دليل الواقع الافتراضي Xray VLESS: VPS، ويندوز، ماك، أندرويد، آيفون

هذه Xray VLESS Reality server setup guide walks you through deploying a modern proxy on your VPS. VLESS with the Reality transport-security layer is currently the most requested self-hosted proxy setup VLESS with the Reality transport-security layer is currently the most requested self-hosted proxy setup: unlike a classic VPN it doesn't produce a distinctive handshake or a fixed packet signature. Reality clones the TLS 1.3 handshake of a real, popular website (the target), so to a DPI system watching the wire, a connection to your server looks identical to someone visiting that website — there is no fake or self-signed certificate to fingerprint, because your server briefly forwards the actual certificate of the target site during the handshake.

The protocol stack is: بدون فيروس (a lightweight, stateless proxy protocol handling authentication) running over XTLS Vision (a flow-control mode that speeds up the connection by copying already-encrypted TLS records at the raw socket level) secured by واقع (the camouflage layer described above). All three come from the same project, Xray-core, the actively maintained successor to the original V2Ray/V2Fly project.

This guide sets up an Xray server by hand, entirely from the command line, with no web panel and no Docker — the smallest possible footprint on the VPS. No domain name and no TLS certificate purchase are required: Reality borrows the target site's certificate for the handshake and never presents one of its own. Next, where it says your_IP, you'll need to enter your assigned IP address.

What you'll need: a VPS running Ubuntu 22.04/24.04 or Debian 11/12, root access, your VPS's IP address, and TCP port 443 free (no web server, panel, or other proxy already listening on it).

ليس لديك خادم بعد؟ انظر How to order a server and pay for it.

Comparing this against other self-hosted options first? See دليل نشر خادم AmneziaWG for a WireGuard-based alternative, or إعداد Hysteria2 وTUIC for two other modern, censorship-resistant protocols.

1. الاتصال بالخادم

ويندوز (PuTTY)

افتح برنامج PuTTY، وأدخل عنوان IP الخاص بخادمك الافتراضي في حقل اسم المضيف، واضبط المنفذ على 22، وقم بتسجيل الدخول كمسؤول باستخدام كلمة المرور التي أرسلها لك مزود خدمة الخادم الافتراضي عبر البريد الإلكتروني.

عنوان IP الخاص بالخادم: عنوان IP الخاص بك
تسجيل الدخول كـ: الجذر
Password : your password

• Open PuTTY, enter your VPS IP address in the Host Name field.

• Set the port to 22.

• Enter log in as root.

• Use the password your VPS provider emailed you. You should then land on the server's shell prompt.

للحصول على شرح مفصل لكيفية الاتصال عبر PuTTY/SSH، انظر كيفية الاتصال بخادم Linux عبر SSH. 

لينكس / ماك أو إس (طرفية)

ssh root@your_IP

All commands below are run on the server, in this same SSH session — that covers Sections 2 through 6, plus the server-side checks in Section 10. Sections 7–9 (installing and configuring the VPN client) happen on your own Windows/Android/iOS device instead, since that's the device the proxy needs to run on; each of those sections says explicitly which lines, if any, still touch the server.

2. تحضير الخادم

تحديث النظام

قبل تثبيت أي شيء، قم بتحديث قائمة الحزم وترقية الحزم المثبتة:

apt update -y && apt upgrade -y

If the session is interrupted after apt upgrade, this is expected (dbus/polkit restarted) - just reconnect via SSH. 

If this upgrades the kernel, a reboot is a good idea before continuing. (For a refresher on apt and how Linux package managers work, see مديرو حزم لينكس.) تحقق من:

cat /var/run/reboot-required

If the file exists, reboot first with 'reboot', wait ~30 seconds, then reconnect.

Install the tools this guide uses

apt install -y curl wget unzip openssl ufw qrencode

Curl and unzip are needed by the Xray installer itself; openssl generates the short ID in Section 4; ufw is the firewall configured below; qrencode turns the finished client link into a scannable QR code in Section 7.

Check the system clock

Reality's handshake includes a timestamp check (the maxTimeDiff field, disabled by default but worth knowing about), and a clock that has drifted noticeably can also make ordinary TLS certificate validation misbehave elsewhere on the server. Confirm the clock is synced:

timedatectl status

If "System clock synchronized" shows "no", enable it with:

timedatectl set-ntp true

قم بتكوين جدار الحماية (UFW)

للمزيد من المعلومات حول قواعد اتحاد عمال المزارع، انظر تكوين جدار الحماية على لينكس.

