Xray, VLESS and REALITY: a Step-by-Step Guide

This guide is for people who want a working proxy and have no wish to learn how it works. It contains only steps: what to click, what to paste and what you should see. There are no explanations.

At the end you'll have your own server that carries all the traffic of your computer and phone, and from the outside it looks like ordinary visits to a big website. It usually takes about half an hour.

How it works and why it's set up this way is covered in two detailed articles: the server and the Windows client and the Android client. If something goes wrong, start with the table at the end of this guide: it tells you what to do and which section to read.

In the commands below, replace the words in capitals with your own: SERVER-ADDRESS with the address of your server, DONOR-SITE with the site you pick in step 5. Copy everything else as is. The sample output uses the made-up addresses 203.0.113.10 and 2001:db8::10 and the site www.example.com.

---

Step 1. Rent a server

You need the smallest virtual machine (VPS) in a country where the sites you want aren't blocked. Here are a few providers and their prices for the smallest suitable server as of November 4, 2026. Prices may change, and tax depends on your country. This isn't a ranking or an advertisement, and there are no referral links here.

Provider	Where	Server	Price per month
DigitalOcean	Europe, USA	1 vCPU, 1 GB of memory	$6
Vultr	Europe, USA	1 vCPU, 1 GB of memory	$5
Akamai (Linode)	Europe, USA	1 vCPU, 1 GB of memory	$5
Hetzner	Germany, Finland	2 vCPU, 4 GB of memory	from €5.99 excl. VAT
OVHcloud	Europe, North America	2 vCPU, 4 GB of memory	from $4.54

Two caveats. Vultr's cheapest $2.50 plan is IPv6-only and won't do. On the day I checked, Hetzner showed these plans as temporarily unavailable, so look at availability before signing up. I didn't check whether the providers accept cards from your country: better find that out in advance too.

When you create the server, choose:

• system: Ubuntu, the newest version marked LTS (this guide was tested on Ubuntu 26.04);
• login: by password, if you don't know what an SSH key is. Make up a long password and save it;
• IPv6: turn it on if there's such a checkbox.

Once the server is created, write down its address, which looks like 203.0.113.10.

Step 2. Connect to the server

On a Windows computer, open the Start menu, type "Terminal" and run it. Enter this, with your address:

ssh root@SERVER-ADDRESS

When asked Are you sure you want to continue connecting, answer yes. Then enter the password: nothing appears on the screen as you type, and that's normal. Some hosting providers ask you to change the password at the first login.

It worked if the line now starts with root@. All commands up to step 8 are entered here, in this window. You can paste copied text with a right click.

Step 3. Install the packages

apt update && DEBIAN_FRONTEND=noninteractive apt full-upgrade -y
apt install -y curl jq openssl qrencode ufw
[ -f /var/run/reboot-required ] && reboot

This takes a few minutes. If the server reboots and the connection drops, wait a minute and run the command from step 2 again.

Step 4. Install Xray

bash -c "$(curl -fsSL https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install

It worked if the last lines include Xray v… is installed. The installer suggests removing curl and unzip (apt purge curl unzip): don't do that, they're still needed.

Step 5. Pick a donor site

Your server will pass itself off as some big, real website. That's the donor site; the earlier articles call it the camouflage site. It's best to take a site from the same part of the world as the server:

• for a server in Europe: www.bosch.com, www.lidl.de, www.bahn.de, www.otto.de;
• for a server in the USA: www.target.com, www.walmart.com.

I checked these sites from a server in Germany, and only as of the date of this guide, so check them from yours. Download the check script and run it:

curl -fsSL https://cdn.vitaliy.org/9d4196ab-1c3c-4efb-b065-b643384f1832/xray-reality/xray-donor-check.sh -o xray-donor-check.sh
bash xray-donor-check.sh www.bosch.com www.lidl.de www.bahn.de www.otto.de

You'll get something like this:

SITE                           RESULT
www.bosch.com                  GOOD answers in 14 ms
www.lidl.de                    GOOD answers in 24 ms
www.bahn.de                    GOOD answers in 13 ms
www.otto.de                    GOOD answers in 20 ms

Pick a site marked GOOD. If a site gets BAD (the reason is shown next to it), just take another one: results can change, and some sites refuse automated requests. Now open the chosen site in a browser at home, without any proxy. It must open: if the donor is blocked on your network, your server will be blocked along with it.

Step 6. Set up the server

Download the second script and run it with the site you picked:

curl -fsSL https://cdn.vitaliy.org/9d4196ab-1c3c-4efb-b065-b643384f1832/xray-reality/xray-setup.sh -o xray-setup.sh
bash xray-setup.sh DONOR-SITE

The script creates the keys, writes the settings, opens the necessary ports, starts Xray and checks the result. Run it once. It worked if you see:

    without a key, this server shows the real www.example.com

DONE. The server is ready. The first user is user1.

Links for user1 (secret, do not post them anywhere):
vless://…@203.0.113.10:443?…#user1-ipv4
vless://…@[2001:db8::10]:443?…#user1-ipv6

QR code of the first link, for a phone:

followed by a QR code. The vless://… link and the QR code are your key to the server. Anyone who gets them can use it, so don't send them through chats or email, and don't post screenshots. There are two links, and the first one is the main one. The second, if present, is for when the first has problems.

