breaks, and do not paste explanatory text from a chat app along with the link. If the format is unsupported, check whether the response is actually a login page, an error page, or another format that needs conversion. Instead of retrying the import, confirm the input type and response, then check the logs for parsing errors. Menu names may vary by version.
Which Android download should I choose: arm64 or universal?
Check the processor information under About device in your settings. If the system does not show the architecture, consult the device manufacturer's specifications. Most recent Android phones use arm64, so choose the arm64 package if that matches your device. If you are unsure or need compatibility with multiple supported architectures, consider the universal package. Universal does not mean faster; it usually includes components for more architectures and may be larger. If installation reports a parsing error, also check your Android version, whether the download completed, and whether the existing app has a matching signature. Do not assume the architecture is the cause based on that message alone.
What should I do if TUN reports insufficient permissions?
Turn off TUN first and confirm that standard system proxy mode works. This avoids troubleshooting permissions and subscriptions at the same time. On Windows, exit the client and restart it as an administrator. On macOS and Linux, follow the client's prompts to grant the required permissions or configure helper components; do not change permissions across the entire application directory blindly. On Android, approve the system VPN connection request the first time you connect, and check whether another VPN app is already using the connection. If it still fails after authorization, check the logs for virtual network adapter creation or route-writing errors. Fix the local environment before changing subscriptions.
Can I change the local port if 10808 is already in use?
Yes, but first check whether another client instance is still running in the background. Exit any duplicate instances and restart. If another program still occupies the port, change the local listening port under settings and save. Use the value shown in your current interface; 10808 is only a common example. Restart the core after changing it, and update any manually entered addresses in browser extensions or apps with their own proxy settings. Reconfigure the system proxy as well. Do not let two programs share the same listening address and port, and do not enable LAN access just to clear an error.
Updates, routing & tests
Tips
Keep the basic setup that works, then adjust the update route, routing, and test method one at a time.
When updating a subscription, should I connect directly or use the proxy?
Try a direct update first, provided your current network can reach the subscription URL. Use the proxy only if direct access fails and you have already verified that the existing proxy connection works. If you are importing for the first time and have no working server yet, updating through the proxy usually has no working connection to use and is not a general fix. Keep the original group before updating, then confirm the server list matches the selected group. If the response indicates an authentication failure or expired URL, changing the update route usually will not help; check your subscription access and expiration date. Do not enter subscription URLs on public online converters or network testing sites, as they may expose access credentials.
How do I bypass mainland China with routing rules, and does rule order matter?
In v2rayN's routing settings, choose a rule set that bypasses mainland China and fits your needs. Save it and confirm it is the active route. Rules are usually checked in order, so a broad rule near the top can prevent a more specific rule from matching. Put rules for specific domains before rules that cover a wider scope. For geosite or geoip entries, ensure the current core supports the syntax and that the rule data files are available. Test destinations expected to connect directly and through the proxy, then check outbound tags in the logs. A page loading in the browser alone does not confirm that routing worked as intended.
Which should I check: V2Ray latency or download speed?
TCPing checks whether a TCP connection can be established to the target port. A real connection latency test also involves the proxy route and requests to its test target, while a download speed test measures data transfer over a period of time. Each test covers different steps, so their results are not interchangeable. For everyday use, first check whether your actual destinations are reliably reachable, then use real connection latency as a guide to responsiveness. Run a brief speed test if you often download large files. An unreachable test target can also cause failures, so one timeout does not mean the server is down. Avoid testing many servers at once, as competition for local bandwidth can skew results.
What logs and system details should I share when asking for help?
Note your operating system, client name and version, the core actually in use, proxy mode, and the steps that triggered the problem. Then copy a short, continuous section of logs from around the error. Preserve the order of events and key terms such as connection refused, i/o timeout, or TLS handshake failure; there is no need to share a full log from extended use. Before posting, remove subscription URLs, identifiers, passwords, tokens, and any server details you do not want to disclose. If you need more verbose logs, enable them briefly, reproduce the issue once, then restore the previous level. Include recent settings changes and whether a direct connection works with the client closed; this is usually more useful than a single error screenshot.
Narrow it down by symptom
Troubleshooting
A timeout is only a symptom. Use logs and comparison tests to distinguish subscription access, remote connections, local proxy entry points, and DNS issues.
How can I diagnose a failed subscription update or an empty server list?
First confirm that the selected group is the one you just updated, then check the update logs. A domain lookup failure usually points to local DNS or network issues; a connection timeout calls for checking the access path; an authentication failure means checking the URL and permissions. If the update succeeds but the list is empty, the response may contain no recognizable entries, or a group filter may be hiding them. Clear filters and keep the existing configuration rather than deleting all servers. If the URL returns a webpage or its format has changed, ask the configuration provider which client formats are supported. Switching between direct and proxy updates only helps when the access routes differ; it cannot fix expired credentials.
Are repeated server timeouts caused by a failed server or my local network?
Stop testing servers in bulk and check a single known configuration. Confirm the device clock is accurate and the basic network works, then use the logs to distinguish a DNS lookup failure, connection timeout, or handshake error. A reachable port does not mean the protocol settings are correct; TLS, transport, and server settings must also match. If the same configuration works on another trusted network, investigate the current network, firewall, or DNS first. If only one server keeps failing, check its remote status. Test results also depend on the target, so consider actual app connections and log evidence together. Do not reinstall the client repeatedly based on a timeout label alone.
The client says connected, but the system proxy does not work. What should I do?
Connected often means only that the client or local service is running; it does not guarantee that requests have reached the remote server. First confirm the core is still running. Then choose the option to automatically configure the system proxy from the system proxy menu, and check the operating system's proxy settings to make sure the address and port point to the current local listener. Browser extensions, app-specific proxy settings, and other proxy tools may override these settings, so use just one control point while troubleshooting. If the browser works but one app fails, check whether that app follows the system proxy. If nothing works, continue by checking the server and routing logs. Clear the system proxy before exiting the client to avoid leaving a broken proxy setting behind.
Web pages will not load and the logs show DNS errors. Which settings should I check?
First identify whether the failing domain is for the subscription, the server, or the destination; each may use a different resolution path. Turn off the proxy and check whether your basic network can resolve common domains. If it cannot, fix the system network or DNS settings first. If only proxied destinations fail, check the core's DNS configuration, routing rules, and the route used to reach remote DNS. Avoid sending DNS requests through a connection that itself depends on those lookups, which can create a loop. Record the original settings, change one item at a time, and retest. Secure DNS in the browser and app caches can also affect results; avoid layering multiple custom DNS configurations at once.