V2Ray Setup Guidefor Every Platform

Before You Begin and Configuration Layers

Identify Your OS, Architecture, and Client

Before installing, check your operating system and processor architecture, then choose the right download. On Windows, go to “Settings → System → About” and check the system type. On macOS, open “About This Mac” from the Apple menu to identify the chip. On Linux, check your device details in system settings. On Android, check the OS version and device specifications to determine the architecture. Don’t judge compatibility by download size, or assume that devices running the same OS use the same architecture.

Use v2rayN on desktop platforms. The setup is similar across Windows, macOS, and Linux, but permissions, system proxy settings, and package formats vary. On Android, v2rayNG with the Xray core is the usual choice; consider v2flyNG if an existing configuration specifically depends on V2Fly behavior. The client manages servers, subscriptions, and network entry points; the core handles connections. A client window opening does not mean the core started successfully.

Prepare a Subscription Link and Backup

The client does not provide servers. Before setup, get a subscription link or a server share link you’re authorized to use. Make sure the service is active and check which protocols and transport settings it requires. Treat subscription links like passwords: they often contain access credentials. Hide the full link in screenshots, logs, and support requests, including its query parameters—not just the beginning.

If you already have a client configuration, note the active server, subscription groups, local listening ports, routing mode, and DNS settings. When migrating, use the client’s export or backup feature and store the backup in a secure location. Record the original OS proxy settings, too: the device may already use a workplace proxy, and clearing it could disrupt your usual setup.

Four Layers That Are Easy to Confuse

Layer one is subscription retrieval: can the client read server details from the subscription link? Layer two is core startup: is the local port listening? Layer three is traffic entry: are apps sending requests through the system proxy, a manually configured proxy, or TUN? Layer four is outbound routing: does traffic entering the core go direct, through a proxy, or get blocked by routing rules? Troubleshoot one layer at a time instead of assuming every issue means the server is down.

The system proxy affects apps that follow the operating system’s proxy settings. Some programs use a separate network stack and need a proxy address configured manually. TUN captures more traffic through a virtual network interface, but depends on permissions, routing, and DNS working together. In routing settings, “Global” usually changes how traffic that has already entered the client is routed; it does not automatically redirect apps that bypass the system proxy.

For your first setup, use just one traffic entry point. Start with the system proxy and verify access in a browser before trying TUN. Temporarily exit other software that changes proxy settings, virtual adapters, or network routes so two tools don’t modify the system at once. Change one setting at a time and keep logs from before and after each change. Once the basics work, add features such as automatic updates or app-specific routing.

Before starting, make sure the system clock is accurate, the disk is writable, and the installation directory has enough space. Certificate checks rely on the correct time, saving settings requires directory permissions, and the core needs its executable files fully extracted. Taking care of these basics is more effective than repeatedly switching protocols after installation. For the shortest setup path, see the Getting Started guide. To learn about platform-specific limitations, continue with the sections below.

Windows: Install v2rayN and Set Up a Proxy

Choose the Desktop or Classic WPF Edition

Choose v2rayN from the Windows downloads. The desktop edition uses a cross-platform interface, while the classic WPF edition uses a Windows desktop interface. Menus may look different, but both serve the same purpose. Choose a package that matches the OS and architecture listed on the download page. Don’t assume that two packages named v2rayN can share a folder or use each other’s program files.

If you’re using an installer, follow the setup wizard and launch the app from the Start menu. If you’re using an archive, extract all files to a permanent directory that your account can write to, then run the main program. Don’t launch it from the archive preview or extract only the main executable while leaving its dependencies behind. Keep the path short and avoid sync folders, temporary download directories, and protected system folders.

If the app reports a missing runtime on first launch, identify the required component and architecture, then install it from a trusted source. If the window closes unexpectedly, check your security software’s quarantine, system events, and client logs before changing security settings. A standard system proxy usually doesn’t require administrator privileges. Elevate permissions only when enabling a feature that needs system-level access and the client asks you to.

