v2rayNG Per-App Proxy: How To Route Selected Android Apps

Per-app proxy mode in v2rayNG lets you choose which Android applications enter the local VPN interface. Instead of sending every phone connection through the proxy, you can limit proxy access to a browser, messaging tool, testing application, or another selected app. This is useful when local services should remain direct, when battery and data usage matter, or when only one application needs a different network route.

The important point is that per-app proxy selection and V2Ray routing rules work at different levels. The Android application list decides which apps are captured by v2rayNG. After a selected app enters the VPN interface, the imported configuration still decides whether its domain uses a proxy outbound, a direct outbound, or a blocked outbound. A correct setup therefore requires both the right app mode and a working node configuration.

How v2rayNG per-app proxy works

When you start a VPN connection in v2rayNG, Android creates a local VPN interface. Depending on the selected mode, Android sends traffic from all applications or only the applications in the per-app list into that interface. v2rayNG then passes captured connections to the selected core, commonly an Xray-based core, where the configuration processes DNS, routing, and outbound selection.

The list is based on Android application packages rather than website domains. Selecting a browser does not mean every browser tab will use the same final outbound: the routing section may still send local domains direct and remote domains through the proxy. Likewise, excluding a browser from the VPN interface prevents v2rayNG from processing its traffic, so a V2Ray routing rule cannot later bring that browser connection back into the proxy.

This layered behavior explains many apparently inconsistent results. An application may be selected correctly but fail because its traffic matches a blocked route, uses an unsupported protocol, or cannot resolve DNS. Another application may be unselected and still work normally because it is using the mobile or Wi-Fi network directly. Always identify the layer that is failing before changing several settings together.

Choose the right app mode

Use “Proxy only selected apps” when the proxy requirement is narrow. Typical examples include testing a remote website in one browser, using a communication app that needs a particular route, or comparing direct and proxied behavior without changing the rest of the phone. In this mode, a newly installed app will normally remain outside the proxy until you add it to the list.

Use “Bypass selected apps” when the majority of applications should use the proxy and only a few need direct access. For example, a user may want most browsing and online services to use the proxy while excluding a local network controller, a banking application, or an app that must reach a device on the home LAN. This mode is convenient for broad coverage but less conservative because Android background services can generate traffic even when their visible app is not open.

• Choose proxy-only mode if fewer than five applications need the proxy.
• Choose bypass mode if most daily applications already require the proxy and only two or three must remain direct.
• Do not add an application merely because it is installed. Add it because its network traffic has a clear reason to use the proxy.
• After changing modes, stop and start the VPN connection so the new application scope is applied cleanly.
• Record the current mode and app list before troubleshooting, especially when several people share the same phone profile.

Remember that some Android applications use multiple processes or launch helper components. The visible name in the app list may not make the relationship obvious. If a feature still does not work after selecting the main application, check whether the failing function belongs to a separate companion app or system component. Avoid selecting broad system packages unless you understand the effect on local connectivity, battery use, and background synchronization.

Configure selected apps in v2rayNG

The exact wording can differ slightly between v2rayNG releases and Android versions, but the workflow is stable. First import or select a known-good node. Test that node in the normal VPN mode before narrowing the application scope. If the node itself is broken, per-app selection will make the symptoms harder to interpret.

1. Update the node

   Open v2rayNG, select the intended subscription group, tap the menu, and run the subscription update. Select one imported configuration that has recently connected successfully.

2. Open app settings

   Go to the v2rayNG settings area and open the VPN or per-app proxy section. Look for the mode selector and the installed application list; names vary slightly by release.

3. Pick a mode

   Select “Proxy only selected apps” for a narrow scope, or “Bypass selected apps” when most applications should remain inside the VPN interface.

4. Select applications

   In the app list, tick the applications that match the chosen mode. In proxy-only mode, tick the apps to proxy; in bypass mode, tick the apps to exclude.

5. Start the VPN

   Return to the main screen, choose the node, tap the connect button, and approve Android’s VPN permission request. Wait until v2rayNG shows an active connection.

6. Test one app

   Open one selected app and test sign-in, page loading, media, and notifications. Then test one unselected or bypassed app to confirm that the boundary is behaving as intended.

