Guía de realidade VLESS de raios X: VPS, Windows, Mac, Android, iPhone

esta Xray VLESS Reality server setup guide walks you through deploying a modern proxy on your VPS. VLESS with the Reality transport-security layer is currently the most requested self-hosted proxy setup VLESS with the Reality transport-security layer is currently the most requested self-hosted proxy setup: unlike a classic VPN it doesn't produce a distinctive handshake or a fixed packet signature. Reality clones the TLS 1.3 handshake of a real, popular website (the target), so to a DPI system watching the wire, a connection to your server looks identical to someone visiting that website — there is no fake or self-signed certificate to fingerprint, because your server briefly forwards the actual certificate of the target site during the handshake.

The protocol stack is: VLESS (a lightweight, stateless proxy protocol handling authentication) running over XTLS Vision (a flow-control mode that speeds up the connection by copying already-encrypted TLS records at the raw socket level) secured by Realidade (the camouflage layer described above). All three come from the same project, Xray-core, the actively maintained successor to the original V2Ray/V2Fly project.

This guide sets up an Xray server by hand, entirely from the command line, with no web panel and no Docker — the smallest possible footprint on the VPS. No domain name and no TLS certificate purchase are required: Reality borrows the target site's certificate for the handshake and never presents one of its own. Next, where it says your_IP, you'll need to enter your assigned IP address.

What you'll need: a VPS running Ubuntu 22.04/24.04 or Debian 11/12, root access, your VPS's IP address, and TCP port 443 free (no web server, panel, or other proxy already listening on it).

Aínda non tes un servidor? Consulta How to order a server and pay for it.

Comparing this against other self-hosted options first? See Guía de despregamento do servidor AmneziaWG for a WireGuard-based alternative, or Configuración de Hysteria2 e TUIC for two other modern, censorship-resistant protocols.

1. Conexión ao servidor

Windows (PuTTY)

Abre PuTTY, introduce o teu enderezo IP do VPS no campo Nome do host, configura o porto en 22 e inicia sesión como root co contrasinal que che enviou o teu provedor de VPS por correo electrónico.

Enderezo IP do servidor: o teu enderezo IP
iniciar sesión como: root
Password : your password

• Open PuTTY, enter your VPS IP address in the Host Name field.

• Set the port to 22.

• Enter log in as root.

• Use the password your VPS provider emailed you. You should then land on the server's shell prompt.

Para obter unha guía detallada sobre a conexión mediante PuTTY/SSH, consulte Como conectarse a un servidor Linux mediante SSH. 

Linux / macOS (terminal)

ssh root@your_IP

All commands below are run on the server, in this same SSH session — that covers Sections 2 through 6, plus the server-side checks in Section 10. Sections 7–9 (installing and configuring the VPN client) happen on your own Windows/Android/iOS device instead, since that's the device the proxy needs to run on; each of those sections says explicitly which lines, if any, still touch the server.

2. Preparación do servidor

Actualiza o sistema

Antes de instalar nada, actualiza a lista de paquetes e actualiza os paquetes instalados:

apt update -y && apt upgrade -y

If the session is interrupted after apt upgrade, this is expected (dbus/polkit restarted) - just reconnect via SSH. 

If this upgrades the kernel, a reboot is a good idea before continuing. (For a refresher on apt and how Linux package managers work, see Xestores de paquetes de Linux.) Consultar con:

cat /var/run/reboot-required

If the file exists, reboot first with 'reboot', wait ~30 seconds, then reconnect.

Install the tools this guide uses

apt install -y curl wget unzip openssl ufw qrencode

Curl and unzip are needed by the Xray installer itself; openssl generates the short ID in Section 4; ufw is the firewall configured below; qrencode turns the finished client link into a scannable QR code in Section 7.

Check the system clock

Reality's handshake includes a timestamp check (the maxTimeDiff field, disabled by default but worth knowing about), and a clock that has drifted noticeably can also make ordinary TLS certificate validation misbehave elsewhere on the server. Confirm the clock is synced:

timedatectl status

If "System clock synchronized" shows "no", enable it with:

timedatectl set-ntp true

Configurar o cortafuegos (UFW)

Para obter máis información sobre as regras da UFW, consulte Configuración do firewall en Linux.

