For Android users who have imported a profile but keep seeing VPN permission prompts, lose the connection after locking the screen, or want only certain apps to use the proxy. First check whether v2rayNG has taken over the VPN connection, then review background battery restrictions and choose a per-app mode. Each step includes a way to verify the result, so you can tell node issues apart from system restrictions or an incorrect app selection.
VPN Permission vs. Node Connection
v2rayNG is an Android client that uses the Xray core. Its usual VPN mode uses Android's VpnService to create a local virtual network interface. Traffic from apps covered by the VPN is passed to the core, which uses routing rules to send it direct, through a proxy, or block it. This local interface is not a node server. Android showing VPN connected does not mean the remote node is working.
The first time you tap Connect on the main screen, Android usually shows a “Connection request” prompt asking to set up a VPN connection. Approving it grants the app permission to route traffic from this device; it does not grant access to a subscription. A connection can still fail after approval if the node address, port, UUID, transport, or TLS settings are incorrect.
-
Select a node
Select the profile you want to use on the v2rayNG main screen, then tap Connect. Test with a known working profile first. Avoid changing the subscription, routing rules, and app list all at once.
-
Grant permission
Approve the “Connection request” prompt from Android. If you can't interact with it, turn off overlays such as floating windows or screen filters, then return to the client and try connecting again.
-
Check system status
Open Android Settings and search for “VPN” to confirm that v2rayNG owns the current connection. Status bar icons vary across Android versions and manufacturers, so don't rely on the icon alone to determine whether the service is working.
-
Test connectivity
Use a browser included in the proxy scope to open a page you want to test, and check the client's logs. If the VPN is connected but requests time out, investigate the node and routing rules instead of repeatedly revoking system permission.
VPN connection replaced? Check for another VPN
An Android user or profile can usually have only one active VPN connection established through VpnService. Another app using a local VPN, such as a network filter, security tool, or work connection, may take over from v2rayNG. This is different from background battery management. Work profiles may also have separate management policies, so settings in your personal profile may not apply.
- Disconnects immediately after connecting: Open Android Settings → VPN and check whether another app has taken over. Stop the other VPN connection, then start v2rayNG and test again.
- Permission prompt appears every time: Check whether another VPN was enabled, you switched profiles, or the client was reinstalled. Any of these can change the permission state; it doesn't necessarily mean the profile is corrupted.
- All apps lose internet access when the client stops: Check the VPN details for “Block connections without VPN” or a similarly named option. This is a system-level blocking policy, not a node health check.
- Can't change a setting: If the device is managed by an organization, check its management policy first. Don't troubleshoot by deleting a managed configuration.
For initial troubleshooting, leave “Always-on VPN” and “Block connections without VPN” off. Once the connection is stable and the per-app rules behave as expected, decide whether to enable either option. In particular, with blocking enabled, apps excluded from the VPN may be unable to connect directly. “Bypass” does not necessarily mean traffic will use the regular network.
Disconnects When the Screen Locks: Battery and Background Limits
A connection that works in the foreground, drops after the screen goes off, and recovers when you return to the client is often a sign of background restrictions—but it isn't conclusive. Wi-Fi handoffs, server outages, and network restrictions during sleep can cause similar symptoms. First note whether Android still shows the VPN as connected and whether the client is still running when the drop occurs. Then adjust settings based on what you find.
Background checks: separate Android limits from manufacturer settings
Android app battery settings
- Long-press the v2rayNG icon, open App info, and look for “Battery” or “App battery usage.”
- If available, set background battery usage to “Unrestricted” or allow background activity.
- Check notification permissions and allow connection status notifications. Android 13 and later may request notification permission separately.
Manufacturer background management
- Search Settings for “Auto-start.” If the option is available, allow v2rayNG to start as needed.
- In “Background activity” or “Battery optimization,” relax restrictions that may stop the app.
- If your system supports locking apps in the recent apps list, you can use it as an additional measure, but it does not replace battery settings.
Change permissions only for v2rayNG; there's no need to disable battery saver for the whole device. Relaxing restrictions may increase battery use, so keep only the settings you need.
Connection notifications help show whether the service is still running, but “Allow notifications” and “Allow background activity” are separate permissions. Denying notification permission does not automatically prevent Android from running a foreground service. Likewise, seeing a notification doesn't prove that every request reached the node successfully.
- While the screen is on, visit a page in the same browser and note the time and network type.
- Lock the screen for 5 minutes, unlock it, then visit the same page in the same app. Five minutes is a suggested test interval, not an Android cleanup threshold.
- If the request fails, check which app owns the VPN connection and review the client logs before reconnecting. Note what changes after reconnecting.
- Repeat the test on Wi-Fi and mobile data. Change just one battery setting per round so you can identify which change made a difference.
