How to Install VLESS + XTLS-Reality on a VPS

A practical, command-by-command guide to installing Xray-core, generating secure credentials, configuring VLESS with XTLS Vision and REALITY, opening the firewall, connecting a client, and troubleshooting common VPS deployment errors.

What This Guide Builds

This tutorial installs a self-hosted VLESS endpoint on a Linux VPS using Xray-core. VLESS provides lightweight client authentication, XTLS Vision controls the optimized data flow, and REALITY supplies the transport-security layer that makes the connection resemble an ordinary TLS session.

The final server listens on TCP port 443 and accepts only clients that present the correct UUID, REALITY client key, server name, and short ID. You do not need to purchase a domain or issue a TLS certificate for this basic REALITY configuration.

Responsible-use note: Deploy this technology only where lawful and permitted. It should not be used to access systems without authorization, violate platform rules, conceal abuse, or evade legal obligations.

Quick Installation Summary

1. Order a KVM VPS with a public IPv4 address and root or sudo access.
2. Update Debian or Ubuntu and install the required command-line tools.
3. Install Xray-core with the official XTLS installation script.
4. Generate a UUID, an X25519 key pair, and a hexadecimal short ID.
5. Select and test a stable HTTPS target for the REALITY handshake.
6. Create the VLESS + XTLS Vision + REALITY server configuration.
7. Validate the JSON, restart Xray, open port 443, and verify the service.
8. Enter the matching values ​​in a REALITY-compatible client.

How the Connection Is Structured

The client connects to the VPS on port 443. REALITY handles the TLS-like handshake, VLESS authenticates the user, and XTLS Vision manages the flow. Xray then sends permitted traffic through the server’s normal outbound network connection.

Requirements Before Installation

Recommended VPS Size

VLESS and REALITY do not require a large server for a small private deployment. Location, CPU consistency, network quality, and available bandwidth are generally more important than storage capacity.

Connect to the VPS and Update Linux

Connect from a terminal with SSH. Replace the sample IP address with the public address supplied by the VPS provider.

ssh root@203.0.113.10

Update the package index, apply available updates, and install the tools used in the remaining steps.

apt update && apt upgrade -y
apt install -y curl openssl ca-certificates ufw

Install Xray-Core

The official XTLS installation project provides a script for systemd-based Linux distributions. Review third-party installation scripts before running them and use the official repository rather than an unknown mirror.

bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install

After installation, verify that the binary is available and display the installed version.

/usr/local/bin/xray version
systemctl status xray --no-pager

Generate the UUID, X25519 Keys, and Short ID

The server and client must share a matching UUID. REALITY also uses an X25519 key pair: the private value remains on the server, while the corresponding client-side value is entered in the client application.

Generate a random VLESS UUID

/usr/local/bin/xray uuid

Generate the REALITY X25519 key pair

/usr/local/bin/xray x25519

Generate a 16-character hexadecimal short ID

openssl rand -hex 8

Choose and Test a REALITY Target

REALITY uses the TLS appearance and handshake characteristics of a real HTTPS target. Choose a stable domain that supports TLS on port 443, is reachable from the VPS, and accepts the server name you will configure.

Test the candidate directly from the VPS. Replace the example domain with your selected target.

/usr/local/bin/xray tls ping www.microsoft.com:443

• Use the hostname, not an http://or https://URL.
• Keep the server target, server serverNames, and client SNI consistent.
• Avoid random domains that are unreliable, blocked, or incompatible with the VPS route.
• Review current Project X guidance before using CDN-backed or unusual targets.

Create the Xray Server Configuration

Back up the existing configuration before replacing it. This makes recovery easier if a JSON error or incompatible value prevents the service from starting.

cp /usr/local/etc/xray/config.json /usr/local/etc/xray/config.json.backup 2>/dev/null || true
nano /usr/local/etc/xray/config.json

Paste the following configuration, then replace every uppercase placeholder with the values ​​generated in the previous steps.

