Help · Architecture

VLESS Reality

The default transport. It uses a real TLS 1.3 handshake that borrows the identity of a real website, so to an observer the connection looks like HTTPS to that site, and a probe that connects to the node gets the real site.

Open in the app All help topics
example

A probe connects to the node → the node passes it to the real cover site → the probe gets that site's real certificate

VLESS Reality is the default way onto a ProofKit node, on TCP port 443. It is VLESS (the protocol Xray uses) wrapped in REALITY, a TLS layer built to survive the two things censors do to VPN servers: recognise their traffic, and probe them.

The problem

Ordinary VPN protocols (OpenVPN, WireGuard, plain VLESS) have recognisable packets, and deep packet inspection (DPI) can spot them in the first few packets. Censors also actively probe suspected servers: they connect themselves and see what answers.

How Reality answers both

  1. A real TLS 1.3 handshake, shaped like a Chrome browser's, naming a real website (the node's cover site) as the server.
  2. The cover site's real certificate. The node relays the handshake to the real site, so the certificate an observer sees is genuinely that site's.
  3. Probes go to the real site. A client without the node's key and your personal ID is passed through to the cover site, so a probe that connects ends up talking to that site.

What it does not hide

  • The node's IP address. A censor can block or throttle an address without identifying the protocol.
  • The shape of the traffic: one long connection to the "site". Where DPI flags that pattern, try XHTTP.
  • A cover site that is itself blocked on your network gets the node blocked with it; another exit uses another cover site.

Apps

Every app that runs VLESS Reality works: Happ, Hiddify, V2RayNG, Streisand, V2RayN, and other Xray-core or sing-box based apps.