For v2rayNG users who have already imported VMess or VLESS nodes but are seeing an unresponsive first connection, disconnects after locking the screen, or a need to proxy only selected apps. Follow the steps for VpnService permission, battery restrictions, and per-app proxy settings, then use logs and connectivity tests to identify whether the issue lies with the node, Android permissions, or routing rules.
Complete VpnService authorization before the first connection
In its usual VPN mode, v2rayNG calls Android’s VpnService interface to create a local virtual network and take over the traffic that needs handling. This system interface is not a remote VPN protocol and does not replace node protocols such as VMess, VLESS, or Trojan; it sends app traffic to v2rayNG, while the Xray core selects the remote outbound according to the active configuration.
When you tap the connect button in the lower-right corner of the main screen for the first time, Android usually shows a “Connection request” dialog. After confirmation, a key or VPN indicator appears in the status bar. Only one VpnService app can occupy the interface at a time. If another network tool is still running, v2rayNG may remain stuck on starting or stop immediately after launch.
Import a configuration
Tap “+” in the upper-right corner of the main screen and choose “Import from clipboard” or “Scan QR code.” For subscription users, open “Subscription group settings” from the left menu, add the link, and select “Update subscription.”
Choose a node
Return to the configuration list and tap an available configuration so that a selection mark appears on the left. Importing a configuration is not enough; make sure it is selected as the active node.
Start the connection
Tap the round connect button in the lower-right corner of the main screen, then confirm in Android’s “Connection request” window that v2rayNG may establish a VPN connection.
Check the status
Make sure the status at the bottom changes from “Disconnected” to “Connected,” then open the upper-right menu and run “Test all configurations for real connectivity” or test latency for the active configuration.
Resolve interface conflicts
If the authorization dialog does not appear, stop other apps using the system VPN interface, then go to “Settings” → “Apps” → “v2rayNG,” force-stop it, and open it again.
If the connect button works and the system VPN indicator appears but webpages still do not open, VpnService authorization has probably completed. Check the node’s validity, server address, port, TLS time verification, and DNS settings instead of resetting app permissions again. A device clock off by a few minutes can make a configuration using TLS or REALITY fail its handshake, so automatic date and automatic time zone should remain enabled.
Fix disconnects after screen lock with battery optimization exemptions
Android may restrict background activity when the screen is off, the battery is low, or the app has been idle for a long time. A “Connected” status in v2rayNG does not mean the system can never reclaim its process. If everything works with the screen on but messages are delayed after a few minutes of screen lock and recover only after reopening the client, check the battery policy before switching nodes repeatedly.
The standard Android path is usually “Settings” → “Apps” → “Special app access” → “Battery optimization” → “All apps” → “v2rayNG” → “Don’t optimize.” Some devices place the same option under “Settings” → “Apps” → “v2rayNG” → “Battery,” where it may be called “Unrestricted,” “Allow background activity,” or “No restrictions.” The goal is to let the client maintain the local VPN and remote connection after the screen is locked.
- Disable battery restrictions: Set v2rayNG’s battery policy to “Unrestricted” or “Don’t optimize”; disabling only the system-wide battery saver is not enough.
- Allow background activity: If the system offers “Background activity,” “Auto-start,” or “Associated launch,” grant v2rayNG the necessary permissions.
- Keep foreground notifications enabled: Do not block the ongoing service notification while connected; it indicates that Android’s foreground service is still running.
- Remove data restrictions: In “Settings” → “Network & internet” → “Data Saver,” allow v2rayNG unrestricted data access.
- Retest after screen lock: Keep the connection active, lock the screen for 30 minutes, then check message delivery and webpage access over both Wi-Fi and mobile data.
Local ports 10808 and 10809 are mainly for sharing the proxy or manually assigning a local proxy. Ordinary apps in VPN mode usually do not need a port entered. If you changed “Settings” → “Local port,” also check other devices or apps that depend on that port; changing the port will not fix Android killing the app in the background.
