v2rayNG for Android: VPN Permissions, Battery Settings & Per-App Proxy

VPN permission: Check the system tunnel and server connection separately

v2rayNG uses the Xray core to handle proxy connections and creates a virtual network interface through Android's VpnService. The first time you tap Connect, Android displays a VPN connection request. Once you approve it, the app can handle traffic from apps covered by your settings. This grants system-level permission; it does not authenticate with a server or confirm that a subscription or server is working.

A VPN icon in the status bar only means the system tunnel is active. The server address, port, user ID, and TLS or REALITY settings still need to match the server. If the icon is present but websites won't load, check the logs and try accessing a site. Reinstalling the app to trigger the permission prompt again won't help.

1. Select a server

   In the configuration list on the v2rayNG home screen, tap an imported configuration and make sure it's selected. Start by testing one server you know works; avoid switching subscription groups repeatedly.

2. Check the service mode

   Open Settings from the side menu and check that Service mode is set to VPN. The location of this option may vary between versions. Proxy-only mode doesn't automatically route network requests from other apps.

3. Approve the connection request

   Return to the home screen and tap Connect. When Android displays the VPN connection request, approve it. If you've already granted permission, Android may not show the prompt again.

4. Test real-world access

   Use the browser you plan to route through the proxy to visit a known working HTTPS page, then check the connection status and logs in v2rayNG. A successful latency test doesn't replace loading a webpage.

Battery settings: Adjust background limits for v2rayNG only

If the connection works while the screen is on but drops after you lock it, check background restrictions before changing the transport protocol. Android's battery saver, manufacturer-specific background cleanup, and network changes can all affect the connection. Allowing v2rayNG to run in the background can reduce interruptions, but it can't guarantee an uninterrupted connection on mobile data.

A common path is Settings → Apps → v2rayNG → Battery → Unrestricted. If you see an Allow background activity option, check that too. Some devices instead use Special app access → Battery optimization: switch to All apps, select v2rayNG, and choose Don't optimize. These are Android system settings, not subscription settings in the app.

Some devices also let you lock an app in the recent apps screen. This can help, but it doesn't replace battery settings. Avoid disabling battery saver for the entire device just for one app. After changing settings, keep the same server and test with the screen on and locked. Note when the connection drops and whether you were using Wi-Fi or mobile data.

Per-app proxy: understand what the selected apps list means

Go to Settings → Per-app proxy from the side menu, enable the feature, then check whether Bypass mode is on. Some versions show the toggle and app list on the same screen. Don't just look at which apps are checked: the same list works in opposite ways depending on the mode. The list won't limit which apps use the VPN unless per-app proxy is enabled.

For example, to route only a browser through the proxy, turn off Bypass mode and select that browser. To route most apps through the proxy while letting a local service connect directly, turn on Bypass mode and select that app. After changing the list or mode, return to the home screen, disconnect, and reconnect so the new app scope takes effect.

App selection vs. routing rules: entering the tunnel doesn't mean all traffic goes to the remote server

Per-app proxy determines which apps send traffic into the VPN tunnel. Once traffic is inside, Xray routing rules determine whether each connection uses the proxy, connects directly, or gets blocked. So selecting a browser doesn't mean every browser request goes through the remote server. Server settings from a subscription don't choose your Android app list for you.

• Apps not selected in proxy-only mode: Their traffic doesn't enter this VPN tunnel, so routing rules inside the tunnel can't control it.
• Selected apps: Their traffic may still connect directly because of domain, IP, or other routing rules. When troubleshooting, check the routing options in the app's Settings instead of focusing only on the app list.
• DNS requests: DNS resolution also depends on the app's DNS settings, Android Private DNS, and how the app handles lookups. An exit IP alone can't tell you how every request was resolved.
• App clones and work profiles: Apps are generally matched by package and user profile. An app with the same name in another profile may not be covered by the VPN service in your current profile.

Shopping, payment, and video apps may hand links off to an external browser, and sign-in flows may open another app. If a page behaves unexpectedly, first check which app actually made the connection, then decide whether to add it to the list. Don't select every system component just to cover one redirect.

Connection checks: Test permissions, background behavior, and app selection separately

After setup, follow a consistent test sequence to make problems easier to reproduce than by switching servers repeatedly. Keep the same server and network during each test: first confirm foreground access, then check behavior while the screen is locked, and only then test switching between Wi-Fi and mobile data. Change one condition at a time so the logs are easier to match to your actions.

1. Round 1 — Foreground access: Confirm the service is running on the home screen. Open the selected browser, visit an HTTPS page, then test a page that should connect directly. If both fail, check the server settings, system time, and network connection first.
2. Round 2 — Lock-screen test: Lock the screen for 15 minutes, as suggested above. After unlocking, immediately check the VPN status and load a new page. Note whether the service stopped, rather than simply recording that the page was slow. A running service with timed-out connections is a different issue from a process that was killed.
3. Round 3 — App scope: Open one app on the selected list and one app that isn't. Compare the results with new connection entries in the app logs and your routing settings. Cached pages and background preloading aren't reliable evidence.
4. Additional network-switch test: Turn off Wi-Fi, switch to mobile data, and try again. A brief reconnect may be caused by the network change. If the connection doesn't recover, check background data permissions, then try stopping and restarting the service manually.

When asking for help, include your Android version, v2rayNG version, service mode, Bypass mode status, and whether the issue happens with the screen on or after locking it. Logs can show specific errors, but hide subscription links, server addresses, and user IDs before sharing. You don't need to post your full configuration to describe these settings issues.

FAQ: VPN prompts, lock-screen disconnects, and app lists that don't work