System proxy controls how apps send traffic to the client; global and bypass-China routing control which outbound route the client uses after receiving it. For everyday browsing, start with system proxy plus bypass-China routing. If a site behaves unexpectedly, switch to global temporarily for comparison. Development tools and games require separate checks for proxy support, UDP, and per-app settings—the mode name alone doesn’t tell the whole story.
Start with two layers: proxy entry and outbound route
“Why is an app connecting directly even though global mode is on?” The problem is often the entry point. v2rayN manages servers, subscriptions, and core settings on desktop; the selected V2Ray or Xray core handles the actual connections. A running client and a selected server don’t mean every app is sending requests through the local proxy.
System proxy is a set of proxy settings provided by the operating system. Apps that honor these settings, such as browsers, send requests to a local HTTP or SOCKS endpoint; tools with their own network stack may ignore them. Global routing controls what happens after traffic enters the core: ordinary traffic received by the core uses the proxy outbound by default. It does not mean every connection on the system is intercepted.
| Setting | Layer | What it controls | What it doesn’t guarantee |
|---|---|---|---|
| System proxy | App entry | Sends apps that honor system settings through the local proxy | That every app or UDP traffic uses the proxy |
| Manual proxy in an app | App entry | Connects a specific app to a local listening address | That other apps also use the proxy |
| VPN interception or TUN | Network entry | Receives IP traffic according to the configuration | That all traffic ultimately goes through a remote server |
| Global routing | Core outbound | The default proxy route for traffic the core receives | Intercepting traffic that never reaches the core |
| Bypass-China routing | Core outbound | Routes traffic directly or through a proxy based on domain or IP | Correctly identifying the origin of every website |
Global vs. bypass China: which should you use day to day?
Global mode is useful for short diagnostic tests. With the same server and entry point, if a site works in global mode but not in bypass-China mode, check routing rules, classification data, and DNS before changing your subscription. Global mode also sends many requests that could connect directly through a remote server, using more server traffic and potentially changing the apparent location of your connection.
Bypass-China routing typically combines domain classifications for mainland China with IP ranges, sending matching requests directly and routing the rest through the proxy. Presets may also include direct access for private addresses, ad blocking, or other rules, so similarly named modes across different clients aren’t necessarily configured the same way. A company’s location, its server’s IP address, and its classification aren’t always aligned.
Bypass China: a practical starting point for everyday routing
RecommendedConnect commonly used services in mainland China directly and route other requests through the proxy. After enabling it, test sites in mainland China, sites that need a proxy, and local network services separately. Add a rule if a specific domain behaves unexpectedly.
Best for: everyday browsing, work, and using services in and outside mainland China
Global: one outbound route for troubleshooting
Business requests that reach the client use the proxy outbound by default. Whether LAN traffic, DNS, or reserved rules are exceptions depends on the actual configuration. Switch back to your everyday routing after testing.
Best for: troubleshooting routing issues and tasks that need a consistent remote exit
Manual proxy: limit proxy use to selected apps
Set a local address and port in a specific tool instead of relying on the system proxy. This is an entry-point option that can still be paired with global or bypass-China routing; it isn’t a third routing mode.
Best for: proxying only a terminal, development tool, or specific browser profile
How to compare: keep the entry fixed, then change the route
Keep the server and app proxy settings unchanged, and switch only between global and bypass-China routing. If the results differ, check the destination and outbound tag in the logs. Don’t change DNS, the server, and the mode all at once, or you won’t know which change mattered.
Desktop setup in v2rayN: check the ports, then enable system proxy
On desktop, make sure the core starts successfully before changing system proxy settings. Using the v2rayN 7.x layout as an example, check the local listener options under Settings → Parameter Settings, then choose “Set system proxy automatically” from the system proxy menu on the main screen. Menu names and locations can vary between desktop builds, so check the current interface and core startup logs.
