System Proxy vs. Global vs. Bypass Mainland China: Which Proxy Mode Should You Use?

In v2rayN, “System Proxy,” “Global,” and “Bypass Mainland China” are not three mutually exclusive switches at the same level. System Proxy determines which applications hand connections to the local client, while Global and Bypass Mainland China determine which outbound is used after a connection enters the Xray or V2Ray core. Separating traffic capture from core routing explains common issues such as a browser working while another program connects directly, mainland websites slowing down in Global mode, or game traffic bypassing the node.

What System Proxy, Global, and Bypass Mainland China control

System Proxy operates at the operating-system entry layer. With the common default settings in v2rayN 7.13.2, the client listens locally on the SOCKS port 127.0.0.1:10808 and HTTP port 127.0.0.1:10809. After choosing “System Proxy” → “Auto configure system proxy” from the tray menu, Windows points its proxy settings to the local HTTP entry point. Browsers, some office applications, and programs that follow system network settings pass requests to v2rayN.

Global mode operates at the core routing layer. Once a connection has entered the local proxy port, the core generally sends all proxyable traffic through the currently selected VMess, VLESS, or other node outbound. “Global” does not mean every process on the system automatically enters the proxy. Programs that ignore system proxy settings, create sockets directly, or use an independent network stack may still bypass the local listening port.

Bypass Mainland China also operates at the routing layer, classifying traffic by domain and destination IP. Common rules send geosite:cn, geoip:cn, and local network addresses directly, while other matches use the proxy. Its behavior depends on whether GeoSite and GeoIP data are up to date, as well as DNS results, rule order, and the final fallback rule. It should not be understood as real-time geographic identification for every website.

• Traffic capture: System Proxy, manually configured HTTP/SOCKS ports, TUN, or a transparent proxy bring traffic into the core.
• Routing decisions: Global, Bypass Mainland China, and custom rules determine whether traffic leaving the core goes direct, through the proxy, or is blocked.
• Node protocols: VMess, VLESS, and similar protocols describe how the client connects to the server; they are not traffic-capture modes.

Why some programs connect directly after System Proxy is enabled

System Proxy is not an operating-system-wide redirect for all traffic. Browsers usually read Windows proxy settings, but game launchers, updaters, command-line tools, and some UDP-based programs may ignore them. Some applications read the proxy state only at startup, so they must be fully closed and relaunched after switching modes in v2rayN. Others provide their own proxy settings; enter 127.0.0.1 and the corresponding port inside the application.

DNS can also affect what you observe. An application may first resolve an IP through the system DNS, then send the connection through a SOCKS or HTTP entry point; with remote DNS, FakeDNS, or TUN enabled, the resolution path changes again. A page loading does not prove that DNS resolution and the data connection used the same exit. During troubleshooting, check the target address, inbound tag, and outbound tag in v2rayN’s live log instead of relying only on the browser result.

How to configure and verify the three modes in v2rayN

Before making changes, update the subscription and select a node that has already been verified to work. A subscription is only a list of server configurations; it does not automatically determine the System Proxy state. Switching to a VMess or VLESS node also does not capture traffic from every program. Change one variable at a time and record the original System Proxy and routing modes.

In v2rayN 7.x, start with “Settings” → “Parameters” → “Basic settings” and confirm that the local listening ports do not conflict with other programs. Then choose “System Proxy” → “Auto configure system proxy” from the tray menu, and select “Global” or “Bypass Mainland China” from the routing menu. Menu labels may vary slightly between minor releases, but the entry and routing layers should still be configured separately.

1. After selecting a node, run a latency test once. Latency reflects only the probe result and cannot replace a real webpage or download test.
2. Enable System Proxy, restart the browser you want to test, and visit one familiar mainland China website and one service that requires a proxied exit.
3. Open v2rayN’s live log, confirm that the request enters through the local HTTP or SOCKS inbound, and check whether it uses the direct or proxy outbound.
4. Switch to Global mode first to verify the node itself. If Global works but Bypass Mainland China does not, focus on routing order, GeoSite, GeoIP, and DNS.
5. Restore the original mode when testing is complete. If you entered proxy settings manually in an application, restore those as well to avoid creating a duplicate proxy chain.

Choosing modes for everyday browsing, services outside mainland China, and gaming

Everyday browsing and office applications

Prefer “System Proxy with Bypass Mainland China.” Mainland websites, software updates, and local services usually connect directly, while services outside mainland China use the proxy according to the rules, keeping node traffic and latency more manageable. If a domain is misclassified, add a higher-priority domain rule instead of switching to Global permanently.

Temporary troubleshooting for services outside mainland China

Start with Global mode to narrow down the problem. If a page fails under Bypass Mainland China but loads immediately in Global mode, check whether the domain matched a direct rule, whether DNS returned an unexpected address, and whether an earlier match exists in the rule set. Fix the rule after identifying the cause, then restore rule-based routing.

Gaming and real-time UDP traffic

System Proxy alone is usually not enough to capture game traffic. When a process ignores system proxy settings, consider v2rayN’s TUN mode. TUN creates a virtual network interface and broadens traffic capture, but it also adds DNS, routing-table, administrator-permission, and local-network-access factors to troubleshoot.

• Web browsing: Prefer System Proxy with Bypass Mainland China, and verify the domain rules and browser exit.
• Services outside mainland China: Use Global briefly for diagnosis, then apply precise domain-based routing once confirmed.
• Real-time gaming: Check the server region, baseline latency, and packet loss first, then consider TUN; a proxy route cannot automatically reduce latency caused by physical distance.
• Local network devices: Printers, router admin pages, and file-sharing addresses should remain direct; common private address ranges should not be sent to a remote node.

Which rules to check when Bypass Mainland China misroutes traffic

Rule systems usually match in order and use the specified outbound after the first match. A domain may match a custom domain rule and also appear in a GeoSite category; its resolved IP may then match GeoIP. Start troubleshooting with the most specific custom rules, then inspect dataset rules and the final fallback. Do not modify multiple rule groups at once.

Domain strategy also affects whether IP rules participate in routing. If the core matches by domain only, some connections will not be resolved further for GeoIP matching. If a resolution-based strategy is enabled, the DNS result may affect the outbound. Use the simplified structure below to understand the concept; actual fields depend on the current core and the configuration generated by the client.

{
  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      {
        "type": "field",
        "domain": ["geosite:cn"],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "ip": ["geoip:private", "geoip:cn"],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "network": "tcp,udp",
        "outboundTag": "proxy"
      }
    ]
  }
}

Final rules for choosing among the three modes

For most desktop users, a reliable starting point is “Auto-configured System Proxy with Bypass Mainland China.” It covers regular browsers and applications that follow system settings while keeping mainland and local-network traffic direct. Global mode is better for short diagnostics or cases where every captured connection must use the node; it should not be treated as a permanent switch for solving every network problem.

When the target program ignores system proxy settings, start with its built-in HTTP/SOCKS configuration. Evaluate TUN only when you need to capture more processes, UDP traffic, or traffic from applications that cannot be configured individually. After every change, verify the inbound and outbound in the live log instead of judging the configuration only by whether a page opens.

1. Browsers and standard desktop applications: System Proxy with Bypass Mainland China.
2. Node or protocol connectivity troubleshooting: System Proxy with Global; restore rule-based routing after confirmation.
3. One application routed incorrectly: add a precise domain or IP rule instead of switching everything to Global.
4. Ignores System Proxy or relies on UDP: check the application’s proxy settings and consider TUN if necessary.
5. Modes frequently misroute traffic: update geographic data and check DNS, rule order, and the final fallback.