VLESS Reality explained: how a VPN connection is designed to look like ordinary HTTPS

VLESS Reality is a way of building a VPN connection in which the traffic between your device and the server is designed to look like an ordinary HTTPS visit to a real website. VLESS carries the data, and REALITY provides the encryption and the “disguise”.

VLESS and Xray-core

VLESS is a lightweight, stateless protocol used by Xray-core. It identifies users by an ID (UUID). In the common setup, which GLink uses, VLESS does not encrypt the data itself (its encryption setting is “none”) and runs inside an outer security layer such as TLS or REALITY. Unlike the older VMess protocol, VLESS itself does not depend on the device clock.

REALITY

• The server “points to” a real third-party website (the target) instead of using its own domain and certificate.
• The client authenticates with the server’s public key (which serves as its password) and a short ID. Connections that do not pass this check are forwarded to the real target website, so a probe without the key reaches that website.
• To an observer, the handshake is genuine TLS 1.3 carrying the target website’s name, and the encryption keeps forward secrecy.
• With the Vision flow (xtls-rprx-vision), VLESS adds random padding during the handshake of the traffic it carries, aiming to blur the packet-length pattern typical of “TLS inside TLS”.

XHTTP

XHTTP (formerly SplitHTTP) is a transport that carries the connection inside ordinary HTTP requests. Depending on the mode, data goes up in many separate requests (packet-up) or in one streamed request (stream-up, stream-one), and comes down as a streamed response. It can use HTTP/1.1, HTTP/2 or HTTP/3 and can be combined with REALITY; in other setups it can also run behind a CDN. The modes trade compatibility for efficiency: packet-up is the most compatible.

Trojan

Trojan is an older protocol: the client authenticates with a password inside a normal TLS connection, and connections that are not valid clients are typically passed to a regular web server. Used over ordinary TLS, as in GLink, it needs a valid TLS certificate on the server, usually for the server’s own domain.

WireGuard and OpenVPN

WireGuard and OpenVPN are general-purpose VPN protocols, not designed for disguise. WireGuard’s documentation says it does not focus on obfuscation, and a study at an ISP with about a million users showed that most OpenVPN traffic can be fingerprinted by its byte patterns, packet sizes and server responses. Protocols such as VLESS Reality are designed to blend in with ordinary HTTPS instead.

Honest limits

• There is no invisible protocol. Censors study traffic and adapt; methods that work today may be detected tomorrow.
• When a network allows only a whitelist of services, or the internet is shut down entirely, no VPN protocol works.
• Looking like HTTPS is about the shape of the traffic; it does not make the connection faster.

What the GLink subscription contains

The GLink subscription is built from these protocols: VLESS Reality — over TCP with the Vision flow, or over XHTTP without it, depending on how the location’s server is set up — and, on plans that include it, Trojan over TLS where the location’s server supports it. What you get depends on your plan and its live locations.

What a subscription link is and what it returns →