For a clear example, use SOCKS listener 127.0.0.1:10808 and HTTP listener 127.0.0.1:10809. These are example ports, not guaranteed defaults for every version. Some builds use a single mixed port for both HTTP and SOCKS. If your settings provide only a mixed endpoint, use that port; don’t assume there’s a separate 10809 port.
- Check the server. After importing a subscription, select a server and check the startup logs for listener failures, configuration errors, or port conflicts.
- Check the listener. Note the local address, port, and supported proxy protocols. For a single-device setup, keep the loopback address; there’s no need to enable LAN access for your browser.
- Set the system proxy. Choose “Set system proxy automatically,” then check the operating system’s proxy settings to confirm they point to the current client port.
- Choose a route. Select a bypass-China preset from the routing options on the main screen. If there’s also a “Bypass LAN and China” option, check that preset first when accessing devices such as printers or NAS systems.
- Test, then restore. Try one site in mainland China and one site that requires a proxy. Before closing the client, clear the system proxy so it won’t point to a listener that’s no longer running.
The “bypass addresses” setting in the system proxy interface is not the same as the client’s “bypass-China routing.” The former may let an app skip the local proxy, so the core never sees the request. The latter chooses a direct outbound route after the request has entered the core. Check both settings when troubleshooting.
Android setup in v2rayNG: VPN interception isn’t the same as a global outbound route
v2rayNG uses the Xray core. Once you start a connection in VPN mode and grant permission, the client receives traffic through Android’s VPN interface, then the core selects an outbound route according to its routing configuration. This isn’t the same as a desktop HTTP system proxy, and there’s no need to enter the desktop port 10809 in your phone’s network settings.
Check the current preset under Settings → Routing Settings in v2rayNG. If per-app proxying is enabled, verify the app list and whether selected apps are included or excluded. Two similar options—“proxy only selected apps” and “bypass selected apps”—do exactly the opposite. After changing routes, restart the connection as prompted by the client, then reopen the target app and test again.
Desktop and Android: check each entry point and use comparable routing strategies
Desktop: v2rayN
- Browsers connect through the system proxy or an in-app proxy.
- Set an explicit HTTP or SOCKS address in the terminal.
- Use bypass-China routing to classify outbound traffic; check LAN access separately.
- For games, check UDP and the traffic interception method separately.
Android: v2rayNG
- Grant permission and start the connection in VPN mode.
- Check that the per-app list includes the target app.
- Choose the appropriate routing preset in Routing Settings.
- After changing strategies, disconnect and test again.
Using the same subscription only ensures a consistent source for server details; it doesn’t automatically sync system proxy settings, per-app lists, or local routing rules.
V2flyNG uses the V2Fly core. If you use this Android client, check the entry point, per-app scope, and outbound route in that order, but don’t copy v2rayNG menu paths or Xray-specific settings directly. VMess and VLESS are server protocol names, not global or bypass-China switches; changing the server protocol won’t automatically change routing rules.
Browsing, development, and gaming: choose based on the traffic
For browsing, start with system proxy plus bypass-China routing. It usually offers a practical balance between services in mainland China and sites that require a proxy. For location checks, account sign-ins, or payments, keep the outbound route consistent throughout the task; don’t switch repeatedly between direct and remote routes midway. If a page loads but its images or sign-in API don’t, check the routing for those subdomains separately.
| Scenario | Recommended entry | Recommended routing | What to check |
|---|---|---|---|
| Web browsing and office work | System proxy | Bypass China | Whether the browser honors system proxy settings |
| Terminal and development tools | In-app proxy or explicit options | Route according to project needs | Tool-specific proxy overrides and where DNS is resolved |
| LAN devices | Keep the existing entry settings | Direct access to private addresses | Address ranges such as 192.168.0.0/16 |
| Online games | A traffic interception method that supports the game’s traffic | Choose an outbound route based on the server | UDP, packet loss, and latency spikes |
Terminal test: bypass system settings and check the proxy entry directly
The commands below test the HTTP and SOCKS endpoints separately. Replace the ports with your actual settings; the example domain is for demonstrating a request, not the only way to test connectivity. In Windows PowerShell, use curl.exe to avoid issues with command aliases and parameter handling.
