v2rayNG can route only selected Android apps through its VPN connection, or route selected apps through the VPN while leaving the rest outside it. The exact menu labels vary by app version and Android manufacturer, so first identify whether the list means “apps to proxy” or “apps to bypass.” This guide explains the two modes, gives a careful setup sequence, and shows how to verify the result without confusing an app-list setting with the proxy server or routing rules.
Understand what per-app proxy changes
On Android, v2rayNG uses the system VPN service to receive traffic from apps. Per-app proxy changes which app packages are included in that VPN path. It does not create a separate proxy server for each app, and it does not change the node’s protocol, address, or authentication settings. Once traffic reaches v2rayNG, the selected core and routing rules still determine how that traffic is handled.
Most versions present one of two list behaviors. In a proxy-only mode, apps you select are routed through v2rayNG and apps you leave unselected are excluded. In a bypass-selected mode, selected apps are excluded and other eligible apps use the VPN. These modes can look nearly identical in the list, so check the mode label or description before changing checkboxes. A list with the right apps selected but the wrong mode can produce the opposite result from what you intended.
| List mode | Apps you select | Apps you do not select | Useful when |
|---|---|---|---|
| Proxy selected apps | Use the v2rayNG VPN path | Stay outside that VPN path | Only a few apps need the proxy |
| Bypass selected apps | Stay outside that VPN path | Use the v2rayNG VPN path | Most apps need the proxy, with a small exception list |
| All apps, no per-app filter | Not applicable | Not applicable | You want the default VPN behavior for eligible apps |
“Outside the VPN path” does not necessarily mean an app will connect directly to its destination in every situation. Android networking, a different VPN app, an app’s own proxy settings, and device policies can affect the result. Also, traffic that does enter v2rayNG can still be routed directly by the core’s rules. Per-app selection controls the app-to-VPN boundary; it does not override every routing decision after that boundary.
Choose a list mode before selecting apps
Start with the desired result, not the checkboxes. Write down two short lists: apps that must use the proxy and apps that must remain outside it. Then select the mode that makes the smaller list easier to maintain. For example, if two apps need the proxy and twelve do not, proxy-only mode is usually easier to review. If nearly every app should use the proxy and only one needs to bypass it, bypass-selected mode may be simpler.
There is no universally safer mode. A missed app in proxy-only mode may connect outside the VPN, while an overlooked app in bypass-selected mode may enter it. The practical difference is the default for newly installed apps: in proxy-only mode, a new app is commonly outside the selected set until added; in bypass-selected mode, a new eligible app may be included unless it is added to the exclusion list. Recheck the list after installing or removing apps.
- Choose proxy-only when you want a small, explicit allowlist of apps that use v2rayNG.
- Choose bypass-selected when most apps should use the VPN and you have only a few exclusions.
- Leave filtering off when all eligible apps should follow the normal VPN behavior and you do not need an app-specific exception.
Do not infer the mode from an app’s checked state alone. Look for wording such as “Proxy apps,” “Bypass apps,” “Per-app proxy,” or a proxy/bypass selector in v2rayNG’s settings. Some releases place the selection in a dedicated settings screen; others show the app list after opening the per-app option. Manufacturer-modified Android settings may also use different names for VPN status and app permissions.
Decision rule: maintain the shorter list
Choose the mode that requires fewer exceptions, then record whether the list contains apps to proxy or apps to bypass. That one note prevents a future checkbox change from silently reversing your intended policy.
Configure the app selection
Before changing the list, confirm that an ordinary v2rayNG connection works. Select a known-good node, start the VPN, and test one browser or other app with per-app filtering disabled. If nothing can connect at this stage, solve the basic node or VPN problem first; app selection cannot repair an unreachable server. Menu wording differs between v2rayNG releases, so use the labels on your installed version rather than assuming every device has identical screens.
Check the baseline
Open v2rayNG, select a working node, tap the connect button, and approve Android’s VPN permission if prompted. Confirm that the app reports a connected state and test one site or service before enabling an app filter.
Open the filter
Open the v2rayNG menu and go to Settings, then look for Per-app proxy or a similarly named app-selection option. If your release exposes a mode selector, read whether it means “proxy selected apps” or “bypass selected apps.”
Choose the mode
Select the mode that matches your intended default. If only a few apps should use the proxy, choose the mode that proxies selected apps. If only a few should stay outside, choose the mode that bypasses selected apps.