Create a Subscription Group and Connect to a Server

Open “Subscription Group Settings,” add a group, enter a recognizable name, and paste the full subscription link into “Address (url).” Save it, then choose “Update Subscription” for that group. If you don’t have a working proxy yet, try updating without one first. If the link can only be reached through an existing connection, make sure that connection works before updating through it, or you may create a startup dependency loop.

After updating, make sure the server list belongs to the group you just updated. Select a server and set it as active. Check the logs for configuration parsing errors, core startup failures, or port conflicts. Latency tests are useful for narrowing down options, but they may not use the same connection path as your apps. Verify with a browser and the logs, and don’t assume one failed test means the subscription didn’t import.

Set Up the System Proxy and Enable TUN If Needed

Open the v2rayN menu in the taskbar notification area, find “System Proxy,” and choose an option such as “Set system proxy” to apply the proxy settings. If the icon isn’t visible, check the hidden icons area. Then go to “Settings → Network & Internet → Proxy” in Windows and check the local address and port set by the client. Windows labels may change; the address and port are what matter.

“Clear system proxy” removes settings made by the client, while “Do not change system proxy” leaves the existing settings untouched. They are not the same. For apps that use a manual proxy, enter the protocol and port the client is actually listening on—not the remote server’s port. Browser extensions may override system proxy settings, so switch the browser back to using the system settings while testing.

Enable TUN only after you’ve verified the regular proxy works. Follow the client’s prompts for administrator permissions or service setup, then check the virtual interface and core logs. If all connections stop working, turn off TUN first and confirm that the network recovers. Then check for conflicts with other virtual adapters, workplace network clients, or security policies. Don’t change servers, DNS, and drivers all at once, or you won’t know what caused the problem.

Exit, Update, and Troubleshoot Windows-Specific Issues

Closing the window may just minimize v2rayN to the notification area; it doesn’t necessarily exit. Before updating, use the tray menu to fully quit and confirm that the core process has stopped. Then update using the client’s supported method or install a new package. Keep a backup of your configuration and don’t copy old program files over a new installation. If Windows says a file is in use, close the active session normally instead of repeatedly forcing deletion.

If the browser can’t connect after an unexpected exit, check whether the system proxy still points to a local port that is no longer listening. Restore the proxy settings you recorded before installation if needed. If the window opens but settings won’t save, check write access to the installation directory. If connections fail at startup, check whether the network is ready. Enable launch at startup and auto-connect only after the manual setup is stable, so startup timing issues aren’t mistaken for persistent connection failures.

For more on dependencies, extraction paths, and first-launch checks, see First Install and Initial Setup of v2rayN. If only certain apps bypass the proxy, check their network entry points first; you don’t need to reinstall the entire client.

macOS: Choose the Right Chip Build and Grant Network Permissions

Choose a Build for Your Chip and Open It for the First Time

Open “About This Mac” from the Apple menu. If it shows an Apple chip, choose the Apple Silicon build; if it shows an Intel processor, choose the Intel build. Find the download on the macOS client downloads page. Use the device details—not the year you bought it—to choose the architecture. Devices in the same product line may have different processors, so don’t rely on the package name instead of checking your system.

Open the downloaded disk image and follow the window instructions to move the app to the Applications folder. Launch it from there. Don’t keep running it from the mounted disk image, or leave copies with the same name in multiple locations and switch between them. Once the app is in Applications, eject the disk image and confirm you’re running that copy to avoid updating a different one by mistake.

If the system’s security checks block the first launch, confirm the file’s source and your device’s architecture, then check the relevant notice under “System Settings → Privacy & Security.” Use the system’s approved process to open apps you’ve identified and trust. Don’t disable security checks globally just to launch a client. If you see a damaged file, unsupported architecture, or missing component warning, investigate each separately rather than treating them all as permission issues.

Import a Subscription and Check the Active Server

Open the subscription management section in v2rayN. In “Subscription Group Settings,” add a group, enter a name and the full link, save it, and update the group. When pasting, check that copied text from a chat app doesn’t include extra instructions, line breaks, or localized punctuation. Preserve capitalization, encoded characters, and query parameters; don’t edit the link to make it look neater.

