DOCSEARCHbyAlgolia
Submit Docs

Xray VLESS-Reality VPS Configuration Guide

repository·master·Indexed 21 days ago

https://github.com/emptylibra/configure-xray-with-vless-reality-on-vps-server

A specialized guide and toolkit for deploying a stealthy Xray server using the VLESS protocol with XTLS-Reality on a VPS. The project includes the TLSScaner tool for finding masking sites and detailed instructions for server and client setup using the 3X-UI management panel. It covers VPS selection, basic security (including fail2ban), VLESS-Reality configuration, and client routing rules for PC and mobile devices.

Tokens
14.9K
Snippets
12
Records
46
Agent score
84%

What's inside configure-xray-with-vless-reality-on-vps-server

  1. Overview of VLESS XTLS-Reality on VPS

    master

    This project provides a guide for setting up a self-hosted Xray server using the VLESS protocol with XTLS-Reality extensions on a VPS (Virtual Private Server). This setup is designed to provide high resistance to traffic detection and censorship by masking proxy traffic as standard HTTPS (WEB) traffic.

    Key Benefits

    • Data Privacy: Full control over your server and traffic, ensuring no third-party observation.
    • Traffic Routing Control: Ability to manage routing rules on both the client and server sides, including granular rules for specific processes, applications, or websites.
    • Stealth and Resilience: Uses uTLS, XTLS-Vision, and XTLS-Reality to mask traffic as legitimate HTTPS, making it highly resistant to detection by censorship systems.
    • Flexibility: Allows routing specific resources through the proxy while keeping local traffic (e.g., domestic websites) direct.

    Trade-offs and Requirements

    • Cost: Requires a monthly budget (approx. 200-500 RUB) for renting a foreign VPS.
    • Complexity: Requires familiarity with Linux and command-line interfaces for initial server security and setup, though much of the VLESS configuration is handled via a web GUI.
    • Dependency: The protocol's masking relies on a target website. If the target site becomes unavailable or changes, the proxy may stop working (this can be mitigated by using multiple servers or your own website).
    • Availability: VPS uptime is not 100% guaranteed by providers.

    Prerequisites

    • A PC with internet access for remote server configuration.
    • A rented foreign VPS.
    • Time and willingness to learn Linux and networking concepts.

  2. Overview of Xray VLESS-Reality Configuration Project

    master

    This repository provides a comprehensive guide for configuring an Xray server using the VLESS protocol with XTLS-Reality on a VPS, managed via the 3X-UI panel. It is designed for users looking to set up secure, high-performance proxy/VPN services for the 2024-2025 period.

    Key Components:

    • TLSScaner: A tool used to find suitable websites for masking (based on the RealiTLScanner project).
    • 3X-UI (X-UI): The web panel used to manage Xray configurations.
    • VLESS + XTLS-Reality: The core protocol stack used for secure communication.

    Available Formats:

    • Markdown (.md): The source instruction file.
    • PDF (.pdf): A converted version of the guide for easier reading.
    • Releases: The latest guide versions (including PDF and MD archives) can be downloaded from the GitHub Releases section.

  3. Understand client-side routing and traffic management

    master

    Client applications (on PC, mobile, or tablets) use Routing or Policies to decide how traffic is handled. This allows you to selectively proxy specific applications, processes, or domains while keeping others direct.

    Common routing strategies include:

    • Direct (direct): Traffic goes straight to the internet (e.g., for local/Russian websites).
    • Proxy (proxy): Traffic is sent through your VPS (e.g., for accessing blocked foreign resources).
    • Block (block): Traffic is dropped (e.g., for advertisements or torrents).

    Routing can be based on domain names, IP addresses (using GeoIP databases), or regular expressions. It is important to keep GeoIP databases updated in your client to ensure accurate routing.

  4. Manage server configurations with Subscriptions

    master

    A Subscription allows a client to automatically download an updated list of server configurations from a remote URL. This is useful for updating protocols or server domains without manually redistributing links or QR codes to all users.

    Note that subscription formats vary significantly (e.g., SIP008, Clash, V2RayN, OpenOnlineConfig). While online converters exist, they may not always work reliably.

  5. How censorship systems detect and block proxy traffic

    master

    Understanding how traffic is detected helps in configuring a resilient server. Common detection methods used by censorship equipment (like TSPU) include:

    • Deep Packet Inspection (DPI): Analyzing packet structure, signatures, and sizes, especially during the connection handshake.
    • Active Probing: Censors attempt to connect to your server using known VPN paths or URLs to see if it responds like a real web server.
    • TLS Fingerprinting: Analyzing the set of supported ciphers, elliptic curves, and extensions. If the fingerprint doesn't match a known browser (like Chrome or Firefox), it may be flagged.
    • TLS-inside-TLS Detection: Using statistical analysis of packet sizes to detect nested encryption.
    • Protocol Whitelisting: Blocking any protocol that doesn't match a known, allowed pattern.
    • Domain/IP Blacklisting: Blocking access to specific domains or entire IP ranges/subnets.

  6. Choose between System Proxy and TUN/VPN modes

    master

    Client applications typically operate in one of two primary modes:

    1. System Proxy: The client listens on a local port (e.g., 127.0.0.1:10080). You configure your OS or browser to use this proxy.

      • Pros: Simple and reliable.
      • Cons: Risk of DNS leaks (where your ISP sees your DNS queries) and some applications may ignore system proxy settings entirely.