Select packages
Find each app by its displayed name and check the intended entries. Verify the complete list before leaving the screen; similar names, cloned apps, and work-profile copies may appear as separate entries.
Reconnect and test
Save the selection if the screen has a save control, return to the main screen, and restart the VPN connection. Test one selected app and one unselected app, then confirm that each behaves as intended.
On many Android versions, app selection is applied when the VPN interface is created. Reconnecting after editing is therefore a useful way to ensure the new selection is active. If the VPN was already running while you changed the list, do not assume the change took effect immediately; stop and start the connection once, then repeat the tests.
For a clean test, temporarily close the apps being checked and reopen them after reconnecting. Existing network sessions can remain alive for a while, and an app may reuse a connection created before the filter changed. Compare one app at a time, keep the same node and network, and avoid changing DNS or routing settings during this test. That makes it easier to identify whether the app list itself caused the difference.
Verify the result and troubleshoot mismatches
A connected indicator confirms that the VPN service is running, not that every app is using it. Test both sides of the filter. For an app intended to use the proxy, confirm that it can reach a service that requires the proxy in your current network environment. For an app intended to bypass it, compare behavior with v2rayNG stopped, while keeping in mind that the app may have its own proxy, DNS, or account settings.
Use more than one signal when possible. Check the app’s observed network behavior, review v2rayNG’s connection or core log for requests during the test, and compare with a known direct connection. A log entry for a request is evidence that traffic reached the client; an empty log is not conclusive if the app reuses a connection, uses a different network path, or has not made a new request. Do not treat a latency test for the node as proof that a particular app is routed through it.
Why is my app missing from the list?
Check whether the app is installed in a different Android user, work profile, or cloned-app space. v2rayNG may show only packages visible in the current profile. Switch to the profile where the app is installed, or select the corresponding work-profile copy if it is listed separately.
I checked the app, but it still connects directly. What should I check?
Confirm the list mode first: a checked item may mean “bypass” rather than “proxy.” Then save the setting, stop and restart v2rayNG, and reopen the app to create a fresh connection. If it still behaves differently, check whether the app uses its own proxy or whether the request is routed directly by the core’s rules.
Why does the selected app stop working?
Confirm that the node works with filtering disabled, then check v2rayNG’s connection log while opening the app. Also test on Wi-Fi and mobile data separately. A failed node, DNS issue, unsupported traffic type, or app-specific network restriction can affect one app even when the VPN itself is connected.
- No apps connect after enabling filtering: Recheck the mode and make sure at least one app is selected if using proxy-only mode. Restart the VPN and verify that Android still shows v2rayNG as the active VPN.
- Newly installed apps bypass unexpectedly: Review the selected list. Proxy-only mode often requires adding new apps explicitly; bypass-selected mode may include them by default.
- A duplicate app behaves differently: Check whether the two entries belong to separate profiles or an app-cloning feature. Select and test the exact package instance you use.
- Only one service fails: Keep the app selection unchanged and compare another node or network. This separates an app-specific problem from a filtering problem.
If an app is absent, do not install a replacement package merely to make it appear in the list. First confirm the active Android user, work profile, and app-cloning setup. Likewise, avoid changing several v2rayNG options at once: changing list mode, DNS, routing, and node settings together makes the result difficult to diagnose. Record the current mode and selected apps, change one variable, reconnect, and repeat the same test.
Keep the configuration predictable
Per-app filtering works best when it remains a small, documented policy rather than a collection of unexplained checkmarks. Keep a note such as “proxy selected apps” or “bypass selected apps,” record the names of the exceptions, and review the list after an Android update, v2rayNG update, profile change, or app reinstall. Reinstallation can change the package entry or move the app to another profile, so a previously correct list may need attention.
Remember the three separate stages: Android decides which apps enter the VPN, v2rayNG and its core process the traffic that arrives, and routing rules choose the outbound for each request. If an app is excluded, changing a core routing rule will not pull its traffic into the VPN. If an app is included but a request goes direct, inspect the core’s routing behavior as well as the node. Keeping those stages separate prevents unnecessary node changes when the actual issue is an app filter.
Use a two-app verification test
After every filter change, test one app that should use the VPN and one that should bypass it. This catches a reversed mode or stale connection faster than checking only the connected indicator.