Most of the newly opened nodes in the past two years are VLESS + Reality. Compared with the old protocol, it has several more unfamiliar parameters such as public key, ShortId, and fingerprint. When adding them manually, errors are most likely to occur here - the handshake fails by just one character, and the error message is not straightforward. This article explains each parameter clearly and provides a troubleshooting list for problems that cannot be connected.
1What is Reality and why are proxy providers changing it?
Simply put: Reality is a TLS disguised upgrade of VLESS. Traditional TLS nodes need to buy their own domain names and hang certificates; Reality directly "borrows" the certificate of a real large website to complete the handshake. From the outside, this connection is accessing that website. It does not require a domain name or certificate, and is more resistant to detection, so it quickly became mainstream. It is enough to know these principles. The key is to fill in the parameters correctly.
2If you can import the link, don't fill it in by hand.
Given by the service provider vless:// All Reality parameters have been encoded in the shared link. After copying, use "Server" → "Import batch URL from clipboard" to import. There is no need to fill in a word, and the error rate is the lowest. The following manually filled content is mainly used to build a self-built server or check what is wrong after importing.
3Manual addition: what to fill in each item
"Server" → "Add [VLESS] Server", focus on the following columns:
- Address/Port: Server IP (or domain name) and port, Reality commonly uses 443.
- User ID: UUID, the string generated by the server, paste it as it is.
- Flow: fill in
xtls-rprx-vision. This item is the easiest to miss, and if it is missed, it will basically be impossible to connect. - Encryption method: keep
none. VLESS itself is not encrypted, security is provided by the outer layer of Reality. - Transport protocol:
tcp. - Transport layer security: Drop down selection reality(not tls). After selecting, the following items will appear.
- SNI (serverName): The website domain name "borrowed" by the server must be consistent with the server configuration, for example
www.microsoft.com. You can't just change it yourself. - Fingerprint: Normally fill in
chrome, simulates the browser's handshake characteristics. - PublicKey: The x25519 public key generated by the server is a long string of letters and numbers, and no single character can be wrong.
- ShortId: For the short ID (short hexadecimal string) in the server configuration, copy it if available. If it is left blank on the server, leave it blank here too.
Where does the public key come from? Reality server use xray x25519 Generate a pair of keys: the private key is written into the server configuration, and the public key is sent to the client. If you build it yourself, don't send the private key as the public key - the two strings look very similar, and they will never be connected if they are filled in backwards.
4Can't connect? Check these four items according to frequency of occurrence
- ① The kernel is too old: Reality requires newer Xray kernel support. Older versions of the kernel will directly report unrecognized fields. Go to "Check for Updates" to upgrade the Xray kernel to the latest, and then Conveniently, the v2rayN body has also been updated..
- ② Public key/ShortId copied incorrectly: Most common. Don't type by hand, copy the whole string. Pay attention when checking
l(lowercase L),I(capital i),0andOSuch confusing characters. - ③ Flow control leakage filling: If vision is enabled on the server and the flow control on the client is empty (or vice versa), the handshake can be performed but data cannot be transmitted, or the data is interrupted in seconds. Keep both sides consistent.
- ④ SNI is inconsistent: SNI must be the domain name specified in the server configuration. If you decide to switch to another website, the server will reject it directly.
If everything is correct and it still doesn't work, just look at the log: search below the main interface or in the log file REALITY For related error lines, "invalid" mostly points to the public key/ShortId, and "timeout" indicates that the IP or port is suspected to be blocked, so change the port or IP and try again.
5How to choose between Hysteria2 and
Reality uses TCP, which is stable and has good versatility; Hysteria2 Using UDP, the speed advantage is obvious on lines with severe packet loss, but some network environments will limit UDP. There is no conflict between the two protocols. If both are included in the subscription, use whichever one is faster. For a complete side-by-side comparison of each protocol, see Agreement Comparison.