# How to Self-Host a V2Ray Server: A Complete Setup Guide

> Learn to self-host a V2Ray server with this complete guide. Set up a Linux VPS, V2Ray core, TLS, WebSocket, and Nginx for secure and private internet access.

- Repository: [如何翻墙/fanqiang](https://github.com/bannedbook/fanqiang)
- Tags: how-to-guide
- Published: 2026-09-06

---

**To self-host a V2Ray server, deploy a Linux VPS, install the V2Ray core binary, configure TLS encryption with a valid certificate, set up WebSocket transport behind Nginx, and manage the service with Systemd.**

The **fanqiang** repository by bannedbook provides battle-tested tutorials and configuration templates for building production-ready V2Ray servers. This guide synthesizes the official server setup documentation, extracting the exact file paths, command sequences, and JSON configurations you need to deploy a secure, obfuscated proxy infrastructure.

---

## Prerequisites and Core Components

Before proceeding, ensure you have access to these four infrastructure pieces documented across the repository:

| Component | Purpose | Source Location |
|-----------|---------|---------------|
| **Linux VPS** | Hosts the V2Ray daemon and receives client connections | Any cloud provider (Vultr, BandwagonHOST per `v2ss/自建V2ray服务器简明教程.md`) |
| **V2Ray core binary** | Executes the proxy engine with inbound/outbound protocol support | Official release or `v2ray官方一键安装脚本` |
| **TLS certificate** | Encrypts traffic to mimic standard HTTPS | Let's Encrypt via `certbot` or self-signed for testing |
| **Nginx reverse proxy** | Terminates TLS and forwards WebSocket traffic | Configuration templates in `v2ss/server-cfg/` |

The repository emphasizes **TLS + WebSocket + Nginx** as the gold standard for traffic obfuscation, documented in `v2ss/V2Ray之TLS+WebSocket+Nginx+CDN配置方法.md`.

---

## Step 1: Provision and Prepare Your VPS

Select a Linux distribution (Ubuntu 20.04+ or Debian 11+ recommended). The tutorial `v2ss/自建V2ray服务器简明教程.md` covers VPS acquisition from providers including Vultr and BandwagonHOST.

Once connected via SSH, update packages and install dependencies:

```bash
sudo apt update && sudo apt upgrade -y
sudo apt install curl wget nginx certbot python3-certbot-nginx -y

```

Point a domain's A record to your VPS IP before requesting certificates.

---

## Step 2: Install V2Ray Core

The repository references two installation methods. For efficiency, use the official one-click script:

```bash
bash <(curl -L https://raw.githubusercontent.com/v2fly/fhs-install-v2ray/master/install-release.sh)

```

This places binaries at `/usr/local/bin/v2ray` and `/usr/local/bin/v2ctl`, with configuration directory `/usr/local/etc/v2ray/`.

Verify installation:

```bash
v2ray --version
v2ctl uuid  # Generate your first client UUID

```

The Windows client guide in [`windows/V2RayN.md`](https://github.com/bannedbook/fanqiang/blob/main/windows/V2RayN.md) confirms these binary names match official releases.

---

## Step 3: Generate TLS Certificate

For production deployments, obtain a valid certificate from Let's Encrypt:

```bash
sudo certbot --nginx -d yourdomain.com

```

Certificates are written to `/etc/letsencrypt/live/yourdomain.com/`. For testing only, the TLS tutorial (`v2ss/自建V2Ray+TLS翻墙配置方法.md`) documents self-signed certificate generation.

---

## Step 4: Configure V2Ray Server

Create [`/usr/local/etc/v2ray/config.json`](https://github.com/bannedbook/fanqiang/blob/main//usr/local/etc/v2ray/config.json) with this structure adapted from [`v2ss/images/config.json`](https://github.com/bannedbook/fanqiang/blob/main/v2ss/images/config.json):

```json
{
  "inbounds": [
    {
      "port": 10086,
      "listen": "127.0.0.1",
      "protocol": "vmess",
      "settings": {
        "clients": [
          {
            "id": "e3b0c442-98fc-1c14-9afb-6a2a9b3c2d70",
            "alterId": 0,
            "security": "auto"
          }
        ]
      },
      "streamSettings": {
        "network": "ws",
        "wsSettings": {
          "path": "/bannedbook"
        }
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom",
      "settings": {}
    }
  ],
  "routing": {
    "rules": [
      {
        "type": "field",
        "outboundTag": "blocked",
        "domain": ["geosite:category-ads-all"]
      }
    ]
  }
}

```

**Critical configuration notes:**

- Replace the example `id` with output from `v2ctl uuid`
- `listen: 127.0.0.1` binds only to localhost—Nginx handles external exposure
- `path: "/bannedbook"` must match Nginx location block exactly
- Port 10086 is arbitrary; any unprivileged port works for internal communication

