REALITY and XTLS Vision: Why They Are Fast — Certificate-Free Handshakes and Flow Control Explained

Adding a subscription to v2rayNG is usually easier than importing individual VMess or VLESS links, but the workflow has several separate steps. You need a valid provider URL, the correct subscription menu, a successful update, a latency test, and a selected profile before the VPN connection can work. If the list updates but every server fails, the problem is usually different from an update timeout or a missing VPN permission.

This guide uses the current v2rayNG workflow on Android as a practical reference. Menu names can vary slightly between releases and localized builds, while the exact protocol parameters are supplied by the subscription provider. Do not manually change UUIDs, Reality keys, SNI values, or transport settings unless the provider gives you replacement values.

What a v2rayNG subscription actually does

A subscription is a remote source of node configurations rather than a single permanent server. The provider gives you a URL, commonly beginning with https://, and v2rayNG requests that address when you add or update the subscription. The response may contain several encoded share links, such as vmess:// or vless://, or another format supported by the client. v2rayNG then converts the response into profiles that can be selected locally.

This means the subscription URL and the imported profiles have different roles. The URL is the source used for future updates; the profiles are the current local copies used for connection attempts. Removing a profile does not necessarily invalidate the subscription, and updating a subscription does not mean that every old profile will remain unchanged. Providers can add, rename, disable, or replace nodes at any time.

Before copying the address, confirm that it is a client subscription URL rather than a provider login page, a payment link, or a single-node share link. A URL copied with a trailing space, an incomplete query string, or hidden line breaks may be rejected. Keep the original address private: anyone who obtains a working subscription URL may be able to download the same node list or consume the provider’s update quota.

Prepare the link and open the subscription menu

Install v2rayNG from a trusted distribution source and open it once before importing anything. On the main screen, look for the subscription management entry. Depending on the build, it may appear as Subscription groups, Subscription settings, or a similar label in the overflow menu. The important distinction is that a normal web URL belongs in subscription management, while a text beginning with vmess:// or vless:// is normally imported as a share link.

If Android asks for file, notification, or VPN-related permission, read the prompt and grant only what the application requires for its displayed function. The VPN permission is normally requested when you first start a connection, not when you merely save the subscription. Do not assume that a saved URL has already created an active tunnel.

1. Copy the URL

   Copy the complete subscription address from the provider’s account page or message. Check that it begins with http:// or https://, and avoid copying surrounding punctuation or quotation marks.

2. Open subscriptions

   In v2rayNG, open the main menu and choose the subscription group or subscription settings entry. Tap the add button, commonly shown as a plus sign, to create a provider entry.

3. Save the entry

   Enter a short name such as Primary provider, paste the URL into the address field, and leave the remarks or User-Agent field unchanged unless the provider specifies a value. Tap Save or OK.

4. Run the update

   Return to the subscription list, select the new entry, and tap Update or Update all subscriptions. Wait for the completion message instead of leaving the page immediately.

5. Check profiles

   Return to the profile list and confirm that new nodes appear. If the list is empty, review the update result, the URL characters, and the provider’s supported client format before editing protocol fields.

Update profiles and verify what was imported

After saving the subscription, an update request must reach the provider server and the response must be parsed successfully. A successful HTTP request alone does not guarantee that profiles were imported. The response may be empty, expired, encrypted in an unsupported format, or limited to a different client type. Check both the update status and the resulting profile count.

Profile names are only labels; they do not prove that a node is usable. Open a profile’s details when necessary and check the server address, port, protocol, security mode, transport, and any required flow or Reality parameters. For a VLESS profile, a typical modern entry may contain an address, port 443, a UUID, TLS or Reality security, a server name, and a transport such as TCP. A VMess profile may use WebSocket, TLS, and a path supplied by the provider. These are examples, not values to copy into an unrelated server.

• Expected result: the subscription update reports completion and one or more new profiles appear in the main list.
• Partial result: some profiles appear, but the provider may have returned invalid or unsupported entries alongside valid ones.
• Empty result: the URL may be expired, the account may have no active traffic allowance, or the response format may not match v2rayNG.
• Stale result: the request may have used cached data, or the provider may not have changed the list since the previous update.