Open the two ports you'll need: 22/tcp for SSH (skip this rule and you risk losing access to the server) and 443/tcp, the port Xray will listen on and the same port ordinary HTTPS traffic uses — which is exactly why it's the right choice for Reality.

ufw allow 22/tcp

ufw allow 443/tcp

ufw --force enable

ufw status

Ambas as regras deberían mostrarse como PERMITIR na saída de estado de ufw.

3. Installing Xray-core for VLESS Reality Server

The Xray-core project (XTLS) publishes an official install-and-upgrade script that installs the binary as a systemd service. Review any third-party script before piping it into bash — this one comes straight from the project's own repository.

bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install

Verify the binary is in place and check the installed version:

/usr/local/bin/xray version

If the command output is paginated and appears to hang, press Q to exit. The Xray binary is installed to /usr/local/bin/xray, and its configuration files are stored in /usr/local/etc/xray/.

You can also use the same installer script to upgrade an existing installation. For a full list of options (including removal, geodata-only updates, and log rotation), run:

bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" --help

4. Generating the Keys and Credentials

Reality authentication rests on four pieces of data. Generate all of them now; you'll paste them into the server configuration in Section 5.

Generate a UUID for the client

/usr/local/bin/xray uuid

This is the VLESS user ID — treat it as a credential, since it's what authenticates a client to the server. Run the command again for every additional device or person you want to grant access to.

Generate the Reality X25519 key pair

/usr/local/bin/xray x25519

This prints three lines: Chave privada, contrasinale Hash32. PrivateKey goes only into the server configuration and must never be shared. Password is the corresponding public key — despite the name, this is the value every client enters; Xray renamed the field from PublicKey to Password specifically to discourage people from publishing it carelessly. Hash32 is used only for the separate VLESS Encryption feature and isn't needed for a Reality setup.

Generate a short ID

openssl rand -hex 8

This produces a 16-character hexadecimal string used to tell different clients or client groups apart. Both server and client must use the same value.

Choose and test a Reality target

The target is the real website whose TLS handshake your server imitates. It should support TLS 1.3 and HTTP/2, must not sit behind a CDN like Cloudflare (Xray forwards any traffic that fails Reality authentication straight to the target, so a CDN-fronted target can turn your server into an open relay for that CDN), and ideally is hosted in roughly the same network region as your VPS for a plausible latency profile. Test a candidate directly from the server:

/usr/local/bin/xray tls ping www.microsoft.com:443

Use the bare hostname, not a URL. A handful of domains that are commonly used as Reality targets because they're stable, TLS 1.3-capable, and not CDN-fronted: www.microsoft.com, addons.mozilla.org, dl.google.com. Test a few and pick one that responds reliably from your VPS's location; you'll use the same hostname as both the target and the serverNames entry in Section 5.

5. Writing the Server Configuration

Back up the config the installer shipped with, then open the file for editing:

cp /usr/local/etc/xray/config.json /usr/local/etc/xray/config.json.orig
nano /usr/local/etc/xray/config.json

Open the configuration file for editing:

nano /usr/local/etc/xray/config.json

Replace the whole file with the template below, substituting your own UUID, PrivateKey, short ID, and target hostname from Section 4 (and the port you opened in Section 2, if you changed it from 443):

{
  "log": {
    "loglevel": "warning"
  },
  "inbounds": [
    {
      "listen": "0.0.0.0",
      "port": 443,
      "protocol": "vless",
      "settings": {
        "users": [
          {
            "id": "YOUR-UUID-HERE",
            "flow": "xtls-rprx-vision",
            "email": "client1"
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "method": "raw",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "target": "www.microsoft.com:443",
          "serverNames": ["www.microsoft.com"],
          "privateKey": "YOUR-SERVER-PRIVATE-KEY",
          "shortIds": ["YOUR-SHORT-ID"]
        }
      }
    }
  ],
  "outbounds": [
    { "protocol": "freedom", "tag": "direct" },
    { "protocol": "blackhole", "tag": "blocked" }
  ]
}

Press Ctrl+O (WriteOut) to save the file.

Press Enter to confirm the file name.

Press Ctrl+X to exit nano.

The important fields: users[].id is the UUID from Section 4; users[].flow turns on XTLS Vision; method (formerly called network) selects the RAW transport, the plain TCP-based method Reality requires; target and serverNames are the site you tested in Section 4; privateKey is the server-side X25519 key, never the Password value; shortIds lists every short ID clients are allowed to present. To add more users later, append additional objects to the users array, each with its own UUID and email label, then restart the service.

