This guide is for users who have installed a client and are ready to import a subscription for the first time. Follow the steps in order; basic setup usually takes about ten minutes. If the subscription isn't working or your network has an issue, resolve that first rather than rushing through the guide. Haven't installed a client yet? Choose an installer on the client downloads page, then come back here.

The client reads configurations and establishes connections, but it doesn't include a service you can use out of the box. Before you begin, get a valid subscription URL from a trusted source and check that it hasn't expired. Subscription URLs may contain access credentials. Don't share them in public screenshots, group chats, or with unfamiliar conversion sites. When troubleshooting, redact any personal information in the URL first.

Import a Subscription and Load the Server List

First, identify what you have. A subscription URL is usually a web address that returns a list of configurations. Content beginning with vmess://, vless://, trojan://, or ss:// is usually a single share link. Add a subscription URL to a subscription group; import a single link from the clipboard. Pasting a share link into the subscription URL field will usually make updates fail, even if the copied text looks complete.

v2rayN: Add a Subscription Group and Update It

Open the v2rayN main window and find “Subscription groups” in the top menu. Open “Subscription group settings” or the equivalent option. Add a group, enter a recognizable source name, and paste the full subscription URL into the address field. Check for extra spaces or line breaks at the beginning or end, and don't edit the URL parameters. Save, close the settings window, and return to the main screen.

Open the “Subscription groups” menu again and update the group you just created. If you haven't established a working proxy connection yet, you can start with “Update subscription (without proxy).” This works only if your current network can reach the subscription URL. If the URL requires an existing proxy, choose the appropriate update option once that connection is available. Don't keep switching the same update option while offline.

When the update finishes, switch to the group and check that the main list contains server configurations from the subscription. Select one and use the context menu to set it as the active server; some versions also let you double-click. First confirm that the active selection has changed. Check the connection status in a later step. If the group is empty, check the status area or logs to distinguish between an inaccessible URL and an unrecognized response; each requires a different fix.

v2rayNG: Save the Group, Then Update from the Main Screen

Open the v2rayNG side menu and go to “Subscription group settings.” Tap the add button, enter a name and subscription URL, then save. Return to the server list and choose Update subscription from the top menu. If the menu offers an update for a specific group, select the one you just added. Saving the URL only creates a local subscription entry; it doesn't download server configurations, so you still need to update from the main screen.

Once configurations appear, tap the one you want to use and check that it shows as selected. For a single share link, copy the full link first, then use the clipboard import option in the main screen's add menu. A subscription update may replace or remove entries from its source, so avoid keeping important manual changes in a group that updates automatically. With the list and active configuration ready, you can now decide which apps and requests the client should handle.

Choose How to Route Traffic and Select a Routing Mode

After importing a subscription, distinguish between two settings that are easy to confuse: the traffic capture method determines whether app traffic reaches the client, while the routing mode determines whether requests go direct or through the proxy. For example, with the system proxy enabled and a direct routing rule selected, requests may still bypass the remote server. “Enable system proxy” and “Send all traffic through the proxy” are not the same thing.

v2rayN: Start with the System Proxy

Find “System proxy” in the status area at the bottom of the window or in the system tray context menu, then select “Automatically configure system proxy.” This points the system proxy settings to the client's local listener and is usually a good starting point for testing with a browser. Don't enter the server address directly in the system proxy settings or copy a local port from another guide. Use the listener configuration the client is actually running.

Next, find the “Routing” menu or routing profile selector. For your first setup, choose a ready-made profile that matches your needs, such as “Bypass LAN addresses,” rather than starting with custom rules. Profiles with similar names can contain different rules, so check the rule details when needed. The active profile—not just its name—determines whether LAN devices connect directly and regular websites use the proxy.

Leave TUN disabled for now. TUN and the system proxy capture traffic differently; TUN may require additional permissions and can affect other networking software. First confirm that your browser works through the system proxy, then consider switching if you need to cover more apps. If an app doesn't follow the system proxy, that doesn't mean the server is unavailable; check the app's own proxy settings first.

v2rayNG: Check VPN Mode and App Coverage

Open v2rayNG settings and confirm that VPN mode is enabled. This mode uses the system VPN interface to capture device traffic, but that doesn't mean a connection is already working. If “Per-app proxy” is enabled, check whether the list is set to proxy only selected apps or exclude selected apps. These options do opposite things, even when the same apps are selected.

For your first test, temporarily disable per-app restrictions or make sure the browser you're testing is included. Keep the routing settings on a familiar default profile and avoid changing local DNS, domain sniffing, and custom rules all at once. Change one thing at a time so you can identify the cause if something goes wrong. If another app is already using the system VPN interface, stop its connection first to avoid a conflict.

At this point, you should be able to answer two questions: will the test app send requests to the client, and will the current routing rules send those requests through the proxy? Domain strategies, rule order, and protocol selection are part of advanced setup; see the protocol and core reference. You don't need to understand them to get a basic connection working.

