For years the cat-and-mouse was about hiding proxy traffic inside TLS — but censors learned to actively probe suspicious servers and catch the fakes. REALITY inverts the trick: instead of presenting its own certificate, your server relays the genuine TLS handshake of a real, popular website (Microsoft, Apple, a CDN). To a probe, your endpoint is indistinguishable from that site — same certificate, same fingerprint — because for the handshake, it literally is. There's no self-signed cert to flag, no domain of your own to get blocklisted, and nothing for a fingerprint scanner to latch onto. That's why REALITY is the default recommendation for China in 2026.
What the protocol actually is, how it hides, and where it's strongest — described honestly. No proxy is magic; the right one for your network is.
A proxy is a tiny process — it needs a clean IP and steady bandwidth, not a big machine. Every plan is unmetered NVMe VPS with full root, rented with a token and paid in crypto.
For users in Iran, Turkey and the Gulf, Netherlands and Romania give the lowest latency. For Russia, any European location works. China has no nearby PoP in our network, but REALITY's stealth matters more there than raw latency — Netherlands is the usual pick.
From a blank VPS to a working endpoint. Commands are copy-paste ready for Ubuntu 24.04.
Pick VPS-S in a jurisdiction close to you — Netherlands or Romania for the Middle East. Pay in crypto, get root in minutes on an IP that isn't on any blocklist.
Key-only SSH first, then one command installs the 3x-ui panel that manages Xray for you.
# key-only SSH, then install the 3x-ui panel
bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)In the panel: protocol VLESS, security REALITY, and a camouflage SNI that's reachable from the censored network. The panel handles the key exchange.
# in the panel: add an inbound → protocol VLESS, security REALITY
# pick a camouflage SNI that is reachable from the censored network,
# e.g. www.microsoft.com or a CDN domain — REALITY relays its real certThe panel prints a vless://…#REALITY link and QR. Import into v2rayN (Windows), v2rayNG (Android), Streisand/FoXray (iOS) or sing-box. No client certificate to leak.
# the panel prints a vless://...#REALITY share link + QR.
# import it into v2rayN (Win), v2rayNG (Android), Streisand / FoXray (iOS),
# or sing-box (any). No client cert, no config file to leak.From outside, the endpoint answers a normal TLS handshake for your borrowed SNI. To any scanner it's just another HTTPS host.
# verify from outside: the endpoint answers a normal TLS handshake
curl -sI https://YOUR_IP --resolve YOUR_SNI:443:YOUR_IP | head -1Trojan and VMess-over-TLS both wrap proxy traffic in a legitimate-looking TLS session — but they present a certificate for a domain you control, and that domain (and its cert) can be probed, fingerprinted and blocklisted. REALITY removes the weak link: there is no domain of yours and no certificate of yours. Your server completes the handshake using a real third-party site's certificate, then quietly switches to carrying your traffic only for authenticated clients. A censor that probes sees the real site; a scanner that fingerprints sees the real site's TLS stack. There's simply nothing that says 'proxy'.
REALITY borrows the TLS handshake of a real 'dest' site you point it at. Pick one that is (1) reachable and unblocked from inside the censored network, (2) served over TLS 1.3 with the modern X25519 curve, and (3) plausible as a destination — a big CDN, a Microsoft or Apple endpoint, a popular site that isn't itself blocked. Avoid anything the censor has an interest in blocking, and avoid tiny or region-locked sites. The 3x-ui panel can test a candidate SNI for compatibility before you commit.
3x-ui turns Xray into a point-and-click job: create inbounds, add users with traffic quotas and expiry dates, and hand out per-user share links or QR codes. It's ideal if you're serving a family or reselling — each person gets their own credential you can revoke without touching anyone else. Put the panel itself behind a non-standard port and key-only SSH, and never expose it to the open internet without a password. Our first-hour hardening checklist covers the basics.
REALITY is superb against DPI and active probing, but it rides on TCP — so on a deliberately throttled or extremely lossy mobile network (common in Iran during unrest) a UDP/QUIC protocol like Hysteria2 can feel dramatically faster. And if your goal is purely Telegram, a MTProto proxy is lighter and purpose-built. The good news: full root means you can run REALITY and a fallback on the same VPS, different ports, and switch when the network changes.
Related reading: Self-Hosted VPN on a No-KYC VPS: WireGuard vs OpenVPN · The First Hour of VPS Hardening: A Checklist · Self-hosted VPN use case