curl --proxy http://127.0.0.1:10809 --connect-timeout 10 --max-time 20 --head https://example.com
curl --proxy socks5h://127.0.0.1:10808 --connect-timeout 10 --max-time 20 --head https://example.comsocks5h passes the destination hostname to the SOCKS proxy for resolution, while socks5 typically resolves it locally first. Different results may indicate different DNS paths, but don’t prove that a particular resolver is at fault. An HTTP response shows that this request completed a connection, but doesn’t by itself prove it used the proxy outbound—a bypass-China rule may have sent it directly.
Game testing: a working website doesn’t prove UDP works
- Standard HTTP system proxies usually can’t carry game UDP traffic. Switching to global routing doesn’t remove this entry-point limitation.
- Even with VPN or TUN interception, the server, protocol configuration, and remote service must support the UDP forwarding your game needs.
- Compare direct and proxied connections to the same server. Observe each for three minutes and record in-game latency, packet loss, and disconnects. This is a testing procedure, not a prediction of performance.
- Distinguish sign-in requests from gameplay traffic. A successful sign-in page only shows that those connections work; it doesn’t mean the game server uses the same outbound route.
Still having issues after switching modes? Troubleshoot in order
Don’t treat global mode as a universal fix. Changing routes won’t help if the port is wrong, the app isn’t connected to the proxy, or the server is unavailable. Check in this order: can the app reach the proxy entry → is the server working → does the route match → is DNS consistent? Change one variable at a time and record the results.
Why can’t my terminal connect even with global mode selected?
First, test with the explicit curl proxy command above. If that works but ordinary requests fail, check the terminal tool’s proxy options or environment variables instead of switching routes again. Environment variables are handled differently by different tools, so setting them once doesn’t guarantee they’ll work everywhere.
Global mode works, but sites don’t load in bypass-China mode. What should I change?
Keep the server unchanged and check whether the failed domain is classified for a direct connection. If it needs a proxy, add a proxy rule for that domain before any broad direct-connection rule that might match first. Then check classification data and DNS. Don’t route all mainland-China IP ranges through the proxy based on a single failing site.
Can’t find your home NAS or printer after enabling the proxy?
First, check whether the device address is in a private range, such as 192.168.0.0/16, 10.0.0.0/8, or 172.16.0.0/12, and check the direct-routing rules for private addresses. If the device relies on broadcast or LAN discovery, also check how VPN, TUN, and the firewall handle that traffic; a domain rule alone may not be enough.
Web pages stop loading after closing v2rayN?
Check the system proxy settings to see whether they still point to 127.0.0.1 and a port that’s no longer running. Clear any leftover settings and try again. Next time, choose “Clear system proxy” in the client before quitting. Disable any proxy configured manually in individual apps as well.
Custom routing rules are usually evaluated in order, and the first match determines the outbound route. A broad proxy or direct-connection rule near the top can take precedence over precise domain rules below it. DNS resolution also affects whether IP rules can match. So if a site works after switching modes, treat that as a troubleshooting clue, then check the domain, resolved IP, and outbound tag in the logs.
Recommended order: fix the entry point before fine-tuning routing
For everyday use, start with system proxy or VPN interception plus bypass-China routing. Use global mode as a comparison when troubleshooting, and add a precise rule only when a specific domain has an issue. Save a copy of the original configuration, and keep the server, destination, and entry point the same for each test.
For more setup help, follow the subscription import steps in Quick Start, or check routing and DNS settings in the User Guide. Understand the entry point and outbound route separately, and you can choose the right proxy mode based on what you need to configure instead of repeatedly toggling the same setting.