This guide explains how to configure per-app proxying in v2rayNG on Android so that only selected applications use the VPN tunnel while other applications connect directly. You will learn how the allow-list and bypass modes differ, where to select applications, how to start the VPN safely, how to verify the result with logs and network tests, and what to check when an app appears to ignore the rule.
How v2rayNG per-app proxying works
v2rayNG does not normally inject a proxy setting into each Android application. Instead, it creates an Android VPN interface and receives traffic selected by the per-app rule. The application traffic then enters v2rayNG, is matched against the active routing configuration, and is sent either through the selected VMess or VLESS server or directly to the destination. This is why Android may display a VPN key or VPN status even when only two or three applications are selected.
There are two different decisions to keep separate. The first is the application list: which packages are included in or excluded from the VPN interface. The second is the routing rule: after traffic enters v2rayNG, whether a domain or address uses the proxy outbound or the direct outbound. Per-app proxying controls the application boundary; routing rules control the destination boundary.
In practice, an allow-list is usually easier to reason about. For example, selecting a browser, a messaging application, and a work tool means those applications use the VPN while unselected applications remain outside the tunnel. A bypass list reverses the meaning: selected applications avoid the VPN and the remaining applications are captured. Always read the label shown beside the mode before saving, because selecting the same packages produces opposite results in the two modes.
Per-app proxying also depends on the Android package identity rather than the visible name alone. A vendor may provide separate packages for a standard application, a lightweight edition, a beta channel, or a work profile. If the wrong package is selected, the visible application may continue using the direct network even though a similarly named entry is enabled in v2rayNG.
Prepare the node and Android environment
Before changing application rules, make sure the selected v2rayNG profile works without per-app filtering. Open v2rayNG, choose a known-good configuration, start the service, and test one ordinary web page or a service that normally requires the proxy. If the basic connection already fails, per-app settings will only make the symptoms harder to interpret.
Check the profile’s protocol and transport fields as well. VMess and VLESS are not interchangeable records: a VLESS profile may require a UUID, encryption value, Flow setting, TLS or REALITY parameters, and a matching transport, while VMess commonly contains an alter ID value only in older configurations. Do not edit these fields merely because an application is not passing through the proxy. First prove that the profile works for all traffic.
Android can also restrict background activity or battery use. Aggressive battery optimization may stop v2rayNG after the screen is locked, and a data-saving policy may prevent a selected application from making requests. These restrictions are separate from per-app proxy mode. Keep v2rayNG allowed to run in the background during testing, and temporarily disable battery optimization for the client if the VPN disconnects after several minutes.
Recommended setup: narrow rules first
Selected applications
- Choose one browser first
- Add a second app only after testing
- Confirm the exact package name
Unselected applications
- Leave ordinary local apps outside
- Check direct connectivity separately
- Avoid selecting every package initially
A one-application test makes it clear whether the problem is the node, the VPN capture, or the application list.
Configure selected applications step by step
Recent v2rayNG releases place the relevant control in the application’s settings area, but the exact label can vary by build. Look for an item named “Per-app proxy,” “Application proxy,” or a similar application-selection entry. The workflow below is more important than a particular screen title: enable the feature, choose its mode, select packages, save, and restart the VPN service.
-
Open app settings
Launch v2rayNG, open the side menu or settings screen, and find the per-app proxy or application list option. Do not begin by editing the server profile; per-app selection belongs to the VPN traffic configuration.
-
Enable the feature
Turn on per-app proxying if the screen provides a separate enable switch. If the list becomes unavailable until this switch is enabled, save the setting and return to the same screen before selecting packages.
-
Choose proxy mode
Select the mode that proxies only the applications you mark. In some versions this is described as “Proxy selected apps”; in others, it appears as an allow-list or include mode. Read the explanatory text carefully rather than relying on the position of the switch.
-
Select one package
Mark one browser or test application. Search by its visible name, expand duplicate entries when necessary, and check that the package belongs to the personal profile rather than a separate work profile.
-
Save and restart
Save the application list, return to the main screen, stop the current VPN, wait about 2 seconds, and start it again. Accept Android’s VPN permission prompt if it appears, then wait for v2rayNG to show a running state before opening the test application.
