v2rayNG can proxy selected Android applications without forcing every app through the same connection. This is useful when a browser or messaging app needs the proxy, while banking, local-network, or work applications should continue using the ordinary network. The important detail is that per-app behavior is controlled by the Android VPN routing mode inside v2rayNG, not by the node protocol itself. A VLESS, VMess, or Trojan profile can all be used; the application list determines which local traffic enters the VPN tunnel.
Before changing the setting, make sure v2rayNG can connect normally with a single test profile. Per-app routing adds another decision layer: the profile must work, the Android VPN permission must be active, and the selected application list must match the intended mode. If the list and mode are reversed, the result can look like a broken proxy even though the node and core are operating correctly.
This guide explains the exact v2rayNG path for Android per-app proxying, compares the two operating modes, walks through a safe configuration procedure, and shows how to test, troubleshoot, and restore the default all-app behavior when necessary.
Understand what v2rayNG per-app routing actually changes
In ordinary VPN mode, v2rayNG creates a local TUN-based VPN interface and Android sends application traffic into that interface. The Xray core inside v2rayNG then receives the captured traffic, applies DNS and routing rules, and forwards it through the selected outbound. With the default all-app behavior, most eligible application traffic is visible to the VPN service unless Android or the application itself applies an exception.
Per-app proxying inserts a package-level filter before the normal core routing decision. Android identifies applications by package name rather than by the label shown on the launcher. For example, two applications may display similar names while having different package identifiers, and a reinstall or vendor variant can change which package is actually installed. v2rayNG therefore presents an application selection screen rather than asking you to type package names manually.
The two modes are easy to confuse:
- Proxy selected apps: only applications in the selected list are captured by v2rayNG. Other applications use the normal Android network path.
- Bypass selected apps: all eligible applications are captured except those in the selected list. The listed applications use the ordinary network path.
This filter is different from a domain rule such as geosite or a destination rule such as geoip. A domain rule decides whether a request should be proxied after traffic has reached the core. A per-app rule decides whether an application’s traffic should enter the VPN service in the first place. If an application is excluded at the Android VPN layer, changing Xray routing rules cannot bring that traffic back into the proxy.
Practical conclusion: choose the mode before choosing the apps
If only two or three applications need the proxy, use “proxy selected apps.” If nearly every application needs the proxy and only a few must remain direct, use “bypass selected apps.” The number of exceptions is a better guide than the application names.
Compare proxy-selected and bypass-selected modes
Both operating modes use the same VPN permission and the same active v2rayNG profile, but they have opposite failure patterns. In proxy-selected mode, forgetting to add an application leaves it direct. In bypass-selected mode, forgetting to add an application sends it through the proxy. Decide which mistake is safer for your environment before enabling the VPN.
Only the checked applications enter v2rayNG. This limits proxy exposure and makes the result easy to verify when a small number of apps require access through the tunnel.
Suitable for: a browser, one messaging app, or targeted testing
Most applications enter v2rayNG, while checked applications remain outside the VPN path. This reduces list maintenance when the proxy should be the normal route.
Suitable for: broad proxy use with a few direct exceptions
No per-app exception is applied. This is the normal fallback when you want Android traffic to follow the VPN service and do not need package-level filtering.
Suitable for: restoring the default and diagnosing list mistakes
Use proxy-selected mode when battery impact, compatibility, or privacy boundaries matter. A video application, a local payment application, and a work application may have very different network requirements. Keeping unrelated packages outside the VPN reduces the amount of traffic that the core must inspect and avoids changing the network path for applications that already work normally.
Use bypass-selected mode when the device is mainly used through the proxy and only a few applications must connect directly. Typical exceptions include local device-management tools, services that require a region-specific direct connection, or applications that reject VPN interfaces. The downside is that a newly installed application may automatically enter the proxy path because it is not yet present in the bypass list.
Configure v2rayNG step by step
The wording can vary slightly between v2rayNG releases and Android vendor skins, but the control is normally located in the VPN or per-application proxy settings. Start from a known working profile and avoid changing the core, transport, and application filter at the same time. The following sequence keeps the fault boundary clear.
Verify the active profile
Open v2rayNG, select a known working VMess, VLESS, or Trojan profile, and connect once with the ordinary default mode. Confirm that the status changes to connected and that a simple browser request succeeds before configuring the application list.
Open VPN settings
Tap the menu button, open “Settings,” then enter the VPN or application-level proxy section. Depending on the build, the entry may be labeled “Per-app VPN,” “Applications,” or “Proxy only selected apps.” Read the mode description rather than relying only on the checkbox title.
Choose the operating mode
Select “Proxy selected apps” when the checked list should be proxied, or select “Bypass selected apps” when the checked list should remain direct. Do not begin selecting packages until this mode is fixed.
Select installed packages
Open the application list and check the packages required by your plan. In proxy-selected mode, check every app that should use v2rayNG. In bypass-selected mode, check every app that must avoid v2rayNG. Save or return to the previous settings page so the selection is committed.
