Linux VLESS Client: sing-box & Xray System Proxy on VPS

To set up a Linux VLESS client like sing-box or Xray as a system-wide proxy on your desktop, install a client (e.g., sing-box 1.8.0+ or Xray-core 1.8.0+) and configure a systemd unit for autostart, ensuring all traffic routes through a secure tunnel with minimal resource consumption, typically less than 50 MB RAM.

Introduction: Why Use a Personal Proxy on Your Linux Desktop with a VPS?

In today's dynamic digital landscape, where privacy, security, and access to information are increasingly critical, using your own proxy server via a Virtual Private Server (VPS) stands out as one of the most reliable solutions. This not only allows you to bypass regional restrictions and censorship but also significantly enhances the anonymity and security of your internet connection. Unlike public VPN services, which may log data or impose bandwidth limitations, a personal proxy on a VPS gives you complete control over your traffic.

For Linux desktop users on distributions like Ubuntu, Debian, or Arch Linux, a powerful and flexible toolkit exists to achieve this. Modern proxy clients such as sing-box and Xray offer a wide range of protocols (VLESS, Reality, Hysteria, and others), operating modes (system proxy, TUN mode), and fine-grained routing rule configuration. This allows you to adapt the proxy to any need: from global protection of all traffic to use for specific applications only. Furthermore, thanks to optimization, these client applications consume minimal system resources, making them an ideal choice even for low-power devices.

Setting up your own VPN server on a VPS is an investment in your digital freedom and security. If you haven't yet deployed the server-side component, we recommend checking out our complete guide to creating a VPN on your own VPS, which details all steps from choosing a plan to configuring a modern protocol.

Choosing Your Linux VLESS Client: sing-box vs. Xray?

When it comes to setting up a proxy on Linux via a VPS, the choice between sing-box and Xray-core is crucial. Both tools are high-performance, multi-functional platforms for traffic proxying, but each has its unique characteristics.

sing-box: The Universal Toolkit for Any Task

sing-box is a relatively new but rapidly gaining popularity project, positioned as a universal proxy client and server. Its key advantages include:

• Extensive Protocol Support: VLESS, Reality, Hysteria2, TUIC, Shadowsocks, VMess, Trojan, WireGuard, OpenConnect, and many others. This makes sing-box an extremely flexible solution.
• Advanced Routing Capabilities: Detailed rule configuration based on domains, IP addresses, CIDR networks, GeoIP/GeoSite, and process owner.
• TUN Mode: Built-in support for creating a virtual network interface (TUN), allowing it to function as a full-fledged VPN for all system traffic without the need for manual proxy configuration in each application.
• Excellent Performance: Optimized code and an asynchronous architecture ensure high speed and low latency.
• Active Development: The project is continuously updated, with new features and protocols regularly added.

Xray-core: Time-Tested Stability and Performance

Xray-core is a fork of V2Ray and has long established itself as a reliable and high-performance solution. It also supports a wide range of protocols and features:

• Protocols: VLESS, VMess, Trojan, Shadowsocks, Socks, HTTP. It is particularly strong in implementing VLESS with Reality, offering stealth features to bypass blocking.
• Advanced Routing: Similar capabilities to sing-box for traffic management based on various rules.
• Stability: The project has a long history and is considered very stable, which is important for critical tasks.
• TUN Mode: Implemented via the inbound protocol dokodemo-door with special settings for traffic capture.

Which one to choose?

If you need the most versatile tool with support for the latest protocols and active development, sing-box is an excellent choice for deploying sing-box on a VPS and using it as a client. If you value time-tested stability and a robust implementation of VLESS/Reality, Xray-core is a reliable option. For most Linux desktop users, sing-box offers a slightly simpler and more integrated TUN mode setup, as well as out-of-the-box support for Hysteria2 and TUIC without additional wrappers.