On the first connection, Android may show a system confirmation that v2rayNG wants to establish a VPN connection. Approve it only when you intended to start the client. If Android displays a persistent VPN indicator, that is expected while the local interface is active. Switching between Wi-Fi and mobile data may trigger a reconnect; wait for the connection status to stabilize before judging the result.

Understand routing, DNS, and local access

Per-app proxy is an application-level filter, not a replacement for routing configuration. Suppose a browser is selected in proxy-only mode. The browser’s connections enter v2rayNG, but the configuration may contain rules such as private IP ranges to direct, local domains to direct, foreign domains to proxy, or unwanted destinations to block. The final result depends on rule order and the selected outbound.

DNS can also produce a misleading result. If the selected application opens a domain but DNS resolution fails, the app may report a general network error even though the VPN interface is working. Some configurations resolve domains locally; others send DNS requests through a configured remote server or use domain-based routing before resolution. The correct choice depends on the imported configuration and the client core, so avoid replacing DNS addresses randomly while testing.

Local access deserves special attention. A proxy-only setup can still affect access to private addresses if those destinations are captured and then processed by routing rules. Devices such as printers, media servers, and local control panels commonly use addresses in ranges such as 192.168.0.0/16, 10.0.0.0/8, or 172.16.0.0/12. A direct rule for private networks is often needed, but the exact rule must match the configuration format supported by the active core.

Fix common connection problems

Begin with a controlled comparison. Keep the same node, network, and application while changing only the per-app mode. First connect with the normal broad scope, then connect with proxy-only mode and one selected app. If the broad connection works but the selected app does not, focus on the app list, Android VPN permission, and application behavior. If both fail, troubleshoot the node or core configuration first.

A short verification checklist

Before making advanced changes, verify that Android has granted VPN permission, v2rayNG is not paused by a battery or background restriction, and another VPN service is not active at the same time. Android generally allows only one active VPN service, so a security, filtering, or corporate VPN can prevent v2rayNG from receiving traffic.

• Confirm the selected node has a valid server address, port, user ID, and transport parameters.
• Check that the active core supports the imported protocol and security fields.
• Reconnect after editing the app list instead of relying on an old VPN session.
• Test with one simple website and one application function before testing streaming, uploads, or background notifications.
• Review the v2rayNG log for timeout, DNS, handshake, certificate, or connection-refused messages.
• Temporarily disable battery restrictions for testing if Android is stopping the background VPN service.

Common log messages should be read in context. A timeout can indicate an unreachable server, blocked transport, incorrect port, or a route that never reaches the expected outbound. A DNS error points toward resolution rather than app selection. A connection-refused message usually means the destination or local listener rejected the connection. Avoid treating every error as proof that per-app proxy is malfunctioning.

selected app
    ↓
Android VPN interface
    ↓
v2rayNG core
    ↓
DNS and routing rules
    ↓
direct, proxy, or block outbound

Recommended daily setup and maintenance

For most beginners, a stable daily configuration is simple: select proxy-only mode, add only the applications that genuinely require the proxy, use a known-good imported node, and leave the routing rules unchanged until the basic connection works. This arrangement makes it clear which application is being tested and avoids unnecessary background traffic from unrelated services.

Review the list after installing or uninstalling applications. Android package identities can change when an application is reinstalled, cloned into a second profile, or replaced by a different edition. A visible app name may also appear more than once. Select the entry that corresponds to the profile you actually use, then test it immediately rather than assuming the old selection still applies.

Subscription updates normally replace or refresh node information, not your Android application-selection logic, but behavior can vary with the client version and imported profile. After updating, confirm that the intended node remains selected and run a quick test in each important application. If a provider changes transport, security, or routing parameters, an older v2rayNG core may no longer support the new entry even though the subscription update itself succeeded.

Per-app proxying is also useful for separating testing from normal use. You can select one browser for a new node, compare direct and proxy performance, and remove it from the list when the test ends. Keep notes about the mode, selected apps, node name, network type, and observed result. This avoids confusing a routing change with a network change and helps identify whether the problem is repeatable.