VLESS WS TLS Setup with Cloudflare CDN on your VPS

What is VLESS over Cloudflare CDN (WebSocket + TLS) and How to Set It Up?

You can set up VLESS over Cloudflare CDN on your VPS with WebSocket and TLS to mask traffic in 30-45 minutes using Xray-core and Nginx, effectively hiding your server's real IP behind Cloudflare's network. This setup allows you to efficiently bypass IP-based blockades, providing an additional layer of privacy and accessibility. Unlike a direct connection where your real IP address is visible, Cloudflare acts as a proxy server, routing traffic through its global network.

The primary goal of using Cloudflare CDN in conjunction with VLESS+WebSocket+TLS is to **mask CDN traffic** and conceal your VPS's true IP address. When you connect to your proxy server, your traffic first goes to one of Cloudflare's many Points of Presence (PoP), and from there, it is redirected to your VPS. To an external observer, such as an internet service provider (ISP), it appears as though you are connecting to a regular website protected by Cloudflare. This significantly complicates blocking your service, as blocking a Cloudflare IP address would affect millions of legitimate websites.

The architecture of Client → Cloudflare → Your VPS offers several advantages:

• Hides the Server's Real IP: Your VPS server becomes inaccessible directly from the internet via its IP address, which enhances security and resilience against DDoS attacks.
• Bypasses IP-based Blockades: Many government censorship systems rely on blacklisting IP addresses. Cloudflare effectively bypasses such blockades because its IP addresses are rarely included in these lists.
• Additional Layer of Protection: Cloudflare provides basic DDoS protection even on its free plans.
• TLS Encryption: All traffic between the client and Cloudflare, as well as between Cloudflare and your VPS, is encrypted using TLS, ensuring data confidentiality.

However, it's important to remember that this setup has its limitations, including potential speed reduction due to routing through Cloudflare and specific CDN usage policies that might be violated with intensive use for VPN traffic. For more details on choosing the optimal VPS for such tasks, you can refer to our article VPN on Your VPS: A Complete Guide 2026.

How VLESS + WebSocket + TLS Works Behind Cloudflare CDN

The operating principle of VLESS + WebSocket + TLS behind Cloudflare CDN is based on multi-layered proxying and encryption. The client establishes a connection with a domain name that points to Cloudflare. Cloudflare accepts this traffic, decrypts it (if full encryption is enabled), and then forwards it to your VPS using the WebSocket protocol over TLS. On the VPS, Nginx acts as a reverse proxy, receiving the encrypted traffic from Cloudflare, decrypting it, and then redirecting the clean WebSocket traffic to Xray-core.

Connection Sequence:

1. Client → Cloudflare: Your VLESS client establishes an encrypted TLS connection with one of the nearest Cloudflare servers. This uses the domain name you've linked to Cloudflare, not your VPS's real IP. The traffic appears as a regular HTTPS request to a website.
2. Cloudflare → Your VPS (Nginx): Cloudflare, upon receiving the traffic, establishes a new TLS connection with your VPS. Depending on your SSL/TLS settings in Cloudflare (Full/Full (strict)), this traffic will also be encrypted. Cloudflare forwards the WebSocket traffic to Nginx, which listens on port 443 on your VPS.
3. Nginx → Xray-core: Nginx on your VPS acts as a reverse proxy. It accepts the incoming TLS connection from Cloudflare, decrypts it, and then redirects the clean WebSocket traffic to the local port where Xray-core is listening (e.g., 127.0.0.1:10000).
4. Xray-core: Xray-core receives the WebSocket traffic, processes it according to the VLESS protocol, and establishes a connection to the target resource (e.g., a website on the internet).

This setup provides effective CDN traffic masking, as an external observer only sees an HTTPS connection to Cloudflare. Using websocket tls vless in this combination makes the traffic virtually indistinguishable from regular web traffic, which is a powerful tool for bypassing censorship.

Preparing Your VPS and Domain for VLESS over Cloudflare Setup

Before proceeding with your vless through cloudflare setup, ensure you have everything you need. This is a critical step that will lay the foundation for stable proxy operation.

VPS Requirements:

For most users, even under moderate load, a VPS with 2 vCPU, 2 GB RAM, and a 40 GB NVMe disk is sufficient. For 50 concurrent users, 4 vCPU, 8 GB RAM, and an 80 GB NVMe disk are adequate.