Since Xray 26.3.27, a Reality inbound with no explicit minClientVer field enforces a default of the server's own core version — older client apps (an out-of-date v2rayN, v2rayNG, or Streisand build bundling an older Xray-core) are silently redirected to the target's fallback page instead of connecting, with no error in the client and nothing obviously wrong in the server log. If a client that used to work suddenly times out after an update, first try updating the client app itself; if that isn't possible, add "minClientVer": "25.9.11" (or another older baseline) inside realitySettings, at the cost of making that older client's TLS fingerprint a little less consistent with a modern browser.

Validate and restart

Test the configuration before restarting the live service — this catches JSON typos and unsupported fields before they take the proxy down:

/usr/local/bin/xray run -test -c /usr/local/etc/xray/config.json

6. Inicio do servizo e activación do inicio automático

Restart Xray with the new configuration and enable it to start automatically on reboot:

systemctl enable --now xray

systemctl restart xray

systemctl status xray --no-pager

Status should show active (running). Confirm something is actually listening on port 443:

ss -lntp | grep ':443'

If Xray fails to start, the fastest way to see why is the systemd journal (for background on reading Linux logs in general, see Como ler os rexistros de Linux e onde atopalo):

journalctl -u xray -n 50 --no-pager

7. Building the Client Connection Link

Xray clients import a single vless:// share link rather than a config file. Build it from the values generated in Section 4 (the client apps' share-link format still uses the older name type=tcp for the transport, even though the JSON field itself is now called method):

YOUR-UUID — from xray uuid (e.g., a1b2c3d4-e5f6-7890-abcd-ef1234567890)

YOUR-PASSWORD-PUBLIC-KEY — is the Password from xray x25519 (NOT the PrivateKey!)

YOUR-SHORT-ID — from openssl rand -hex 8 (e.g., a1b2c3d4e5f67890)

your_IP — (IP of your server)

SNI — www.microsoft.com (or your target)

vless://YOUR-UUID-HERE@your_IP:443?encryption=none&security=reality&sni=www.microsoft.com&fp=chrome&pbk=YOUR-PASSWORD-PUBLIC-KEY&sid=YOUR-SHORT-ID&type=tcp&flow=xtls-rprx-vision#My-Xray-Server

Ligazón de exemplo: 

vless://a1b2c3d4-e5f6-7890-abcd-ef1234567890@your_IP:443?encryption=none&security=reality&sni=www.microsoft.com&fp=chrome&pbk=xyz_public_key_here&sid=a1b2c3d4e5f67890&type=tcp&flow=xtls-rprx-vision#My-Xray-Server

pbk is the Password value from xray x25519 (the public key, never the private key), sni matches the target hostname, and the text after # is just a display label you can rename freely in any client.

Turn it into a QR code so mobile clients can scan it directly:

qrencode -o ~/vless-client.png "vless://YOUR-UUID@your_IP:443?encryption=none&security=reality&sni=www.microsoft.com&fp=chrome&pbk=YOUR-PASSWORD-PUBLIC-KEY&sid=YOUR-SHORT-ID&type=tcp&flow=xtls-rprx-vision#My-Xray-Server"

Or print it straight to the terminal without saving a file:

qrencode -t ansiutf8 "vless://YOUR-UUID@your_IP:443?encryption=none&security=reality&sni=www.microsoft.com&fp=chrome&pbk=YOUR-PASSWORD-PUBLIC-KEY&sid=YOUR-SHORT-ID&type=tcp&flow=xtls-rprx-vision#My-Xray-Server"

Copy the PNG to your own computer with scp, run from your computer's terminal (or PowerShell on Windows), not the server:

scp root@your_IP:~/vless-client.png .

8. Conexión desde Windows

Everything in this section happens on your Windows PC, not over SSH — the client has to run on the device that will actually use the proxy.

Install v2rayN

v2rayN is a free, actively maintained GUI client bundling Xray-core, with native VLESS/Reality support. Download the latest release from the project's páxina:

Grab the Windows 64-bit .zip asset (a self-contained build needs no separate .NET runtime as of recent v2rayN versions), extract it anywhere, and run v2rayN.exe.

Import the server

Copy the vless:// link built in Section 7 to your clipboard (or copy the QR PNG over with scp and open it), then in v2rayN choose Servers further Import bulk URL from clipboard (or scan the QR code via the built-in scanner). The new server profile appears in the list with the label you set after the #.