After the update, select a server and confirm that it’s the active one, then check the core logs. The menu bar icon and main window may show different levels of status: an open window only means the interface is running. The core may still fail to start because of a port conflict or configuration issue. Verify the connection with a specific test destination and note the server, entry point, and routing mode so you can make meaningful comparisons later.

Check System Proxy Settings for the Active Network Service

After selecting automatic system proxy configuration in the client, open “System Settings → Network,” select the network service you’re using, and check “Proxies” in its details. Wi-Fi and wired connections are separate services, so check the settings again when you switch between them. Don’t check only a disconnected service, or assume that correct settings for one service apply to every network interface.

System proxy settings must match the local address and port the client is listening on. Some apps have their own proxy settings; others read the system proxy only at startup. After making changes, fully quit and reopen the app you’re testing. Browser extensions, work configuration profiles, and other network tools can also override settings, so identify which layer is actually handling the request.

When enabling TUN, follow the client’s prompts for required permissions, then check the logs to confirm that the interface and routes were created. Permission setup varies by installation type, so don’t copy terminal authorization commands from instructions for a different version. If you’re asked to grant permission again, check whether the app was moved, whether you launched another copy, and whether the configuration directory still belongs to your account.

Recover from Sleep, Switch Networks, and Update

After a laptop wakes from sleep, its existing connection may no longer work, especially after switching between Wi-Fi, a hotspot, and a wired network. First confirm that the system has a working network, then restart the client connection. If the regular system proxy works but TUN doesn’t, focus on routes and DNS after wake rather than deleting the subscription right away. Repeat tests to distinguish a brief network interruption from a configuration problem.

Before updating, fully quit the client from the menu bar and back up its configuration before replacing the app. If the network still doesn’t work after the app closes, check whether the active network service still has a local proxy configured. Restore the original settings you recorded: home networks may need manual proxy settings turned off, while work networks may need their original proxy address restored. Clearing every proxy setting is not a universal fix.

If the client can’t save subscriptions after installation, check its configuration directory permissions and available disk space. If it only fails on one network, keep the server and settings the same and test on another network. Change one condition at a time to distinguish device permissions, local network restrictions, and server reachability—and avoid turning a working configuration into an unrepeatable mix of changes.

Linux: Package Formats, Desktop Proxy, and TUN

Choose a Package for Your Distribution and Architecture

Choose v2rayN from the Linux downloads. Choose deb for Debian-based distributions and rpm for RPM-based distributions. Also check whether your processor is x64 or arm64. Package format and processor architecture are separate requirements; both must match. For derived distributions, follow their own software installation instructions and dependency requirements.

You can open the package in your graphical software installer and let the system resolve dependencies. If dependencies are missing, check the installer’s exact component names and supported system versions. Don’t copy libraries from another distribution into system directories. v2rayN is a graphical app and requires a working desktop session; this section doesn’t cover headless command-line servers.

If you’re not sure of your architecture, open a terminal and run the read-only command below. Common output includes x86_64, usually x64, and aarch64, usually arm64. If you get something else, check your device and package compatibility rather than forcing installation past the package manager’s architecture check. The command identifies your system; it doesn’t change network settings.

uname -m
cat /etc/os-release

Run as a Regular User and Import a Subscription

After installation, launch v2rayN from the desktop app menu using your current account. Don’t routinely run the entire graphical app as an administrator. Client settings, cache, and logs usually belong to the user environment. Switching between privilege levels can change directory ownership, making settings impossible to save, subscription groups disappear, or updates fail.

Add a group in “Subscription Group Settings,” enter the link, save it, and update the group. If the first update fails, check the logs for network errors and parsing errors. For network errors, check the current connection, DNS, and update route. For parsing errors, verify that the subscription response is actually in a format the client can read. Once imported, select an active server and check whether the core starts. Don’t jump straight to TUN.