    2. TUN / VPN Mode: The client creates a virtual network interface. The system's default route is set to this interface, forcing all TCP and UDP traffic from all applications through the client.

      • Pros: Captures all system traffic, including apps that ignore proxy settings; mitigates DNS leaks.
      • Cons: More complex setup (requires virtual drivers).

    Some clients offer a mixed mode to use both simultaneously for different applications to optimize performance.

  7. How VLESS transport and extensions work

    master

    VLESS can be transported over various internet protocols to achieve different masking goals. While several options exist, TCP is the recommended transport when using REALITY for maximum reliability.

    Transport Protocols

    • TCP: Used with the Reality extension to leverage TLS.
    • TLS: Establishes a standard TLS connection (like HTTPS) to wrap the protocol.
    • Websockets: Useful for bypassing strict corporate firewalls or using CDNs like Cloudflare/Amazon Cloudfront as a fallback.
    • HTTPUpgrade: A simplified, more efficient version of Websockets.
    • mKCP, QUIC, gRPC: Alternative transport protocols, though some are susceptible to blocking.

    Key VLESS Extensions

    • uTLS: Obfuscates the TLS fingerprint. It allows the client to mimic the digital fingerprint of popular browsers like Chrome, Firefox, or Safari, or to generate random fingerprints to avoid detection.
    • XUDP: Enables full Full Cone NAT for UDP packets, which is critical for ensuring audio/video calls work correctly through the proxy.
    • XTLS-Vision (xtls-rprx-vision): A modern version that prevents detection of "TLS-inside-TLS" (double encryption) by removing redundant encryption layers after a successful handshake. It requires a domain name and a target site for masking.
    • XTLS-Reality: An advanced implementation that performs identity verification during the TLS handshake. It protects against active probing by serving a real TLS certificate from a legitimate host to unauthorized scanners.

  8. Understand the difference between Proxy and VPN

    master

    In the context of this setup, it is important to distinguish between a Proxy and a VPN:

    • Proxy Server: Acts as an intermediary between the user and the target server (e.g., the international internet). This project configures a proxy server located abroad to access blocked resources. Proxies allow for flexible routing, such as only sending traffic from specific applications through the proxy while letting everything else connect directly to the internet.
    • VPN (Virtual Private Network): Typically creates an encrypted tunnel that secures all traffic from a node, often making all connected devices appear as if they are on the same local network.

    This project uses a specialized protocol (VLESS with XTLS-Reality) that provides encryption similar to a VPN but operates as a proxy, allowing you to selectively route traffic and avoid unnecessary load on your VPS.

  9. Configure IPv6 for client applications

    master

    If your ISP provides IPv6 connectivity, you must ensure your client handles it correctly to avoid traffic leaking outside the proxy.

    • If the client does not support IPv6 or it is disabled in settings, IPv6 traffic might bypass the proxy and go directly to the internet.
    • Solutions:
      • Disable IPv6 on your physical network interfaces (Ethernet/WiFi).
      • Enable IPv6 within the client application. If the server does not support IPv6, modern browsers will automatically fallback to IPv4.

  10. Use Share Links and QR Codes to configure clients

    master

    Most multi-protocol clients allow sharing configurations via Share links or QR codes.

    • Share links: URLs starting with protocols like ss:// (Shadowsocks), vmess:// (VMess), or vless:// (VLESS). These contain a Base64-encoded JSON structure with connection data.
    • QR Codes: A visual representation of the same data that can be scanned by a camera.

    Warning: There are multiple link formats (e.g., SIP002, Clash, Sing-box). When importing, some fields might be lost during conversion. Specifically, the uTLS fingerprint field is frequently lost; always verify this setting manually after importing a link or scanning a QR code.

  11. Best practices for VPS and Proxy security

    master

    To prevent detection and blocking of your Xray server, follow these security guidelines:

    1. Avoid detectable protocols: Do not install WireGuard, OpenVPN, or Shadowsocks on the same VPS, as some providers block VPS instances associated with these protocols.
    2. Avoid 'double crossing' borders: Do not access Russian (RuNet) resources through the VPS. Access them directly via local routing. If necessary, use a chain like Local -> VPS -> Warp -> RuNet to avoid suspicious traffic patterns.
    3. Use uTLS: Always enable uTLS on client applications and set a correct TLS fingerprint (e.g., mimicking Chrome or Firefox).
    4. Limit access: Do not share proxy access with a large number of people. Keep it to 5-10 close contacts to avoid detection of anomalous traffic patterns.

  12. Why use VLESS with XTLS-Reality instead of WireGuard or Shadowsocks

    master

    Standard protocols like WireGuard, OpenVPN, OutLine, and Shadowsocks are increasingly easy for censorship systems (like Russia's RKN or China's GFW) to detect and block using Deep Packet Inspection (DPI) or statistical analysis (e.g., analyzing the ratio of 1s and 0s in packets).

    VLESS with extensions like uTLS, XTLS-Vision, and XTLS-Reality is used because:

    • It masks traffic as standard HTTPS traffic.
    • It is highly resistant to active probing (where censors try to connect to your server to see if it's a real web server).
    • It avoids detection via TLS fingerprinting by mimicking modern browser fingerprints.
    • As of 2024, it remains one of the few protocols that censorship systems cannot easily target specifically.