First, allow Android to let v2rayNG create a local VPN. Then address background restrictions that can interrupt the connection when the screen is locked. Finally, choose which apps use the tunnel. This guide is for users who have imported a config but are running into a VPN permission prompt, background disconnects, or unexpected per-app routing. Work through the checks in order to isolate system permission, background activity, and routing rules without changing several settings at once.
1. VPN permission and connecting to a server are separate steps
v2rayNG uses Android's VpnService to capture app traffic on the device and pass it to the Xray core for handling according to your config. The first time you connect, Android usually displays a “Connection request” dialog saying the app wants to set up a VPN connection. Tap “OK” to allow a local VPN interface. This does not confirm that the remote server is reachable or grant access to a server.
Importing a VMess or VLESS config only adds the server settings. The address, port, authentication details, transport, and TLS settings must still match the server. A VPN indicator means only that the local VPN service is active; it does not confirm that the server is reachable, DNS is working, or every app is using the proxy.
-
Select a config
Select an imported config on the v2rayNG home screen. Start with one you know works. While troubleshooting permission issues, avoid changing your subscription, transport, and routing at the same time.
-
Connect
Tap the connect button in the lower-right corner of the home screen. The first time Android shows a “Connection request” dialog, review it and tap “OK.” If no dialog appears, permission may already be granted; check the system VPN settings to confirm.
-
Check for conflicts
Go to Settings → Network & internet → VPN. The path may differ by device, so try searching Settings for “VPN.” Make sure v2rayNG is the active connection, rather than another app occupying the VPN slot.
-
Test access
Open a known-working HTTPS page in your browser, then check the v2rayNG log. If the VPN is connected but the page won't load, investigate the server and logs instead of repeatedly granting permission.
2. Tell apart notification settings, battery optimization, and background restrictions
“Disconnects as soon as I switch to the home screen” and “stops working after the screen has been locked for a while” may have different causes. For the first, check whether the service started and whether another VPN replaced it. For the second, look at battery optimization, manufacturer-specific background restrictions, and network changes while locked. Exempting v2rayNG from battery optimization can reduce restrictions, but it won't fix a dead server or an unstable mobile connection.
Keep these three system changes separate. Battery optimization affects background activity while idle; a foreground service supports ongoing operation; notification permission controls how notifications appear. On Android 13 and later, denying notification permission does not deny VPN permission and does not necessarily stop the service immediately. So don't rely on the presence or absence of a notification icon to tell whether the connection is active.
- Battery settings: Long-press the v2rayNG icon → App info → Battery or App battery usage, then select Unrestricted or allow background activity. Labels vary by device.
- Battery optimization list: Search Settings for “Battery optimization,” switch to all apps, find v2rayNG, and select “Don't optimize.” Some devices offer only the battery settings above, so you may not see a separate optimization option.
- Manufacturer background controls: If your device has settings such as “Auto-start,” “App launch management,” or “Background activity,” allow the background access v2rayNG needs. Locking the app in the recent-apps screen may help, but it doesn't replace the battery settings.
- Notification permission: In App info → Notifications, allow service status notifications to make it easier to see when the service is running or stopped. Notification permission is not permission to connect to a server.
Force stop explicitly terminates the app; exempting it from battery optimization won't restart it. After changing background settings, open v2rayNG and reconnect manually. Check its status after a reboot, too—an app still visible in recent apps doesn't mean the VPN has restarted.
3. Use a screen-lock test to pinpoint background disconnects
Keep the same config, network, and test app throughout troubleshooting. Change one setting at a time to tell whether Android is stopping the app or the VPN is still running with a failed connection. The times below are suggested checkpoints, not battery-life promises or measured performance results.
| Checkpoint | What to do | What to record |
|---|---|---|
| Right after connecting | Keep the screen on and open a test page | VPN status, page result, and log timestamp |
| After 5 minutes locked | Unlock and reload the same page | Whether the service is still running and needs reconnecting |
| After 15 minutes locked | Check again without switching networks | Whether the issue appears only after a longer idle period |
| After switching networks | Test Wi-Fi and mobile data separately | Whether the VPN is still active and reconnecting restores access |
Check the service first, then the connection
If the system VPN connection has disappeared, check background controls and VPN conflicts first. If the connection is still active but reconnecting restores access, note when the network changed and look for timeouts or DNS errors in the logs. Don't keep adding battery restrictions.
The VPN icon and service notification are clues, not proof; verify with an actual request. Before sharing logs, remove subscription links, server addresses, and authentication details. The failure time, error type, and steps taken are enough. Sharing a full config exposes credentials and isn't necessary to troubleshoot background activity.
4. Per-app proxy: choose between include and bypass modes
In the v2rayNG side menu, go to Settings → Per-app proxy. Common versions offer an “Enable per-app proxy” toggle, an app list, and a “Bypass mode” option; labels and layout vary. Read the toggle descriptions carefully. These settings decide which apps send traffic through the VPN, not which remote server an app uses.