Choosing a VPS with NVMe drives significantly boosts performance, especially with active use, as detailed in the article NVMe, RAM, or Network: What Really Matters for a VPS for Proxy and VPN.

1. VPS Server: Ensure your VPS runs on a Linux operating system (Debian 11/12 or Ubuntu 20.04/22.04 is recommended). SSH access is mandatory.
2. Domain Name: You will need your own domain name (e.g., `example.com` or a subdomain like `sub.example.com`). This is essential for Cloudflare and TLS certificates to function.
3. Cloudflare Account: Register at Cloudflare.com and add your domain. Set Cloudflare's DNS servers as authoritative for your domain.

Configuring DNS in Cloudflare:

In your Cloudflare domain's dashboard, create an A record pointing to your VPS's IP address.

1. Navigate to the DNS -> Records section.
2. Add a new A record:
   • Type: `A`
   • Name: `sub` (or any other subdomain, e.g., `proxy`, `cdn`, etc.)
   • IPv4 address: `YOUR_VPS_IP`
   • Proxy status: Ensure the orange cloud is enabled (Proxied). This is critically important for CDN operation.

After saving the record, wait a few minutes for the changes to propagate. Your subdomain will now route traffic through Cloudflare to your VPS.

Step-by-Step VLESS + WS + TLS Setup on VPS with Xray and Nginx

This section will guide you through the detailed VLESS ws tls setup on your VPS, including installing necessary components and their configuration.

Installing Xray-core on Your VPS

Xray-core is a powerful tool for implementing various proxy protocols, including VLESS. Installation is quite straightforward.

# Update the system
sudo apt update && sudo apt upgrade -y

# Install necessary utilities
sudo apt install -y curl wget unzip

# Install Xray-core (official script is recommended)
bash -c "$(curl -L https://raw.githubusercontent.com/XTLS/Xray-install/main/install-release.sh)" @ install

After installation, Xray-core will be started as a system service. You can check its status with the command `sudo systemctl status xray`.

Configuring Nginx for WebSocket and TLS Proxying

Nginx will listen for incoming traffic on port 443, terminate the TLS connection from Cloudflare, and forward WebSocket traffic to Xray-core.

# Install Nginx
sudo apt install -y nginx

# Create directories for our site configuration
sudo mkdir -p /etc/nginx/sites-available/
sudo mkdir -p /etc/nginx/sites-enabled/

# Remove default Nginx config if it exists
sudo rm /etc/nginx/sites-enabled/default
sudo rm /etc/nginx/sites-available/default

# Create a new Nginx configuration file
sudo nano /etc/nginx/sites-available/your_domain.conf

Paste the following code into `your_domain.conf`, replacing `your_domain.com` with your subdomain (e.g., `sub.example.com`).

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name your_domain.com; # Replace with your subdomain

    # Ensure your Cloudflare Origin CA certificate is installed in /etc/ssl/nginx/
    # This is important for Full (strict) SSL in Cloudflare
    ssl_certificate /etc/ssl/nginx/your_domain.com.pem;
    ssl_certificate_key /etc/ssl/nginx/your_domain.com.key;

    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers off;

    # Add headers required by Cloudflare
    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Frame-Options DENY;

    # You can add a fake website for masking
    # root /var/www/html;
    # index index.html index.htm;

    location / {
        # If you want to show a fake website, uncomment the following lines
        # try_files $uri $uri/ =404;
        # return 404; # Or 200 if you want an empty page
        
        # Redirect all traffic to Xray if the URL does not match our VLESS path
        # This can be dangerous if you have a legitimate website on this domain.
        # It's better to use a separate subdomain or a specific path for VLESS.
        return 404; # Simply return 404 for all requests except the VLESS path
    }

    location /your_vless_path { # Replace with a unique path, e.g., /panel/path
        if ($http_upgrade != "websocket") {
            return 404;
        }
        proxy_redirect off;
        proxy_pass http://127.0.0.1:10000; # Port where Xray-core is listening
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

After saving the file, create a symbolic link to activate the configuration:

sudo ln -s /etc/nginx/sites-available/your_domain.conf /etc/nginx/sites-enabled/your_domain.conf

Test Nginx syntax and reload it:

sudo nginx -t
sudo systemctl restart nginx

Important Note on SSL Certificates: For the Full (strict) scheme in Cloudflare, you will need an Origin CA Certificate from Cloudflare. You can generate it in the Cloudflare dashboard (SSL/TLS -> Origin Server -> Create Certificate). This certificate is valid for 15 years. Save the key (`.key`) and certificate (`.pem`) in the `/etc/ssl/nginx/` directory (or any other specified in your Nginx config) and update the paths in the Nginx configuration.

