Before you start, get three things working: import a valid subscription, select an active node, and connect an app to the local proxy. This guide uses the commonly seen Chinese-language interface in the Windows desktop client and covers subscriptions, system proxy settings, routing, ports, and logs in 10 focused answers. Menu locations may vary slightly by version. If a label differs, look for the equivalent feature and avoid changing several settings at once.
1. Why can't I browse the web right after downloading v2rayN?
v2rayN is a client management interface, not a remote node you can connect through. It organizes configurations, runs the proxy core, and provides a local entry point; a valid server configuration is still required for an actual connection. A subscription link is a way to update a set of configurations, while VMess and VLESS are protocols a node may use. They serve different purposes.
Choose an installer for your operating system and architecture on the client downloads page. Follow the prompts to install, or fully extract the archive before launching the main program—don't run it from inside the archive utility. Standard system proxy use typically doesn't require administrator privileges; elevated permissions are needed only for some virtual network adapter features.
- Client is running: This only confirms that the management interface opened; it doesn't mean the proxy core is running and listening.
- Nodes are listed: You still need to set one as the active server and make sure its configuration hasn't expired.
- Node connects: Your browser must still send requests to the local port through the system proxy or its own proxy settings.
Get the system proxy path working first, then explore TUN, per-app proxy settings, and custom routing. Adding more ways to capture traffic before confirming a basic connection makes it harder to isolate problems.
2. Where do I enter a subscription link?
Enter a subscription URL in a subscription group, not in the server address field for an individual node. A single-node link usually starts with a protocol name; a subscription URL is generally a full web address that includes an access token. Using the wrong field can cause a parsing error or leave the node list empty.
-
Open subscription groups
From the main window, go to “Subscription Group” → “Subscription Group Settings,” then click the add button. Some versions show the add control as “+”.
-
Enter the URL
Add a recognizable name in the remarks field, then paste the complete subscription URL into the address or URL field. Keep everything after the question mark; don't add spaces or line breaks.
-
Update the subscription
After saving, go to “Subscription Group” → “Update All Subscriptions (No Proxy).” Try this option first if you haven't established a connection yet.
-
Set an active node
Once nodes appear, right-click the one you want and choose “Set as active server.” Check the status area and logs to confirm the core started successfully.
If you have a single-node share link, copy it and use the clipboard import option under “Servers” in the main window. Don't include subscription links in public screenshots, support tickets, or chat logs—the token in the URL may grant direct access to your subscription.
3. The list is empty after updating. What should I check first?
Check the update result before deciding that a node is invalid. A failed download, unexpected response content, and a filtered-out group are different problems. Repeatedly clicking Update usually won't fix the underlying cause.
| What you see | Check first | Next step |
|---|---|---|
| Timed out or connection failed | Whether your current network can reach the subscription URL | If you have a working node, try “Update All Subscriptions (Through Proxy)” |
| 401 or 403 response | Token, account status, or access restrictions | Check with your subscription provider to see if the URL has been reset |
| Download succeeded, but parsing failed | Whether the response contains node data or a web login page | Copy the client subscription URL again, not the account dashboard URL |
| Update succeeded, but no nodes are visible | The selected group and search filters | Switch to All Groups and clear the search field |
“Update through proxy” requires a working proxy connection. If no node is available, switching to this option won't make an unreachable subscription URL accessible. Don't delete all your existing nodes and then retry, either: keep a known working node so you can recover if needed.
4. Which system proxy option should I choose?
If you're just getting started and mainly need browser access, choose “Set system proxy automatically.” In the Windows client, this is usually under “System Proxy” in the tray icon's right-click menu; some desktop interfaces also offer the same option in the main window. “Automatically” means the client updates the system proxy settings—it doesn't decide where each website should go.
Set system proxy automatically
RecommendedDirects apps that follow the system proxy setting to the local listening port. Most browsers work without extra configuration, as long as the active node and proxy core are running.
Best for: First-time setup and everyday browser use
Clear system proxy
Removes the system proxy entry set by the client. The proxy core can keep running, but browsers will no longer use it automatically through this system setting.
Best for: Pausing the proxy or troubleshooting connectivity after exit
Leave system proxy unchanged
Keeps the current system settings. This doesn't clear an old configuration; an existing proxy address may still be active. Check which app manages the setting.
Best for: Apps with a manually configured proxy or an existing fixed proxy setup
The system proxy doesn't capture all device traffic. Some command-line tools, games, and standalone network components ignore this setting and need a proxy configured separately—or TUN once the basic connection is confirmed.
5. What's the difference between the system proxy and routing modes?
The system proxy determines whether an app sends requests to the client; routing determines where those requests go next. Selecting global routing in the client won't connect apps that bypass the system proxy. Likewise, enabling the system proxy doesn't mean every request will go through a remote node.
Two ways to use routing: everyday split tunneling and troubleshooting
Everyday split tunneling
- In the main window, open “Routing” and choose a preset rule set, such as “Bypass mainland China.”
- Requests matching direct rules connect directly; the rest are handled by the preset rules.
- Test with one site that should connect directly and another that should use the proxy.
Temporary global test
- Temporarily select a preset global route to reduce interference from split-routing rules during testing.
- Keep the node, browser, and destination URL the same; change only the routing mode.
- Once access works again, check the original rules' order and which rules matched.
In short: confirm the app connects to the client first, then troubleshoot routing. Restore the rules you normally use when testing is done.
If a site still won't load with global routing, don't assume routing is the cause. The node connection, DNS, TLS handshake, or local port could also be failing. Change one thing at a time to see what makes a difference.
