Xray REALITY Protocol Complete Tutorial: Principles, Server Deployment, Anti-Detection Points

REALITY is a transport protocol introduced by Xray in 2023, solving a fundamental weakness of TLS proxies: your certificate is fake. Traditional VLESS+TLS setups require a domain name and Let’s Encrypt certificate, but the certificate itself becomes a fingerprint—with no real website behind it, the traffic pattern stands out immediately.

REALITY’s approach is fundamentally different: directly borrow the TLS handshake of a real website. What the server presents to detection systems is the TLS certificate and handshake details of that actual website, indistinguishable from normal traffic.

How REALITY Works

A normal TLS connection:

Client → ClientHello (with SNI, e.g., www.apple.com) → Server
Server → Certificate (real www.apple.com certificate) → Client

REALITY’s magic: When the Xray server receives the ClientHello, it forwards the handshake request to the real www.apple.com, obtains the real certificate, and relays it back to the client unchanged.

To detection systems in the middle, this looks like a completely legitimate TLS handshake with www.apple.com. It’s impossible to distinguish.

The actual encrypted communication between client and server is hidden behind this handshake, using Xray’s own key pair (identity verified via shortId).

Key advantages:

• No domain name required, no certificate needed
• TLS fingerprint completely borrows from a real website
• Even active probing of your server port returns normal responses from the target website

Prerequisites

• A VPS (DMIT recommended for low latency on CN2 GIA) → Register with DMIT
• Latest Xray (currently v25.x)
• No domain name or certificate required

Server Deployment

Install Xray

bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install

Generate Key Pair

xray x25519

Output:

Private key: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Public key:  yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy

Save both values—you’ll need them in the config.

Generate Short ID

Short ID distinguishes different clients and can be a 0–16 character hexadecimal string:

openssl rand -hex 4    # generates 8 chars, e.g., 55470656
openssl rand -hex 8    # generates 16 chars

Server Configuration

/usr/local/etc/xray/config.json:

{
  "inbounds": [{
    "port": 443,
    "protocol": "vless",
    "settings": {
      "clients": [{
        "id": "your-uuid-here",
        "flow": "xtls-rprx-vision"
      }],
      "decryption": "none"
    },
    "streamSettings": {
      "network": "tcp",
      "security": "reality",
      "realitySettings": {
        "show": false,
        "dest": "www.apple.com:443",
        "xver": 0,
        "serverNames": ["www.apple.com"],
        "privateKey": "your-private-key",
        "shortIds": ["55470656", "7a3bc239"]
      }
    }
  }],
  "outbounds": [{
    "protocol": "freedom",
    "tag": "direct"
  }]
}

Generate a UUID:

xray uuid

Start the Service

systemctl enable xray
systemctl start xray
systemctl status xray

SNI (Masquerading Domain) Selection

SNI is the most critical REALITY configuration—it directly determines whether your traffic passes detection.

Characteristics of a good SNI:

1. The website must actually exist with port 443 always open

   • Detection systems may actively visit the domain. If it doesn’t exist or port 443 is unreachable, you’re immediately exposed.

2. Fast TLS handshake response

   • REALITY’s handshake needs real-time forwarding to the target website. The closer the target, the better.
   • Recommendation: use a major website in the same region as your VPS.

3. Website with high HTTPS traffic

   • Your traffic blends into heavy normal traffic, reducing the chance of individual scrutiny.

Recommended SNIs:

Not recommended:

• Domestic Chinese websites (like www.baidu.com)—servers are overseas, high handshake latency
• Niche websites—port 443 might be unstable
• SNIs known to be widely used by proxy users—obvious fingerprint

Role of Short ID

Short ID is how the server verifies client identity.

How it works: The Xray client embeds a random value in the session_id field of the ClientHello. The server decrypts it with its private key, checking if the padding contains a valid Short ID.

• Legitimate clients: server returns proxy response
• Random scanners: server normally forwards to the target website (looks like a normal website)

Using multiple Short IDs (recommended): different devices use different IDs. If one device is compromised, you only delete that ID without affecting others.

"shortIds": ["55470656", "7a3bc239", "a1b2c3d4"]

Flow Selection

REALITY recommends xtls-rprx-vision:

"flow": "xtls-rprx-vision"

Vision mode can distinguish TLS-in-TLS traffic, preventing active probing from exposing proxy characteristics. It works without it, but detection resistance is slightly weaker.

Firewall Configuration

# Ubuntu UFW
ufw allow 443/tcp
ufw enable

# Or with iptables
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Port 443 is recommended—it blends naturally with HTTPS traffic.

Verify Deployment

After configuring the client, test connectivity:

# Direct curl test (requires client proxy configured)
curl -x vless://uuid@your-vps:443?security=reality&... https://api.ipify.org

Simpler approach: configure the node in mihomo or Surge and visit whatismyip.com to confirm the IP is your VPS.

Frequently Asked Questions

Q: Server startup error failed to read config Check JSON syntax, verify with jq . config.json.

Q: Client connection timeout

1. Check firewall: ss -tlnp | grep 443
2. Verify SNI target is reachable: curl -I https://www.apple.com (from your VPS)
3. Verify privateKey and publicKey match

Q: Connection works but speed is slow SNI target is too far from the VPS, causing high handshake latency. Switch to a major website in the same region as your SNI.

Q: Can I use a non-443 port? Yes, but it’s easier to identify. If using a non-standard port, the SNI target must use the same port:

"dest": "www.apple.com:8443",
"serverNames": ["www.apple.com"]

→ See Client configuration: mihomo / Surge with REALITY → See DMIT VPS Purchase Guide

📷 Cover image · Generated with Flux Schnell AI · panshi.io brand style