Configuring Xray-core for VLESS and WebSocket

Now, let's configure Xray-core to accept VLESS traffic over WebSocket on a local port.

sudo nano /usr/local/etc/xray/config.json

Paste the following configuration, replacing `YOUR_UUID` with a generated UUID (you can generate one with the `xray uuid` command or an online generator), and `your_vless_path` with the same path you specified in the Nginx configuration.

{
  "log": {
    "loglevel": "warning"
  },
  "inbounds": [
    {
      "port": 10000, # This port will be listened to by Nginx
      "listen": "127.0.0.1", # Listen only for local connections from Nginx
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "YOUR_UUID", # Generate your own UUID
            "level": 0
          }
        ],
        "decryption": "none",
        "fallbacks": []
      },
      "streamSettings": {
        "network": "ws",
        "wsSettings": {
          "path": "/your_vless_path", # Must match the path in Nginx
          "headers": {
            "Host": "your_domain.com" # Replace with your subdomain
          }
        }
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom",
      "settings": {}
    },
    {
      "protocol": "blackhole",
      "settings": {},
      "tag": "blocked"
    }
  ]
}

Save the file and restart Xray-core:

sudo systemctl restart xray

Check the status of Xray-core to ensure it's running without errors:

sudo systemctl status xray

Configuring Cloudflare for VLESS Traffic Proxying

Correct Cloudflare configuration is critical for your CDN for VPN server to function.

1. DNS Record: Ensure that the A record for your subdomain (e.g., `sub.example.com`) points to your VPS's IP and has the orange cloud enabled (Proxied).
2. SSL/TLS Mode: Go to the SSL/TLS -> Overview section. Set the mode to "Full (strict)". This ensures that Cloudflare encrypts traffic to your VPS, and your Nginx will use a valid Origin CA Certificate.
3. Firewall Rules: If you encounter issues, ensure Cloudflare is not blocking your traffic. In the Security -> WAF -> Firewall rules section, you can temporarily disable some rules or add exceptions for your IP.
4. Caching Rules: In the Caching -> Configuration section, ensure the caching level for your subdomain is set to "No Query String" or "Standard", or better yet, create a "Bypass Cache" rule for your VLESS path.
5. Page Rules: For better compatibility and performance, and to avoid unnecessary caching, it is recommended to create a Page Rule for your subdomain. Go to Rules -> Page Rules and add a rule:
   • URL: `*your_domain.com/your_vless_path*`
   • Settings: `Cache Level: Bypass`, `Disable Performance`, `Disable Security` (or configure as desired), `SSL: Full (strict)`
   This will help ensure Cloudflare does not interfere with your WebSocket traffic.

Carefully verify that all settings match those specified to ensure the seamless operation of your cloudflare proxy vless.

Configuring Your VLESS + WS + TLS Client

Once the server-side is configured, you need to set up the client application. Examples of clients include V2RayN (Windows), Nekoray (Windows/Linux), Shadowrocket/Streisand (iOS), v2rayNG (Android).

Example client configuration (parameters may vary slightly depending on the application):

• Protocol: VLESS
• Address: `your_domain.com` (your Cloudflare subdomain)
• Port: `443`
• UUID: `YOUR_UUID` (the same one you used in the Xray config)
• Encryption: `none`
• Transport: `WebSocket`
• TLS (Enable TLS): `True`
• SNI: `your_domain.com` (your Cloudflare subdomain)
• Host Header: `your_domain.com` (your Cloudflare subdomain)
• Path: `/your_vless_path` (the same one you used in Nginx and Xray)
• Allow insecure: `False` (if using an Origin CA Certificate)

Ensure all parameters precisely match the server configuration. Incorrect UUID, path, or domain will lead to connection errors. For Android users, detailed setup instructions can be found in the article Your VPS + v2rayNG: Setting up VLESS Reality on Android in 10 minutes.

Limitations and Potential Issues with VLESS over CDN

Despite its effectiveness, using Cloudflare CDN for VLESS traffic proxying has several limitations and potential issues that should be considered.