For a bypass list, follow the same path but choose the mode that sends selected applications directly outside the VPN. This is useful when most applications should use the proxy and only a small number must retain a direct route. The selected list is not a list of “applications to proxy” in this mode; it is a list of exclusions. Switching modes without changing the packages is therefore a quick way to reverse the result.
After the first successful test, add applications in small groups. A group of two or three packages is easier to troubleshoot than a list of twenty. If an application has a separate downloader, media player, authentication component, or browser engine, selecting only the main package may not capture every request related to that service.
Verify that split tunneling is working
Do not verify the setting only by looking for the VPN icon. The icon confirms that Android has an active VPN service, but it does not identify which applications are using the interface. Test a selected application and an unselected application separately, using the same network and the same time window.
For the selected application, open a site that reports the public address or use a service endpoint you trust. The result should match the proxy server’s exit region rather than the direct mobile or Wi-Fi address. Then close the application completely, including its recent-apps entry when appropriate, and reopen it after the VPN is running. Some applications cache DNS results, sessions, or API responses and may not immediately produce a fresh network request.
For the unselected application, use a harmless connectivity test such as loading a local service, checking a normal web page, or comparing the reported public address. It should remain reachable through the direct route in proxy-selected mode. If both applications show the same exit address, check whether the second application was accidentally selected or whether the client is operating in bypass-selected mode.
| Test result | Likely interpretation | Next check |
|---|---|---|
| Selected app uses proxy exit | Application capture and outbound connection work | Test an unselected app |
| Unselected app also uses proxy exit | Mode may be bypass-selected, or the app is included | Review mode and package list |
| Selected app has no connection | Profile, DNS, routing, or app compatibility issue | Read v2rayNG logs and test all-app mode |
| Neither app connects | VPN permission, node, or core startup issue | Disable per-app filtering temporarily |
Conclusion: verify with two applications, not one
A successful proxy test proves that one application can reach the server; only a paired selected-versus-unselected test proves that split tunneling is actually taking effect.
When checking DNS, remember that the displayed public IP and DNS resolver are different measurements. A selected application may use the proxy exit while Android’s resolver still handles some lookups locally, depending on the core and routing configuration. If a domain loads inconsistently, inspect the v2rayNG DNS and routing settings rather than concluding that the application list is broken.
Common problems and practical fixes
The most common mistake is selecting the right application under the wrong mode. A user may mark a browser, choose bypass-selected mode, and then expect the browser to use the proxy. Change the mode or clear the list and rebuild it from one known application. Restart the VPN after every mode change so the Android VPN interface is recreated with the current package rules.
Another frequent issue is that an application keeps using an old connection. Force-stop it from Android’s application settings, start v2rayNG first, and reopen the application. If it uses a browser engine shared with another application, test in a private session and close other related processes. For messaging applications, background connections may remain active until the process is stopped.
If selected traffic fails while all-app proxy mode works, the node is probably healthy and the issue is related to the application list, Android VPN behavior, or routing. If all-app mode also fails, investigate the selected profile, core startup, DNS, and server reachability. Do not change five settings at once; switch one variable, restart, and repeat the same request test.
Why can’t I find the application in the list?
Refresh or reopen the per-app proxy screen, search by the package’s full visible name, and check Android’s personal and work profiles separately. Some system components are hidden or cannot be captured independently. If the application was installed after v2rayNG loaded the list, restart v2rayNG before searching again.
Why do selected and unselected apps use the same address?
First check whether the active mode is “bypass selected apps.” Then clear the list, select one test application in proxy-selected mode, restart the VPN, and repeat the two-application test. Also confirm that another always-on VPN or a device-wide network service is not capturing traffic before v2rayNG.
Why does the selected app go offline?
Test the profile with per-app filtering disabled. If it works, check the application package, restart the VPN, and review routing rules for the app’s domains. If it fails in both modes, inspect the core log for DNS, TLS, authentication, or remote-server errors.
Why does split tunneling stop after the screen locks?
Allow v2rayNG to run without battery restrictions, permit background data, and check Android’s always-on VPN or VPN lockdown settings. Start the service again after changing those permissions. If the disconnect repeats, compare the v2rayNG log before and after the screen is locked.
Once the rule works with one application, document the intended mode and package list in a note. Keep a small test application selected so that a future v2rayNG, Android, or profile update can be checked quickly. Per-app proxying is most reliable when the node, VPN permission, application mode, and routing rules are treated as separate layers and tested in that order.