System Proxy vs. Global and Bypass China Routing: Choosing a v2rayN Proxy Mode

System Proxy and Routing Modes: Understand the Entry and Exit

v2rayN is a desktop client for managing nodes, launching the proxy core, and adjusting related settings. The system proxy is neither a node nor a routing rule: it tells apps configured to use the system proxy which local address to send requests to. Once the core receives a request, routing rules determine whether it uses a proxy outbound, a direct outbound, or a blocked outbound.

So “Why is an app still connecting directly when Global is selected?” is not a contradiction. If the app ignores the system proxy, has no local proxy configured, and is not captured by another traffic-redirection mechanism, its connections never reach the core. Routing rules cannot handle requests that never enter the proxy.

1. Application: Browsers, command-line tools, and other apps decide whether to use the system proxy and may have their own proxy settings.
2. Local entry point: The request reaches a local HTTP, SOCKS, or mixed-protocol listening port, where the core receives it.
3. Routing decision: Rules are checked in order against criteria such as domain, destination IP, and port.
4. Outbound connection: The selected node connects to the destination, or the local network connects to it directly.

Global, Bypass China, and Direct: Choosing a Routing Mode

Mode names describe sets of routing rules, not guaranteed network behavior. Different v2rayN interfaces and custom rule sets may use different names. The actual behavior depends on the current rule order, matching criteria, and default outbound. In particular, “Bypass China” does not mean every site is classified by its geographic location in real time.

v2rayN Setup: Configure the Entry Point and Route Separately

Start the client and select an existing working node, then check the local listener. On Windows, the usual controls are “System Proxy” and “Routing” in the right-click menu for the taskbar tray icon; the desktop interface may also provide corresponding selectors. Menu locations and system permission prompts may differ on macOS, so do not follow the Windows tray instructions as-is.

1. Check the listener: Open “Settings” → “Parameter Settings” and look for local listening port or inbound options. Note the current port and protocol. Option locations may vary between interfaces, so follow the labels in the current version.
2. Configure the entry point: In the “System Proxy” menu, select “Set system proxy” or the equivalent option in your interface so apps that use the system proxy send traffic to the local listener.
3. Choose a route: In the “Routing” selector, choose the Bypass China rule set. If you imported a custom rule set, first confirm its default outbound and private address rules.
4. Start a new connection: After applying the settings, revisit the destination. If needed, close the existing page connection or restart the test app to avoid results being affected by connection reuse.
5. Check the logs: Confirm the core is running and the listener started successfully, then check which outbound handled the destination request. If the current log level does not show access records, temporarily enable the relevant access log and turn it off again after testing.

“Clear system proxy” only removes the system-level proxy setting. It does not remove proxy settings in browser extensions, terminal environment variables, or disable TUN. “Do not change system proxy” usually means the client leaves the current setting untouched; it does not prove that the proxy is off.

Local Ports and Command-Line Tests: Check Whether Requests Reach the Core

The examples below use these specific values: HTTP listener 127.0.0.1:10809 and SOCKS listener 127.0.0.1:10808. These are not default values for every version; some configurations use a single mixed-protocol port. Before running a command, replace the port with the one actually enabled in Parameter Settings. Do not send an HTTP request to a port that only supports SOCKS.

On Windows, run curl.exe in a terminal to avoid parameter parsing issues caused by a same-named alias in some PowerShell environments. The two commands below explicitly specify a proxy, so they do not depend on whether the system proxy is enabled. The example destination checks an HTTP response; one successful request does not prove that every site and protocol is working.

curl.exe --proxy http://127.0.0.1:10809 --connect-timeout 5 --max-time 15 -I https://example.com/
curl.exe --proxy socks5h://127.0.0.1:10808 --connect-timeout 5 --max-time 15 -I https://example.com/

In a macOS terminal, use curl as the command name. In the second command, socks5h means the proxy resolves the destination domain instead of curl resolving it locally to an IP address first. This affects the destination information received by the core and may also affect domain-based rule matching. Note which proxy protocol you use so the two DNS resolution paths are not confused.

• Connection to the local port is refused: First check that the core is running, the port is correct, and the listener supports the protocol you are using. Node connectivity has not yet been tested.
• Local connection succeeds but the remote request times out: Check the node connection, destination connection, and DNS in the logs. Do not assume the subscription has expired.
• The command succeeds but the browser fails: First check the browser's own proxy settings, extensions, and existing connections, and confirm whether it uses the same entry point.

Bypass China Rule Limitations: Domains, IPs, and DNS

Common V2Ray and Xray routing setups use geosite:cn to classify domains and geoip:cn to classify IP addresses. These rely on the corresponding rule data; the core does not determine geographic location on its own. A domain classified as mainland China does not mean its server will always resolve to the same region. Likewise, an IP address associated with a region does not mean every service on a site should use the same outbound.

The snippet below illustrates how matching works; it is not a complete, runnable client configuration. direct must correspond to an existing direct outbound tag. Whether unmatched requests use the proxy also depends on the other rules and the default outbound. Do not overwrite the runtime configuration generated by v2rayN. Adjust the corresponding rules in the client's routing settings instead.

{
  "routing": {
    "domainStrategy": "AsIs",
    "rules": [
      {
        "type": "field",
        "ip": ["geoip:private"],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "domain": ["geosite:cn"],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "ip": ["geoip:cn"],
        "outboundTag": "direct"
      }
    ]
  }
}

• Rule order: The first matching rule is used. If a broad proxy rule appears before the mainland China direct rules, the later rules may never match.
• Domain resolution strategy: AsIs does not proactively resolve a domain to an IP address for IP rule matching. If a request contains only a domain and does not match a domain rule, do not assume a later mainland China IP rule will apply.
• Private addresses: Local printers, router admin pages, and intranet services typically need a direct route. Corporate internal domains may also rely on dedicated DNS or a specific network connection.
• Updating rules: After changing DNS or rule data, establish a new connection to the same destination and check the logs. This helps avoid misdiagnosis caused by stale caches or long-lived connections.

Common Proxy Mode Questions: Troubleshoot by Symptom