Step 1: Import a subscription
Get a valid subscription URL before opening the client. The client reads configuration and establishes connections; installing it does not give you any nodes. Get the subscription URL from a trusted service provider. If you only have a string that starts with vmess://, vless://, or trojan://, that's a node share link. It uses a different import option from a subscription group, so don't paste it into the subscription URL field.
v2rayN: Save a group, then update the subscription
In the main window, click Subscription Group at the top, open Subscription Group Settings, and click Add. Enter a recognizable group name in Remark, paste the full subscription URL into Address, and click OK to save. Check the beginning and end of the URL when copying it, and remove any extra spaces, line breaks, or punctuation from chat messages. Query parameters are usually needed to identify the subscription, so don't remove them.
Return to the main window, select the group you just saved, then choose Update current subscription (no proxy) from the Subscription Group menu. During initial setup, you don't yet have a working connection, so use this option to avoid relying on a proxy that isn't running. The server list should show entries after the update. Saving a group only stores the URL; servers appear only after a successful update and import.
If the list is still empty, check the latest subscription update entry in the log at the bottom. A URL that can't be reached, an expired subscription, and a response that can't be parsed are different problems. Recheck the original URL and subscription status first; don't keep deleting and reinstalling the client. Try updating through a proxy only if you already have a working proxy and know the subscription URL must be accessed through it. Changing the update method won't fix an invalid subscription.
v2rayNG: Manage subscriptions from the top-right menu
On the main screen, tap the three-dot menu in the top-right corner, open Subscription Group Settings, and tap the plus button to add a group. Enter a label and subscription URL, then save. Return to the main screen, open the three-dot menu, and select Update subscription. Some versions let you update the current group or all groups; choose the group you just added. Wait for the update to finish and confirm that nodes appear in the list, not just a subscription label.
If you have a single node share link, copy the entire link and use Import from clipboard under the plus button on the main screen. In v2rayN, use Import batch URLs from clipboard in the Server menu. Nodes imported from share links usually aren't updated automatically with a subscription group, so you'll need to import them again if the configuration changes. Avoid adding the same URL as multiple groups, which can make it hard to tell them apart after updates.
Don't run speed tests or change protocol fields yet. First, decide how traffic will enter the client and which route it will take. If the update log mentions a subscription format or encoding issue, see Frequently Asked Questions for help before continuing.
Step 2: Choose a proxy mode
First, understand the two separate settings. The system proxy or VPN determines whether traffic reaches the client; the routing mode determines whether traffic that reaches it goes direct or through the proxy. “Global” usually means global proxy routing; it doesn't mean every program on your computer will automatically use the system proxy. Keep the first setup simple: don't enable the system proxy, TUN, and multiple network tools at the same time. That makes it easier to see the effect of each change.
v2rayN: Configure the system proxy and start with standard routing
At the bottom of the main window, open System Proxy and select Auto configure system proxy. You can also right-click the v2rayN tray icon and choose the same option from the System Proxy submenu. This points the system proxy to the client's local listening address. Keep v2rayN running and test with a browser that follows the system proxy. Opening the client alone isn't enough: if the system proxy is set to Clear system proxy, regular browser traffic may still go directly to the internet.
Next, choose a standard routing rule from the Routing selector at the bottom. If the list includes Bypass mainland China (whitelist), you can start with that: destinations matching direct rules connect directly, while others follow the selected routing configuration. Rule names vary between versions and configurations, so check what the rules do instead of relying on their names. To compare routing behavior, temporarily switch to Global routing, then restore your original rule after testing.
Leave Enable TUN off during initial setup. TUN requires a virtual network adapter, permissions, and system routes; it's not necessary for a basic connection. If the browser works but an app doesn't, check whether that app follows the system proxy. If needed, see the traffic interception and permissions section in the Cross-Platform Guide. Don't keep switching routing rules instead of checking how traffic enters the client.
v2rayNG: Check routing settings and authorize the VPN connection
Tap the menu in the top-left corner of the main screen, open Settings, and find Routing settings. Check the current option under Predefined rules. For everyday split routing, start with Bypass LAN and mainland China addresses. To temporarily rule out split routing, try Global proxy. If you have custom rules, note the current selection before making changes; don't clear them. Save your settings, return to the main screen, and use the connect button to establish the traffic tunnel.
The VPN icon in the Android status bar means the system is routing the relevant traffic through a local VPN tunnel; it doesn't mean the node has connected successfully. If you've configured per-app proxying, check that your browser is included. The app list's meaning changes with the bypass-mode setting, so read its description too. For the first test, include all apps to avoid mistaking an excluded app for a node failure.
Your subscription now provides nodes, and you've chosen how traffic enters the client and which route it takes. Next, select one node and connect. Don't change DNS, transport parameters, or TLS settings at the same time. Keeping the original configuration makes it easier to tell whether a connection failure is due to the subscription or a local change.