Reconnect the VPN
Disconnect v2rayNG, wait for the Android VPN notification to disappear, and connect again. Accept the Android VPN permission prompt if it appears. A reconnect ensures that the new package filter is applied to the current VPN session rather than only being stored for a later start.
After saving the list, review the selected mode one more time. A checked application has opposite meaning in the two modes, so a correct package list with the wrong mode produces the exact inverse of the intended result. Keep the list short and purposeful; adding every application to a proxy-selected list is harder to maintain than using the all-application default.
Some Android versions display a system VPN warning or a “VPN is active” key icon. This icon confirms that a VPN service is running, but it does not confirm that a particular application is included. Android may also restrict background activity, suspend the v2rayNG process, or restore a previous VPN connection after a reboot. If the behavior changes after the screen turns off, review the battery setting for v2rayNG and allow the background operation required by your device.
Test the filter without guessing
A useful test must compare an included application, an excluded application, and the VPN status itself. Testing only the application that should be proxied is insufficient because a wrong bypass mode can still make that application work while silently routing unrelated traffic.
- Test the included package: force-stop it, reconnect v2rayNG, open it again, and load a page or refresh data that requires a new connection.
- Test the excluded package: repeat the same force-stop and restart process with an application that should remain direct. Confirm that its normal service is still available.
- Test the VPN state: check the Android VPN indicator and the v2rayNG status screen. If the VPN is disconnected, both included and bypassed applications may appear to use the ordinary network, which makes the comparison invalid.
For a stronger check, use the v2rayNG log while making one request at a time. A successful core connection proves that at least some traffic reached the core, but it does not prove that every package did. If the selected application is supposed to be proxied and no corresponding connection appears in the log, first inspect the package list and mode. If a supposedly bypassed application appears in the log, check whether it opened a connection before the new settings were applied or whether another component on the device is using the same process.
Proxy selected apps
- Checked package
- Enters v2rayNG
- Unchecked package
- Uses normal route
- Best test
- Compare one checked and one unchecked app
Keep the list limited to applications that genuinely need the proxy.
Bypass selected apps
- Checked package
- Uses normal route
- Unchecked package
- Enters v2rayNG
- Best test
- Check a listed exception and a new app
Review newly installed applications because they may be proxied automatically.
Do not use a speed test as the only validation. A speed-test application may be excluded, may select a different endpoint, or may reuse a cached connection. A better sequence is to inspect the VPN state, create a fresh request in the target application, compare the application’s behavior with the selected mode, and then review the core log. This separates package filtering from node latency and server throughput.
Troubleshoot common per-app mistakes
The most common problem is reversed behavior: the application intended for proxying goes direct, while an unrelated application uses the proxy. This almost always means that “bypass selected apps” was chosen when “proxy selected apps” was intended, or the reverse. Change only the operating mode, reconnect the VPN, and repeat the two-application comparison. Do not edit the node until this basic interpretation has been confirmed.
A second problem is that the target application does not appear in the list. Check whether it is installed for the current Android user or work profile. Android can maintain separate application instances, and the package visible in one profile may not be available to the VPN service in another. A vendor-specific cloned-app feature can also create a second package entry. Select the package that corresponds to the instance you actually open.
If the application was selected but still behaves as direct, force-stop it before testing. Some applications maintain long-lived WebSocket connections, background services, or cached DNS results. Also disconnect and reconnect v2rayNG after modifying the list. If Android asks for VPN permission again, approve it and verify that no other VPN service has taken control of the device.
If every application loses connectivity after enabling the filter, return temporarily to the all-application mode. Confirm that the active profile still works, then add one package at a time. If all-app mode also fails, the problem is probably unrelated to per-app selection and may involve the node, subscription data, DNS behavior, local network, or core startup. Per-app settings should not be used to conceal a general connection failure.
Some applications use more than one package or delegate network work to a companion service. Selecting only the visible front-end may not capture all related traffic. In that situation, compare the application’s behavior with the log and inspect the installed package names shown by v2rayNG. Add only the necessary companion package, because broad selection can unexpectedly proxy background traffic.
Restore the default configuration when needed
To remove package-level filtering, open v2rayNG and follow “Settings” to the VPN or application proxy section. Change the mode to the default all-application behavior, clear the selected package list if the interface provides a “Clear” action, save the settings, disconnect the VPN, and connect again. The exact label may be “Proxy all apps,” “All applications,” or an empty per-app list, depending on the version.
After restoring the default, force-stop the applications used during testing and reopen them. Check that the Android VPN indicator is present and that the v2rayNG status reports the intended active profile. If an application still takes the wrong path, review Android’s system VPN settings for always-on VPN or lockdown options, and make sure another VPN service is not enabled. These system-level controls can change the result independently of the v2rayNG package list.
Keep a small record of the working state: the selected mode, the application names, the active profile type, and the date of the last successful test. This is especially useful after an application update, a v2rayNG update, or an Android system upgrade. Package lists can remain saved while application permissions or VPN behavior change, so a quick comparison after a major update is safer than assuming the previous state still applies.