For Android users who have imported a server but run into authorization errors, disconnections when the screen is locked, or apps that bypass the proxy. First confirm that Android's VPN is working, then remove background restrictions, and finally configure app selection and routing rules. Following this order helps distinguish system shutdowns, excluded apps, and server issues.
1. VPN permission routes traffic; it doesn't mean the server is reachable
v2rayNG is an Android client that uses the Xray core. Its usual VPN mode relies on Android's VpnService: Android creates a virtual network interface and sends eligible app traffic to the local service, where the core handles it according to the server configuration and routing rules. This doesn't add a remote VPN account to your phone, and it doesn't require root access to route traffic.
The first time you connect, Android displays a VPN connection request. Once approved, v2rayNG can create the interface. A key or VPN icon in the status bar only confirms that the local VPN is active; it doesn't prove the server is reachable or that DNS resolution, the TLS handshake, and routing are all configured correctly. Check server connectivity and actual website access separately.
Another network-filtering app that uses a local VPN may replace v2rayNG's connection when started in the same user or profile. Work and personal profiles may also have different management policies. To troubleshoot, first stop other VPN services in the same profile; don't mistake a replaced VPN connection for a server disconnect.
2. Verify permission and service status in four steps
The paths below refer to common Android menus; names may vary by OS version and manufacturer. If you can't find an option, search Settings for “VPN” or “battery optimization.” Start with a known-working server and confirm the basic connection before adding per-app rules.
-
Resolve VPN conflicts
Open Settings → Network & internet → VPN and check for other connections. If another app has “Always-on VPN” enabled, turn it off, then return to v2rayNG.
-
Check the operating mode
In v2rayNG's side menu, open Settings and check “Service mode.” Choose VPN mode if you want to route app traffic. Proxy-only mode provides a local proxy endpoint, but doesn't automatically send traffic from regular Android apps through the core.
-
Approve the system request
Return to the main screen, select a server, and tap Connect. Approve the Android VPN request. If you previously canceled it, starting the connection again will usually prompt you to approve it.
-
Test real-world access
Check for the Android VPN indicator and a running notification, then open a browser and visit the site you want to test. If it fails, check Logs in the side menu to distinguish DNS errors, connection timeouts, and handshake failures. Don't rely on the connection button's color alone.
“Always-on VPN” and “Block connections without VPN” are Android policies, not ordinary background-activity settings. The latter blocks network access that doesn't go through the VPN. Combined with per-app exclusions, it may leave excluded apps without internet access instead of sending them directly. Leave this blocking option off while troubleshooting the basics.
3. Battery exemptions: check battery, background activity, and auto-start
A common sign of background restrictions is that everything works while the screen is on, but access fails after the phone has been locked for a while and returns when you reopen v2rayNG. This is a clue, not proof. Network switches, server disconnects, and DNS failures can look similar. Check whether the running notification disappears or the service restarts before drawing a conclusion.
| Android interface | Common settings path | What to check |
|---|---|---|
| Stock Android / Pixel | Settings → Apps → See all apps → v2rayNG → App battery usage | Allow background usage; try “Unrestricted” when troubleshooting |
| Xiaomi HyperOS / MIUI | Settings → Apps → Manage apps → v2rayNG → Battery saver | Choose “No restrictions,” then search Settings for “Autostart” and check its permission |
| Huawei EMUI / HarmonyOS Android app environment | Settings → Apps & services → App launch → v2rayNG | Switch to manual management and allow auto-launch, secondary launch, and background activity |
| OPPO ColorOS / OnePlus ColorOS | Settings → Apps → App management → v2rayNG → Power usage | Allow background activity; some versions also offer an auto-start option |
| vivo OriginOS | Settings → Battery → Background power consumption management → v2rayNG | Allow high background power use; check auto-start separately under app permissions |
| Samsung One UI | Settings → Battery and device care → Battery → Background usage limits | Remove v2rayNG from sleeping apps and check “Never auto sleeping apps” |
These are common entry points, not fixed paths for every device. Recent One UI versions may put Battery directly on the Settings home screen; other systems may move power management into the app info page. If needed, long-press the v2rayNG icon, open App info, and check battery and background permissions there.
- Start with app-level restrictions: Allow v2rayNG to run in the background before considering whether system-wide battery saver is the cause. There's no need to disable every power-saving feature on the phone.
- Auto-start and keeping the app alive are different: Auto-start permission doesn't mean the client is configured to connect at boot, and an “Unrestricted” battery setting can't guarantee that Android will never stop the process.
- Don't test by force-stopping: Android's Force stop option terminates the service by design. Locking the app in Recents may help on some manufacturer interfaces, but it doesn't replace background permissions.