Open the two ports you'll need: 22/tcp for SSH (skip this rule and you risk losing access to the server) and 443/tcp, the port Xray will listen on and the same port ordinary HTTPS traffic uses — which is exactly why it's the right choice for Reality.

ufw allow 22/tcp

ufw allow 443/tcp

ufw --force enable

ufw status

يجب أن تظهر كلتا القاعدتين على أنهما مسموحتان في مخرجات حالة ufw.

3. Installing Xray-core for VLESS Reality Server

The Xray-core project (XTLS) publishes an official install-and-upgrade script that installs the binary as a systemd service. Review any third-party script before piping it into bash — this one comes straight from the project's own repository.

bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install

Verify the binary is in place and check the installed version:

/usr/local/bin/xray version

If the command output is paginated and appears to hang, press Q to exit. The Xray binary is installed to /usr/local/bin/xray, and its configuration files are stored in /usr/local/etc/xray/.

You can also use the same installer script to upgrade an existing installation. For a full list of options (including removal, geodata-only updates, and log rotation), run:

bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" --help

4. Generating the Keys and Credentials

Reality authentication rests on four pieces of data. Generate all of them now; you'll paste them into the server configuration in Section 5.

Generate a UUID for the client

/usr/local/bin/xray uuid

This is the VLESS user ID — treat it as a credential, since it's what authenticates a client to the server. Run the command again for every additional device or person you want to grant access to.

Generate the Reality X25519 key pair

/usr/local/bin/xray x25519

This prints three lines: PrivateKey, كلمة المرورو التجزئة32. PrivateKey goes only into the server configuration and must never be shared. Password is the corresponding public key — despite the name, this is the value every client enters; Xray renamed the field from PublicKey to Password specifically to discourage people from publishing it carelessly. Hash32 is used only for the separate VLESS Encryption feature and isn't needed for a Reality setup.

Generate a short ID

openssl rand -hex 8

This produces a 16-character hexadecimal string used to tell different clients or client groups apart. Both server and client must use the same value.

Choose and test a Reality target

The target is the real website whose TLS handshake your server imitates. It should support TLS 1.3 and HTTP/2, must not sit behind a CDN like Cloudflare (Xray forwards any traffic that fails Reality authentication straight to the target, so a CDN-fronted target can turn your server into an open relay for that CDN), and ideally is hosted in roughly the same network region as your VPS for a plausible latency profile. Test a candidate directly from the server:

/usr/local/bin/xray tls ping www.microsoft.com:443

Use the bare hostname, not a URL. A handful of domains that are commonly used as Reality targets because they're stable, TLS 1.3-capable, and not CDN-fronted: www.microsoft.com, addons.mozilla.org, dl.google.com. Test a few and pick one that responds reliably from your VPS's location; you'll use the same hostname as both the target and the serverNames entry in Section 5.

5. Writing the Server Configuration

Back up the config the installer shipped with, then open the file for editing:

cp /usr/local/etc/xray/config.json /usr/local/etc/xray/config.json.orig
nano /usr/local/etc/xray/config.json

افتح ملف التكوين للتحرير:

nano /usr/local/etc/xray/config.json

Replace the whole file with the template below, substituting your own UUID, PrivateKey, short ID, and target hostname from Section 4 (and the port you opened in Section 2, if you changed it from 443):

{
  "log": {
    "loglevel": "warning"
  },
  "inbounds": [
    {
      "listen": "0.0.0.0",
      "port": 443,
      "protocol": "vless",
      "settings": {
        "users": [
          {
            "id": "YOUR-UUID-HERE",
            "flow": "xtls-rprx-vision",
            "email": "client1"
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "method": "raw",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "target": "www.microsoft.com:443",
          "serverNames": ["www.microsoft.com"],
          "privateKey": "YOUR-SERVER-PRIVATE-KEY",
          "shortIds": ["YOUR-SHORT-ID"]
        }
      }
    }
  ],
  "outbounds": [
    { "protocol": "freedom", "tag": "direct" },
    { "protocol": "blackhole", "tag": "blocked" }
  ]
}

Press Ctrl+O (WriteOut) to save the file.

Press Enter to confirm the file name.

Press Ctrl+X to exit nano.

The important fields: users[].id is the UUID from Section 4; users[].flow turns on XTLS Vision; method (formerly called network) selects the RAW transport, the plain TCP-based method Reality requires; target and serverNames are the site you tested in Section 4; privateKey is the server-side X25519 key, never the Password value; shortIds lists every short ID clients are allowed to present. To add more users later, append additional objects to the users array, each with its own UUID and email label, then restart the service.

