VLESS Reality

What Is VLESS Reality?

VLESS Reality is a next-generation proxy protocol that camouflages traffic as legitimate TLS connections to a real website. Unlike traditional TLS proxies, Reality does not require a domain or certificate — it borrows the TLS fingerprint of an existing destination (e.g., www.google.com).

How Reality Works

1. The client initiates a TLS handshake with a Server Name Indication (SNI) set to a popular domain (the "dest" site).
2. The server uses an X25519 key pair to derive a shared secret with the client, proving its identity without presenting a certificate for the dest domain.
3. An observer sees only standard TLS traffic to a well-known site — the proxy traffic is indistinguishable from normal browsing.

X25519 Keys

Each VLESS Reality inbound has a unique key pair:

• Private key — stays on the server and is managed by V2RayTun automatically.
• Public key (pbk) — shared with clients via the subscription URL.
• Short ID (sid) — an additional authentication token (hex string, typically 8 characters).

Configuration in V2RayTun

When you create a node, a VLESS Reality inbound is provisioned automatically. You can customize it through Hosts → Config Profiles:

URI Format

The subscription endpoint generates VLESS Reality URIs in the following format:

vless://uuid@ip:443?type=tcp&security=reality&sni=www.google.com&fp=chrome&pbk=PUBLIC_KEY&sid=SHORT_ID&flow=xtls-rprx-vision#NAME

Compatible Clients

Import the subscription URL or scan the QR code from the panel to configure the client automatically.