Xray-core VLESS proxy setup tutorial

A step-by-step guide to setting up an Xray-core server with VLESS protocol and connecting clients on Android, Windows, and Linux. Originally published on Hetzner's community platform, later removed and republished on GitHub.

This is the manual, panel-free approach — you edit JSON configs directly instead of using a web UI like 3x-ui. Useful for understanding what's actually happening under the hood: inbounds, outbounds, stream settings, TLS certificates, and UUID-based client authentication.

Server setup

Install Xray-core from GitHub releases (a single binary + geodata files), drop it into /usr/local/xray, and create a JSON config at /usr/local/etc/xray/config.json.

The config has three main sections:

• inbounds — what the server listens for. In this tutorial: VLESS on port 443 over TCP with TLS. Each client gets a UUID (generated via xray uuid) and an email label for log differentiation.
• outbounds — where traffic goes. The "freedom" protocol means "forward to the actual destination." This is the simplest case; you could add routing rules here for split tunneling.
• streamSettings — transport and encryption. TCP + TLS is the baseline; VLESS itself doesn't encrypt (it delegates that to TLS), which avoids double-encryption overhead.

Two certificate options: self-signed (instant, no domain needed, but clients must set allowInsecure: true) or Let's Encrypt via certbot (requires a domain, supports auto-renewal, and Xray hot-reloads certs).

Port 443 is privileged, so you either run as root or grant the binary cap_net_bind_service via setcap. The tutorial recommends running as a regular user with the capability set.

A systemd unit keeps it running: Type=exec, Restart=on-failure, After=network-online.target.

Client setup

The client config mirrors the server but inverted: the inbound is a local SOCKS5 listener on 127.0.0.1:1080, and the outbound is a VLESS connection to your server.

Android — v2rayNG app from Play Store. Add a VLESS server manually, paste your UUID, enable TLS.

Windows — two paths:

1. Run Xray directly with a SOCKS proxy config, then point Chrome (--proxy-server="socks5://127.0.0.1:1080") or Firefox (network settings) at it.
2. Use v2rayN with TUN mode ("Enable Tun") to route all system traffic through the proxy transparently. This uses sing-box under the hood to create a virtual network interface.

Linux — same SOCKS proxy approach as Windows. Per-app via Chrome's --proxy-server flag or Firefox settings. System-wide depends on your desktop environment.

What this doesn't cover

The tutorial sticks to the simplest working configuration: single protocol (VLESS), single transport (TCP+TLS), no routing rules, no DNS handling. For production use you'd want:

• Routing rules to only proxy blocked traffic (see russia-v2ray-rules-dat for geo rule files)
• A client like mihomo that can do rule-based split routing instead of all-or-nothing SOCKS proxying
• A management panel like 3x-ui if you're serving multiple users and don't want to edit JSON by hand

For users who can't afford a VPS at all, masterhttprelayvpn occupies the zero-budget end of the same design space — it uses Google Apps Script as a free relay with domain-fronting instead of a VLESS server on an IP you pay for. Much slower, much easier to set up, more fragile against Google policy changes.

Full source with all config examples: source.