System Proxy vs. Routing Modes: Global Proxy and Bypass China Rules Explained

At a glance

The system proxy determines whether an app sends connections to a local proxy port; the routing mode determines where connections go after they reach the core. Using v2rayN on Windows, this guide covers everyday split routing, temporary Global-mode testing, and local network access, with a step-by-step approach to checking the entry point, rules, and outbound route.

Two separate layers: app entry and core outbound routing

Starting v2rayN and selecting a server doesn’t mean your browser is using the proxy. The client must start the core, and the app must send connections to it through the system proxy, its own proxy settings, TUN, or another entry point. Only connections that reach the core are evaluated against its routing rules.

Windows system proxy settings are network settings that apps can choose to use, not a switch that captures all network traffic. Browsers that honor the system proxy typically use it; tools with their own proxy settings, some games, and command-line programs may not. Setting the route to Global won’t change how those apps connect.

Layer 1: System proxy

Where to find it: v2rayN tray menu → “System Proxy”
What it controls: Apps that honor the system proxy
Where connections go: A local listening address and port
What it doesn’t do: Choose a direct or proxy outbound route

First confirm the request reaches the core; then check which routing rule it matches.

Layer 2: Routing mode

Where to find it: “Routing” selector at the bottom of the v2rayN main window
What it controls: Connections that have reached the core
Common outbound routes: direct、proxy、block
What it doesn’t do: Force every app to use the proxy entry point

Check the active configuration for the exact preset name, rules, and outbound tags.

For example, if the local proxy listens on 127.0.0.1:10808, the browser can send requests to that port while the core still routes destinations in mainland China through direct. This port is only an example, not a default for every version. The app’s proxy type must match the listener: HTTP, SOCKS, or mixed.

Global vs. Bypass China: the difference is in routing, not the proxy switch

“Global proxy” is often used to mean two different things: making apps use the system proxy, or routing connections through the proxy outbound. This section covers the second: routing policy. Global routing typically sends connections to the proxy unless an earlier rule matches them. Check the active preset to see whether it retains exceptions for direct LAN access or blocking; don’t rely on its name alone.

Bypass China: everyday split routing

Recommended

Common rules send LAN addresses and domain or IP ranges for mainland China directly, while routing other connections through the proxy. Services in mainland China usually use your local network, while overseas destinations go through the selected node. The outcome depends on rule order, data files, and DNS settings.

Best for: accessing services in mainland China and overseas while avoiding unnecessary proxy traffic.

Global: route everything through the proxy

Send connections that reach the core through the proxy unless an exception applies. Destinations in mainland China may also go through the remote node, affecting latency, the apparent exit region, and node data usage.

Best for: temporarily checking for split-routing errors or ensuring a specific test session uses the node’s exit route.

“Bypass China” matches destinations against rule sets; it doesn’t determine a route based on the language displayed on a webpage. A Chinese-language site may use overseas services, and a single page may connect to both local image hosts and overseas APIs. So it’s normal for one page load to use multiple outbound routes; that doesn’t mean the rules are broken.

Destination type	Typical Bypass China routing	Typical Global routing
Matches a mainland China domain list	Direct	Proxy, unless an earlier direct rule matches
Overseas destination not matched by a direct rule	Proxy	Proxy
LAN address, such as 192.168.1.1	Usually direct	Depends on whether a LAN exception is retained
App connection that never reaches the core	Not controlled by these routing rules	Not controlled by these routing rules

Using v2rayN: connect the entry point first, then choose a route

The steps below use the Windows version of v2rayN. Menu wording and layout may vary by version. Look for the “System Proxy” and “Routing” settings, and don’t mistake “Automatically configure system proxy” for automatic server selection or split-routing rule generation.

Activate a server

Select an available entry in the main server list, right-click it, and choose “Set as active server.” Make sure the core starts without port-conflict or configuration-load errors.
Note the listening ports

Open “Settings” → “Parameter settings” and check the local listening ports and types. If your version lists separate HTTP and SOCKS ports, note each one separately; don’t mix up the ports for the two protocols.
Set up the system proxy

Right-click the v2rayN icon in the taskbar notification area and choose “System Proxy” → “Automatically configure system proxy.” In Windows, open “Settings” → “Network & internet” → “Proxy” and verify the local address and port.
Choose a route

Return to the “Routing” selector at the bottom of the main window and choose the Bypass China preset from the current list. Leave other settings unchanged for now; switch to the Global preset only for comparison while troubleshooting.
Test, then restore your settings

Reload the page you’re testing and check the destination and outbound tag in the core’s access log. After testing Global mode, restore your everyday route. When you’re done with the system proxy, choose “System Proxy” → “Clear system proxy.”

Rule order and DNS also affect routing

V2Ray and Xray evaluate routing rules in order; the first matching rule determines a connection’s outbound route. If an earlier proxy rule matches all destinations, later direct rules for mainland China never get a chance to handle those connections. Back up your configuration before editing, then check the rule order.