Since Xray 26.3.27, a Reality inbound with no explicit minClientVer field enforces a default of the server's own core version — older client apps (an out-of-date v2rayN, v2rayNG, or Streisand build bundling an older Xray-core) are silently redirected to the target's fallback page instead of connecting, with no error in the client and nothing obviously wrong in the server log. If a client that used to work suddenly times out after an update, first try updating the client app itself; if that isn't possible, add "minClientVer": "25.9.11" (or another older baseline) inside realitySettings, at the cost of making that older client's TLS fingerprint a little less consistent with a modern browser.

Validate and restart

Test the configuration before restarting the live service — this catches JSON typos and unsupported fields before they take the proxy down:

/usr/local/bin/xray run -test -c /usr/local/etc/xray/config.json

6. بدء الخدمة وتفعيل التشغيل التلقائي

Restart Xray with the new configuration and enable it to start automatically on reboot:

systemctl enable --now xray

systemctl restart xray

systemctl status xray --no-pager

Status should show active (running). Confirm something is actually listening on port 443:

ss -lntp | grep ':443'

If Xray fails to start, the fastest way to see why is the systemd journal (for background on reading Linux logs in general, see كيفية قراءة سجلات Linux وأين تجدها):

journalctl -u xray -n 50 --no-pager

7. Building the Client Connection Link

Xray clients import a single vless:// share link rather than a config file. Build it from the values generated in Section 4 (the client apps' share-link format still uses the older name type=tcp for the transport, even though the JSON field itself is now called method):

YOUR-UUID — from xray uuid (e.g., a1b2c3d4-e5f6-7890-abcd-ef1234567890)

YOUR-PASSWORD-PUBLIC-KEY — is the Password from xray x25519 (NOT the PrivateKey!)

YOUR-SHORT-ID — from openssl rand -hex 8 (e.g., a1b2c3d4e5f67890)

your_IP — (IP of your server)

SNI — www.microsoft.com (or your target)

vless://YOUR-UUID-HERE@your_IP:443?encryption=none&security=reality&sni=www.microsoft.com&fp=chrome&pbk=YOUR-PASSWORD-PUBLIC-KEY&sid=YOUR-SHORT-ID&type=tcp&flow=xtls-rprx-vision#My-Xray-Server

مثال على الرابط: 

vless://a1b2c3d4-e5f6-7890-abcd-ef1234567890@your_IP:443?encryption=none&security=reality&sni=www.microsoft.com&fp=chrome&pbk=xyz_public_key_here&sid=a1b2c3d4e5f67890&type=tcp&flow=xtls-rprx-vision#My-Xray-Server

pbk is the Password value from xray x25519 (the public key, never the private key), sni matches the target hostname, and the text after # is just a display label you can rename freely in any client.

Turn it into a QR code so mobile clients can scan it directly:

qrencode -o ~/vless-client.png "vless://YOUR-UUID@your_IP:443?encryption=none&security=reality&sni=www.microsoft.com&fp=chrome&pbk=YOUR-PASSWORD-PUBLIC-KEY&sid=YOUR-SHORT-ID&type=tcp&flow=xtls-rprx-vision#My-Xray-Server"

Or print it straight to the terminal without saving a file:

qrencode -t ansiutf8 "vless://YOUR-UUID@your_IP:443?encryption=none&security=reality&sni=www.microsoft.com&fp=chrome&pbk=YOUR-PASSWORD-PUBLIC-KEY&sid=YOUR-SHORT-ID&type=tcp&flow=xtls-rprx-vision#My-Xray-Server"

Copy the PNG to your own computer with scp, run from your computer's terminal (or PowerShell on Windows), not the server:

scp root@your_IP:~/vless-client.png .

8. الاتصال من نظام التشغيل ويندوز

Everything in this section happens on your Windows PC, not over SSH — the client has to run on the device that will actually use the proxy.

Install v2rayN

v2rayN is a free, actively maintained GUI client bundling Xray-core, with native VLESS/Reality support. Download the latest release from the project's صفحة:

Grab the Windows 64-bit .zip asset (a self-contained build needs no separate .NET runtime as of recent v2rayN versions), extract it anywhere, and run v2rayN.exe.

Import the server

Copy the vless:// link built in Section 7 to your clipboard (or copy the QR PNG over with scp and open it), then in v2rayN choose Servers further Import bulk URL from clipboard (or scan the QR code via the built-in scanner). The new server profile appears in the list with the label you set after the #.

