System Proxy, Global Mode, or Bypass Mainland: Which v2rayNG Mode Should You Choose?

First Separate System Interception from Routing

“System proxy” is often used as shorthand for a device connected through a proxy, but in v2rayNG the more precise process is starting Android’s VPN service. The first time you tap the start button on the main screen, Android asks for connection permission. After you allow it, a VPN indicator appears in the status bar, and only traffic from apps within the interception scope enters v2rayNG. Importing a subscription, selecting a server, or completing a latency test does not mean traffic is already being intercepted.

Global mode and bypass mainland mode operate at the next layer. Once traffic enters v2rayNG, the Xray core uses routing rules to decide whether to send it through the proxy outbound or connect directly. Global proxy mode typically sends most intercepted connections to the current server. Bypass mainland mode sends LAN addresses, common mainland domains, and mainland IP addresses directly, while handing all other traffic to the proxy server.

So “the system proxy is enabled” and “all traffic goes through the server” are not the same thing. The first describes whether the entry path exists; the second describes the routing result. Per-app proxy settings, an app’s own direct-connection behavior, system restrictions, and rule matches can all cause some connections to bypass the current server.

• Entry layer: the main-screen start button, system VPN permission, and per-app proxy scope.
• Matching layer: domains, IPs, ports, and protocol types are matched in sequence against the routing rules.
• Exit layer: after a rule matches, the corresponding outbound—proxy, direct, or block—is selected.

How Traffic Flows in Each Mode

Take a browser visiting one mainland site and one business site that requires a proxy. Before v2rayNG starts, both requests leave directly through the device’s default network. After starting v2rayNG in global proxy mode, both requests will typically first reach the current VMess or VLESS server, which then accesses the targets. In bypass mainland mode, the mainland site connects directly while the other business site uses the proxy outbound.

Domain requests also involve DNS. If a domain is resolved to an IP first, routing rules may continue by evaluating the destination IP. When domain rules or the built-in DNS policy are enabled, the core can instead use domain categories to choose an exit. Switching only the routing mode while ignoring DNS can produce a mixed path, with page traffic using the proxy but DNS requests using the local network, or incorrect resolution can prevent rules from matching the intended destination.

1. Not started: app → system network → target site; v2rayNG does not participate in the connection.
2. Global proxy: app → VPN interface → Xray core → current proxy server → target site.
3. Bypass mainland: app → VPN interface → Xray routing; mainland and LAN targets use direct, while all others use proxy.
4. Global direct: the app can still enter the VPN interface, but routing uniformly selects direct. This is useful for comparison tests and does not disable the app.

The latency figures above come from comparison requests made on the same device, Wi-Fi network, and during the same period. They illustrate path differences, not universal network performance. In bypass mode, mainland sites usually have lower first-packet latency because they skip a remote hop; the gap may narrow when the proxy server is nearby. Compare relative changes on the same network rather than applying a fixed speed expectation.

Which Mode to Use for Browsing, Cross-Border Work, and Troubleshooting

For everyday use, “Bypass LAN and Mainland Addresses” is usually the best choice. Maps, payments, cloud storage, and local media services connect directly, avoiding unnecessary detours; domains and IPs that need a proxy are handled by the current server. It is also better suited to long-term background use because LAN printers, router admin pages, and storage devices on the same network usually remain directly accessible.

Cross-border work can also start with bypass mode, but check whether corporate domains are being classified incorrectly. Some services use mainland CDNs for static assets while hosting login, API, or file services in other regions, so one page may establish several types of connections at once. If the login page loads but submission times out, run a comparison in global proxy mode. If global works but bypass fails, the problem is more likely in routing rules or DNS than in the server protocol.

For troubleshooting, switch to global proxy mode briefly. Global mode removes variables introduced by domain groups and IP classification, making it useful for verifying whether VMess, VLESS, TLS, Reality, and similar connections can be established. Once the server is confirmed usable, restore the routing mode that matches your needs instead of sending all connections through a remote path for the sake of one site.

