From below of long thin blue cables connected to row of smal

Xray’s VLESS+XTLS-Reality is widely recognized as the most robust protocol combination for anti-censorship. Its core principle is disguising traffic as a normal TLS handshake, making it difficult for the GFW to identify proxy traffic through signature detection.

This guide walks you through deploying a fully functional setup from scratch.

Prerequisites

  • An overseas VPS (I recommend DMIT Hong Kong or US nodes for excellent routing quality)
  • VPS OS: Ubuntu 22.04+
  • Local client: mihomo (formerly Clash Meta)

Server Deployment

Install Xray

bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install

Generate XTLS-Reality Keys

xray x25519

Output:

Private key: Your private key (save this)
Public key:  Your public key (add to client config)

Generate a UUID:

xray uuid

Server Configuration

/usr/local/etc/xray/config.json:

{
  "inbounds": [
    {
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "your-uuid",
            "flow": "xtls-rprx-vision"
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "dest": "www.apple.com:443",
          "xver": 0,
          "serverNames": ["www.apple.com"],
          "privateKey": "your-private-key",
          "shortIds": [""]
        }
      },
      "sniffing": {
        "enabled": true,
        "destOverride": ["http", "tls", "quic"]
      }
    }
  ],
  "outbounds": [
    {"protocol": "freedom", "tag": "direct"},
    {"protocol": "blackhole", "tag": "block"}
  ]
}

Key parameters:

  • dest: Masquerade target. Choose a well-known website that supports TLS 1.3 (apple.com or microsoft.com work)
  • serverNames: Must match dest
  • flow: xtls-rprx-vision: Enables XTLS Vision mode for the strongest anti-censorship effect

Start and enable auto-boot:

systemctl enable xray --now
systemctl status xray

Open Firewall Port 443

ufw allow 443/tcp
ufw allow 443/udp

Client Configuration (mihomo)

Add this to your mihomo proxy configuration:

proxies:
  - name: "DMIT-HK-Reality"
    type: vless
    server: your-vps-ip
    port: 443
    uuid: your-uuid
    network: tcp
    tls: true
    udp: true
    flow: xtls-rprx-vision
    reality-opts:
      public-key: your-public-key
      short-id: ""
    servername: www.apple.com
    client-fingerprint: chrome

client-fingerprint simulates browser TLS fingerprints. I recommend using chrome.

Add Hysteria2 as Dual-Protocol Backup

Single-protocol setups are a single point of failure. I also deploy Hysteria2 as a backup:

# Install Hysteria2
bash <(curl -fsSL https://get.hy2.sh/)

Hysteria2 uses QUIC (UDP) and excels when TCP is restricted; VLESS+Reality is more stable when UDP is limited. They complement each other.

See my multi-gateway architecture guide for detailed setup.

Verify the Setup

After configuring the server, connect with your client and verify:

# Check your exit IP
curl https://api.ipify.org

# Verify traffic is routed through the proxy
curl --proxy socks5://127.0.0.1:7890 https://api.ipify.org

If the IPs differ, your proxy is working.

Why Choose DMIT

Deploying Xray requires a high-quality VPS—IP quality directly affects your experience.

Why I use DMIT:

  • Hong Kong nodes have low latency (20–40 ms) with no noticeable lag in daily use
  • Native IP with strong streaming service unlock capabilities
  • Stable routing and lower IP blocking rates compared to competitors

For a complete VPS buying guide, see: VPS Selection Guide

If you run into issues during setup, feel free to reach out on Telegram.

📷 Hero image · Generated with Flux Schnell AI · panshi.io brand style