v2rayN System Proxy and Routing Modes: Global vs. Bypass Mainland China

At a glance

The system proxy determines whether apps that follow Windows proxy settings send requests to v2rayN. The routing mode determines whether requests that reach the core are proxied, sent direct, or blocked. For everyday use, start with “Set system proxy” and “Bypass Mainland China,” then use Global routing as a comparison. This guide uses the Windows desktop client and explains why browsers, apps with their own proxy settings, and LAN devices may behave differently.

System Proxy vs. Routing Mode: Two Separate Settings

v2rayN is the client interface; the selected core handles local proxy listeners and request forwarding. Protocols such as VMess and VLESS connect to remote servers—they do not determine whether a Windows app uses the system proxy. Even with a node selected and the core running, a browser may still connect directly.

Think of the request path as “app → local proxy → core routing → outbound.” The system proxy mainly affects the first step; routing presets such as Global and Bypass Mainland China mainly affect the last. These settings are separate and do not need to have matching names.

System Proxy: Getting Requests In

Where to find it: “System Proxy” at the bottom of the main window
Common option: Set system proxy
Applies to: Apps that read and follow the system proxy settings
Local address: 127.0.0.1 plus the active listening port

Apps that ignore system proxy settings need a proxy configured separately or another way to capture their traffic.

Routing Mode: Choosing an Outbound

Where to find it: The “Routing” selector at the bottom of the main window
Common presets: Global, Bypass Mainland China
Applies to: Requests that have reached the core
What it controls: Matching rules and the final outbound

Presets can be edited; actual behavior depends on the current rules and their order.

Global vs. Bypass Mainland China: Rule Matching Is the Difference

Global routing typically sends requests not handled by earlier rules to the proxy outbound. Bypass Mainland China typically uses domain lists, IP lists, and other rules to send matching destinations directly, while routing the rest through the proxy. “Mainland China” here is a rule-set category—not a live judgment based on a site's language, company, or the user's location.

What to check	Global routing	Bypass Mainland China routing
Ordinary requests that reach the core	Usually use the proxy outbound	Routed by domain, IP, and other criteria
Sites matching mainland China rules	Usually still use the proxy, unless an earlier rule says otherwise	Usually go direct over the local network
Sites not matching mainland China rules	Usually use the proxy	Usually use the proxy, depending on the fallback rule
LAN addresses	Check for exceptions for private addresses	Confirm that direct connections to private addresses are included
Apps that ignore system proxy settings	Are not captured just because Global is selected	Are not captured just because the routing rules changed

In Xray routing, rules are checked in order, and the first match determines where traffic goes. A custom direct rule for a domain may never match if it comes after a catch-all proxy rule. A direct outbound typically connects to the destination over your local network instead of through the selected proxy server, though the request may still pass through the local core.

For everyday browsing alongside services in mainland China: Start with Bypass Mainland China and check whether login, video, downloads, and work services behave as expected.
To diagnose routing for a specific site: Switch to Global briefly, keep the same node, and visit the same URL again.
To use a fixed egress for a specific service: Add explicit rules for its domains and dependencies. Do not treat Global as a guarantee that all traffic will use the same egress.

Windows Setup: Change One Variable at a Time

These steps use menu labels commonly found in the Chinese-language v2rayN interface. Controls may appear in different places in desktop and classic versions. If the bottom bar is hidden in your layout, look for “System Proxy” in the tray icon's right-click menu. Turn off TUN before you start so the two traffic-capture methods do not affect the results at once.

Check the local ports

Open “Settings” → “Parameter Settings” and look under the basic or inbound settings for the local listening ports and supported protocols. Field groups vary by version, so use the labels in your current interface. Note whether the entry is HTTP, SOCKS, or mixed; do not record just one number.
Select the active node

Select the node you want in the node list, right-click it, and choose “Set as active server.” Check the core startup log for listener failures or address-in-use errors. Keep this node fixed during testing; do not switch servers at the same time.
Set the system proxy

Under “System Proxy,” select “Set system proxy.” Then open Windows “Settings” → “Network & Internet” → “Proxy” and check the local proxy address and port. Make sure Windows is not still pointing to a port left behind by an old app.
Choose a routing rule

Select “Bypass Mainland China” from “Routing” in the main window. Test a site in mainland China, a site that requires a proxy, and a LAN address. Note which type of request fails; a successful node test alone is not enough.
Compare with Global

Change only “Routing” to “Global,” then close and reopen the page in question. If only one site starts working, check its domain match, DNS, and rule order first. Restore your usual routing mode when testing is complete.