You can read both scripts at the addresses in the commands; they're plain text files.

Step 7. Create a key for each device

Let's keep the user1 key for the computer. Create a separate one for the phone: then if you lose the phone, you revoke only its key.

xray-user add phone

The command shows the links and the QR code for the new device. The name can be anything, in Latin letters. If the QR code doesn't fit on the screen, maximize the terminal window and shrink the font by holding Ctrl and turning the mouse wheel. To show a key again: xray-user link phone.

The server is ready. Now let's set up the devices.

Step 8. A Windows computer

Install. On the v2rayN releases page, download v2rayN-windows-64.zip and unpack it to any folder, for example C:\v2rayN. Right-click v2rayN.exe and choose "Run as administrator".

Key. Copy the first vless://… link from the terminal in full and press Ctrl+V in the v2rayN window. The server user1-ipv4 appears in the list. Right-click it and choose Set as active.

Settings. Open Settings → Option Setting:

• on the Core: basic settings tab, turn on Turn on Sniffing and Route Only;
• on the Tun Mode settings tab, turn on Enable IPv6 Address.

Save with Confirm. Then open Settings → DNS Settings, and on the Basic DNS Settings tab enter:

Field	Value
Remote DNS	https://1.1.1.1/dns-query
Domestic DNS	1.1.1.1
Bootstrap DNS	1.1.1.1

Confirm again.

Turn it on. At the bottom of the main window, in the Routing list, pick the set with the word Global, and turn on the Enable Tun switch.

Check. Open ifconfig.co in a browser. If the page shows the address of your server rather than your home address, everything works. The same Enable Tun switch turns the proxy off.

Step 9. An Android phone

Install. In the phone's browser, open the v2rayNG releases page and download the file v2rayNG_…_arm64-v8a.apk (if the phone is old or you don't know its processor, take …_universal.apk). Open the file and allow the installation. Install the app only from here: stores carry clones with similar names.

Key. In the app, tap +, choose Import from QR code and point the camera at the QR code from step 7 on the computer screen.

Settings. Open Settings and turn on:

• Enable IPv6;
• Enable routeOnly.

In the app menu, open Routing Settings, tap Import predefined rulesets and choose Global.

Turn it on. Tap the server in the list, then the start button, and confirm Android's VPN request. A key icon appears in the status bar.

Check. Open ifconfig.co in the phone's browser: it should show the address of your server.

To keep it running. In the Android settings, find the v2rayNG app and in the battery section choose the unrestricted mode.

Android runs only one VPN at a time: when v2rayNG starts, other VPN apps are disconnected. Apps that refuse to work through a VPN (banks, for example) can be sent around it: menu → Per-app settings, with details in the Android article.

iPhone and Mac

I haven't tested this section. The same server will do; all you need is a client that understands VLESS and REALITY and can import the link or QR code from step 7.

• iPhone: Streisand (free, its description lists VLESS with REALITY) or Anywhere. The apps in the App Store depend on the country, so they may not be in yours.
• Mac: v2rayN also comes for macOS, in the v2rayN-macos-… files on the same releases page. The settings should match step 8, but the names and locations of the items may differ.

Create a key of its own for the device (xray-user add iphone) and check the address on ifconfig.co.

What to do later

All commands are entered on the server: connect first, as in step 2.

What you need	Command
See which keys exist	xray-user list
Create a new key	xray-user add name
Show a key again	xray-user link name
Revoke a key (say, you lost a phone)	xray-user del name
Change the donor site	xray-user donor new-site
Update Xray	the command from step 4

When you change the donor, the keys of all devices change: issue them again with xray-user link. Any change to the keys interrupts connections for a second, and clients reconnect by themselves.

Xray doesn't update itself, so every few months update both the server and the apps on your devices. While you're at it, repeat the first command of step 3 and the last one, with the reboot. The hosting provider charges until you delete the server, even if you aren't using it.

If it doesn't work

What you see	What to do	What to read
ssh won't connect or rejects the password	Check the address and password in the hosting panel. It usually also has a web console and a password reset	Your provider's documentation
port 443 is already in use	Something is already running on the server. The easiest fix is to recreate it clean and start again from step 2	The server
does not answer over TLS 1.3	Check that you entered the site name correctly, or take another site from step 5	Choosing a camouflage site
this server is already set up	The server is already configured, and step 6 needn't be repeated. Manage keys with xray-user
The client reports a connection error	Check that the link was copied in full. If the hosting panel has its own firewall, open port 443/TCP there. Try the second link. Run systemctl status xray on the server: it should say active (running)	The server, If it won't connect
It connects, but sites don't open	Check whether the donor site opens without the proxy. If not, change the donor: xray-user donor new-site	Choosing a camouflage site
It worked and then stopped, and the donor opens	The server's address may have been blocked. Create a new server and repeat everything from step 2	Limitations
ifconfig.co shows your home address	On Windows, check that Enable Tun is on and v2rayN runs as administrator. On Android, check Enable IPv6	TUN, IPv6
Home or work network resources don't open	While the proxy is on, internal names may not work. Use the address, or turn the proxy off	Routing
Wi-Fi at a cafe or hotel won't let you in	Turn off the proxy, log in through the network's page and turn it back on	A laptop in a cafe