Proxy only selected apps
RecommendedEnable per-app proxy, turn off “Bypass mode,” and select only the apps whose traffic should go through v2rayNG. For the first test, select just one browser so the result is easy to verify. Other apps won't use this VPN tunnel.
Best for: a small number of apps, initial setup, and troubleshooting one app at a time.
Bypass selected apps
Enable per-app proxy, turn on “Bypass mode,” and select the apps to exclude. Selected apps won't use this VPN tunnel. All other apps will enter the tunnel and continue through the core's routing rules.
Best for: sending most apps through the tunnel while excluding a few.
The selections mean opposite things in the two modes. Suppose Browser A and video app B are your test apps: with bypass mode off, selecting only A sends just A through the tunnel; with bypass mode on, selecting only B excludes B. Don't switch modes while keeping the old list—the previous include list becomes an exclude list.
- Before changing settings: Disconnect and note the current mode and selected apps so you don't confuse what the list means.
- After changing settings: Return to the home screen and reconnect so the VPN interface is created with the updated app list. App filtering doesn't rewrite an existing connection on the fly.
- When testing: Close and reopen the test app, then make a new network request. Existing connections, cached pages, and offline content can skew the results.
- Can't find an app in the list? Check whether it's installed under another user or work profile. The regular app list doesn't automatically include every profile.
5. Check per-app filtering and routing as separate layers
Selecting an app for per-app proxy doesn't mean all its requests go through a remote server. Once the app's traffic enters the tunnel, Xray applies routing rules to choose an outbound route: proxy, direct connection, or block. Traffic excluded by the per-app list never enters this processing chain, so changing core domain rules usually won't affect its route.
| Settings layer | What it controls | Common misconception |
|---|---|---|
| Per-app proxy | Which apps' traffic enters the VPN | Selecting an app guarantees it uses a remote server |
| Routing rules | Which outbound route handles requests entering the core | Domain rules can capture apps excluded from the VPN |
| Server config | How the proxy outbound connects to the server | Changing the protocol fixes Android stopping the app in the background |
| DNS settings | How requests for relevant domains are resolved | Changing DNS fixes every page that won't load |
To verify the app list, note the original routing mode, then temporarily use a clearly defined global proxy mode to reduce interference from direct-connection rules. Restore the original setting when you're done. Even in global proxy mode, apps excluded by the per-app list remain outside its control. Custom configs may also have their own routing structure; don't assume a preset in the interface overrides all custom rules.
- An app can't access anything: first confirm it's included in the VPN tunnel, then check the server and the system's VPN blocking settings.
- Only some domains fail: check the relevant routing rules, DNS results, and logs. Don't immediately remove the whole app from the list.
- The old behavior persists after changing the app list: reconnect the VPN, restart the test app, and try a new request.
- Subscription update fails: troubleshoot subscription retrieval separately from app access. Subscription management is not a substitute for the per-app proxy list.
6. VPN permission and per-app proxy FAQs
I tapped Connect but didn't get a permission prompt. Does v2rayNG lack permission?
Not necessarily. Android may have retained permission from an earlier session. Search Settings for “VPN” and check the active connection, then review the v2rayNG log. If another app is set as always-on VPN, address that setting before starting v2rayNG again.
I set battery optimization to “Don't optimize.” Why does it still disconnect when locked?
Check the manufacturer's auto-start and background activity controls, and make sure you haven't force-stopped the app. Test at the 5- and 15-minute checkpoints. If the service is still running, investigate network changes, server timeouts, and DNS rather than repeatedly changing the same battery setting.
I selected an app. Why isn't it using the proxy?
First check whether “Bypass mode” is on—when enabled, selected apps are excluded. If it's off, check whether routing sends the request directly. After changing the app list, disconnect and reconnect, then close and reopen the test app to avoid reusing an existing connection.
Do I need to select every system app?
No. Don't select apps in bulk just for the sake of completeness. Start with the apps you actually need, then add more after confirming the behavior. System components, download services, and work-profile apps may use separate identities; test the actual requests instead of relying only on the foreground app's name.
Can I transfer per-app settings directly to v2flyNG?
Node share links and per-app filter lists are different kinds of data. v2rayNG uses the Xray core, while v2flyNG uses the V2Fly core; supported config features and settings may differ. When switching clients, check node compatibility, then set up and test the app list again in the new client.
After setup, keep a brief record of the client version, server type, per-app mode, selected apps, and battery settings. When a problem comes up, reproduce it before changing anything. Permission creates the local VPN interface; background settings reduce the chance of the service being restricted; per-app filtering and routing determine where traffic goes. Check them in that order to narrow down the cause.