Right-click the profile and select it as active, then enable the system proxy (or TUN mode, for routing the whole machine) from the main window's toolbar.

9. Connecting from Android

Everything here happens on your Android device, not over SSH.

Install v2rayNG

v2rayNG is the Android counterpart to v2rayN, from the same maintainer, and is the most widely used Xray client on Android. Install it from Google Play, or download the APK directly from the project's صفحة النشرات if Play isn't available in your region:

Import the server

Open v2rayNG, tap the + button in the top right, and choose Import config from Clipboard after copying the vless:// link, or Scan QR code and point the camera at the PNG generated in Section 7. Tap the imported profile to select it, then tap the round connect button at the bottom. Android will prompt for VPN permission the first time — approve it to establish the tunnel.

10. Connecting from iOS

Everything here happens on your iPhone or iPad, not over SSH. Apple's App Store guidelines mean Xray/VLESS clients on iOS are typically free but occasionally paid, standalone apps rather than a system-integrated feature.

Install a Reality-capable client

Streisand is a free, open-source client that supports VLESS with Reality, alongside several other protocols. Search for it in the App Store, or open this link.

App Store catalogs vary by storefront/region and can change over time; if Streisand isn't visible in yours, alternatives with VLESS+Reality support include Happ, V2Box, and V2rayTun — search the App Store for whichever is available to your account.

Import the server

Copy the vless:// link to your clipboard, open the client, and use its Add from clipboard (or equivalent "import") option, or scan the QR code from Section 7 with the client's built-in scanner. Toggle the new profile on; iOS will prompt for VPN-configuration permission the first time, which you'll need to approve via Face ID, Touch ID, or your passcode.

11. التحقق من الاتصال

With the tunnel active from Section 8, 9, or 10, go back to your own device (not the SSH session) and open any "what's my IP" checker in a browser — the address shown should match your VPS's your IP address.

To verify from the server side instead, check the systemd journal for connection activity and confirm an established TCP session on port 443:

journalctl -u xray -n 50 --no-pager
ss -tnp | grep ':443'

At the default "warning" log level Xray doesn't print much about individual connections; if you need to see more detail while troubleshooting, temporarily set "loglevel": "info" in config.json and restart the service, then switch it back to warning once things are working.

مرجع:

12. اختتام

Following this guide leaves your VPS running its own Xray VLESS+Reality server, disguised as ordinary HTTPS traffic to a real website, with no domain and no certificate to maintain. The service runs as the systemd unit xray and survives a reboot without any action on your part.

Add new clients at any time by appending another object to the users array in config.json with a fresh UUID from xray uuid and a distinct email label, then restarting the service (systemctl restart xray) and building that user their own share link from Section 7. Separate UUIDs per person or device make it possible to revoke one without disturbing anyone else.

بعض العادات التي يجدر الاستمرار عليها بمجرد تشغيل الخادم:

• Keep Xray patched. Re-run the install script from Section 3 periodically — it upgrades an existing installation in place — and keep client apps updated too, given the minClientVer behavior noted in Section 5.
• Back up config.json somewhere private off the server. It holds the server's Reality private key and every client's UUID; losing it means regenerating credentials for every device.
• Revoke lost devices promptly. Remove the corresponding entry from the users array in config.json and restart the service.

إذا لم يتم الاتصال، فتحقق بالترتيب التالي:

• the service status (systemctl status xray --no-pager) and the journal (journalctl -u xray -n 50 --no-pager)
• the firewall rules (ufw status — port 443/tcp must be open)
• that port 443 isn't already bound by another service (ss -lntp | grep ':443' should show only xray)
• that the UUID, public key, short ID, SNI, and flow in the client match config.json exactly — a single mismatched character fails the handshake silently
• the Reality target itself, with xray tls ping <target>:443, in case the site changed its TLS configuration

Comparing Xray against other options? See دليل نشر خادم AmneziaWG و كيفية إعداد Wireguard VPN على الخادم الخاص بك for WireGuard-based alternatives, or إعداد Hysteria2 وTUIC for two other censorship-resistant protocols built for lossy or heavily filtered networks. If you only need a simple proxy rather than a full tunneling setup, تكوين 3proxy على CentOS/ArchLinux is a much lighter alternative, and the older إعداد خادم VPN على Linux: PPTP أو OpenVPN؟ covers protocols that are simpler to set up but far easier for DPI to detect and block. For general server hardening once the proxy is live, see مستخدمو لينكس: الإدارة والأذونات.