Right-click the profile and select it as active, then enable the system proxy (or TUN mode, for routing the whole machine) from the main window's toolbar.

9. Connecting from Android

Everything here happens on your Android device, not over SSH.

Install v2rayNG

v2rayNG is the Android counterpart to v2rayN, from the same maintainer, and is the most widely used Xray client on Android. Install it from Google Play, or download the APK directly from the project's páxina de lanzamentos if Play isn't available in your region:

Import the server

Open v2rayNG, tap the + button in the top right, and choose Import config from Clipboard after copying the vless:// link, or Scan QR code and point the camera at the PNG generated in Section 7. Tap the imported profile to select it, then tap the round connect button at the bottom. Android will prompt for VPN permission the first time — approve it to establish the tunnel.

10. Connecting from iOS

Everything here happens on your iPhone or iPad, not over SSH. Apple's App Store guidelines mean Xray/VLESS clients on iOS are typically free but occasionally paid, standalone apps rather than a system-integrated feature.

Install a Reality-capable client

Streisand is a free, open-source client that supports VLESS with Reality, alongside several other protocols. Search for it in the App Store, or open this link.

App Store catalogs vary by storefront/region and can change over time; if Streisand isn't visible in yours, alternatives with VLESS+Reality support include Happ, V2Box, and V2rayTun — search the App Store for whichever is available to your account.

Import the server

Copy the vless:// link to your clipboard, open the client, and use its Add from clipboard (or equivalent "import") option, or scan the QR code from Section 7 with the client's built-in scanner. Toggle the new profile on; iOS will prompt for VPN-configuration permission the first time, which you'll need to approve via Face ID, Touch ID, or your passcode.

11. Verificación da conexión

With the tunnel active from Section 8, 9, or 10, go back to your own device (not the SSH session) and open any "what's my IP" checker in a browser — the address shown should match your VPS's your IP address.

To verify from the server side instead, check the systemd journal for connection activity and confirm an established TCP session on port 443:

journalctl -u xray -n 50 --no-pager
ss -tnp | grep ':443'

At the default "warning" log level Xray doesn't print much about individual connections; if you need to see more detail while troubleshooting, temporarily set "loglevel": "info" in config.json and restart the service, then switch it back to warning once things are working.

referencia:

12. Conclusión

Following this guide leaves your VPS running its own Xray VLESS+Reality server, disguised as ordinary HTTPS traffic to a real website, with no domain and no certificate to maintain. The service runs as the systemd unit xray and survives a reboot without any action on your part.

Add new clients at any time by appending another object to the users array in config.json with a fresh UUID from xray uuid and a distinct email label, then restarting the service (systemctl restart xray) and building that user their own share link from Section 7. Separate UUIDs per person or device make it possible to revoke one without disturbing anyone else.

Algúns hábitos que paga a pena manter unha vez que o servidor estea funcionando:

• Keep Xray patched. Re-run the install script from Section 3 periodically — it upgrades an existing installation in place — and keep client apps updated too, given the minClientVer behavior noted in Section 5.
• Back up config.json somewhere private off the server. It holds the server's Reality private key and every client's UUID; losing it means regenerating credentials for every device.
• Revoke lost devices promptly. Remove the corresponding entry from the users array in config.json and restart the service.

Se a conexión non se establece, comprobe na seguinte orde:

• the service status (systemctl status xray --no-pager) and the journal (journalctl -u xray -n 50 --no-pager)
• the firewall rules (ufw status — port 443/tcp must be open)
• that port 443 isn't already bound by another service (ss -lntp | grep ':443' should show only xray)
• that the UUID, public key, short ID, SNI, and flow in the client match config.json exactly — a single mismatched character fails the handshake silently
• the Reality target itself, with xray tls ping <target>:443, in case the site changed its TLS configuration

Comparing Xray against other options? See Guía de despregamento do servidor AmneziaWG Como configurar Wireguard VPN no teu servidor for WireGuard-based alternatives, or Configuración de Hysteria2 e TUIC for two other censorship-resistant protocols built for lossy or heavily filtered networks. If you only need a simple proxy rather than a full tunneling setup, 3 configuración de proxy en CentOS/ArchLinux is a much lighter alternative, and the older Configuración do servidor VPN en Linux: PPTP ou OpenVPN? covers protocols that are simpler to set up but far easier for DPI to detect and block. For general server hardening once the proxy is live, see Usuarios de Linux: xestión e permisos.