Feature	sing-box	Xray-core
Key Protocols	VLESS, Reality, Hysteria2, TUIC, Shadowsocks, WireGuard, OpenConnect, VMess, Trojan	VLESS, Reality, VMess, Trojan, Shadowsocks, Socks, HTTP
TUN Mode	Built-in, native	Via inbound dokodemo-door
Routing Flexibility	High, detailed rules (domains, IP, GeoIP, processes)	High, detailed rules (domains, IP, GeoIP)
Performance	Excellent, asynchronous architecture	Excellent, optimized code
Protocol Modernity	Supports the newest protocols (Hysteria2, TUIC)	Current protocols, focus on VLESS/Reality
Ease of Configuration	Single JSON configuration, intuitive sections	Single JSON configuration, requires understanding of V2Ray/Xray architecture
Resource Consumption	Low (often less than 30-50 MB RAM)	Low (often less than 30-50 MB RAM)

Preparing Your VPS and Obtaining Client Configuration

Before proceeding with client setup on your Linux desktop, ensure your VPS is ready and the proxy server's backend is functioning correctly. Valebyte.com offers powerful and reliable dedicated Linux servers and VPS solutions that are ideal for these purposes. Minimal VPS requirements for one to two users are 1 vCPU, 512 MB RAM, and a 10 GB NVMe disk, which will ensure stable server operation with bandwidth up to 100-200 Mbps.

Server-Side Setup

It's assumed that you have already deployed either a sing-box or Xray server on your VPS. If not, you can use our detailed guides:

• For sing-box: sing-box on VPS: A Universal Server for VLESS, Reality, and Hysteria.
• For Xray (with VLESS Reality): Your Own VPN on VPS: VLESS Reality + Xray-core in 10 Minutes.
• For managing multiple Xray users: Marzban on VPS: Xray Panel Installation and Multi-User Management.

Ensure that the server-side component is configured, ports are open in the firewall (e.g., ufw on Ubuntu), and the service itself is running (`systemctl status sing-box` or `systemctl status xray`).

Obtaining Client Configuration

After successfully setting up the server, you will need the client configuration. This is typically provided in one of the following forms:

1. JSON File: A complete JSON file that can be directly used on the client.
2. URL Link: A special link (e.g., vless://..., sb://..., ss://...) that some clients support for automatic import.
3. Individual Parameters: Server IP address, port, UUID, password, encryption method, protocol.

Save this configuration file or these parameters on your Linux desktop. For sing-box and Xray, the JSON format is most commonly used, offering maximum flexibility and control.

Installing sing-box as a Linux VLESS Client on Your Desktop

The process of installing sing-box on a Linux desktop is straightforward and can be accomplished in several ways. We will cover the most common methods for Ubuntu, Debian, and Arch Linux distributions.

Automatic Installation for Ubuntu/Debian/Arch

The official sing-box installation script simplifies the process by automatically detecting your system and installing the necessary files.

Open your terminal and execute the following command:

sudo bash -c "$(curl -L https://sing-box.app/install.sh)"

This script will download the latest stable version of sing-box, unpack it, and install the executable files to /usr/local/bin/sing-box, as well as create the necessary directories for configuration. After running the script, sing-box will be accessible from anywhere in the terminal.

Manual Installation

If you prefer manual control or wish to install a specific version, follow these steps:

1. Download the binary file: Go to the sing-box releases page on GitHub (https://github.com/SagerNet/sing-box/releases) and download the archive corresponding to your architecture (e.g., sing-box-*-linux-amd64.tar.gz for 64-bit systems).
2. Extract the archive:

   wget https://github.com/SagerNet/sing-box/releases/download/v1.8.0/sing-box-1.8.0-linux-amd64.tar.gz
   tar -xzvf sing-box-1.8.0-linux-amd64.tar.gz

   (Replace v1.8.0 with the actual version)
3. Move the executable:

   sudo mv sing-box-*/sing-box /usr/local/bin/

4. Create directories for configuration and logs:

   sudo mkdir -p /etc/sing-box
   sudo mkdir -p /var/log/sing-box
   sudo chown -R $USER:$USER /var/log/sing-box

Verify Installation

After installation by either method, verify that sing-box is accessible and displays its version:

sing-box version

The output should be similar to this:

sing-box 1.8.0 (go1.21.6 linux/amd64)

Basic sing-box Configuration as a System-Wide Proxy

sing-box configuration is done via a JSON file. This file defines how sing-box will accept incoming connections (inbounds), where it will send them (outbounds), and how it will route traffic (routing). Place your configuration file (e.g., config.json) in the /etc/sing-box/ directory.

Example Configuration File (JSON)

Below is a universal configuration example that includes several inbounds (SOCKS5, HTTP, TUN) and an outbound (VLESS with Reality), along with basic routing rules. Replace the placeholders YOUR_VPS_IP, YOUR_VLESS_PORT, YOUR_UUID, YOUR_REALITY_SNI, YOUR_REALITY_PUBLIC_KEY, and YOUR_REALITY_SHORT_ID with the actual data from your VPS.

