# Xray-core VLESS proxy setup tutorial

A step-by-step guide to setting up an Xray-core server with VLESS protocol and connecting clients on Android, Windows, and Linux. Originally published on Hetzner's community platform, later removed and republished on GitHub.

This is the manual, panel-free approach — you edit JSON configs directly instead of using a web UI like [[3x-ui]]. Useful for understanding what's actually happening under the hood: inbounds, outbounds, stream settings, TLS certificates, and UUID-based client authentication.

## Server setup

Install Xray-core from GitHub releases (a single binary + geodata files), drop it into `/usr/local/xray`, and create a JSON config at `/usr/local/etc/xray/config.json`.

The config has three main sections:

- **inbounds** — what the server listens for. In this tutorial: VLESS on port 443 over TCP with TLS. Each client gets a UUID (generated via `xray uuid`) and an email label for log differentiation.
- **outbounds** — where traffic goes. The "freedom" protocol means "forward to the actual destination." This is the simplest case; you could add routing rules here for split tunneling.
- **streamSettings** — transport and encryption. TCP + TLS is the baseline; VLESS itself doesn't encrypt (it delegates that to TLS), which avoids double-encryption overhead.

Two certificate options: self-signed (instant, no domain needed, but clients must set `allowInsecure: true`) or Let's Encrypt via certbot (requires a domain, supports auto-renewal, and Xray hot-reloads certs).

Port 443 is privileged, so you either run as root or grant the binary `cap_net_bind_service` via `setcap`. The tutorial recommends running as a regular user with the capability set.

A systemd unit keeps it running: `Type=exec`, `Restart=on-failure`, `After=network-online.target`.

## Client setup

The client config mirrors the server but inverted: the inbound is a local SOCKS5 listener on `127.0.0.1:1080`, and the outbound is a VLESS connection to your server.

**Android** — v2rayNG app from Play Store. Add a VLESS server manually, paste your UUID, enable TLS.

**Windows** — two paths:
1. Run Xray directly with a SOCKS proxy config, then point Chrome (`--proxy-server="socks5://127.0.0.1:1080"`) or Firefox (network settings) at it.
2. Use v2rayN with TUN mode ("Enable Tun") to route all system traffic through the proxy transparently. This uses [[sing-box]] under the hood to create a virtual network interface.

**Linux** — same SOCKS proxy approach as Windows. Per-app via Chrome's `--proxy-server` flag or Firefox settings. System-wide depends on your desktop environment.

## What this doesn't cover

The tutorial sticks to the simplest working configuration: single protocol (VLESS), single transport (TCP+TLS), no routing rules, no DNS handling. For production use you'd want:

- Routing rules to only proxy blocked traffic (see [[russia-v2ray-rules-dat]] for geo rule files)
- A client like [[mihomo]] that can do rule-based split routing instead of all-or-nothing SOCKS proxying
- A management panel like [[3x-ui]] if you're serving multiple users and don't want to edit JSON by hand

For users who can't afford a VPS at all, [[masterhttprelayvpn]] occupies the zero-budget end of the same design space — it uses Google Apps Script as a free relay with [[domain-fronting]] instead of a VLESS server on an IP you pay for. Much slower, much easier to set up, more fragile against Google policy changes.

Full source with all config examples: [[xray-tutorial|source]].