For Android users who have imported a node but are dealing with the initial VPN permission prompt, disconnections after locking the screen, or uncertainty about which apps use the proxy. First confirm that VpnService is established, then relax the necessary background restrictions, and finally configure the per-app list. Following this order helps you isolate system access, process lifecycle, and routing issues.
VpnService: Separate VPN Access from Node Connectivity
v2rayNG is an Android client that uses the Xray core to handle node protocols and routing rules. In VPN mode, Android’s VpnService creates a local virtual network interface. Eligible app traffic enters the client, where the core decides whether to send it directly, proxy it, or block it. The VPN icon only confirms that the local interface is up; it does not mean the remote node is working.
The first time you start the VPN service, Android displays a connection request. Approving it grants permission to create a local VPN interface; it does not purchase or activate a remote service. The node address, port, user ID, transport, and TLS parameters must still be correct. A misconfigured VMess or VLESS node may fail to load websites even after permission is granted.
Other tools that use the local VPN in the same user profile may replace or conflict with v2rayNG, including some firewalls and DNS tools. Check work and personal profiles separately; the connection status in one does not tell you what is happening in the other. If the connection drops just after enabling another network tool, check whether it has taken over the VPN interface before switching nodes repeatedly.
Takeaway: Check the interface, then test the node
After starting the service, confirm that v2rayNG is the active app on the system VPN page, then test access in the app you actually need. If the interface is down, troubleshoot permissions and conflicts. If it is up but access still fails, check the node logs, DNS, and routing.
First Connection: Check Permissions and VPN Conflicts
The steps below use common Android menu labels. Names may vary by v2rayNG version and phone manufacturer, so follow the feature descriptions shown on your device. Before you begin, select a trusted, fully configured node and confirm that the client is in VPN mode. Proxy-only mode does not automatically route network requests from other apps.
-
Check the operating mode
Open the v2rayNG side menu and tap “Settings.” Check the options related to “VPN mode.” Use VPN mode when you want device-wide or per-app access. A mode that only provides a local proxy port is not the same as a system VPN.
-
Approve the connection request
Return to the main screen, select a node, and tap the start button in the lower-right corner. When Android displays the “Connection request” dialog, confirm the app name and tap “OK.” If you deny the request, the VPN interface will not be created.
-
Check the system VPN settings
Go to “Settings” → “Network & internet” → “VPN” and confirm that v2rayNG is the active connection. Some devices place VPN settings under “Connection & sharing” or “More connections.” Use Settings search if needed.
-
Rule out VPN conflicts
Temporarily stop other apps that use the VPN interface. If another connection has “Always-on VPN” enabled, check its settings first. Don’t remove a work or organization profile unless you know what it is for.
-
Test real-world access
Open an app that needs the proxy, then open an everyday app that should connect directly. Note whether each can connect, the error message, and when it occurred. The client’s latency test is useful as a secondary check, but it cannot replace testing the apps you actually use.
Battery Optimization: Diagnose Disconnects After Screen Lock
If v2rayNG works in the foreground but stops working after the screen has been locked for a while, Android’s background restrictions are a common cause. Wi-Fi changes, mobile network changes, or remote connection timeouts can also be responsible. Exempting the app from battery restrictions can reduce background interruptions, but it cannot keep a node online indefinitely. Before changing settings, check whether the VPN icon disappears, whether the service is still running, and whether it recovers as soon as you unlock the device.
- Battery restrictions: Long-press the v2rayNG icon → “App info” → “Battery” or “App battery management,” then set background usage to “Unrestricted” or allow background activity. The exact label varies by Android version.
- Battery optimization: Search Settings for “Battery optimization,” find v2rayNG, and check whether you can set it to “Don’t optimize.” Some devices include this option in the app’s battery settings instead.
- Background launch: If your device offers “Auto-start” or “App launch management,” allow v2rayNG to start and run in the background when needed. Allowing auto-start does not guarantee that the client will connect automatically after a reboot.
- Notification status: Check “App info” → “Notifications.” On Android 13 and later, notification permission affects whether notifications appear. A missing notification alone does not prove that the VPN service has stopped.
- Cleanup behavior: During testing, don’t use system cleaner apps to end v2rayNG or tap “Force stop.” Locking the app in the recent apps screen is only an optional aid on some devices.
After changing settings, test on the same Wi-Fi network first, then test mobile data separately to avoid changing multiple variables at once. Use the table below to record results. These are suggested test intervals, not measurements from this site or a guarantee that the app will stay active in the background.
| Test | Suggested steps | What to record |
|---|---|---|
| Foreground baseline | Keep the screen on and use the target app continuously for 2 minutes | Confirm that the node and app access both work |
| Short screen lock | Lock the screen for 10 minutes, then reopen the same app | Whether the VPN is still active and the first request succeeds |
| Longer idle period | Leave the screen locked for 30 minutes, then check again | Whether the app was stopped and whether it recovers after unlocking |
| Network switch | Switch from Wi-Fi to mobile data, then send a new request | Whether a reconnect is needed and whether the logs show a connection timeout |
A 30-minute idle period does not guarantee that the device entered deep Doze, so passing once does not prove that every standby scenario will work. If the VPN icon remains visible but access fails only after switching networks, reconnect first and check the logs. Relaxing battery restrictions further usually won’t fix a failed remote connection.
