# What Is the VLESS Protocol? Implementation Details in the Fanqiang Repository

> Discover the VLESS protocol, a simpler VMess alternative. Learn its lightweight design and implementation details in the bannedbook/fanqiang repository for secure proxy connections.

- Repository: [如何翻墙/fanqiang](https://github.com/bannedbook/fanqiang)
- Tags: deep-dive
- Published: 2026-09-05

---

**VLESS (VMess Less) is a lightweight, authentication-free transport protocol that uses a single UUID and optional flow parameter to establish secure proxy connections, eliminating the complex alterId configuration required by traditional VMess.**

The **VLESS protocol** serves as a streamlined alternative within the V2Ray ecosystem, designed to reduce configuration overhead while maintaining high-performance traffic forwarding. In the `bannedbook/fanqiang` repository, VLESS is implemented through a series of Kotlin and Java option classes that integrate with the SingBox configuration generator and Android proxy manager to build runtime-compatible proxy configurations.

## Core Architecture of the VLESS Protocol

The Fanqiang codebase implements VLESS through three primary data structures defined in [`SingBoxOptions.java`](https://github.com/bannedbook/fanqiang/blob/main/SingBoxOptions.java). These classes map directly to the protocol's handshake mechanics, which rely on UUID-based identification rather than the multi-ID system used by VMess.

### VLESS Inbound Configuration

The `VLESSInboundOptions` class defines how the server listens for incoming VLESS connections. Located at line 2417 of [`fqnews2/app/src/main/java/moe/matsuri/nb4a/SingBoxOptions.java`](https://github.com/bannedbook/fanqiang/blob/main/fqnews2/app/src/main/java/moe/matsuri/nb4a/SingBoxOptions.java), this class encapsulates server-side parameters including network listeners, TLS termination, and transport layer settings.

Key fields include:
- `listen` and `listen_port` – Bind address and port allocation
- `users` – List of `VLESSUser` objects containing authentication credentials
- `tls` – `InboundTLSOptions` for certificate management
- `transport` – `V2RayTransportOptions` supporting TCP, WebSocket, or QUIC overlays

### User Identification and Flow Parameters

Each VLESS user is represented by the `VLESSUser` class (lines 61-68 in [`SingBoxOptions.java`](https://github.com/bannedbook/fanqiang/blob/main/SingBoxOptions.java)). Unlike VMess, which requires an `alterId` parameter for backward compatibility, VLESS relies solely on a **UUID** for client identification.

The class supports:
- `uuid` – The 36-character universally unique identifier
- `name` – Optional human-readable label
- `flow` – Optional encryption layer specification (e.g., `"xtls-rprx-origin"`)

The **flow** parameter enables extended encryption modes such as XTLS vision, which reduces encryption overhead during TLS handshakes.

### VLESS Outbound Configuration

Client-side connections are managed through `VLESSOutboundOptions` (lines 71-90 in [`SingBoxOptions.java`](https://github.com/bannedbook/fanqiang/blob/main/SingBoxOptions.java)). This class mirrors the inbound structure while adding client-specific routing capabilities:

- `server` and `server_port` – Target destination coordinates
- `network` – Transport protocol selection
- `multiplex` – `MultiplexOptions` for connection pooling and concurrency control
- `tls` – `OutboundTLSOptions` with SNI configuration

## Protocol Detection in the Proxy Manager

The Android runtime handles VLESS detection through the [`RawUpdater.kt`](https://github.com/bannedbook/fanqiang/blob/main/RawUpdater.kt) file located at [`fqnews2/app/src/main/java/io/nekohasekai/sagernet/group/RawUpdater.kt`](https://github.com/bannedbook/fanqiang/blob/main/fqnews2/app/src/main/java/io/nekohasekai/sagernet/group/RawUpdater.kt). At line 290, the parser examines JSON proxy configurations to differentiate VLESS from VMess instances.

When `proxy["type"] == "vless"` evaluates true, the updater:
1. Sets the internal `isVLESS` flag to true
2. Disables VMess-specific fields such as `alterId` and `cipher`
3. Preserves the `uuid` and optional `flow` fields for protocol negotiation

This detection mechanism ensures that legacy VMess parameters do not contaminate VLESS configuration objects during runtime initialization.

## Practical Implementation Examples

The following examples demonstrate how to construct VLESS configurations using the Fanqiang source classes.