Connect and Check the Status

Return to the server list and confirm that the intended configuration is still active. Updating a subscription, switching groups, or highlighting an item doesn't necessarily change the active server. Check which item the client identifies as active. Before connecting, make sure the device itself has internet access so issues like a disconnected Wi-Fi network or an incomplete captive portal login aren't mistaken for client problems.

v2rayN: Confirm the Core and System Proxy Are Ready

In v2rayN, setting a configuration as the active server usually starts or reloads the core. The control may differ between versions, so don't look for a connect button identical to the one on mobile. Check the status area or logs to make sure the core doesn't exit immediately, then confirm the system proxy still shows “Automatically configure system proxy.” The selected server, running core, and apps using the proxy are three separate things to verify.

If the logs say a local listening port is already in use, first close duplicate client instances and other proxy tools using the same port. If you really need to change the port, do so in the client settings and reapply the system proxy to avoid leaving it pointed at the old listener. Don't disable the firewall just because the connection failed; startup errors usually point to a more specific fix.

v2rayNG: Approve the VPN Permission Prompt

On the v2rayNG main screen, select the configuration you want to use, then tap the connect button in the lower-right corner. The first time, Android usually asks for permission to set up a VPN connection. Check the app name and purpose, then allow it. Return to the client and check whether the button or status message has changed; a VPN icon may also appear in the status bar. If you denied permission, restart the connection and approve it before VPN mode can capture traffic.

If the connection stops as soon as it starts, open the client logs and look for errors from that time. If it works in the foreground but disconnects after you switch apps, check Android's battery usage and background activity restrictions for v2rayNG. Start with the default settings and adjust permissions only if the system is actually stopping the background service. There's no need to change every battery-saving option in advance.

When an Error Appears, Keep the Context Before Making Changes

A successful startup usually means local traffic capture and the core are running, but it doesn't guarantee a working remote connection. Some configurations connect to the remote server only when a request is made, so test actual access next. For an authentication error, update the subscription and check the service status. For a connection timeout, check your network and the target server. For a certificate error, check the system time and configuration source.

Don't treat skipping certificate verification as a general fix, and don't change the protocol, address, and security settings all at once. Keep the logs around the time of the error, redact private addresses and credentials, and then investigate; this is more useful than reinstalling repeatedly. For common log errors, see Troubleshooting and common issues. If there are no obvious startup errors, continue by testing an actual request.

Test Access and Check Which Traffic Uses the Proxy

Keep the client running and open a new page in the browser you confirmed is covered by the proxy. Visit a known-good HTTPS site. Don't just refresh an old tab that's been open for a while: existing connections, cached pages, and background requests can make results hard to interpret. First check that the page reloads and links open, then review the client logs to see how the request was handled.

Check the Request Before Relying on a Test Result

If the client log level records connection details, check for the target and its handling result after making a request. A request in the logs shows that traffic reached the client, but check whether it went direct or through the proxy. If the logs don't show individual requests, that alone doesn't prove traffic missed the client. Check the log level and the app settings first. Don't draw conclusions from a connection icon or a single latency test.

If you need to check the exit IP, use a trusted IP lookup service as a reference, keeping your routing rules in mind. If the lookup page is routed directly, seeing your local network's IP is expected; it doesn't mean all proxy traffic is failing. A changed IP only confirms that this particular set of requests took a different route, not that every app on the device uses the same exit.

Test Browsers and Other Apps Separately

If the browser works but a desktop app behaves the same as before, check whether the app follows the system proxy. Some apps require you to select the system proxy in their settings or enter the client's local proxy address manually. Don't assume this means the protocol is incompatible; the remote protocol and routing rules only come into play after the app's requests reach the client.

In v2rayNG, check whether per-app rules exclude the app you're testing. If you changed the app list, disconnect and reconnect, then reopen the app. If no apps can access the internet, check the logs for remote connection and DNS issues. If only one domain fails, check that destination, the matching routing rule, and DNS behavior first. For more detailed diagnosis, see the Common issues page; there's no need to work through every setting in this getting-started guide.

Disconnect and Update the Subscription Later

After testing, note the group, active server, traffic capture method, and routing profile you used. There's no need to save the full URL if it contains credentials. If the server list changes later or a configuration stops working, update the existing subscription first, then select a working entry. After an update, make sure the active configuration is still available so you don't keep using an old entry that's been removed from the source.

When you're done with v2rayN, clear the system proxy through the client before exiting. If the exit process is supposed to restore the proxy automatically, confirm that it did. To stop v2rayNG, tap the connect button to disconnect and check that it's no longer running. If your browser suddenly loses internet access after you exit, first check whether the system or app is still pointing to a stopped local proxy. There's no need to reset the entire network right away.

Import a Subscription and Connect