Per-App Proxy: Selecting an App Doesn’t Force It Through the Node
Per-app proxy settings determine which apps enter v2rayNG’s VPN interface. Routing rules then decide which outbound connection handles that traffic. These are two separate filtering steps. Even if a browser is selected, requests to local addresses may still go direct because of bypass rules. Apps excluded from the VPN won’t enter the client just because the core is set to global proxy mode.
A common path is the v2rayNG side menu → “Settings” → “Per-app proxy.” Enable the feature, check the “Bypass mode” setting, and then select apps. Don’t rely on the number of checked apps: switching bypass mode reverses what the same list means.
Include selected apps only
RecommendedEnable per-app proxy, turn off “Bypass mode,” and select the apps that should use the VPN. A shorter list is easier to verify and makes a good starting point for troubleshooting; other apps will generally continue to use the system network.
Best for: Using a node in just a few apps, such as a browser.
Bypass selected apps
Enable per-app proxy, turn on “Bypass mode,” and select the apps to exclude. All other apps enter the VPN interface, with routing rules deciding whether their traffic goes direct or through the proxy. Newly installed apps will usually be included as well.
Best for: Routing most apps through the VPN while excluding a few local-service apps.
Disable per-app filtering
Turn off per-app filtering so that all apps permitted by the system in that user profile enter the VPN. Then use routing rules based on domains, IP addresses, and other criteria to direct traffic. Troubleshooting should focus on routing, not the app selection list.
Best for: Managing access for all apps in one place when you can maintain routing rules.
Example: Route a browser through the VPN
- Stop the v2rayNG VPN service, then go to “Settings” → “Per-app proxy.”
- Enable per-app proxy, turn off “Bypass mode,” and select only the browser you’ll use for testing.
- Return to the main screen and restart the service so the updated app list is applied when the VPN interface is recreated.
- Close and reopen the browser, then send a new request. Don’t rely on a page that has already loaded.
- Open an app that isn’t selected and compare its access. Check the client logs to see whether traffic is reaching the VPN.
If a preinstalled app isn’t listed, check whether the screen offers a “Show system apps” option. Don’t add every system component just to save time. Downloads, account sign-ins, and embedded web pages may be handled by other processes, so investigate based on the issue you’re seeing. Apps in a work profile also can’t be identified by matching their icons to apps in your personal profile.
FAQ: VPN Permissions, Screen-Lock Disconnects, and App Lists
Why does the connection request keep appearing when I tap Start?
First make sure you tapped “OK” on the previous request. Then go to “Settings” → “Network & internet” → “VPN” and check for another active connection or an always-on policy. If the app exits immediately after you approve the request, check the v2rayNG logs to distinguish VPN interface creation failures from core startup failures. Don’t delete all your subscriptions as a first step.
No notification after locking the screen—does that mean the service was stopped?
Not necessarily. First check whether the connection is still listed on the system VPN page, then unlock the device and test a new request. If the connection has disappeared, review the app’s battery restrictions and system cleanup history. If it’s still there, check notification permissions, node connectivity, and network changes. Don’t draw conclusions from the notification icon alone.
Why do some websites still connect directly when my browser is selected?
First check that “Bypass mode” is off, then stop and restart the service. Next, review your routing rules: routing an app through the VPN doesn’t mean every request must go through the node. You can temporarily test with a proxy-first route for comparison, then restore your usual rules. Don’t change DNS and the node at the same time.
Why won’t the login page open after I exclude an app?
First check whether Android’s “Block connections without VPN” is enabled. Then see whether the sign-in flow opens an external browser or another app. Temporarily disable per-app filtering, restart the VPN, and retry the sign-in. If that fixes it, check the related apps and routes one by one instead of excluding every system service.
Troubleshooting: Change One Setting at a Time
VPN permissions, battery settings, and app lists each affect a different layer. Stabilize VPN access first, then adjust which apps use it, and finally fine-tune routing in the core. This makes issues easier to isolate than changing protocols, DNS, and nodes all at once. A successful subscription update only means the configuration was downloaded; it doesn’t mean VpnService has been authorized or the per-app list is active.
- Confirm VPN access: Does the system VPN page show v2rayNG? Is another VPN taking over the interface?
- Check that it stays active: Does the same node work in the foreground? Is the service still running after screen lock? Do you need to reconnect after switching networks?
- Check app coverage: Is per-app proxy enabled? Is bypass mode set as intended? Did you restart the service after changing the list?
- Check routing last: Review route matches, DNS, the node port, and transport settings. Record the app and steps needed to reproduce the issue.
For the basics of VPN access and traffic routing, see the user guide. If you’re unsure what VPN interfaces, outbound connections, or DNS mean, consult the glossary. Keep the error time and type in your troubleshooting notes. Before sharing logs, remove sensitive details such as subscription URLs and user IDs.