{
  "log": {
    "level": "info",
    "timestamp": true,
    "output": "/var/log/sing-box/sing-box.log"
  },
  "dns": {
    "servers": [
      {
        "address": "1.1.1.1",
        "detour": "proxy"
      },
      {
        "address": "8.8.8.8",
        "detour": "proxy"
      },
      {
        "address": "prefer_proxy",
        "strategy": "prefer_ipv4",
        "detour": "proxy"
      }
    ],
    "rules": [
      {
        "outbound": "direct",
        "domain_suffix": [
          ".local",
          "localhost"
        ]
      },
      {
        "outbound": "block",
        "domain_suffix": [
          "evil.com"
        ]
      }
    ],
    "strategy": "prefer_ipv4",
    "disable_cache": false,
    "disable_expire": false,
    "independent_cache": false
  },
  "inbounds": [
    {
      "type": "tun",
      "tag": "tun-in",
      "interface_name": "sb-tun0",
      "inet4_address": "172.19.0.1/30",
      "mtu": 9000,
      "auto_route": true,
      "strict_route": true,
      "endpoint_independent_nat": true,
      "stack": "system",
      "sniff": true,
      "sniff_override_destination": true,
      "domain_strategy": "prefer_ipv4"
    },
    {
      "type": "socks",
      "tag": "socks-in",
      "listen": "127.0.0.1",
      "listen_port": 1080,
      "sniff": true,
      "sniff_override_destination": true
    },
    {
      "type": "http",
      "tag": "http-in",
      "listen": "127.0.0.1",
      "listen_port": 1081,
      "sniff": true,
      "sniff_override_destination": true
    }
  ],
  "outbounds": [
    {
      "type": "vless",
      "tag": "proxy",
      "server": "YOUR_VPS_IP",
      "server_port": YOUR_VLESS_PORT,
      "uuid": "YOUR_UUID",
      "flow": "xtls-rprx-vision",
      "tls": {
        "enabled": true,
        "server_name": "YOUR_REALITY_SNI",
        "insecure": false,
        "utls": {
          "enabled": true,
          "fingerprint": "chrome"
        },
        "reality": {
          "enabled": true,
          "public_key": "YOUR_REALITY_PUBLIC_KEY",
          "short_id": "YOUR_REALITY_SHORT_ID"
        }
      }
    },
    {
      "type": "direct",
      "tag": "direct"
    },
    {
      "type": "block",
      "tag": "block"
    }
  ],
  "route": {
    "rules": [
      {
        "outbound": "block",
        "domain_suffix": [
          "evil.com"
        ]
      },
      {
        "outbound": "direct",
        "ip_is_private": true
      },
      {
        "outbound": "direct",
        "domain_suffix": [
          "valebyte.com",
          "yandex.ru",
          "google.com"
        ]
      },
      {
        "outbound": "proxy",
        "domain_strategy": "prefer_ipv4",
        "rule_set": [
          "geosite-cn"
        ],
        "domain_suffix": [
          "cn"
        ]
      },
      {
        "outbound": "proxy",
        "protocol": [
          "udp",
          "tcp"
        ],
        "rule_set": [
          "geoip-cn",
          "geoip-ru"
        ]
      },
      {
        "outbound": "proxy"
      }
    ],
    "rule_set": [
      {
        "type": "remote",
        "tag": "geosite-cn",
        "url": "https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/release/geosite/cn.srsr",
        "format": "srsr",
        "update_interval": "24h"
      },
      {
        "type": "remote",
        "tag": "geoip-cn",
        "url": "https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/release/geoip/cn.srsr",
        "format": "srsr",
        "update_interval": "24h"
      },
      {
        "type": "remote",
        "tag": "geoip-ru",
        "url": "https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/release/geoip/ru.srsr",
        "format": "srsr",
        "update_interval": "24h"
      }
    ],
    "default_outbound": "proxy",
    "domain_strategy": "prefer_ipv4"
  }
}

TUN Mode: Global VPN Tunnel

TUN mode ("type": "tun" in inbounds) is the most convenient way to use sing-box as a system-wide proxy, effectively turning it into a full-fledged VPN client. It creates a virtual network interface (sb-tun0 in the example) through which all or part of the system's traffic is routed. This eliminates the need to configure a proxy in every application.