{
  "log": {
    "loglevel": "warning"
  },
  "inbounds": [
    {
      "tag": "vless-reality-in",
      "listen": "0.0.0.0",
      "port": 443,
      "protocol": "vless",
      "settings": {
        "users": [
          {
            "id": "YOUR-UUID-HERE",
            "flow": "xtls-rprx-vision",
            "email": "primary-user"
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "method": "raw",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "target": "www.microsoft.com:443",
          "xver": 0,
          "serverNames": [
            "www.microsoft.com"
          ],
          "privateKey": "YOUR-SERVER-PRIVATE-KEY",
          "shortIds": [
            "YOUR-SHORT-ID"
          ]
        }
      }
    }
  ],
  "outbounds": [
    {
      "tag": "direct",
      "protocol": "freedom"
    },
    {
      "tag": "blocked",
      "protocol": "blackhole"
    }
  ]
}

Important Configuration Fields Explained

Validate the Configuration and Restart Xray

Test the configuration before restarting the production service. This catches missing commas, quotation errors, invalid keys, and unsupported fields.

/usr/local/bin/xray run -test -c /usr/local/etc/xray/config.json

When the test completes without an error, restart Xray and configure it to start automatically after reboot.

systemctl restart xray
systemctl enable xray
systemctl status xray --no-pager

Confirm that a process is listening on TCP port 443.

ss -lntp | grep ':443'

Configure the VPS Firewall

Allow the active SSH service before enabling the firewall. If your VPS uses a custom SSH port, allow that exact port instead of relying only on the OpenSSH application profile.

ufw allow OpenSSH
ufw allow 443/tcp
ufw --force enable
ufw status verbose

Configure a Compatible Client

Use an up-to-date client that explicitly supports VLESS, XTLS Vision, and REALITY. The exact screen and field names vary by operating system and application.

How to Verify the Installation

A successful systemd status alone does not prove that the client can connect. Verify the server locally and then test from an external network.

Common Problems and Solutions

VPS Hardening Checklist

A working proxy service does not automatically make the server secure. Protect the operating system and administrative access separately.

• Install security updates regularly and subscribe to provider maintenance notices.
• Use SSH keys and disable password login only after key access is confirmed.
• Create a non-root sudo account for routine administration where practical.
• Allow only the ports actually required by the deployment.
• Keep the Xray private key and user credentials out of public repositories and screenshots.
• Create separate UUIDs or user entries when access must be revoked independently.
• Review systemd logs and unusual network activity.
• Keep an off-server copy of the configuration, without exposing credentials publicly.
• Document how to rotate the UUID, X25519 key pair, and short ID after compromise.

Updating, Backing Up, or Removing Xray

Back up the configuration

install -m 600 /usr/local/etc/xray/config.json /root/xray-config-backup.json

Update Xray with the official installer

bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install

Review available installer options before removal

bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ help

Re-test the configuration after a major update because field names, aliases, validation rules, and client compatibility can change over time.

Using Retzor for a VLESS REALITY VPS

Retzor offers KVM-based virtual servers with administrative operating-system access and NVMe storage. These are the core infrastructure characteristics needed to install Xray-core and control the firewall, service configuration, and listening ports.

Select a data-center location close to the intended users and test latency, route quality, public-IP accessibility, and port availability before moving an important configuration to production.

Frequently Asked Questions

Final Thoughts

Installing VLESS with XTLS-Reality on a VPS involves four core tasks: installing Xray-core, generating the required credentials, building a valid REALITY server configuration, and entering identical values ​​in a compatible client.

Most deployment failures are caused by a small mismatch rather than a complex server problem. Test the JSON before restarting Xray, verify that port 443 is free and reachable, and compare the UUID, flow, SNI, client key, and short ID carefully.

For the underlying infrastructure, a clean KVM VPS with root access, a public IP, stable networking, and a location close to the intended users is generally sufficient. Retzor virtual servers can be evaluated for this type of self-managed Linux deployment.