Step 3: Select a node and connect
Choose one entry from the group you just updated and set it as the active server. A node name is only a label, not proof of connection quality; seeing a node in the list only confirms that its configuration was imported. First, connect using one complete configuration from a valid subscription, then compare latency and throughput. If other proxy, VPN, or traffic interception tools are running on your computer or phone, stop them first to prevent conflicts with ports, system proxy settings, or routes.
v2rayN: Set the active server and check that the core starts
In the server list, right-click the target node and select Set as active server. Make sure the active indicator is on the expected entry, then check the log at the bottom. v2rayN starts or reloads the core based on the current configuration; you usually don't need to look for a generic Connect button. Keep Auto configure system proxy enabled from the previous step, then open a browser to verify the connection.
If the log reports that a local listening port is in use or the core failed to start, fix the startup error before switching nodes. For a port conflict, close duplicate client instances first. If you need to change a port, go to Settings > Parameter settings and check the local listening configuration; reconfigure the system proxy after making changes. Don't copy a fixed port value from another guide. The proxy address must match the listening address used by your client.
If the core is running but requests time out, keep the current routing rule and try another node from the same valid subscription. One failing node and all nodes failing point to different causes. If only one fails, check that node first; if they all fail, also check your local network, system clock, and subscription status. For more detailed TLS, DNS, and routing checks, see the troubleshooting FAQs.
v2rayNG: Select a node and approve the system VPN request
Select the target node in the main list and confirm that its selection indicator changes, then tap the connect button in the bottom-right corner. The first time you connect, Android displays a VPN connection request. Confirm that it comes from the v2rayNG app you're using, then allow it. This permission is required to create the local traffic tunnel. If you cancel the request, tap the connect button again instead of waiting for the node to connect on its own.
After connecting, check the button state and VPN icon in the status bar. If the connection stops right away, open Log from the main-screen menu and check for startup errors. Android may stop one VPN app if another is running, so keep only one traffic interception tunnel active while testing. If the connection drops only when the app is in the background, check for background restrictions under System settings > Apps > v2rayNG > Battery. The exact labels depend on your phone.
A status of Running isn't the final confirmation. It only means the client or local tunnel has started; you still need to verify the remote connection and access to your destination. Keep the current node and follow the same checks in order so you can interpret the results without switching nodes mid-test.
Step 4: Verify the connection
Check three things: whether the client can send a proxy request, whether the app can reach its destination, and whether traffic follows the expected route. A successful TCP port test doesn't replace these checks, and a VPN icon in the status bar doesn't prove the remote handshake succeeded. For your first setup, skip download speed tests and start with a small, repeatable browsing check.
Run a real connection test, then open a page
In v2rayN, right-click the current node and select Test server real connection latency. In v2rayNG, open the top-right menu, select Test all configurations for real connection, and check the result for the selected node. Menu names may vary slightly between versions; make sure you're using a real connection test, not TCPing. A real connection test sends a proxy request using the client's test method, making it more representative of everyday use than checking whether a remote port is open. It still only shows whether the test destination was reachable at that moment.
Next, open a browser and visit an HTTPS page that should use the proxy under your current rules, then visit a regular page that's expected to connect directly. Check that the page content, images, and subsequent redirects load correctly. If needed, reopen the tab to avoid seeing cached content. One inaccessible site doesn't mean the whole proxy is broken; try another similar destination to rule out a site-specific issue.
Test succeeds but browsing fails? Check how traffic enters the client
If the client test succeeds but your browser can't connect, check System Proxy in the desktop client and confirm that Auto configure system proxy is still selected. Also check whether the browser has a separate proxy setting or proxy extension. On Android, confirm that the VPN is still running and that per-app proxying includes your browser. The test feature may send requests directly through the core, while the browser relies on system-level traffic interception. They use different paths, so their results can differ.
Next, make a new request and check the log at the same time, using the timestamp to find the relevant entry. If the log shows a connection error, note the error keywords for troubleshooting. If it includes an outbound tag, use it to see whether the request went direct or through the proxy. No request entry doesn't prove that traffic never reached the client; log level, connection reuse, and client version can all affect what's displayed. Confirm that logging is working, then check the system proxy and actual browsing results together.
To compare split-routing behavior, temporarily switch to global routing and retry the same destination. Restore the original rule as soon as the test is done. If only global routing works, check the original domain matching and routing rules. If both modes fail, check the node, network, and startup log. An IP lookup shows the exit IP for that particular request; it doesn't prove that every app uses the proxy.
Finally, disconnect and confirm normal network access
When you're done, select Clear system proxy from the System Proxy menu in v2rayN before quitting. Otherwise, apps may keep sending requests to a local listening port that's no longer running. If you enabled TUN, turn it off first and wait for the network to recover. In v2rayNG, tap the connect button to disconnect, make sure the VPN icon disappears from the status bar, then open a regular page to confirm that normal network access has returned.
Your initial setup is complete once you can reconnect and repeat the same checks with the same results. For future subscription updates, node changes, or routing adjustments, change one setting at a time and repeat the steps in this section. If timeouts persist, DNS lookups fail, or the connection drops after sleep, see the Frequently Asked Questions. For more detailed system-specific guidance on permissions, TUN, and DNS, read the Cross-Platform Installation and Setup Guide. That's all you need for a basic setup; there's no need to change every advanced option just to connect for the first time.