• "interface_name": "sb-tun0": The name of the TUN interface to be created.
• "inet4_address": "172.19.0.1/30": The local IP address for the TUN interface. Ensure this subnet does not conflict with your local network.
• "auto_route": true: Automatically adds routes to redirect traffic to the TUN interface.
• "strict_route": true: Ensures that all traffic passes through the TUN.
• "stack": "system": Uses the system's network stack, which provides better compatibility.

For proper DNS operation in TUN mode, sing-box can intercept requests and direct them through the proxy. In the "dns" section, you can specify remote DNS servers (e.g., 1.1.1.1, 8.8.8.8) with "detour": "proxy" to prevent DNS leaks.

System Proxy: SOCKS5 and HTTP

If TUN mode is not suitable for some reason (e.g., you only need to proxy specific applications or you are using a particular network configuration), sing-box can operate as a traditional SOCKS5 or HTTP proxy.

• "type": "socks": Opens a SOCKS5 proxy on 127.0.0.1:1080.
• "type": "http": Opens an HTTP proxy on 127.0.0.1:1081.

These ports can be used to configure the proxy in system settings (for GNOME/KDE) or for individual applications via environment variables:

export http_proxy="http://127.0.0.1:1081"
export https_proxy="http://127.0.0.1:1081"
export all_proxy="socks5://127.0.0.1:1080"
your_application

Routing Rules: Flexibility and Control

The "route" section allows for fine-tuning which traffic should go through the proxy ("proxy"), which directly ("direct"), and which should be blocked ("block"). This is critically important for performance and security.

• "ip_is_private": true: All requests to local IP addresses (192.168.x.x, 10.x.x.x, etc.) will go direct. This prevents local traffic from being sent through the VPS.
• "domain_suffix": ["valebyte.com"]: Traffic to specified domains will go direct. Useful for resources that do not require proxying.
• "rule_set": Allows the use of remote rule lists (e.g., GeoIP/GeoSite) for more complex routing. The example uses geosite-cn and geoip-cn/geoip-ru to route traffic to/from these countries through the proxy.
• "default_outbound": "proxy": If no rule is matched, traffic will go through the "proxy". This ensures all unidentified traffic is protected.

Careful configuration of routing rules can significantly improve operational speed (by not proxying unnecessary traffic) and enhance security.

Running and Autostarting sing-box with systemd

For stable and reliable operation of sing-box on your Linux desktop, it is recommended to set it up as a system service using systemd. This ensures automatic startup on system boot, restarts in case of failures, and convenient management.

Creating a systemd Unit File

Create the file /etc/systemd/system/sing-box.service with the following content:

[Unit]
Description=sing-box proxy service
Documentation=https://sing-box.app
After=network.target nss-lookup.target systemd-resolved.service

[Service]
Type=simple
User=root
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW CAP_NET_BIND_SERVICE
ExecStart=/usr/local/bin/sing-box run -c /etc/sing-box/config.json
Restart=on-failure
RestartSec=10
LimitNPROC=500
LimitNOFILE=100000

[Install]
WantedBy=multi-user.target

Explanation of the Unit File:

• Description: A description of the service.
• After=network.target nss-lookup.target systemd-resolved.service: Ensures that sing-box starts after the network is initialized and DNS services are available.
• Type=simple: A simple service type.
• User=root: sing-box, especially in TUN mode, requires root privileges to create network interfaces and modify routes.
• CapabilityBoundingSet and AmbientCapabilities: Limit root privileges to only the necessary network operations (CAP_NET_ADMIN for TUN, CAP_NET_RAW for some protocols, CAP_NET_BIND_SERVICE for opening ports below 1024).
• ExecStart=/usr/local/bin/sing-box run -c /etc/sing-box/config.json: The command to start sing-box, specifying the path to the configuration file.
• Restart=on-failure: Automatically restarts the service if it exits with an error.
• RestartSec=10: A 10-second delay before attempting a restart.
• LimitNPROC, LimitNOFILE: Increase limits on the number of processes and open files, which can be useful for a large number of connections.
• WantedBy=multi-user.target: The service will start when the system enters multi-user mode (the standard mode for most Linux desktops).

Service Management and Autostart

After creating the unit file, execute the following commands in your terminal:

1. Reload the systemd daemon:

   sudo systemctl daemon-reload

2. Enable sing-box to autostart on system boot:

   sudo systemctl enable sing-box

3. Start the sing-box service:

   sudo systemctl start sing-box

4. Check the service status:

   sudo systemctl status sing-box

   The output should indicate that the service is active and running (Active: active (running)).