Domain lists: geosite:cn refers to a domain list in the data file, not a live lookup of a destination’s region. Coverage depends on the data loaded.
IP lists: geoip:cn matches destination IP addresses. Whether and when a domain is resolved depends on the routing domain strategy.
LAN: geoip:private is commonly used to send private addresses directly. If web browsing works but your router’s admin page doesn’t, check both the system proxy bypass list and the core’s direct-routing rules.
Default outbound: The core’s default outbound behavior also matters when no rule matches. Don’t infer that the entire configuration bypasses China from a single direct rule.

Domain rules require the core to have domain information. If an app sends only an IP address to the proxy, domain rules may not match directly. Protocol sniffing can provide additional destination information when conditions allow, but it can’t recover every domain. Browser encrypted DNS, app-level DNS, and core DNS may also follow different paths.

Two setups: browser proxy and TUN capture

If you only need a browser that honors the system proxy to access websites, the system proxy is usually enough. If an app ignores it, check for the app’s own HTTP or SOCKS settings first. Consider TUN when you need broader network coverage. TUN is another entry point, not another name for Global routing.

Choose a setup based on how apps connect

Primarily using a browser

Enable the system proxy and confirm the browser uses system settings.
Use Bypass China for everyday routing.
Check whether a browser extension or separate proxy setting overrides the system settings.
Switch to Global temporarily for troubleshooting, and keep other variables unchanged.

Apps that need TUN

Follow the client’s instructions to check permissions, the virtual network adapter, and routing capture status.
Check DNS, UDP, and LAN access separately.
You still need to choose a core routing mode; TUN doesn’t mean Global outbound.
Avoid running multiple network-capture tools at the same time during testing.

The entry point gets connections into the core. Whatever entry point you use, split-routing results depend on the routing rules actually loaded.

On Android, v2rayNG uses the Xray core, while v2flyNG uses the v2fly core. They typically use Android’s VPN service to capture traffic, unlike the system proxy settings configured by v2rayN on Windows. Per-app selection determines which apps enter this connection first; core routing rules are applied afterward. VMess and VLESS are node protocols: they don’t replace the entry point or determine whether traffic bypasses China.

Common misconfigurations: test one request at a time

When troubleshooting, keep the destination fixed and change one setting at a time. If you use a command-line test, specify the proxy explicitly so you don’t mistake a command that ignores the system proxy for a node failure. The example below assumes a local HTTP or HTTP-compatible mixed listener on port 10808. If yours differs, use the port from your actual configuration.

curl --proxy http://127.0.0.1:10808 --connect-timeout 10 --max-time 20 -I https://example.com

This command explicitly sends the connection through the local proxy, with a 10-second connection timeout and a 20-second total timeout. It tests only the path for this request; it can’t confirm that every app, domain, or UDP connection works. If access logging is disabled, you can enable it temporarily and turn it off after testing. Before sharing logs, remove subscription URLs, credentials, and personal browsing records.

Why is an app still connecting directly in Global mode?

First check whether the app uses the system proxy. If it has its own proxy settings, enter a local address and port that match the listener type. Then check the core access log to see whether the request appears. If it never reaches the core, changing the routing mode won’t help.

Why does a site open in Global mode but not with Bypass China?

Visit the same destination in both modes and compare the actual outbound tags. If Bypass China uses direct while Global uses proxy, check the direct connection, DNS results, and any rules that may have matched incorrectly. Once you’ve confirmed the destination, add the narrowest possible proxy rule rather than deleting all direct rules.

A website in mainland China is slow. Is the node too slow?

First check whether the site goes through the proxy in Global mode. Switch back to Bypass China, then check which outbound route the site’s main domain and API domains use. Comparing node performance only makes sense after confirming that the connection goes through the node.

Why can’t I open 192.168.1.1 with the proxy on?

Check your router’s actual admin address, the system proxy bypass list, and the core’s rules for routing private addresses directly. A remote node usually can’t reach your home router’s private address, so don’t send those destinations through the remote proxy.

Pages stop loading after I close v2rayN. What should I do?

Open Windows “Settings” → “Network & internet” → “Proxy” and check whether a manual proxy pointing to your local machine is still configured. You can restart v2rayN, choose “System Proxy” → “Clear system proxy,” then close the client and test again.

Everyday setup and cleanup checklist

For a desktop setup that uses services in mainland China and overseas, start with the system proxy enabled and Bypass China routing. Switch to Global temporarily only when investigating a specific routing issue. Global isn’t a higher-level connection mode, and Bypass China doesn’t guarantee every destination is classified correctly. Both require a working node, a configured entry point, and rules that fit your needs.

Note the active server, listening ports, and routing preset so you can restore them later.
Test destinations in mainland China, overseas, and on your LAN—not just one webpage.
Restore your everyday preset after testing and turn off temporary verbose logging.
Clear the system proxy when you’re done using it. If you use TUN, also confirm that traffic capture has stopped.