V2RAY / GLOSSARY
Common terms for protocols, subscription imports, routing and DNS settings.
Look up a setting by name, then follow related terms to explore connected concepts. The explanations below distinguish the graphical interface, proxy core and network path. Menu names and available options depend on the installed client and selected core.
PROTOCOL / TRANSPORT
The protocol defines authentication and data format, transport determines how data is carried, and the security layer protects the connection. Check node settings by layer; the protocol name alone does not establish compatibility.
VMess is a proxy protocol in the Project V ecosystem, with authentication and data protection mechanisms. The client and server must use compatible user IDs, transport settings and security parameters. A significantly incorrect system clock can also affect authentication, so check the time settings if a handshake fails.
Related: TransportVLESS is a lightweight proxy protocol that handles user authentication and traffic encapsulation but does not encrypt data on its own. Connection security is typically provided by TLS, REALITY or another complementary mechanism. Check the transport, security layer and flow-control fields for each server; do not assume one VLESS server's settings will work for another.
Related: REALITYTrojan is a proxy protocol typically used with TLS and authenticated with a password. Check the password, server address, port and TLS server name together when configuring it. The server address locates the server, while the server name is used for the handshake and certificate verification; they are not necessarily the same. Disabling certificate verification is not a substitute for correcting the settings.
Related: Server settingsREALITY is a transport security mechanism in the Xray ecosystem, not a standalone proxy protocol. It is often paired with VLESS and requires parameters such as the server's public key, server name and short ID to match. The public key and client fingerprint are separate fields. If a configuration still fails after import, check whether the core supports it rather than relying on whether the interface lets you save it.
Related: XrayTransport determines how a proxy protocol's data is carried, for example over TCP, WebSocket or gRPC. It is a separate configuration layer from proxy protocols such as VMess and VLESS. WebSocket may require a path and Host; gRPC may require a service name. Correct addresses and credentials cannot make mismatched transport settings work.
Read the full setup guidePROJECT / CORE
V2Ray can refer to a specific core or appear in discussions of the broader tools ecosystem. Distinguish the project, core and client first to identify which layer provides a feature.
Project V is an ecosystem of projects and tools built around network proxy capabilities, with V2Ray as a key component. Graphical clients, cores and configuration formats each serve different purposes. When searching for the “V2Ray official website,” first decide whether you need project documentation, core information or client instructions; settings and interfaces from different projects are not interchangeable.
About the projectV2Fly is a community project that maintains V2Ray-related code and documentation. Its v2fly-core is commonly called the V2Ray core and handles protocols, routing, DNS and other functions. v2flyNG is an Android client that uses this core family. Similar names do not mean it has exactly the same settings as other clients.
Related: Graphical clientXray is a proxy core project that evolved from V2Ray, offering protocol, routing and transport security capabilities. It shares technical roots with V2Fly, but their features and configuration support are not identical. v2rayNG uses the Xray core. For settings such as REALITY, check the capabilities of the core actually in use rather than inferring them from the client name.
Related: Proxy coreA graphical client displays servers, manages subscriptions, generates configurations and controls the core. v2rayN is for desktop platforms, while v2rayNG and v2flyNG are for Android. “Update subscription,” “Set active server” and “System proxy” are separate actions in the interface. A successful import does not mean traffic is already using the selected server.
Choose a clientThe proxy core is the runtime component that handles connections, protocols and routing; the graphical interface organizes user actions. If the core fails to start, the client may open normally but still be unable to establish proxy connections. Start troubleshooting by checking the startup output. Determine whether the issue is an invalid configuration field, a port conflict on the local listening address or a missing runtime component, then adjust the relevant setting.
Troubleshooting Q&ACLIENT / SUBSCRIPTION
A subscription is a source of configuration, a server contains connection settings, and a test result is a measurement made under specific conditions. Keeping these concepts separate helps diagnose update failures, unavailable servers and test timeouts.
A subscription URL lets a client retrieve a set of server configurations and typically includes access credentials. Importing a subscription saves its update source; updating it fetches the latest server list from that source. For example, a tutorial might use https://example.com/sub?token=xxxx. Treat your actual URL as private information and keep it out of public screenshots and logs.
A server is a set of settings for connecting to a remote endpoint, typically including its address, port, protocol, authentication and transport parameters. The name shown in the client is only a label and does not affect how the connection works. Renaming a server usually does not change its address. Before editing subscription-generated settings, remember that a later update may overwrite your local changes.