5. Stop the service (if needed):

   sudo systemctl stop sing-box

6. View logs:

   sudo journalctl -u sing-box -f

Now, sing-box will automatically start with your system, providing continuous traffic proxying.

Installing and Configuring Xray-core as a Linux VLESS Client on Your Desktop

Xray-core, like sing-box, can be installed and configured as a powerful Xray Linux client. The installation process is similar, and configuration is also done via a JSON file.

Installing Xray

To install Xray-core on Ubuntu/Debian/Arch Linux, you can use the official script:

bash -c "$(curl -L https://raw.githubusercontent.com/XTLS/Xray-install/main/install-release.sh)" @ install

This script will install Xray-core to /usr/local/bin/xray and create a default configuration file at /usr/local/etc/xray/config.json. A systemd service for autostart will also be configured.

After installation, check the version:

xray version

Basic Xray Configuration (JSON)

Xray configuration is also a JSON file. Below is an example for VLESS with Reality, including inbounds for SOCKS, HTTP, and TUN mode (via dokodemo-door), as well as basic routing rules. Replace the placeholders with your server data.

{
  "log": {
    "loglevel": "info",
    "access": "/var/log/xray/access.log",
    "error": "/var/log/xray/error.log"
  },
  "dns": {
    "servers": [
      "1.1.1.1",
      "8.8.8.8",
      {
        "address": "1.1.1.1",
        "domains": [
          "geosite:cn"
        ],
        "expectIP": [
          "geoip:cn"
        ]
      }
    ]
  },
  "inbounds": [
    {
      "port": 1080,
      "listen": "127.0.0.1",
      "protocol": "socks",
      "settings": {
        "auth": "noauth",
        "udp": true
      },
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls"
        ]
      },
      "tag": "socks-in"
    },
    {
      "port": 1081,
      "listen": "127.0.0.1",
      "protocol": "http",
      "settings": {
        "udp": true
      },
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls"
        ]
      },
      "tag": "http-in"
    },
    {
      "port": 12345,
      "listen": "127.0.0.1",
      "protocol": "dokodemo-door",
      "settings": {
        "network": "tcp,udp",
        "address": "1.1.1.1",
        "port": 53
      },
      "tag": "tun-in"
    }
  ],
  "outbounds": [
    {
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "YOUR_VPS_IP",
            "port": YOUR_VLESS_PORT,
            "users": [
              {
                "id": "YOUR_UUID",
                "flow": "xtls-rprx-vision"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "dest": "YOUR_REALITY_SNI:443",
          "fingerprint": "chrome",
          "serverNames": [
            "YOUR_REALITY_SNI"
          ],
          "publicKey": "YOUR_REALITY_PUBLIC_KEY",
          "shortId": "YOUR_REALITY_SHORT_ID"
        }
      },
      "tag": "proxy"
    },
    {
      "protocol": "freedom",
      "tag": "direct"
    },
    {
      "protocol": "blackhole",
      "tag": "block"
    }
  ],
  "routing": {
    "domainStrategy": "AsIs",
    "rules": [
      {
        "type": "field",
        "ip": [
          "geoip:private"
        ],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "domain": [
          "valebyte.com",
          "yandex.ru"
        ],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "domain": [
          "geosite:cn"
        ],
        "outboundTag": "proxy"
      },
      {
        "type": "field",
        "ip": [
          "geoip:cn",
          "geoip:ru"
        ],
        "outboundTag": "proxy"
      },
      {
        "type": "field",
        "inboundTag": [
          "tun-in"
        ],
        "outboundTag": "proxy"
      },
      {
        "type": "field",
        "outboundTag": "proxy"
      }
    ]
  }
}

Xray Configuration Features:

• "protocol": "vless": Uses the VLESS protocol, which is one of the most efficient.
• "security": "reality": Activates Reality obfuscation for maximum stealth.
• TUN Mode in Xray: Implemented via the inbound dokodemo-door. For it to work, you need to additionally configure system routing (e.g., using iptables) to redirect all traffic to 127.0.0.1:12345 (the dokodemo-door port). This is a more complex setup compared to native TUN in sing-box. An example of routing configuration for Xray's TUN mode might look like this:

  sudo iptables -t nat -A OUTPUT -p tcp -d 0.0.0.0/0 -j REDIRECT --to-ports 12345
  sudo iptables -t nat -A OUTPUT -p udp -d 0.0.0.0/0 -j REDIRECT --to-ports 12345
  # Exclusions for local networks
  sudo iptables -t nat -I OUTPUT -p tcp -d 192.168.0.0/16 -j RETURN
  sudo iptables -t nat -I OUTPUT -p udp -d 192.168.0.0/16 -j RETURN
  # ... and so on for other private IP ranges

  This significantly complicates the setup and requires careful attention.
• "routing": Routing rules are similar to sing-box but may have slightly different syntax.

