# Setting up V2Ray with WebSocket and TLS: A Complete Configuration Guide

> Master V2Ray WebSocket TLS setup to mask proxy traffic as HTTPS, bypassing deep packet inspection. Follow our complete guide for secure, private internet access.

- Repository: [如何翻墙/fanqiang](https://github.com/bannedbook/fanqiang)
- Tags: how-to-guide
- Published: 2026-09-06

---

**Use `network: "ws"` and `security: "tls"` in V2Ray's `streamSettings` to encapsulate proxy traffic inside HTTPS-looking WebSocket connections that resist deep-packet inspection.**

The **fanqiang** repository by bannedbook is a comprehensive, document-driven collection of censorship-circumvention tutorials covering every major platform from Windows to routers and game consoles. Setting up V2Ray with WebSocket and TLS is one of its core server-side configurations, offering strong traffic camouflage by blending proxy connections into standard HTTPS traffic on port 443.

## How WebSocket + TLS Camouflage Works in V2Ray

V2Ray supports multiple transport protocols, but raw TCP traffic is easily fingerprinted and blocked. The WebSocket + TLS combination solves this through two layered transformations:

- **WebSocket transport** (`network: "ws"`) — Wraps V2Ray protocol data inside HTTP upgrade requests, making the traffic resemble ordinary web browsing
- **TLS encryption** (`security: "tls"`) — Encrypts the entire WebSocket stream and enables standard HTTPS port usage

According to the fanqiang source code in `v2ss/V2Ray之TLS+WebSocket翻墙方法.md`, this configuration leverages port-level camouflage (443) and protocol blending to defeat simple firewall rules while maintaining end-to-end encryption.

## Server Configuration

The server inbound rule listens on port 443, uses the **vmess** protocol for user authentication, and configures `streamSettings` with WebSocket transport and TLS termination.

Key configuration elements from the official guide:

```json
{
  "inbounds": [
    {
      "port": 443,
      "protocol": "vmess",
      "settings": {
        "clients": [{ "id": "YOUR_UUID", "alterId": 0 }]
      },
      "streamSettings": {
        "network": "ws",
        "security": "tls",
        "tlsSettings": {
          "certificates": [{
            "certificateFile": "/etc/v2ray/v2ray.crt",
            "keyFile": "/etc/v2ray/v2ray.key"
          }]
        }
      }
    }
  ],
  "outbounds": [{ "protocol": "freedom", "settings": {} }]
}

```

Replace `YOUR_UUID` with a valid V8 UUID (generate with `cat /proc/sys/kernel/random/uuid` or an online UUID v4 generator). The certificate and key files must be valid TLS credentials—Let's Encrypt certificates work perfectly for this purpose.

## Client Configuration

The client creates a local SOCKS5 proxy on port 1080 and defines an outbound vmess node matching the server's WebSocket + TLS parameters.

From `v2ss/V2Ray之TLS+WebSocket翻墙方法.md` (lines 84-88):

```json
{
  "inbounds": [
    {
      "port": 1080,
      "protocol": "socks",
      "sniffing": { "enabled": true, "destOverride": ["http","tls"] },
      "settings": { "auth": "noauth" }
    }
  ],
  "outbounds": [
    {
      "protocol": "vmess",
      "settings": {
        "vnext": [
          {
            "address": "mydomain.me",
            "port": 443,
            "users": [{ "id": "YOUR_UUID", "alterId": 0 }]
          }
        ]
      },
      "streamSettings": {
        "network": "ws",
        "security": "tls"
      }
    }
  ]
}

```

Critical matching requirements: the client's `address` must resolve to your server's TLS certificate domain, and both `network` and `security` values must exactly match the server configuration.

## Platform-Specific Client Setup

The fanqiang repository provides dedicated guides for every major client platform:

| Platform | Recommended Client | Guide Path |
|----------|-------------------|------------|
| Windows | V2RayN | [`windows/V2RayN.md`](https://github.com/bannedbook/fanqiang/blob/main/windows/V2RayN.md) |
| macOS | V2RayU or V2rayX | [`macos/V2RayU.md`](https://github.com/bannedbook/fanqiang/blob/main/macos/V2RayU.md), [`macos/V2rayX.md`](https://github.com/bannedbook/fanqiang/blob/main/macos/V2rayX.md) |
| Android | V2RayNG | [`android/V2RayNG.md`](https://github.com/bannedbook/fanqiang/blob/main/android/V2RayNG.md) |
| iOS | Shadowrocket | [`ios/Shadowrocket.md`](https://github.com/bannedbook/fanqiang/blob/main/ios/Shadowrocket.md) |
| Routers | OpenWrt | [`router/OpenWRT.md`](https://github.com/bannedbook/fanqiang/blob/main/router/OpenWRT.md) |

Each guide contains UI-specific instructions for importing the JSON configuration or manually entering the WebSocket + TLS parameters.

## Adding CDN or Nginx Layer (Optional)

For additional IP masking and performance optimization, the repository provides an extended configuration in `v2ss/V2Ray之TLS+WebSocket+Nginx+CDN配置方法.md`. This places Nginx as a reverse proxy in front of V2Ray, allowing you to:

- Serve legitimate website content on the same domain
- Route WebSocket upgrade requests to the local V2Ray backend
- Add Cloudflare or other CDN services for IP hiding and DDoS protection

The WebSocket transport makes this possible because standard HTTP reverse proxies natively support WebSocket forwarding.

## One-Click Server Installation

For fresh VPS deployments, `v2ss/V2ray官方一键安装脚本.md` provides automated installation scripts that bootstrap V2Ray with sensible defaults. After running the script, manually edit the generated configuration to add the WebSocket and TLS settings shown above.

## Summary

- **WebSocket transport** (`network: "ws"`) disguises V2Ray traffic as HTTP upgrade requests
- **TLS encryption** (`security: "tls"`) enables port 443 usage and provides cryptographic protection
- Server and client configurations must match exactly on protocol, transport, and security settings
- The fanqiang repository provides platform-specific client guides at predictable paths: `windows/`, `android/`, `ios/`, `macos/`, `router/`
- Optional CDN/Nginx layering adds IP masking without changing the core V2Ray configuration

## Frequently Asked Questions

### What port should I use for V2Ray with WebSocket and TLS?

Use **port 443**. This is the standard HTTPS port, making your traffic indistinguishable from normal encrypted web browsing and significantly reducing the chance of connection blocking.

### Do I need a valid TLS certificate, or can I use self-signed?

You need a **valid, publicly trusted certificate** such as those from Let's Encrypt. Self-signed certificates will cause TLS handshake failures on most clients and defeat the camouflage purpose, as browsers and applications flag them as suspicious.

### Can I use WebSocket without TLS?

Technically yes, but **strongly discouraged**. WebSocket without TLS provides no encryption and the unencrypted HTTP upgrade is easily detected and blocked. The TLS layer is essential for both security and traffic camouflage.

### Why use WebSocket instead of HTTP/2 or gRPC?

WebSocket has **broader compatibility** with reverse proxies, CDNs, and restrictive networks. While HTTP/2 and gRPC offer better performance in some scenarios, WebSocket's resemblance to ordinary HTTP traffic makes it more resilient against basic DPI systems—as implemented in the bannedbook/fanqiang configuration philosophy.