Setting up V2Ray with WebSocket and TLS: A Complete Configuration Guide

Use network: "ws" and security: "tls" in V2Ray's streamSettings to encapsulate proxy traffic inside HTTPS-looking WebSocket connections that resist deep-packet inspection.

The fanqiang repository by bannedbook is a comprehensive, document-driven collection of censorship-circumvention tutorials covering every major platform from Windows to routers and game consoles. Setting up V2Ray with WebSocket and TLS is one of its core server-side configurations, offering strong traffic camouflage by blending proxy connections into standard HTTPS traffic on port 443.

How WebSocket + TLS Camouflage Works in V2Ray

V2Ray supports multiple transport protocols, but raw TCP traffic is easily fingerprinted and blocked. The WebSocket + TLS combination solves this through two layered transformations:

• WebSocket transport (network: "ws") — Wraps V2Ray protocol data inside HTTP upgrade requests, making the traffic resemble ordinary web browsing
• TLS encryption (security: "tls") — Encrypts the entire WebSocket stream and enables standard HTTPS port usage

According to the fanqiang source code in v2ss/V2Ray之TLS+WebSocket翻墙方法.md, this configuration leverages port-level camouflage (443) and protocol blending to defeat simple firewall rules while maintaining end-to-end encryption.

Server Configuration

The server inbound rule listens on port 443, uses the vmess protocol for user authentication, and configures streamSettings with WebSocket transport and TLS termination.

Key configuration elements from the official guide:

{
  "inbounds": [
    {
      "port": 443,
      "protocol": "vmess",
      "settings": {
        "clients": [{ "id": "YOUR_UUID", "alterId": 0 }]
      },
      "streamSettings": {
        "network": "ws",
        "security": "tls",
        "tlsSettings": {
          "certificates": [{
            "certificateFile": "/etc/v2ray/v2ray.crt",
            "keyFile": "/etc/v2ray/v2ray.key"
          }]
        }
      }
    }
  ],
  "outbounds": [{ "protocol": "freedom", "settings": {} }]
}

Replace YOUR_UUID with a valid V8 UUID (generate with cat /proc/sys/kernel/random/uuid or an online UUID v4 generator). The certificate and key files must be valid TLS credentials—Let's Encrypt certificates work perfectly for this purpose.

Client Configuration

The client creates a local SOCKS5 proxy on port 1080 and defines an outbound vmess node matching the server's WebSocket + TLS parameters.

From v2ss/V2Ray之TLS+WebSocket翻墙方法.md (lines 84-88):

{
  "inbounds": [
    {
      "port": 1080,
      "protocol": "socks",
      "sniffing": { "enabled": true, "destOverride": ["http","tls"] },
      "settings": { "auth": "noauth" }
    }
  ],
  "outbounds": [
    {
      "protocol": "vmess",
      "settings": {
        "vnext": [
          {
            "address": "mydomain.me",
            "port": 443,
            "users": [{ "id": "YOUR_UUID", "alterId": 0 }]
          }
        ]
      },
      "streamSettings": {
        "network": "ws",
        "security": "tls"
      }
    }
  ]
}

Critical matching requirements: the client's address must resolve to your server's TLS certificate domain, and both network and security values must exactly match the server configuration.

Platform-Specific Client Setup

The fanqiang repository provides dedicated guides for every major client platform:

Platform	Recommended Client	Guide Path
Windows	V2RayN	windows/V2RayN.md
macOS	V2RayU or V2rayX	macos/V2RayU.md, macos/V2rayX.md
Android	V2RayNG	android/V2RayNG.md
iOS	Shadowrocket	ios/Shadowrocket.md
Routers	OpenWrt	router/OpenWRT.md

Each guide contains UI-specific instructions for importing the JSON configuration or manually entering the WebSocket + TLS parameters.

Adding CDN or Nginx Layer (Optional)

For additional IP masking and performance optimization, the repository provides an extended configuration in v2ss/V2Ray之TLS+WebSocket+Nginx+CDN配置方法.md. This places Nginx as a reverse proxy in front of V2Ray, allowing you to:

• Serve legitimate website content on the same domain
• Route WebSocket upgrade requests to the local V2Ray backend
• Add Cloudflare or other CDN services for IP hiding and DDoS protection

The WebSocket transport makes this possible because standard HTTP reverse proxies natively support WebSocket forwarding.

One-Click Server Installation

For fresh VPS deployments, v2ss/V2ray官方一键安装脚本.md provides automated installation scripts that bootstrap V2Ray with sensible defaults. After running the script, manually edit the generated configuration to add the WebSocket and TLS settings shown above.

Summary

• WebSocket transport (network: "ws") disguises V2Ray traffic as HTTP upgrade requests
• TLS encryption (security: "tls") enables port 443 usage and provides cryptographic protection
• Server and client configurations must match exactly on protocol, transport, and security settings
• The fanqiang repository provides platform-specific client guides at predictable paths: windows/, android/, ios/, macos/, router/
• Optional CDN/Nginx layering adds IP masking without changing the core V2Ray configuration

Frequently Asked Questions

What port should I use for V2Ray with WebSocket and TLS?

Use port 443. This is the standard HTTPS port, making your traffic indistinguishable from normal encrypted web browsing and significantly reducing the chance of connection blocking.

Do I need a valid TLS certificate, or can I use self-signed?

You need a valid, publicly trusted certificate such as those from Let's Encrypt. Self-signed certificates will cause TLS handshake failures on most clients and defeat the camouflage purpose, as browsers and applications flag them as suspicious.

Can I use WebSocket without TLS?

Technically yes, but strongly discouraged. WebSocket without TLS provides no encryption and the unencrypted HTTP upgrade is easily detected and blocked. The TLS layer is essential for both security and traffic camouflage.

Why use WebSocket instead of HTTP/2 or gRPC?

WebSocket has broader compatibility with reverse proxies, CDNs, and restrictive networks. While HTTP/2 and gRPC offer better performance in some scenarios, WebSocket's resemblance to ordinary HTTP traffic makes it more resilient against basic DPI systems—as implemented in the bannedbook/fanqiang configuration philosophy.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}