Autostarting Xray with systemd

The official Xray installation script will already configure the systemd service xray.service. You only need to ensure it is enabled and running:

sudo systemctl enable xray
sudo systemctl start xray
sudo systemctl status xray

If you installed Xray manually, create a file /etc/systemd/system/xray.service (similar to sing-box, but with ExecStart=/usr/local/bin/xray run -c /usr/local/etc/xray/config.json) and perform daemon-reload, enable, start.

Optimization and Verification: DNS Leaks and Performance

After configuring the client, it's critically important to ensure its correct operation, absence of leaks, and optimal performance.

Checking for DNS Leaks

DNS leaks occur when DNS requests are sent directly to your ISP instead of through the proxy tunnel, revealing your online activity. This undermines the purpose of using a proxy.

1. Open a browser (preferably in private mode to avoid caching).
2. Go to a DNS leak test website:
   • dnsleaktest.com
   • ipleak.net
3. Run a standard or extended test.

Expected result: You should see the IP addresses of the DNS servers specified in your sing-box/Xray configuration (e.g., 1.1.1.1, 8.8.8.8) or your VPS provider's DNS servers, but under no circumstances the DNS servers of your home internet provider.

How to fix DNS leaks:

• Check the "dns" section in your sing-box/Xray configuration: Ensure that all DNS servers are directed via "detour": "proxy" (for sing-box) or are within "outbounds" that go through the proxy (for Xray).
• Use systemd-resolved: If you are using TUN mode, ensure your /etc/resolv.conf points to 127.0.0.53, and systemd-resolved is configured to use DNS servers provided by sing-box/Xray through the TUN interface. In some cases, you might need to disable systemd-resolved and use a static /etc/resolv.conf with public DNS.
• Force DNS through proxy: In some configurations, you can use an inbound dokodemo-door in Xray or a dns inbound in sing-box to capture all DNS requests and redirect them through the proxy.

Performance

Performance depends on both the client and the VPS server-side. On the client side, sing-box and Xray consume minimal resources (typically 20-50 MB RAM and negligible CPU usage), having no significant impact on overall system performance.

To assess performance:

• Speedtest: Use online services like speedtest.net, or CLI tools (e.g., speedtest-cli) to measure download/upload speeds and ping.
• Ping: Check ping to remote servers to evaluate latency.

Factors influencing VPS performance are detailed in the article NVMe, RAM, or Network: What Really Matters for a VPS for Proxy and VPN. For effective proxying, a high-speed network port (1 Gbps and above) and low latency to the VPS are key.

For 50 concurrent users actively using the proxy for web browsing and streaming, 4 vCPU, 8 GB RAM, and an 80 GB NVMe disk are sufficient.

Users	vCPU	RAM	Disk	Port	Estimated Price
1-5 (light browsing)	1	512 MB	20 GB SSD	100 Mbps	$3-5/mo
5-15 (active browsing, light streaming)	2	1 GB	40 GB NVMe	500 Mbps	$7-10/mo
15-50 (active browsing, HD streaming)	2-4	2-4 GB	80 GB NVMe	1 Gbps	$15-25/mo
50-100 (intensive traffic, 4K streaming)	4-6	8-16 GB	160 GB NVMe	1-10 Gbps	$30-60/mo

Desktop Integration: GNOME and KDE

After configuring sing-box or Xray as a system-wide proxy, it's important to properly integrate it with your Linux desktop so that applications automatically use the proxy or TUN interface.

Configuring System Proxy (SOCKS5/HTTP)

If you are using SOCKS5 or HTTP inbound, you need to specify the system proxy settings.

GNOME (Ubuntu, Fedora, Debian with GNOME)

1. Open Settings.
2. Navigate to the Network section.
3. Find Network Proxy and click the gear icon.
4. Select Manual mode.
5. Specify:
   • SOCKS Host: 127.0.0.1, Port: 1080
   • HTTP Proxy: 127.0.0.1, Port: 1081
   • HTTPS Proxy: 127.0.0.1, Port: 1081
6. Click Apply.