---

## Step 5: Configure Nginx Reverse Proxy

Create `/etc/nginx/sites-available/v2ray` with this configuration derived from the Nginx template in [`v2ss/server-cfg/route-no-udp.json`](https://github.com/bannedbook/fanqiang/blob/main/v2ss/server-cfg/route-no-udp.json) and accompanying guides:

```nginx
server {
    listen 443 ssl http2;
    server_name yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location /bannedbook {
        proxy_pass http://127.0.0.1:10086;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }
}

```

Enable the site and reload Nginx:

```bash
sudo ln -s /etc/nginx/sites-available/v2ray /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

```

---

## Step 6: Deploy Systemd Service

The repository provides `v2ss/server-cfg/xray.service` as a reference template. Create `/etc/systemd/system/v2ray.service`:

```ini
[Unit]
Description=V2Ray Service
After=network.target

[Service]
User=nobody
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
NoNewPrivileges=true
ExecStart=/usr/local/bin/v2ray -config /usr/local/etc/v2ray/config.json
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

```

Enable and start the service:

```bash
sudo systemctl daemon-reload
sudo systemctl enable v2ray.service
sudo systemctl start v2ray.service
sudo systemctl status v2ray.service

```

Verify operation with `journalctl -u v2ray -f`.

---

## Step 7: Firewall and Security Hardening

Restrict inbound traffic to essential ports:

```bash
sudo ufw default deny incoming
sudo ufw allow 22/tcp    # SSH

sudo ufw allow 443/tcp   # V2Ray via Nginx

sudo ufw enable

```

The [`v2ss/server-cfg/route-no-udp.json`](https://github.com/bannedbook/fanqiang/blob/main/v2ss/server-cfg/route-no-udp.json) file provides an alternative routing policy that disables UDP entirely for restrictive network environments.

---

## Step 8: (Optional) Add CDN Layer

For IP masking, wrap your setup with Cloudflare or compatible CDNs. The tutorial `v2ss/V2Ray之TLS+WebSocket+Nginx+CDN配置方法.md` documents this enhancement:

1. Set Cloudflare DNS proxy status to "Orange cloud" for your domain
2. Use "Full (strict)" SSL mode
3. Ensure WebSocket support is enabled (default on paid plans; requires configuration on free tier)

CDN deployment hides your origin IP from clients and adds DDoS protection.

---

## Client Connection and Testing

Export your server configuration as a VMess URI for clients:

```

vmess://{base64-encoded-json}

```

The JSON payload includes:

```json
{
  "v": "2",
  "ps": "my-server",
  "add": "yourdomain.com",
  "port": "443",
  "id": "your-generated-uuid",
  "aid": "0",
  "scy": "auto",
  "net": "ws",
  "type": "none",
  "host": "yourdomain.com",
  "path": "/bannedbook",
  "tls": "tls"
}

```

Repository client guides for verification:

- **Windows**: [`windows/V2RayN.md`](https://github.com/bannedbook/fanqiang/blob/main/windows/V2RayN.md)
- **macOS**: [`macos/V2RayU.md`](https://github.com/bannedbook/fanqiang/blob/main/macos/V2RayU.md)
- **Android**: [`android/V2RayNG.md`](https://github.com/bannedbook/fanqiang/blob/main/android/V2RayNG.md)

Test connectivity by browsing to a geo-restricted site or checking your public IP from the client device.

---

## Summary

- **V2Ray core** handles proxy protocols; install via official script or repository reference
- **TLS certificate** from Let's Encrypt provides encryption and traffic legitimacy
- **WebSocket transport** with `path` parameter enables CDN compatibility
- **Nginx termination** isolates V2Ray from direct internet exposure
- **Systemd service** from `v2ss/server-cfg/xray.service` ensures automatic restart and boot persistence
- **Configuration file** at [`/usr/local/etc/v2ray/config.json`](https://github.com/bannedbook/fanqiang/blob/main//usr/local/etc/v2ray/config.json) controls inbound VMess and outbound freedom routing

---

## Frequently Asked Questions

### What is the minimum VPS specification for self-hosting V2Ray?

A 512 MB RAM instance with 10 GB storage suffices for personal use. The tutorials in `v2ss/自建V2ray服务器简明教程.md` explicitly confirm successful deployments on entry-level VPS tiers from Vultr and BandwagonHOST.

### Can I use V2Ray without a domain name?

Yes, but you sacrifice TLS certificate validity and CDN compatibility. The repository includes self-signed certificate instructions for testing, though production deployments require a registered domain for Let's Encrypt issuance.

### Why does my Systemd service fail to start?

Common causes include: incorrect path to [`config.json`](https://github.com/bannedbook/fanqiang/blob/main/config.json), missing `CAP_NET_ADMIN` capability for binding low ports, or JSON syntax errors. Run `v2ray test -config /usr/local/etc/v2ray/config.json` before reloading Systemd to validate configuration syntax.

### How do I migrate from Shadowsocks to V2Ray on the same server?

V2Ray's inbound configuration supports multiple protocols simultaneously. Add a `shadowsocks` inbound alongside your `vmess` inbound in [`config.json`](https://github.com/bannedbook/fanqiang/blob/main/config.json), or run separate instances on different ports. The repository maintains parallel guides for both protocols without conflict.