How to test: lock the screen before adding more routing rules
After changing permissions, keep the same server and network. Test the same site before locking the screen and again after about 10 minutes, noting whether the notification and logs remain continuous. This is a retest interval, not a fixed timeout after which Android stops apps. If the service stays running but access still fails, investigate the connection and DNS instead of adding more keep-alive settings.
4. Per-app proxy and bypass mode: choose which apps, then check where traffic goes
In v2rayNG, open Settings → Per-app proxy from the side menu and enable the feature, then select apps. Some versions put it under VPN settings. This determines which apps are covered by the VPN; it doesn't determine the final outbound route for a particular domain.
Bypass mode off: include selected apps
RecommendedEnable per-app proxy and leave “Bypass mode” off. Selected apps use the VPN; unselected apps usually use the system network. To verify the setup, start by selecting just one browser so it's easy to confirm the behavior.
Best for: first-time setup or routing only a few apps through the VPN
Bypass mode on: exclude selected apps
The selected apps become an exclusion list. They stay outside this VPN, while all other apps use it. If Android blocks connections that don't use the VPN, the system policy will also affect whether excluded apps can get online.
Best for: routing most apps through the VPN while excluding a few local-service apps
Per-app proxy off: don't filter by app
Restore the usual VPN coverage without filtering apps through this list. The core still uses routing rules to decide whether traffic goes direct, through a proxy, or is blocked. Turning off per-app filtering doesn't force every request to use a proxy outbound.
Best for: managing domain rules centrally or troubleshooting apps that were left out
After changing the app list or bypass mode, stop and restart the v2rayNG connection to rebuild the VPN interface. Also fully close and reopen the app you're testing so an existing connection doesn't skew the results. Cloned apps and work-profile apps may have separate system identities, so selecting the personal-profile app may not cover its other instance.
5. Troubleshoot LAN bypass, DNS, and subscription settings separately
“Bypass mode” in the app list and “bypass LAN” in routing are different settings. The former decides whether an app is covered based on its identity; the latter selects an outbound based on the destination address or domain. To access a home printer, router admin page, or other LAN service, check the LAN routing rules instead of blindly changing the app list.
- LAN destinations:
192.168.0.0/16,10.0.0.0/8, and172.16.0.0/12are common IPv4 private address ranges. Check your active routing configuration to determine whether traffic goes direct; an app's name alone doesn't tell you. - DNS resolution: DNS commonly uses UDP or TCP port
53; DoH uses HTTPS, commonly on port443. These ports describe protocol usage; they aren't recommendations to change your server port to the same number. - Private DNS: If your phone uses a custom Private DNS provider, temporarily set it to “Automatic” under Settings → Network & internet → Private DNS and compare the results. Restore your preferred setting after testing.
- Custom configuration: An imported full JSON configuration may define its own DNS, routing, and outbound settings, which general options in the interface may not override as expected. First check whether you're using a standard server profile or a custom configuration.
A subscription provides server details; it doesn't grant Android VPN permission or remove background restrictions. The VMess or VLESS server type, transport, and security settings must match the server configuration. Don't switch protocols at random to fix disconnections after locking the screen. If only one server fails, compare its settings and connection route before resetting all app permissions.
6. Common questions: match the symptom to the setting
Tapped Connect, but there's no VPN icon. What should I do?
First confirm that v2rayNG is in VPN mode and that Android permission hasn't been revoked. Check the system VPN page for another app set to Always-on VPN. On a managed device, an administrator may need to allow VPN connections. If it still fails, check the client logs for interface or service startup errors.
The internet stops working after the screen locks, then recovers as soon as I open the app. Why?
Check battery restrictions and background activity permissions for your device, allow running notifications, and repeat the screen-lock test with the same server. If the notification remains and the service hasn't restarted, check whether the connection recovers after switching mobile networks. Don't assume Android killed the app.
I selected my browser. Why isn't it using the proxy?
Check whether “Bypass mode” is enabled; if it is, selected apps are excluded. Restart the VPN and browser after changing the setting, then check whether the active routing rule sends the test domain through a direct outbound. A locally hosted site loading successfully doesn't prove the proxy is working.
An excluded app can't connect to the internet. How can I fix it?
In Android's VPN settings, check “Block connections without VPN.” If the excluded app needs direct access, reconsider this blocking policy. Alternatively, remove the app from the exclusion list so it enters the VPN, then handle its traffic with routing rules. Understand the policy's effects before deciding whether to disable the block.
Do I need to grant VPN permission again after updating a subscription?
A routine subscription update usually doesn't revoke Android permission. If the connection fails afterward, first check that the selected server is still available and its settings haven't changed, then review the logs. Clearing app data or reinstalling may require you to grant permission and configure the app again, so don't start there.
Keep a minimal setup that can reproduce the issue: one known-working server, one test browser, and one network. First verify VPN coverage, then confirm that the background service stays up, and only then add apps and rules one at a time. Changing one setting at a time makes it possible to pinpoint the layer causing the problem.