6. What's the difference between port 10808, the server port, and the local address?
The local port is where your browser connects; the server port is where the proxy core connects to the remote node. They don't need to match. The numbers below are common examples, not guaranteed values for your setup. Check “Settings” → “Parameter Settings” for the local listener and the node editor for the server details.
App connects to the local entry point
- Host
- 127.0.0.1
- Example port
- 10808
- Protocol
- Choose HTTP or SOCKS5 according to the listener settings; a mixed port can accept both
If you change the port, update any apps with manually configured proxy settings too. Don't assume separate HTTP ports in older versions apply to newer configurations.
Proxy core connects to the remote node
- Host
- Server hostname or address provided by your subscription
- Example port
- 443; use the value from your subscription
- Identity and transport
- UUID, TLS, and transport settings are determined by the node configuration
Don't change the node's port just to match the local port, and don't put a loopback address in the remote server field.
Two programs can't listen on the same local address and port at the same time. If the logs report that a port is already in use, close any duplicate client processes and restart the service. If you need to change the port, update the proxy settings in your apps too.
7. Why does the browser still fail when the latency test shows a number?
A latency result only means a particular test completed; it doesn't guarantee that every website will load. A TCP test usually confirms only that the remote port is reachable. A real connection test covers more steps, but results still depend on the test URL, routing, and current network conditions. Speed tests generate actual traffic and can't replace checking the app itself.
- Check the active node: The node you just tested may not be the one in use. Right-click it, choose “Set as active server,” and check the logs.
- Check the browser's proxy settings: Disable the browser's proxy extension or check whether it overrides the system proxy. Behavior varies by browser.
- Check the local service: Run the command below in PowerShell to test the example port. If your port is different, replace the number first.
- Check the exact error: If the local port is reachable but pages still fail, look in the core logs for handshake, DNS resolution, and timeout details.
Test-NetConnection -ComputerName 127.0.0.1 -Port 10808TcpTestSucceeded : True only means a service accepted a TCP connection on that port. It doesn't prove that the listener is the intended proxy core or that the remote proxy works. If you get False, check whether the core is running, the port is correct, and the listener started successfully before switching remote nodes.
8. How should I handle timeouts and handshake errors in the logs?
Note when the error occurred, then copy a few nearby log lines. The connection target, outbound name, and error chain are more useful than a generic “failed” message. Before sharing logs, redact subscription tokens, UUIDs, and other credentials while keeping the error text and relevant connection details.
| Error excerpt | Possible layer involved | What to do first |
|---|---|---|
address already in use | Local listener | Close duplicate processes, check the actual listening port, and restart the core |
connection refused | Destination address or port | Check whether the refused connection is to the local entry point or the remote node, then verify the address and port |
i/o timeout | Network path or remote response | Compare with a known working node, then test on a different network |
TLS handshake errors | System time, certificate, SNI, or transport settings | Sync the system clock and check the subscription configuration; don't disable certificate verification |
failed to lookup | DNS resolution | Identify whether the failed lookup is for the node hostname or the destination, then check the corresponding DNS path |
9. When should I use TUN? Can I use the same setup on Android?
Consider TUN only when you need to capture traffic from apps that ignore the system proxy. It uses a virtual network adapter and system routes, which can affect permissions, DNS, and compatibility with other networking software. For initial troubleshooting, turn TUN off and verify the connection with the system proxy. Once that works, test the “Enable TUN” switch in the interface and grant permissions when prompted.
- Desktop v2rayN: Manages nodes, system proxy settings, and routing. How TUN works depends on the client version, the proxy core, and its settings.
- Android v2rayNG: Uses the Xray core and routes traffic through Android's VPN service. You must approve the system permission when connecting for the first time.
- Android v2flyNG: Uses the v2fly core. Before importing, make sure the core supports the protocols and transport combinations in your subscription.
The same compatible subscription can be imported into both desktop and Android clients, but local ports, per-app lists, and routing settings won't sync automatically. Provider limits on device count, concurrent connections, and data usage still apply; being able to import a subscription doesn't mean unlimited devices can use it at once.
If enabling TUN disrupts local network access, causes DNS failures, or creates a routing loop, turn it off and restore the basic connection path first. Don't enable multiple virtual network adapters to capture traffic unless you know which rules each one controls.
10. How do I restore internet access after exiting v2rayN?
The most common cause is that the system proxy still points to a local port, but nothing is listening there after the client exits. Clear the proxy before closing the program. Closing the main window may only minimize it to the tray, so make sure the client has actually exited.
-
Clear the proxy
Reopen v2rayN, choose “Clear system proxy” under “System Proxy,” then exit the client from the tray menu.
-
Check Windows settings
In Windows 11, open “Settings” → “Network & internet” → “Proxy” and check “Use a proxy server.” If you manually set it to a loopback address, turn it off when you no longer need it.
-
Check the browser
Check whether a browser extension or separate proxy setting still points to 127.0.0.1. Restore the system settings, then open a webpage to test.
-
Check traffic capture
If you previously enabled TUN, restart the client, turn off TUN, and then exit normally. Make sure the basic network connection is back before deciding whether to enable it again.
Proxies, automatic configuration scripts, and managed settings on workplace networks may serve a specific purpose, so don't remove them indiscriminately. If browsing still fails after restoring the system and browser proxy settings, first check whether the network requires sign-in and whether Wi-Fi is connected. Then continue troubleshooting DNS; there's no need to reset all network settings as a first step.