After this, most applications that use system proxy settings (web browsers, package managers like apt) will work through your sing-box/Xray client.

KDE Plasma (Kubuntu, Manjaro KDE, Neon)

1. Open System Settings.
2. Navigate to the Connections section.
3. Select Proxy.
4. Choose Manually Specify Proxy Settings mode.
5. Specify:
   • SOCKS Host: 127.0.0.1, Port: 1080
   • HTTP Proxy: 127.0.0.1, Port: 1081
   • HTTPS Proxy: 127.0.0.1, Port: 1081
6. Click Apply.

Proxy Exclusions

In both GNOME and KDE proxy settings, there is a field for exclusions (e.g., "Do not use proxy for"). Here you can add local networks (localhost, 127.0.0.1, 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12) and domains that should bypass the proxy. This complements the routing rules in sing-box/Xray and increases flexibility.

Using Only for Specific Applications

If you don't need a system-wide proxy but only for specific applications, there are several approaches:

1. Environment Variables: For CLI applications or programs that support http_proxy, https_proxy, all_proxy variables, you can launch them like this:

   HTTP_PROXY="http://127.0.0.1:1081" HTTPS_PROXY="http://127.0.0.1:1081" firefox

2. proxychains-ng: This utility allows you to force any application to use a SOCKS5 or HTTP proxy. Install it:

   sudo apt install proxychains4 # for Debian/Ubuntu
   sudo pacman -S proxychains-ng # for Arch

   Configure the /etc/proxychains.conf or ~/.proxychains/proxychains.conf file by adding socks5 127.0.0.1 1080. Then launch applications:

   proxychains4 firefox

3. Process-based Routing Rules (sing-box): sing-box has the unique ability to route traffic based on PID (Process ID) or process name. Add a "rule_set" type rule with "process_name" or "process_path" to the "route" section. This is the most flexible but also the most complex method, as it requires root privileges to identify processes.

For most users leveraging sing-box, TUN mode is the simplest and most effective solution, as it operates at the kernel level and requires no additional configuration in each application or desktop environment.

Frequently Asked Questions

Q: How much RAM do sing-box or Xray consume on the client?

A: Both sing-box and Xray-core are characterized by very low resource consumption. They typically use between 20 and 50 MB of RAM, depending on the configuration and the number of active connections. This makes them ideal for use even on older or low-power Linux desktops without a noticeable impact on system performance.

Q: Can sing-box/Xray be used to proxy only specific applications?

A: Yes, this is possible. You can configure sing-box or Xray as a SOCKS5/HTTP proxy, and then use environment variables (http_proxy, all_proxy) or utilities like proxychains-ng to launch specific applications through this proxy. sing-box also offers advanced routing rules based on process name, providing even greater flexibility.

Q: What is the advantage of TUN mode over a traditional system proxy?

A: TUN mode creates a virtual network interface through which all system network traffic is routed at the kernel level, similar to a full VPN. This means all applications automatically use the proxy without needing individual configuration. A traditional system proxy (SOCKS5/HTTP) requires each application to explicitly support and use these settings, which is not always guaranteed.

Q: How can I verify that my proxy is working and there are no leaks?

A: After starting the client, open a browser and visit IP address and DNS leak test websites, such as dnsleaktest.com or ipleak.net. Your IP address should match your VPS's IP address, and the DNS servers should be remote (e.g., 1.1.1.1, 8.8.8.8) or belong to your VPS provider, not your local internet provider.

Q: Which Linux distributions are supported for sing-box and Xray installation?

A: Both clients work excellently on most modern 64-bit Linux distributions, including Ubuntu, Debian, Arch Linux, Fedora, CentOS, and others. Official installation scripts typically auto-detect the distribution and install the necessary components, significantly simplifying the process for the user.

Conclusion

Configuring sing-box or Xray as a system-wide proxy on your Linux desktop using your own VPS provides a reliable, flexible, and secure solution for managing internet traffic. The choice between sing-box and Xray depends on your protocol preferences and the simplicity of TUN mode setup, but both deliver high performance. It is recommended to use sing-box in TUN mode with systemd autostart for maximum convenience and global traffic protection, while ensuring minimal system resource consumption and robust protection against DNS leaks.