First grant VPN access and confirm that a node connects. Then remove v2rayNG’s background battery restrictions. Finally, configure per-app proxying and reconnect to test. This guide is for first-time Android users, anyone whose connection drops when the screen locks, and anyone who wants only selected apps to use the proxy. Keep three things separate: the VPN captures traffic, Xray routing selects the outbound route, and system power settings determine whether the service keeps running.
VPN permission: establish the system traffic route first
On the v2rayNG home screen, select an imported node and tap Connect. The first time you start VPN mode, Android displays a system connection request. Check that the app is v2rayNG, then tap OK or the equivalent allow button. This permission lets the app create a virtual network interface with VpnService and route selected app traffic through its local service. It does not grant device administrator access or require root.
The VPN icon only indicates that the system tunnel is up. It does not confirm that the remote node is reachable or that all connections pass through the remote server. v2rayNG uses the Xray core to handle proxy protocols and routing; traffic matching a direct rule may still leave over your local network. Check node settings, network reachability, and whether the app is included in the VPN separately.
These figures describe Android features; they are not minimum-version guarantees for the current app release. Another firewall or filtering app that uses a local VPN may replace v2rayNG’s connection when started. Work and personal profiles may also be managed separately. If a work app cannot connect, check your organization’s policies before importing the node again.
First connection: complete these five checks in order
Get one node working with one browser before adding more apps. These steps assume v2rayNG is using VPN mode. Menu labels can vary slightly between app versions and Android builds; if you cannot find an exact match, look for the equivalent function. Do not follow v2rayN desktop system proxy instructions on Android.
-
Import a node
On the home screen, tap “+” → “Import config from clipboard,” then import the complete share link or config and select the node. To use a subscription, open “Subscription group settings” in the sidebar, add the URL, then return to the home screen and tap “Update subscription.” Treat any token in the URL as private.
-
Check the mode
Open “Settings” → “VPN settings” → “Per-app proxy” in the sidebar. For initial troubleshooting, turn per-app proxy off so your test browser is not excluded. If your version has a “Service mode” option, choose VPN mode rather than local proxy mode, which is intended for manually configured ports.
-
Allow the connection
Return to the home screen and tap Connect, then approve Android’s VPN connection request. Next, open Android “Settings” → “Network & internet” → “VPN” and check that v2rayNG is connected. On some devices, this option is under “Connection & sharing.”
-
Test a website
Open a new browser tab and visit a known, currently accessible site that requires the proxy, then try a site that normally works directly. Do not rely on an existing tab: cached content may still appear even when the network is down.
-
Check the logs
If a page fails to load, open “Logs” in the sidebar and note any timeout, DNS, or handshake errors around the time of the connection attempt. Before sharing logs, redact subscription URLs, node credentials, and personal domains; include only the details needed to diagnose the issue.
You do not need to set an HTTP proxy in your browser or change the proxy port in your phone’s Wi-Fi settings for the first test. VPN mode captures eligible IP traffic directly. Copying a desktop guide’s loopback address and port into Wi-Fi settings can add another misconfiguration.
Battery optimization: lift background restrictions before testing with the screen locked
If the connection works with the screen on but fails a few minutes after it locks, check background restrictions first. Android Doze, app standby, and manufacturer background management are separate controls. Exempting v2rayNG from battery optimization can reduce restrictions, but cannot guarantee the process will never be stopped. Memory pressure, force-stopping the app, and manufacturer policies can still affect the service.
App battery settings
- Path
- System “Settings” → “Apps” → “v2rayNG” → “Battery”
- Option
- Select “Unrestricted”; some devices call this “Allow background activity”
- Alternative path
- “Special app access” → “Battery optimization” → “All apps” → “v2rayNG” → “Don’t optimize”
- Test
- Connect, lock the screen for 10 minutes, then immediately open a new webpage
Menu paths depend on your device. Change settings for v2rayNG only; there is no need to disable battery management for every app.
Background launch and data access
- Auto-start
- In system “App management,” allow v2rayNG under “Auto-start” or “Launch management”
- Background data
- “App info” → “Mobile data & Wi-Fi”; check that background data is allowed
- Data Saver
- If Data Saver is on, allow v2rayNG to use unrestricted data if needed
- Recent apps
- If your device supports locking apps in the recent apps screen, you can lock v2rayNG as an additional measure
Allowing background launches does not mean the VPN will connect automatically at startup. Auto-start behavior also depends on the app’s settings and system policies.
Ten minutes is a repeatable observation window, not a universal system timeout. Record what happens with the screen on, after locking it, and after switching from Wi-Fi to mobile data. If the connection fails only after a network switch, check reconnection behavior and node reachability instead of adding more battery exemptions.
- Do not use “Force stop” to clear the app: this terminates the service, and you will usually need to reopen the app to restore it.
- Distinguish swiping an app away from stopping its service: devices handle dismissed recent apps differently. Check the VPN status and test a new request to see whether the service is still running.
- Do not change five settings at once: adjust battery restrictions first and retest. Then check auto-start and background data so you can identify the actual cause.