Desktop System Proxy and App-Specific Settings

Proxy settings vary across Linux desktop environments. GNOME typically manages them in the network proxy section of system settings, while other desktops may have their own settings module. Which settings the client can change also depends on the desktop session. Even when a proxy appears in the graphical settings, some apps won’t use it. Test with an app known to follow the desktop proxy before deciding whether the system proxy works.

Terminal environment variables and the desktop proxy are separate entry points. A working browser doesn’t mean terminal apps have proxy settings—and the reverse is also true. To configure a proxy manually for an app, check the protocol and port the client is listening on, then enter a proxy type supported by that app. Don’t set unknown global environment variables permanently or use a subscription link as the proxy server address.

Check the client logs or system listening information for local port conflicts. The command below lists current TCP listening ports; what it can show depends on your permissions. Check the actual port in the client settings—it doesn’t need to match a number from another guide. If another process is using it, identify that process before closing it or changing the client’s port.

ss -ltnp

TUN Permissions, Routing, and Desktop Integration

TUN requires system-level network access, and the steps depend on how the client was installed. Use the permissions and startup flow provided in the interface. Don’t grant broad permissions to the entire installation directory or blindly run capability commands you find online. After enabling TUN, confirm that the interface was created before checking traffic routes. A permission error in the logs is different from a remote connection timeout.

If TUN blocks access to local network services, check settings for capturing LAN traffic, excluded address ranges, and route priority. If other tunnels or container networks are running, disable the newly added tool temporarily and compare results, keeping a record of the original routes. Don’t delete every network interface; it may break your connection and make the issue impossible to reproduce.

Some desktops don’t show a tray icon by default, so the client may keep running in the background after you close its window. Before updating, changing ports, or starting it again, check whether an old instance is still running. Update packages through the appropriate package manager, and don’t keep copies from different sources installed at once. If the app starts but can’t save settings, check permissions on your user directory instead of granting it more privileges.

Android: Import Subscriptions and Set Up the VPN Interface

Choose v2rayNG or v2flyNG

Go to the Android downloads and start with v2rayNG, which uses the Xray core. If an existing configuration depends on V2Fly, check v2flyNG instead. Most recent mainstream phones can use arm64; if you’re unsure of the device’s app architecture, consider the universal build. A processor’s support for an architecture doesn’t guarantee that the current system provides the same app environment, so check the system and installation prompts.

During installation, grant permission to install unknown apps only to the file manager or browser you’re using, and revoke it afterward if you like. If installation fails, check whether the architecture is incompatible, storage is low, the system requirements aren’t met, or another app conflicts. Don’t delete an existing client just to install over it: uninstalling may also remove subscriptions and local settings, so back them up first.

When migrating an app from another source, Android may block an update because the signatures don’t match. Repeatedly tapping Install won’t fix this. Back up your settings, confirm the target app and its source, then choose a migration method. v2rayNG and v2flyNG are separate apps; similar interfaces don’t mean they can share databases. For migration between apps, use a subscription or share format supported by both.

Add a Subscription Group and Select a Configuration

In the client’s side menu, look for “Subscription Group Settings” or the subscription management section. Add a group, enter a note and subscription link, then save it. Return to the main screen and select “Update Subscription.” For a single server share link, use the clipboard import option instead of treating it as a remote subscription. These are different import methods; using the wrong one may cause fetch errors or format issues.

After updating, tap a configuration to select it, then tap the connect button to start. If your provider requires specific transport or security settings, follow the complete share information and don’t disable options just to simplify the interface. Keep the defaults while testing the basic connection. Once it works, adjust per-app proxy, DNS, and routing rules as needed.

Understand Android VPN Permissions

The first time you connect, Android usually displays a VPN connection request. This authorizes the client to receive device traffic through a system interface; it doesn’t mean the client has a working server. The core must still start and connect to a remote server. Android generally won’t let two standard VPN apps use the same interface at once, so disconnect any existing VPN before testing.

