V2Ray (and its VMess protocol) pioneered the transport tricks everything else now borrows: wrap the proxy in WebSocket, wrap that in TLS, and route it through a big CDN. The magic is the CDN: when Cloudflare sits in front of your domain, a client connects to Cloudflare's IPs — which a censor won't blocklist wholesale because half the internet is behind them — and Cloudflare quietly forwards to your origin. Your real server IP never appears in the client's connection at all. It's a little heavier and needs a domain, but the origin-hiding property is unique, and V2Ray's decade of documentation and universal client support make it the safe, well-trodden path.
What the protocol actually is, how it hides, and where it's strongest — described honestly. No proxy is magic; the right one for your network is.
A proxy is a tiny process — it needs a clean IP and steady bandwidth, not a big machine. Every plan is unmetered NVMe VPS with full root, rented with a token and paid in crypto.
Because Cloudflare fronts the connection, latency to your origin matters less than usual — pick Netherlands or Romania for a fast backhaul, or the cheapest node since the CDN does the heavy lifting. The domain lives at Cloudflare; the VPS just answers behind it.
From a blank VPS to a working endpoint. Commands are copy-paste ready for Ubuntu 24.04.
VPS-S is enough. Any jurisdiction works since the CDN fronts it — Netherlands for a fast origin. Pay in crypto, get root.
Add a domain to Cloudflare (free tier), create a proxied (orange-cloud) record to your VPS IP. This is what hides your origin.
The official installer drops in V2Ray (or the drop-in Xray core). One command, no dependencies.
# official installer (V2Ray or the drop-in Xray core)
bash <(curl -Ls https://raw.githubusercontent.com/v2fly/fhs-install-v2ray/master/install-release.sh)Set VMess over WebSocket with a secret path, terminate TLS, and let Cloudflare proxy it. Censors then see traffic to Cloudflare on your domain, not to your VPS.
# VMess + WebSocket + TLS. Put Cloudflare (proxied, orange cloud)
# in front of a domain that points at this VPS; set path=/your-secret-path.
# GFW/Iran then see traffic to Cloudflare, not to your origin IP.Export the vmess:// link and import into v2rayN, v2rayNG or sing-box. Every connection now rides Cloudflare to your hidden origin.
# share the vmess:// link; import into v2rayN / v2rayNG / sing-box
systemctl restart v2ray && journalctl -u v2ray -n 20 --no-pagerNormally a client connects straight to your server's IP — which a censor can log and blocklist. CDN fronting breaks that chain: you put your domain behind Cloudflare with the proxy (orange cloud) enabled, so DNS resolves to Cloudflare's IPs, not yours. The client's TLS connection terminates at Cloudflare, which forwards the WebSocket stream to your origin over its own network. From the censor's vantage point, you're connecting to Cloudflare — the same IPs serving millions of ordinary sites. To block you specifically, they'd have to block those Cloudflare ranges and take a large slice of the normal web down with you, which most are unwilling to do.
VMess is V2Ray's original protocol; it works and is universally supported, but it carries a bit more overhead and a timestamp-based handshake that, on its own, modern DPI can sometimes spot. That's exactly why it's paired with WebSocket+TLS+CDN — the wrapping is what provides the stealth, not VMess itself. If you don't need CDN fronting, the newer VLESS (especially with REALITY) is leaner and stealthier on its own. Think of V2Ray+CDN as the choice specifically when hiding your origin IP behind Cloudflare is the property you want.
You don't need a paid plan or an expensive domain. A cheap domain (our no-KYC registrar has them from $4.99) plus Cloudflare's free tier gives you the proxied DNS record that does all the work. Keep the record orange-clouded, use a non-obvious WebSocket path, and you're fronted. One caveat to be honest about: your traffic passes through Cloudflare, so trust is split between us (your origin, no logs) and the CDN — for most threat models focused on beating a national firewall, that's a fine trade; for maximum trust-nobody setups, a plain REALITY endpoint keeps everything on your own box.
Once it's up it's low-maintenance: keep V2Ray updated, keep the Cloudflare record proxied, and rotate the WebSocket path if you ever suspect it's been discovered. Because the origin is hidden, your VPS IP rarely gets blocked directly — the usual failure mode is the domain being flagged, which you fix by swapping domains (cheap and fast) rather than redeploying the server. If Cloudflare itself is being interfered with in your country, that's the signal to fall back to REALITY or Hysteria2 on the same VPS.
Related reading: Self-Hosted VPN on a No-KYC VPS: WireGuard vs OpenVPN · The First Hour of VPS Hardening: A Checklist · Self-hosted VPN use case