Configure per-app proxy with an allowlist or exclusion list
Per-app proxy determines which Android apps enter the virtual network created by v2rayNG. It operates at a different layer from server-side routing: per-app proxy first decides on the device whether traffic is handed to v2rayNG, while routing rules then decide whether traffic already inside the client uses the proxy, goes direct, or is blocked. Once an app is excluded from VpnService, later domain rules cannot take control of its traffic.
In the v2rayNG 1.10.x series, open the left menu and go to “Settings” → “Per-app proxy.” Some interfaces show “Per-app proxy” directly in the main menu, but the key options remain enabling per-app proxy, selecting apps, and switching bypass mode. After changing the settings, stop and restart the connection so VpnService rebuilds its app scope.
Proxy selected apps only
RecommendedOnly apps checked in the list enter v2rayNG; all others keep the system’s default network. The scope is easy to understand and is ideal for validating a small number of apps first.
Good for: proxying work apps, browsers, or specific tools as needed
Bypass selected apps
Most apps enter v2rayNG, while checked apps use the local network directly. Newly installed apps usually enter the proxy scope automatically, so review the list regularly.
Good for: sending most apps through the proxy while excluding payment, local-network, or download tools
Take over all apps
Turn off per-app filtering so all apps that can be managed by the system enter the virtual network; domain and IP routing rules then determine the outbound path.
Good for: devices that need unified routing and can maintain a complete rule set
Open Settings
Open the left menu, go to “Settings” → “Per-app proxy,” and enable “Enable per-app proxy.”
Choose the mode
When only a few apps need the proxy, turn off “Bypass mode.” When most apps need the proxy, turn on “Bypass mode” so checked apps use a direct connection.
Select apps
Choose target apps by name. If you are unfamiliar with system components, do not select them in bulk, as this may affect push notifications, online verification, or local network discovery.
Restart the connection
Return to the main screen, tap the connect button to stop the connection, then connect again. Returning to the home screen without reconnecting may leave the previous VpnService app scope active.
Verify one app at a time
Open one app that should use the proxy and another that should connect directly. Compare the egress address, loading result, and v2rayNG logs to confirm the routing direction.
An allowlist is easier to troubleshoot: start with one browser, verify that the node, DNS, and webpage access all work, then add other apps one by one. If you select dozens of apps at once, it becomes difficult to tell whether an issue comes from the app itself, routing rules, or background restrictions.
Check subscriptions, routing, and DNS separately
A subscription link provides server configurations in bulk, usually including the address, port, user ID, transport, and TLS parameters. It does not automatically decide Android’s battery permissions and may not include local domain routing suited to the current network. Node names changing after a subscription update is normal, but manual edits to subscription nodes may be overwritten by the next update.
v2rayNG uses the Xray core to process VMess, VLESS, and other configurations. When you choose VLESS, REALITY, or another combination, the client parameters must exactly match the server, especially the port, transport, Server Name, public key, and Short ID. If a connectivity test times out, check server reachability first; if the log shows a handshake error, verify the TLS or REALITY parameters.
| Layer to check | Primary role | Typical symptom | First action |
|---|---|---|---|
| Subscription and node | Provides the server address, port, and protocol parameters | All nodes time out or one node fails its handshake | Update the subscription, verify the device time, then test multiple nodes |
| VpnService | Hands app traffic to v2rayNG | Fails to start, stops immediately, or conflicts with another VPN | Disconnect the app occupying the interface and authorize again |
| Per-app proxy | Determines which apps enter the virtual network | The browser works but a specific app always connects directly | Check the bypass direction, select the app, and reconnect |
| Routing rules | Determine whether captured traffic uses the proxy, connects directly, or is blocked | Some domains use an unexpected egress path | Review the current routing mode and rule order |
| DNS | Resolves domains to addresses and works with traffic routing | The server connects but domain pages do not open | Switch to a reliable DNS and check whether domain and IP rules match |
DNS and routing should follow the same traffic-splitting strategy. For example, a domain may be set to connect directly, but if its resolution comes from an upstream DNS server unsuitable for the current network, access may be slow or fail. Conversely, if a domain is resolved to an IP first and the rules cover only the domain, matching may fall to the IP and produce a different outbound path. During troubleshooting, verify the node with the default configuration first, then restore custom DNS and routing one setting at a time; this is more efficient than changing several switches at once.