Android doesn’t use the desktop “Set system proxy” steps. Typically, the client creates a system VPN interface, then handles traffic according to routing and per-app settings. A connection indicator only confirms the interface status; it doesn’t prove a site was reached through the remote server. Verify the result in the app, client logs, and routing details as needed.

“Per-app proxy” usually lets you route only selected apps through the client or exclude selected apps, depending on the mode. Check both the mode and the app list: the same list means opposite things in “proxy only” and “bypass” modes. After making changes, disconnect and reconnect, then fully close and reopen the target app so it doesn’t keep using an old connection.

Background Restrictions, Network Changes, and Reconnection

Some devices restrict background processes when the screen is locked. If the connection works in the foreground but drops after locking, check battery optimization, background activity, and the manufacturer’s auto-start controls. Allow the client any necessary exceptions without disabling power saving for every app. Note when and where the disconnection happens, then distinguish between the process being stopped, a network switch, and an expired remote session.

When switching from Wi-Fi to mobile data, the existing connection may need to be re-established. First confirm that the device itself has internet access, then disconnect and reconnect the client. If one network always fails while another works, compare them with the same configuration and don’t change protocol settings at the same time. Also note whether Private DNS, other local network tools, or hotspot sharing are involved; these can introduce system-level differences.

Android’s “Always-on VPN” and “Block connections without VPN” settings can affect network access after disconnecting. If blocking is enabled, losing network access when the client stops may be expected, not a system failure. Before temporarily disconnecting to troubleshoot, understand these settings. Don’t change policies on managed devices without authorization.

Subscriptions, Share Links, and Updates

Know the Difference Between a Link and Its Contents

A subscription link is usually a remote address that the client fetches to get multiple configurations. A server share link describes one server directly. Subscription responses may use encoded text or another format supported by the client, but not every web link is a subscription link. An account homepage, payment page, or documentation page doesn’t become a subscription just because it opens successfully; don’t paste those into the subscription field.

On desktop, remote links are usually saved under “Subscription Group Settings”; on Android, use the subscription management menu. Clipboard import is for share content supported by the client, while file import is for compatible configuration files. Identify what you have before choosing an import option instead of trying every button. The wrong option can create incomplete entries that are harder to troubleshoot later.

After pasting a link, check for spaces, line breaks, escape characters, and punctuation at either end. Some messaging apps copy a period after the link, while some websites display shortened text instead of the actual address. Copy the full link target and keep its query parameters. Don’t replace encoded characters just to make the link look more readable. Example domains aren’t valid for real connections.

How Group Updates Affect Active Configurations

Create groups by source or purpose, and give them clear names instead of putting every subscription in one list. When updating, select the current group first and check the number of results and the logs before updating all groups. A failure in one source may not affect others. Checking each group separately helps preserve configurations that still work instead of clearing everything at once.

Updating a subscription may recreate entries managed by that subscription, so changes to their names or parameters may not survive the next update. Before making customizations you need to keep, check whether the client can copy an entry to a standalone configuration or group. Don’t rely on an unbacked subscription entry as the only copy of your custom settings, and don’t assume the list order will stay the same.

After an update succeeds, check which server is active. The server you used before may have been removed, renamed, or replaced, and the client may still have an active server from another group. Confirm the selected server’s group, protocol, and address, then restart the connection and test. Subscription management and connection management are separate steps; a successful update log doesn’t prove the connection works.

Update Routes and Automatic Update Intervals

Updating without a proxy sends the subscription request over the current network. Updating through a proxy depends on an existing working proxy. The latter is useful when the connection has already been verified, but if your only working configuration has failed, you may not be able to use it to retrieve a new one. First identify the route the request takes and troubleshoot that path instead of repeatedly clicking Update.

For automatic updates to run, options such as “Enable updates” must be on, and the interval must use the unit shown in the interface. If the field is in minutes, don’t enter an hour value directly. Choose an interval based on the provider’s guidance, how often the content changes, and how you use the device. Updating too often only adds unnecessary requests. What happens when the interval is set to zero varies by implementation, so don’t assume zero means continuous updates.