Related: Share linkSubscription groups organize servers by source or purpose and store their update settings. Updating a group usually refreshes content from that source; whether existing entries are replaced or retained depends on the client. Use group names for source notes or purpose, not access credentials. Importing the same URL more than once may also create duplicate groups.
Related: Subscription URLA share link encodes the settings for a single server as copyable text. Common prefixes include vmess://, vless:// and trojan://. It usually describes just one server and is not the same as an updateable subscription URL. A link may contain complete authentication details; encoding does not mean the content is encrypted.
Real connection latency usually measures how long a request takes when sent to a test address through the selected proxy route. Results depend on the test address, DNS, handshake, network load and the client's measurement method. It is not download speed and cannot be compared directly with a TCP connection test. If a test fails, check that the test target is available and review the runtime logs.
Related: DNS resolutionMATCH / OUTBOUND
Routing determines which outbound handles a connection after it enters the core. The system proxy and TUN direct traffic into the client; routing rules choose where it goes. They are separate functions and cannot replace each other.
Routing rules select an outbound for a connection based on conditions such as domain, IP, port or inbound. Rules are commonly checked from top to bottom, and the first match usually determines where the connection goes. Put specific exceptions before broader rules, and check the default outbound for traffic that matches no rule. This helps prevent a local change from affecting unrelated connections.
Read the routing guideIn routing configurations, GeoIP usually refers to IP address sets that can be referenced by tag. geoip:private identifies private or reserved address ranges; the exact scope depends on the data file in use. These rules match IP addresses. If the input is a domain name, whether it must be resolved first also depends on the routing domainStrategy setting.
GeoSite is a collection of domains organized by tags, used to match groups of domains in routing rules. geosite:category-ads-all is a category reference, not a real domain. The data provider defines what each collection contains. Even when names match, check the source and update status of the data file; domain categories do not replace checking which rules actually match in the logs.
domainStrategy is a routing field that determines when domains are resolved for IP-based rule matching. AsIs, IPIfNonMatch and IPOnDemand specify different resolution timings. It is not a DNS server address and does not directly select proxy or direct routing. If the same field name appears in another configuration object, interpret it in the context of that object.
An outbound tag is a name assigned to an outbound in the configuration; routing rules refer to it using outboundTag. direct, proxy and block are common naming conventions, not built-in capabilities of the tags themselves. When copying a rule, confirm that the target tag exists and that its outbound protocol and purpose match your expectations.
NETWORK / DNS
Application traffic and DNS requests may take different paths. To verify your settings, check separately whether the application traffic reaches the client, whether routing selects the right outbound, and which resolver handles DNS requests.
The system proxy points the operating system's proxy settings to the client's local listening address. Whether an application uses that setting is up to the application, so enabling it does not send traffic from every program through the proxy. In v2rayN, “Automatically configure system proxy” mainly changes this entry point. Check the settings of terminal tools and browsers with their own proxy configuration as well.
Compare: TUN modeTUN mode routes traffic into the client through a virtual network interface and usually covers more traffic than the system proxy. Routing and exclusion rules still determine which connections go direct, through the proxy or are blocked. Enabling it may require additional permissions and can cause routing conflicts with other virtual network adapters. “Enable TUN” does not mean every connection uses a proxy outbound.
Related: RoutingDNS resolution translates domain names into IP addresses needed for connections and can also return other record types. The operating system, browser and proxy core may each use a different resolution path. When configuring V2Ray DNS, distinguish resolution of the server address from resolution of the target website, and check the outbound policy for DNS requests. Changing a single resolver address may not be enough.
Related: DNS leakFakeDNS assigns domains synthetic IP addresses for internal use and stores the mapping between each domain and its synthetic address. When a later connection enters the corresponding processing path, the core can use the mapping to recover the domain name. A synthetic address is not the target server's real address. If DNS and connection routing are not coordinated, or an application retains an old cache entry, resolution may succeed while the connection fails.
Related: DNS resolutionA DNS leak occurs when resolution requests bypass the intended path and are handled by another resolver or network egress. Check the configured DNS policy to assess a leak; the apparent IP address used to access a website is not enough to draw a conclusion. Encrypted DNS in the browser, the system resolver and the core's DNS may all be active. Check their settings and logs individually instead of treating every direct DNS request as a problem.
DNS troubleshooting Q&A