Browsers, Apps, and LAN: Test Each Entry Point

Browsers can read the system proxy settings, but extensions, separate proxy settings, and existing connections can change the results. Command-line tools, downloaders, and background services may use their own proxy environment variables or network settings. A working browser does not prove that every app uses the same outbound.

The two port numbers below illustrate a testing method; they are not default values for every version. This example assumes you have confirmed that 10808 provides an HTTP or mixed proxy entry on your machine. If your port is different, use the value shown in the interface. If the port supports SOCKS only, do not use the HTTP options shown here.

10808

Example local proxy port; verify before use

443

Default HTTPS destination port, not the local proxy port

Run the following comparisons in Windows Terminal. Using curl.exe explicitly avoids cases where PowerShell interprets curl as a different command. These example domains illustrate request paths; their reachability is not a measure of node quality.

# Bypass the proxy and connect directly
curl.exe --noproxy "*" -I --connect-timeout 10 https://example.com

# Explicitly send the request to the local HTTP proxy
curl.exe --noproxy "" -x http://127.0.0.1:10808 -I --connect-timeout 10 https://example.com

The second command does not rely on the system proxy setting, but it is still subject to core routing. If the current rules classify the destination as direct, the request will still go out directly. Specifying a local proxy and routing through a remote node are not the same thing. Check the destination and outbound tags in the core access log. If access logging is disabled, the absence of a log entry does not prove the request never reached the core.

If the app has its own proxy settings: Set the correct proxy type, 127.0.0.1, and the active port. Do not use the remote node's server port as the local proxy port.
To access a router or NAS: Test with an actual LAN IP such as 192.168.1.1, then check the device's hostname resolution. Use an address from your current network.
System proxy exceptions vs. direct routing in the core: The former keeps some requests out of the local proxy; the latter chooses a direct outbound after a request reaches the core. Either can affect LAN access.
Private network rules: Check whether the rules cover 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and the local IPv6 address ranges in use.

Bypass Mainland China Issues: Check DNS and Rule Matches

A single site may use separate domains for its main page, images, login, and APIs. A direct match for the main page does not mean every resource uses the same rule. If the page loads but login keeps spinning, check the actual domain of the failed request instead of immediately switching the entire configuration to Global.

Domain rules and IP rules also have different requirements. In Xray, routing.domainStrategy controls when DNS results are used for routing matches. AsIs does not actively resolve domains for routing, so do not assume a domain request will match an IP rule. This does not mean DNS is never used during the connection, nor does it change your operating system's DNS settings.

First, check what the core receives. Whether a request reaches the core with a domain name or an IP address affects which rules can match. If the app resolves the domain itself and passes only an IP, a domain rule may have nothing to match.
Next, check the rule order. In “Settings” → “Routing Settings,” inspect the active preset. Confirm the target domain rule comes before any fallback rule and that its outbound tag points to the expected outbound.
Check the rule data. If your rules refer to geosite:cn or geoip:cn, confirm the current core can load the corresponding data. Rule formats for other cores are not necessarily interchangeable.
Finally, check the DNS path. Browser Secure DNS, system DNS, and core DNS may differ. Compare them one at a time; do not change all three at once or infer the final outbound from the resolved IP's location alone.

Common Questions: What to Check Next

Why does an app still connect directly with Global enabled?

Check the app's “Network” or “Proxy” settings first and confirm whether it reads the system proxy. Try entering the local HTTP or SOCKS proxy manually. If the app has no proxy support, evaluate TUN separately. Changing the routing mode does not make an app use the proxy.

Why are sites in mainland China slower with Bypass Mainland China?

First confirm that the domain is actually going direct, then compare access after clearing the system proxy. If direct access is just as slow, check your local network and DNS first. If the slowdown happens only with split routing, check whether different resource domains are using different outbounds.

Why can't I reach my printer or NAS with Global enabled?

Try accessing the device by its LAN IP and confirm that it is online. Then check Windows proxy exceptions and the current routing rules for direct connections to private addresses. Corporate networks may use additional internal subnets; add rules for the actual addresses rather than routing every unknown address through the proxy.

Why does the browser lose internet access after I close v2rayN?

Open Windows “Settings” → “Network & Internet” → “Proxy” and check whether a manual proxy pointing to your local machine is still enabled. Restart v2rayN and select “Clear system proxy” if needed. On managed work devices, check your organization's policy before changing the settings.

Keep the final setup simple: for everyday use, pair Set system proxy with Bypass Mainland China. To troubleshoot one site, keep the node fixed and switch to Global briefly. Change only one of the entry point, routing, or DNS settings at a time. Recording the target domain and result makes issues easier to reproduce than changing the node and several settings together.