Automatic updates may not run on schedule while the device is asleep, the client is closed, or the system restricts background activity. Check the last update result when you start using the client again, and update manually if needed. If automatic updates fail every time but manual updates work, compare the network, proxy route, and permissions in each case before suspecting the link format. For more troubleshooting, see How to Fix Subscription Update Failures.

Narrow It Down by Error Type

A timeout usually means the request didn’t finish within the allotted time, so check the network route and whether the address is reachable. An access-denied error may involve credentials, source restrictions, or service status. If the response can’t be parsed, make sure it isn’t a login page, error page, or format the client doesn’t support. Don’t share the full response: it may contain access credentials and server authentication details.

Back up any working configuration before changing subscriptions, and make sure the new link comes from a trusted source. If you think a link has been exposed, reset its access credentials if the provider allows it; deleting the local group doesn’t invalidate the old link. For a step-by-step comparison of desktop and Android import options, see How to Import a Subscription Link.

System Proxy, TUN, Routing, and DNS

Identify the Traffic Entry Point Before Troubleshooting Routing

System proxy, TUN, and routing rules solve different problems. The system proxy tells apps that follow its settings to send requests to a local entry point. TUN receives a broader range of connections through a system network interface. Routing rules choose an outbound route for requests that enter the core. First make sure the request reaches the client; otherwise, even a correct routing rule won’t affect apps that bypass it.

For initial troubleshooting, use the regular system proxy as a baseline. Test with a browser that follows the system settings and keep the server and routing unchanged. If the browser works but another app doesn’t, check for its own proxy settings, special transport, or per-app exclusions. If no apps work, check the core, local port, and remote connection before adding complex routing rules.

The local listening address is usually a loopback address, which allows access only from the same device. Enabling LAN access expands who can connect, so use it only when needed and restrict access with a firewall. When setting up a proxy on a phone or another device, a loopback address points to that device—not the computer running the client. Use the computer’s LAN address and confirm that the devices can reach each other and the client is listening on the right interface.

Rule Order and Outbound Tags

Routing rules are generally checked in order. A broad rule near the top can take precedence over a more specific rule below it. If a domain should connect directly, check whether an earlier rule is already matching it rather than just confirming the rule exists. Outbound tags must match the tags defined in the active configuration. Labels such as “Proxy” and “Direct” in the interface may not correspond to the same underlying tags in every configuration.

The example below shows the structure of an Xray routing object to explain how rules work; it isn’t a complete client configuration that you can import. It assumes an outbound named direct already exists and that the core has the relevant domain data. If you manage settings through a graphical client, create the equivalent rule under “Routing” instead of editing a temporary runtime file generated by the client.

{
  "routing": {
    "domainStrategy": "AsIs",
    "rules": [
      {
        "type": "field",
        "domain": ["geosite:cn"],
        "outboundTag": "direct"
      }
    ]
  }
}

geosite matches domain groups, while geoip matches address groups; they aren’t interchangeable. Domain rules need the core to have domain information it can use. Results may differ when an app provides only an IP address. Before adding a rule, check the input information, data files, and rule order, then decide whether features such as domain sniffing are needed. Don’t enable every option just to make one rule match.

DNS Resolution and Connection Routes

DNS resolves domain names to addresses; proxy connections carry requests. These can use separate paths. If a domain won’t open but its address works, that means you should investigate DNS further—it doesn’t prove that a particular DNS service is at fault. First identify whether resolution is handled by the system, the client, or encrypted DNS built into the app. Then determine which path your test is actually using.

In system proxy mode, an app may resolve domains itself or pass them to the local proxy, depending on the protocol and app implementation. TUN may also capture DNS requests, so it works differently from a regular proxy. After switching entry points, check your DNS settings again instead of assuming the browser will behave as before. Change one DNS route at a time to avoid settings from multiple sources overriding each other.