Per-app proxy: choose the list behavior, then select apps
Open “Settings” → “VPN settings” → “Per-app proxy” in the sidebar and enable it, then select apps. The interface commonly offers “Bypass mode”: when it is off, checked apps use the VPN; when it is on, checked apps bypass it. Save your changes, disconnect, and reconnect so Android rebuilds the VPN interface with the updated list. If your version uses different labels, read the switch description and confirm whether checked apps are included or excluded.
Only selected apps use the VPN
RecommendedEnable per-app proxy, turn “Bypass mode” off, and select only the browser you are using for the test. This makes it easier to confirm that the list works; unselected apps continue to use the local network.
Best for: first-time setup or proxying only a few apps
Selected apps bypass the VPN
Enable per-app proxy and “Bypass mode,” then select the apps you want to exclude. Other apps use the VPN, but routing rules still decide whether their traffic goes through the remote server.
Best for: routing most apps through the VPN while excluding a few
Turn off per-app proxy
Do not set an app list. The VPN will usually handle traffic from apps available to it in the current user profile. Routing rules then decide whether traffic goes direct or through the proxy based on domains, IP addresses, and other conditions.
Best for: fixing an incorrect exclusion list or applying routing rules consistently
Do not assume that “uses the VPN” means “all traffic goes through the proxy.” The per-app list filters which traffic enters the VPN; routing then selects the outbound path inside the core. For example, a browser can be included in the VPN while visiting a domain matched by a direct rule, so traffic still leaves over the local network. If temporarily routing all traffic through the proxy makes the site work, check your routing rules next.
Verify the setup: distinguish app lists, routing, and node failures
Compare two browsers: include browser A in the VPN and leave browser B out. Reconnect, open a new test page in each, and record the results. The exit IP can offer a clue, but seeing the same IP does not necessarily mean the setting failed: browser A may have matched a direct rule. Also check whether the site requires a proxy, your routing settings, and the logs.
| What you see | Check first | Next step |
|---|---|---|
| Both A and B fail | Local network or system blocking settings | Disconnect the VPN and test direct access. Check Wi-Fi, mobile data, and “Block connections without VPN.” |
| A fails; B works directly | Node, DNS, and routing | Confirm A is included in the list, then check the logs for DNS resolution, timeouts, or handshake errors |
| Changing the list makes no difference | VPN interface was not rebuilt | Disconnect and reconnect, then fully close and reopen the test app |
| Works with the screen on but fails when locked | Service status and battery restrictions | First check whether Android still shows the VPN as connected, then review battery and background data settings |
| Works on Wi-Fi but fails on mobile data | Network differences and data access | Confirm mobile data works, then check whether the current node is reachable on that network |
Android’s “Always-on VPN” and “Block connections without VPN” are system-level policies, not ordinary background keep-alive settings. The latter can block apps excluded from the VPN, conflicting with a setup where some apps should connect directly. Note the state of both options when troubleshooting. If your organization manages them, ask your administrator what is required; do not try to bypass managed policies with the app list.
- Keep the node fixed first: do not change the node, DNS, and app list during the same test.
- Then keep the network fixed: complete the test on Wi-Fi first, then test mobile data separately.
- Restore routing last: after testing with a temporary route, restore your usual rules and retest.
FAQ: permissions, disconnects, and reversed app lists
Why can’t I open webpages even though the key icon is showing?
The icon means the VPN interface exists; it does not mean the remote handshake succeeded. First check that the test app is included in the list, then open “Logs” in v2rayNG. For timeouts, check the network and node. For handshake errors, verify subscription settings, device time, and security settings. Do not disable certificate verification just to get connected.
Is it normal for Android to ask for VPN permission every time I start the app?
Check whether you recently switched to another VPN app, reinstalled v2rayNG, or had Android revoke the previous permission. Open system “Settings” → “Network & internet” → “VPN” and check the active service. Grant permission only in Android’s system connection prompt; never provide account credentials in a webpage or chat message.
Why does an app stop using the proxy after I check it?
First check “Bypass mode.” When enabled, checked apps are usually excluded; when disabled, they are usually included. After changing the setting, restart the VPN and fully close and reopen the app to avoid interference from existing connections.
What if the connection still drops after I set the battery option to unrestricted?
First check whether the VPN has disconnected in Android settings. If it has, check the manufacturer’s launch management and cleanup policies. If the VPN is still connected but requests fail, check for a network switch, node timeouts, and DNS errors. A battery exemption cannot fix a remote node problem.
Can I use all the same settings in v2flyNG?
Both apps are subject to Android VPN and battery policies, but v2rayNG uses the Xray core and v2flyNG uses the v2fly core. Their protocol support and menus are not necessarily identical. The system-permission troubleshooting steps may apply to both; check each app’s own interface for node compatibility and app-specific options.
For day-to-day use, keep only the changes you need: one confirmed working node, a clear app list, and background permissions for v2rayNG. When something goes wrong, check in this order: system VPN → service status → app list → routing and DNS → node. This is more effective than repeatedly reinstalling the app.