Per-App Proxy: What the Selected Apps List Means
In v2rayNG, open Settings → Per-app proxy. First check whether per-app proxy is enabled, then check “Bypass mode.” Together, these options determine what the app list means: with bypass mode off, only selected apps are usually routed through the VPN; with bypass mode on, selected apps are excluded. Don't interpret the checkboxes without checking the mode.
Route only selected apps through the VPN
RecommendedEnable per-app proxy, leave “Bypass mode” off, and select only the apps you want to test or route through the proxy. Start with one browser. A short list makes it easier to tell whether its traffic is entering v2rayNG.
Best for: A few apps need a proxy, initial setup, and troubleshooting.
Exclude selected apps from the VPN
Enable per-app proxy and turn on “Bypass mode,” then select the apps to exclude. Other apps covered by the VPN will be routed through it. Newly installed apps are usually included too, so review the list after installing apps.
Best for: Most apps should use the VPN, with a few exceptions that need direct internet access.
“Recommended” refers to how easy the mode is to verify during initial setup; it doesn't mean selected-app mode is faster in every situation. Before changing settings, note the current mode and app list. In particular, don't toggle “Bypass mode” with a long existing list without checking it first—the same selections will mean the opposite.
-
Confirm what the list means
Go to Settings → Per-app proxy. Enable the feature, then decide whether to use “Bypass mode.” If the screen provides an explanation, follow its description of what happens to selected apps.
-
Select a test app
For selected-app mode, start by selecting one browser. App names can be similar, so check the package name if needed. An app in your personal profile and its work-profile copy are separate entries.
-
Reconnect the VPN
Save your settings and return to the main screen. Disconnect, then reconnect. The app routing list takes effect when the VPN interface is created, so don't assume an existing interface immediately reflects changes to the list.
-
Restart the target app
Close and reopen the target app to rule out existing connections. Also test an app that isn't selected and confirm that both behave as intended.
Test the app list separately from core routing
Per-app proxy determines which apps send traffic into the VPN; core routing determines which outbound route connections take after that. Even for a selected app, rules may send requests to certain domains directly. So seeing your local network's IP after selecting an app doesn't necessarily mean per-app proxy is broken. Check the current routing mode and the rules for the domain before changing the app list.
- App isn't covered by the VPN: Normally, its connections won't reach the v2rayNG core. Changing core domain rules won't fix an app selection problem.
- App traffic enters the VPN but is routed directly: That's a routing result. Check the client's current routing configuration instead of repeatedly changing Android VPN permissions.
- A page opens in an external browser: The browser, not the original app, may be making the request. Selecting only the app that launched the page may not cover it.
- System services are involved: Downloads, sign-ins, and push notifications may be handled by separate services. Check the logs and how the request is made before adding system apps to the list.
DNS needs to be considered separately. Apps may use system DNS or their own encrypted DNS; cached pages and existing connections can also retain old results. An IP lookup page reflects only that request and doesn't prove that every app or domain follows the same route. To test per-app settings reproducibly, leave DNS and routing unchanged and modify only the app list.
Common Questions and Troubleshooting Steps
VPN permission is granted, but why does the node still time out?
Permission only allows Android to establish a VPN. First confirm the device date and time are correct, then check the node address, port, transport, and TLS settings. Review the client logs for connection errors. If only one app fails, check the per-app list; if all apps covered by the VPN fail, focus on the node and network.
Battery usage is unrestricted, but the connection still drops when the screen locks. What next?
Check for separate manufacturer settings that limit auto-start or background activity, then see whether another app has taken over the system VPN. Test the same app on Wi-Fi and mobile data to distinguish background shutdowns from network changes. Change one setting at a time and note when the issue occurs; a brief recovery doesn't prove it's fixed.
Nothing changed after selecting an app. Should I re-import the subscription?
First check the combination of “Enable per-app proxy” and “Bypass mode.” Disconnect and reconnect v2rayNG, then reopen the target app. Subscriptions provide node profiles; they are separate from the app list. Deleting a subscription is not a routine step for changing per-app rules.
Apps excluded from the VPN can't connect either. What should I check first?
Open Android Settings → VPN → details for the current VPN and check whether “Block connections without VPN” is enabled. If excluded apps need direct internet access, review this option in light of your security requirements. Then check the network, the apps' own proxy settings, and any work profile policies.
Restore settings in this order: confirm which app owns the VPN connection, check that the client stays active in the background, then verify the app list and routing rules. For more help, use the troubleshooting guide to investigate network issues, or the glossary to distinguish subscriptions, routing, and DNS. Keep the time of the error and any relevant logs. Before sharing logs, redact subscription links, node credentials, and other personal information.