Before using a custom DNS server, confirm it’s reachable on the current network and understand whether its requests go through the proxy. If the remote server can’t be reached, routing all DNS queries through the same failed proxy can create another dependency. When the remote server uses a domain name, also consider how that domain is resolved before the proxy connection is established—not just how queries work after it connects.

TUN and Local Network Access

After TUN takes over traffic, new routes may affect printers, network storage, and local admin pages. Check whether the client has options to bypass the LAN or exclude routes, then confirm that the local address ranges match your network. Don’t add an overly broad direct route just to restore access to one device; a broad rule can also affect traffic that should use the proxy.

“Global proxy” is useful for temporarily comparing routing behavior, but it doesn’t mean all system traffic is captured. After testing, restore rules suited to everyday use and verify access to your local network. To understand domain prefixes, address groups, and rule priority, see How to Write Custom Routing Rules in v2rayN, then narrow the rules to match your actual needs.

Common Configuration Issues and Recovery Steps

Use Symptoms to Narrow Down the Problem

Start by noting which app, destination, network, and start time are involved. Then determine whether the issue is with startup, subscriptions, traffic entry, or outbound routing. An app that won’t open and a website that won’t load are different problems. One failing site and every app losing network access also need different fixes. Keep the original settings and logs before making changes so you don’t erase the evidence.

If the client won’t start, check the installation type, system architecture, runtime, directory permissions, and security software records. If the client opens but the core fails, look at the first related error and check configuration parsing and the listening port first. Many later connection errors may simply result from the core failing to start; don’t treat each one as a separate issue or delete every subscription right away.

If a subscription updates successfully but connections fail, confirm that the active server belongs to the expected group and check whether the core is running. Then verify that the test app is using the proxy and review the remote connection logs. A subscription is just a way to retrieve configurations; server availability still depends on authentication parameters, service status, and the network path. Verify connectivity separately after every successful update.

Compare Results with as Few Changes as Possible

Choose one server, one test app, and one destination. Test on the current network, then switch to another available network without changing the configuration. If one server fails, compare it with another in the same group. If all servers fail, check the local entry point and network conditions. Don’t change the app, routing, DNS, and server at the same time, or you won’t know which change mattered.

Connection refused, connection timeout, authentication failure, and certificate errors mean different things. A refusal usually means the destination or local port isn’t accepting connections. A timeout means the connection didn’t complete in time. For authentication failures, check the configuration and service status. For certificate errors, first check the system clock, domain name, and required security settings. Don’t disable certificate verification as a permanent fix; it can hide the real problem.

If a local port is already in use, identify the process using it. If it’s an old client instance, exit normally and restart. If another essential program needs the port, change the client’s port and update any apps configured to use the manual proxy. Changing the client without updating those apps creates another entry-point problem. Never terminate an unknown system process just to free a port.

Restore Network Access After Disconnecting and Back Up Settings

If the network stops working after the client exits, first check whether the desktop system proxy still points to a local listening address. With TUN, check that the interface and routes were removed properly. On Android, check whether “Block connections without VPN” is enabled. Restore the platform’s original settings rather than clearing all network configuration as a first step. Don’t reset network settings casually during a remote work session.

If problems start after an update, compare settings with your backup and check whether you launched a copy from a different installation location. If you need to roll back, follow the client’s supported process and account for possible changes in configuration format. Keep both the old and current configuration copies; don’t repeatedly overwrite your only copy. After recovery, test automatic updates, startup settings, and routing separately.

Logs may include timestamps, destination addresses, rules, and error details. When sharing them, include only the necessary lines around the issue and hide authentication information. If you temporarily raise the log level, restore it after troubleshooting to avoid generating excessive logs. When asking for help, include your OS, client, traffic entry method, and tests you’ve already run—not just a screenshot saying “can’t connect.”

Quick FAQ

After recovery, test your browser, everyday apps, local network services, and connection after waking from sleep to make sure you haven’t fixed just one test case. Record the working entry point, routing, and DNS settings in your backup notes, and use that baseline next time you troubleshoot. To follow the setup steps again, return to the Getting Started guide. Don’t enable every advanced option in this manual at once.