Keep the subscription name short and descriptive if you use several providers. Separate groups make it easier to update one source, identify which provider supplied a profile, and remove an expired URL without deleting profiles from other groups. Avoid repeatedly importing the same URL under different names, because this creates duplicate entries and makes later maintenance harder.

Test latency and choose a practical server

In the main v2rayNG profile list, use the menu action for testing or measuring delay. The wording can differ by release, but it commonly includes a real-delay test or a URL-test option. A basic latency result measures how quickly the client can reach a test destination through the selected profile; it is not a guaranteed download-speed measurement and does not predict performance for every website.

Run the test after updating and compare several profiles under the same Wi-Fi or mobile network. A node showing 85 ms may feel better for interactive browsing than one showing 240 ms, but packet loss, server load, congestion, and destination routing also matter. A profile with 120 ms and stable connections can be more useful than one with 60 ms that frequently times out.

To select a profile, tap the row or its radio button so that it becomes the active configuration. Do this before pressing Connect. If the provider supplies regional names, start with a nearby region, then compare a second profile during the same time period. Do not judge a node from one short test performed during a temporary network spike.

Connect the Android VPN and select a routing mode

Once a profile is selected, tap the main connect button. Android normally displays a VPN permission confirmation the first time v2rayNG creates a tunnel. Approve the request only if the application name and action match what you intended. After connection, Android should show a VPN indicator, and v2rayNG should display a connected state or traffic counters.

v2rayNG commonly offers routing choices such as VPN mode, proxy-only behavior, or bypass rules, although the exact labels depend on the build. VPN or global mode sends supported device traffic through the local tunnel and is the simplest starting point. A bypass or rule-based mode uses domain, IP, or application rules to decide which traffic is direct and which traffic is proxied. Proxy-only operation may require individual applications to support a local SOCKS or HTTP proxy and is therefore less suitable for a first test.

For a first connection, keep the configuration close to its defaults. Turn off other VPN applications, disable Android’s built-in always-on VPN for a moment if it conflicts, and test one browser page. If the tunnel connects but no application can reach the network, check whether another VPN service, private DNS setting, firewall, or per-application bypass list is taking precedence.

Troubleshoot common subscription problems

Update failures are often caused by the path to the subscription rather than by the imported node. If the provider address cannot be reached directly, try updating while another usable connection is active, if the provider permits that workflow. Check the device clock, because an incorrect date can break HTTPS certificate validation. Also confirm that Android has network access for v2rayNG and that data-saver restrictions are not blocking the request.

When a profile fails, compare it with a second profile from the same update. If all profiles fail in the same way, investigate the subscription, network, VPN permission, or provider status. If only one profile fails, the endpoint may be offline or its parameters may have changed. Save useful log lines before clearing data, because deleting application data removes local subscription entries and profile state.

Maintain subscriptions without losing working settings

Set a reasonable update routine rather than refreshing the list every few minutes. Manual updates are useful when the provider announces a change; scheduled updates should follow the provider’s limits and the battery behavior of your device. Keep one known-working profile selected while testing new entries, and avoid editing imported fields unless you understand which server-side value they correspond to.

When moving to another Android device, transfer the subscription URL through a private channel and add it again in v2rayNG instead of sharing screenshots that expose credentials. Some providers bind a subscription to an account, an IP address, or a usage quota. If the URL has been exposed publicly, request a replacement from the provider.

• Update the subscription before concluding that all nodes are offline.
• Record the last successful profile name and approximate latency.
• Keep v2rayNG, its selected core, and Android system components reasonably current.
• Use one routing change at a time so that a new failure has an identifiable cause.
• Read the log for the first error rather than focusing only on the final disconnect message.

The reliable beginner workflow is therefore simple: save the correct provider URL, update it, verify that profiles were created, test several nodes, select one, approve the VPN request, and begin with the least complicated routing mode. Once that baseline works, you can evaluate split routing, DNS behavior, application rules, and background policies without confusing a configuration problem with a subscription problem.