- Test the same node on two different networks first to separate device configuration issues from current network problems.
- Confirm that Android automatic date, automatic time, and automatic time zone are all enabled.
- In “Settings,” check “Predefined rules” or the current routing mode to avoid accidentally selecting full direct connection.
- After updating the subscription, select the active node again and make sure it is not still using a deleted old configuration.
- After changing DNS, per-app proxy, or the local port, stop the connection completely and establish it again.
Use logs to diagnose a connection that succeeds but cannot access sites
“Connected” only means Android has established a local VpnService; it does not guarantee that the remote node handshake succeeded. The correct order is to confirm that the client starts, check whether the node connects, and then verify that the specific app is within the proxy scope. Mixing these three layers often leads to repeated authorization and subscription imports without addressing the actual fault.
No system authorization dialog after tapping Connect?
Go to “Settings” → “Network & internet” → “VPN” and disconnect any existing connection, then open “Settings” → “Apps” → “v2rayNG” and force-stop it. Reopen the client and tap Connect; Android should display the connection request again.
Messages stop arriving after the screen has been locked for several minutes?
Go to “Settings” → “Apps” → “v2rayNG” → “Battery” and choose “Unrestricted.” Then open “Special app access” → “Battery optimization” and select “Don’t optimize.” Keep the connection active and run a 30-minute screen-lock test.
The browser works, but another app does not?
Check bypass mode under “Settings” → “Per-app proxy.” If you are using proxy-selected-apps-only mode, make sure the target app is selected; stop and reconnect after making changes.
All nodes time out after updating the subscription?
Test once over Wi-Fi and once over mobile data, then verify automatic date and time zone. If multiple nodes time out on both networks, check that the subscription is still valid and that the server address and port have not changed.
It says Connected, but no domain opens?
First visit a known-reachable IP service to distinguish a DNS issue, then restore v2rayNG’s default DNS settings and test again. If access works afterward, check the matching direction of custom DNS, domain rules, and IP rules one by one.
The log is usually available under “View logs” in the upper-right menu of the main screen. Look for terms such as startup failure, connection timeout, connection refused, TLS handshake failure, and DNS query failure; there is no need to interpret every line. A timeout means no valid response arrived within the limit; connection refused often points to a server port that is not listening; a handshake failure calls for checking the protocol and encryption parameters.
- Round one: Disable custom routing and custom DNS, keep one known-good node, and confirm the basic connection.
- Round two: Enable per-app proxy for only one target app and verify the VpnService app scope.
- Round three: Restore the battery settings and run a screen-lock test to see whether Android reclaims the background process.
- Round four: Restore DNS, routing, and subscription group settings one by one, changing only one variable each time.
Daily troubleshooting order
Reliable v2rayNG use depends less on frequently changing parameters than on following a consistent order. After installation, authorize VpnService first, then configure battery optimization and background activity, and finally set up per-app proxy. Check node protocols, DNS, and routing only after system permissions are confirmed. This makes it easier to identify whether a problem belongs to Android, the client, or the server configuration.
- After importing a subscription, update it once and explicitly select the active node.
- During the first connection, approve Android’s VpnService request and check the connection indicator in the status bar.
- Set v2rayNG’s battery policy to “Unrestricted” or “Don’t optimize.”
- When only a few apps need the proxy, start with “Proxy selected apps only.”
- Stop and reconnect after changing the per-app list, DNS, or routing mode.
- Retest separately over Wi-Fi, mobile data, and 30 minutes of screen lock.
- When a problem occurs, keep the logs and troubleshoot in this order: authorization, node, app scope, routing, then DNS.