v2rayNG on Android: VpnService, battery whitelist and per-app proxy

Three settings, three links in the chain

On Android, v2rayNG is not an ordinary background process. It uses the system's VpnService to create a virtual network interface: app traffic is sent into that interface first, then handed to the built-in Xray core. For the whole chain to run reliably, three things must hold at once — the system lets it establish a VPN, the process isn't frozen after the screen goes off, and the target app's traffic really does enter the interface.

The three settings map exactly onto those three things. VpnService authorization and the persistent notification handle permission; the battery optimization whitelist handles survival; the per-app proxy list handles routing. Failed connections, drops after screen lock and misbehaving apps almost always trace back to one of them.

VpnService authorization and the persistent notification

The first time you tap Connect on the main screen, the system shows a connection request dialog explaining that v2rayNG wants to set up a VPN connection. Tick 'I trust this application' and tap OK — only then is the authorization remembered. If you tap Cancel, or leave the box unticked, the dialog appears again on the next connection.

1. Allow the connection request

   On the first connection, tick 'I trust this application' in the system dialog and tap OK. The prompt appears only once; if you decline, you'll be asked again on every connection.

2. Keep the persistent notification

   Once connected, a v2rayNG notification appears in the status bar — it is the foreground service's proof of life. Swiping it away from the notification shade is the same as disconnecting.

3. Lock the recent task

   Open the recent tasks list, then pull down on the v2rayNG card or tap the lock icon on it to pin it, so a 'clear all' sweep doesn't take it out too.

4. Allow autostart

   Turn on the autostart switch for v2rayNG in the system app manager, otherwise you'll have to tap Connect manually after every reboot.

The persistent notification can't simply be turned off. If it's only the noise you mind, go to Settings → Apps → v2rayNG → Notifications and lower the channel's importance or set it to silent: the notification stays, but makes no sound and shows no banner. Disabling notification permission altogether can make some systems restrict the foreground service as well, which makes the connection more likely to be reclaimed.

Battery whitelist: keeping the process alive through background cleanup

Since Android 8.0, background apps have been subject to execution limits: once the device enters Doze, background network access is suspended wholesale. v2rayNG holds long-lived connections, so if the process is frozen, TCP connections die silently — the icon stays in the status bar while pages refuse to load.

The fix is to exclude v2rayNG from battery optimization. Different systems give the levels different names, but the goal is the same: let it run unrestricted in the background.

Once you've made the changes, verify them: connect the proxy, lock the screen for ten minutes, then wake it and open any web page. If the first page load is noticeably slow or fails outright, the connection was reclaimed while the screen was off — go back and recheck the two steps above. One more thing that's easy to miss is Data Saver: in Settings → Network & internet → Data Saver, if v2rayNG has its own restriction enabled, background traffic gets cut off there too.

Per-app proxy: route what should be routed, direct what should be direct

The entry point is the menu in the top-right corner of the main screen → Settings → Per-app proxy. You'll see a mode selector and an app list. The three modes differ only in what a checkmark means, so read the table before you start.

The most typical symptom of picking the wrong mode: you check an app and it gets slower — because the current mode is 'Proxy selected apps only', where a checkmark means send it through the proxy, not let it connect directly. Before changing modes, be clear about whether you want a whitelist or a blacklist.

• Banking and payment apps: put them on the direct list. These apps are sensitive to consistency between login IP and region.
• Mainland China video, music and food delivery apps: keep them direct, so going through the proxy doesn't trigger rate limiting or odd region checks.
• Browsers and apps that need overseas network access: put them on the proxy list.
• App stores and system updates: choose as needed — going through the proxy can avoid throttling on update mirrors, while direct saves data.

After changing the list, disconnect and reconnect once. The per-app list is submitted to the system when the VpnService is established; on some systems, editing the list without reconnecting won't take effect immediately.

How it works with subscription updates and routing

Per-app proxy decides which apps go online; routing decides which domains and IPs connect directly. The two stack: traffic is filtered by app first, then matched against routing rules. So putting an app on the proxy list doesn't mean all of its requests go out — if the target domain matches a direct rule, it still connects directly.

The direct domains and direct IP lists you enter under Routing settings in v2rayNG end up generating rules like this:

{
  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      { "type": "field", "outboundTag": "direct", "domain": ["geosite:cn"] },
      { "type": "field", "outboundTag": "direct", "ip": ["geoip:cn"] },
      { "type": "field", "outboundTag": "proxy", "network": "tcp,udp" }
    ]
  }
}

Subscription updates are a separate path. When v2rayNG fetches a subscription, it uses the app's own requests, which don't pass through the per-app proxy list. If the subscription URL needs a proxy to reach, connect to a working server on the main screen first, then go back to Subscription group and tap Update all subscriptions. When an update fails, check whether the server works before repeatedly editing the per-app list.

FAQ