### Building a VLESS Inbound Server

```java
// Initialize inbound listener
SingBoxOptions.VLESSInboundOptions inbound = new SingBoxOptions.VLESSInboundOptions();
inbound.listen = "0.0.0.0";
inbound.listen_port = 443;

// Configure TLS termination
inbound.tls = new SingBoxOptions.InboundTLSOptions();
inbound.tls.enabled = true;
inbound.tls.cert_path = "/etc/ssl/cert.pem";
inbound.tls.key_path = "/etc/ssl/key.pem";

// Define authenticated user
SingBoxOptions.VLESSUser user = new SingBoxOptions.VLESSUser();
user.uuid = "e3d3f2c1-9b2a-4d5e-b8c3-1a2b3c4d5e6f";
user.flow = "xtls-rprx-origin";
inbound.users = Collections.singletonList(user);

// Apply WebSocket transport
SingBoxOptions.V2RayTransportOptions transport = new SingBoxOptions.V2RayTransportOptions();
transport.type = "ws";
transport.path = "/vless-ws";
inbound.transport = transport;

```

### Configuring a VLESS Outbound Client

```kotlin
val outbound = VLESSOutboundOptions().apply {
    server = "proxy.example.com"
    server_port = 443
    uuid = "e3d3f2c1-9b2a-4d5e-b8c3-1a2b3c4d5e6f"
    flow = "xtls-rprx-origin"
    network = "ws"
    
    tls = OutboundTLSOptions().apply {
        enabled = true
        server_name = "proxy.example.com"
    }
    
    multiplex = MultiplexOptions().apply {
        enabled = true
        concurrency = 4
    }
}

```

### Generating VLESS URI Strings

The legacy profile system references the VLESS URI schema through the `VLESS_PROTOCOL` constant defined in [`fqnews/core/src/main/java/com/github/shadowsocks/database/Profile.kt`](https://github.com/bannedbook/fanqiang/blob/main/fqnews/core/src/main/java/com/github/shadowsocks/database/Profile.kt) at line 123.

```kotlin
val uri = "vless://${user.uuid}@${outbound.server}:${outbound.server_port}" +
          "?encryption=${outbound.flow}&type=${outbound.network}&security=tls"

```

## Summary

- **VLESS** eliminates the `alterId` complexity of VMess, using only a UUID and optional flow parameter for authentication and encryption negotiation.
- The implementation resides primarily in [`SingBoxOptions.java`](https://github.com/bannedbook/fanqiang/blob/main/SingBoxOptions.java), which defines `VLESSInboundOptions`, `VLESSOutboundOptions`, and `VLESSUser` classes for configuration management.
- Protocol detection occurs in [`RawUpdater.kt`](https://github.com/bannedbook/fanqiang/blob/main/RawUpdater.kt), which sets the `isVLESS` flag and sanitizes VMess-specific fields when parsing subscription configurations.
- The architecture supports pluggable transports including WebSocket, QUIC, and raw TCP, with optional TLS and XTLS flow layers for enhanced performance.

## Frequently Asked Questions

### What is the difference between VLESS and VMess protocols?

VLESS removes the `alterId` security layer required by VMess, relying instead on a single UUID for client identification. This simplification reduces configuration errors and computational overhead while maintaining security through TLS or XTLS encryption layers. According to the Fanqiang source code, VLESS configurations explicitly disable VMess fields like `cipher` and `alterId` during parsing in [`RawUpdater.kt`](https://github.com/bannedbook/fanqiang/blob/main/RawUpdater.kt).

### How does the VLESS protocol handle user authentication?

VLESS uses **UUID-based authentication** exclusively. The `VLESSUser` class stores a 36-character UUID and an optional `flow` string that specifies extended encryption modes. There is no password or secondary ID system; security depends on the UUID's uniqueness and the transport layer encryption (TLS/XTLS) protecting the connection.

### What is the purpose of the flow parameter in VLESS?

The **flow** parameter specifies additional encryption handling such as `"xtls-rprx-origin"` or `"xtls-rprx-vision"`. These modes enable XTLS, which reduces double-encryption overhead when proxying TLS traffic by allowing the proxy to snoop and relay TLS handshakes without re-encrypting the payload. In the Fanqiang implementation, this is stored in the `flow` field of the `VLESSUser` class.

### Where is VLESS configured in the Fanqiang Android application?

VLESS configurations are defined in [`fqnews2/app/src/main/java/moe/matsuri/nb4a/SingBoxOptions.java`](https://github.com/bannedbook/fanqiang/blob/main/fqnews2/app/src/main/java/moe/matsuri/nb4a/SingBoxOptions.java) through the inbound and outbound options classes. Runtime protocol detection and URI generation are handled in [`RawUpdater.kt`](https://github.com/bannedbook/fanqiang/blob/main/RawUpdater.kt) and [`Profile.kt`](https://github.com/bannedbook/fanqiang/blob/main/Profile.kt) respectively, allowing the app to parse VLESS subscription links and generate compatible SingBox configurations for the V2Ray runtime.