Complete Steps for Switching Modes in v2rayNG

The steps below reference the common v2rayNG 1.9.x interface. Menu order may vary between versions, but the key entry points remain Routing Settings and predefined rules. Before switching, confirm that a server has been selected from the subscription list so that “no active configuration” is not mistaken for a routing-mode failure.

1. Open v2rayNG, confirm that the current server name is highlighted on the main screen, and run a latency test. A latency result only shows that the test request received a response; it does not guarantee that every webpage will work.
2. Open the top-right menu, then go to “Settings” → “Routing Settings” → “Predefined Rules.”
3. For everyday use, select “Bypass LAN and Mainland Addresses”; for troubleshooting, select “Global Proxy”; to verify the local network, briefly select “Global Direct.”
4. Return to the main screen. If v2rayNG is running, stop it and start it again so the active core configuration is regenerated with the new rules.
5. When starting for the first time, or whenever Android requests permission again, approve the VPN connection request. Then check the status bar for the corresponding connection indicator.
6. Visit one mainland site, one target business site, and the router admin address separately. Record whether each is reachable and how its latency changes.

Test sequence
1. Bypass LAN and Mainland Addresses → test everyday access
2. Global Proxy → compare whether the target site recovers
3. Global Direct → confirm that the local network is working
4. Restore bypass mode → retest and record the final results

If the settings page includes a “Local SOCKS Port,” the common default is 10808. This port is mainly for apps that require a SOCKS proxy to be specified manually; when Android VPN interception is working normally, there is no need to enter a port in every app. If another service is using the port, the logs usually show a listen failure. Choose an unused port and restart the core.

Troubleshooting Persistent Problems After Switching Modes

If the target site is unreachable in both global proxy and bypass mode, the problem is usually not the split-routing rules. First try another server from the subscription, then check the v2rayNG logs for connection timeouts, TLS handshake failures, target refusals, or DNS resolution failures. The server address, port, user ID, transport, and TLS parameters must match the subscription configuration; manually changing any one of them can break the connection.

If global proxy works but bypass mode does not, check which routing rule matches first. The target domain may be classified as a mainland domain and sent direct, or its resolved IP may be allowed directly by a mainland-address rule. Add a proxy rule for the business domain in custom routing and place more specific rules before broader ones. Routing is generally evaluated in order, and the first matching rule determines the exit.

If only one app bypasses the proxy, go to “Settings” → “Per-App Proxy” and check whether the app is excluded, as well as whether the current option means “proxy only selected apps” or “bypass selected apps.” These directions are opposites, so the wrong choice is especially easy to make after migrating a configuration or reinstalling. After changing the list, stop and restart the connection, then fully exit the target app before testing again.

• No VPN indicator: check system permission, background restrictions, and whether v2rayNG is running.
• All modes time out: check server availability, device time, protocol parameters, and network connectivity.
• Only bypass mode fails: check domain rules, IP rules, DNS results, and rule order.
• Only one app fails: check the per-app proxy direction, app restart status, and the app’s own network settings.
• LAN device cannot be opened: confirm that the target address belongs to the current subnet and check for custom rules blocking private addresses.

Final Decision Guide

For most users, “Bypass LAN and Mainland Addresses” is a good default. It preserves direct paths to local services and mainland resources while sending connections that need a proxy through the Xray outbound, making it suitable for long-term use. Global proxy is more of a diagnostic tool: when a website, login API, or download request fails, use it to quickly determine whether split routing is responsible.

System interception is the prerequisite for either routing mode to work. If the subscription has updated and node latency looks normal but the browser’s exit has not changed, do not adjust routing rules first. Confirm that v2rayNG is running, system VPN permission is active, and the target app is within the interception scope. Once the entry path is correct, choose the exit based on whether the traffic should connect directly or use the proxy.

1. For stable everyday browsing: enable system interception and select Bypass LAN and Mainland Addresses.
2. To verify that the server works: pin the server and temporarily switch to Global Proxy.
3. To confirm that the local network works: briefly use Global Direct for comparison.
4. Global works but bypass fails: check DNS, domain rules, IP classification, and rule order.
5. One app is not proxied: check the direction selected under “Settings” → “Per-App Proxy.”