1. Speed and Performance: Traffic passes through Cloudflare's servers, which can add latency and reduce overall throughput. Speed depends on the load of the Cloudflare PoP servers nearest to you and their routing to your VPS. Cloudflare is not optimized for continuous high-speed tunneling of large data volumes.
2. CDN Terms of Service (ToS): Cloudflare generally discourages the use of its free services for non-HTTP(S) traffic or tunneling. Although VLESS over WebSocket+TLS appears as regular HTTPS traffic, intensive use or detection of atypical activity may lead to proxying being disabled (the orange cloud turning grey) or even domain blocking.
3. Traffic Limits: Cloudflare's free plans do not have hard traffic limits, but excessive use (e.g., several terabytes per month) may raise flags. If you plan to transfer large volumes of data, consider Unmetered VPS vs. Traffic Limit (TB/month) options.
4. Blocking of Cloudflare IP Addresses: In some regions with very strict censorship, entire ranges of Cloudflare IP addresses may be blocked. While rare, this risk exists.
5. No Caching: Cloudflare's caching does not work for VLESS traffic, as it is not static content. All requests still go through to your VPS.
6. Additional Single Point of Failure: Cloudflare adds another node to the chain, which can become an additional point of failure or cause service disruptions.

Understanding these limitations will help you decide if a CDN for VPN server is the right solution for your specific needs. To estimate your server's traffic consumption, it's useful to refer to the calculation of bandwidth and limits on a VPS.

When is VLESS Reality Better Than Cloudflare CDN?

While VLESS over Cloudflare CDN is an effective method for bypassing blockades, there are scenarios where the VLESS Reality protocol offers a more reliable and performant solution. VLESS Reality is a relatively new technology in Xray-core, specifically designed to bypass deep packet inspection (DPI) without relying on third-party CDNs.

Reality works by masquerading as legitimate TLS traffic to a well-known website. It intercepts the client's TLS handshake and redirects it to a target "reflection" server, while creating the appearance of a connection to a real, popular website (e.g., microsoft.com, apple.com). This makes the traffic virtually indistinguishable from regular HTTPS traffic, making it difficult to block even for the most advanced censorship systems.

Advantages of Reality over Cloudflare CDN:

1. DPI Resistance: Reality is much more resilient to advanced DPI because it does not rely on CDN IP addresses, which can be blocked. It creates a fully legitimate TLS fingerprint.
2. Lower Latency and Higher Speed: Traffic flows directly from the client to your VPS (hidden behind Reality), without intermediate CDN nodes. This reduces latency and increases throughput, making the connection faster and more stable.
3. No Dependence on CDN ToS: You do not violate the terms of service of Cloudflare or other CDNs, as you are not using them for proxying. Your server is not exposed to the risk of being blocked by a CDN.
4. Full Control: You have complete control over your server and are not dependent on the policies of third-party companies.
5. Does Not Require a Domain: Reality can work without its own domain name, using only your VPS's IP address and the SNI of a well-known site. This simplifies setup for those without a domain.

When to choose VLESS Reality:

• If you are in a region with very strict censorship where even Cloudflare IP addresses are blocked.
• If you need the highest possible speed and lowest latency.
• If you want to avoid any risks associated with violating CDN ToS.
• If you prefer a more "stealthy" solution that doesn't rely on known infrastructures.

To set up VLESS Reality on your VPS, you can refer to the article Your VPN on VPS: VLESS Reality + Xray-core in 10 minutes, which describes this process in detail. In general, Reality is a more modern and reliable solution for those seeking maximum resistance to blockades and high performance.

Frequently Asked Questions

Here are answers to the most common questions about setting up VLESS over Cloudflare CDN.

Why use Cloudflare CDN for VLESS?

Using Cloudflare CDN for VLESS allows you to hide the real IP address of your VPS server, which is key for bypassing IP-based blockades. Traffic passes through Cloudflare's global network, disguised as a regular HTTPS request, making your VPN server less noticeable to censorship systems. This significantly increases availability and resilience to external attacks, such as DDoS, utilizing Cloudflare's free features.

Which SSL/TLS mode should I choose in Cloudflare?

For optimal operation and security, it is recommended to choose the "Full (strict)" mode in Cloudflare's SSL/TLS settings. This mode ensures that traffic is encrypted not only between the client and Cloudflare but also between Cloudflare and your VPS server. For this, a valid SSL certificate, such as a Cloudflare Origin CA Certificate (which can be obtained for free for 15 years), must be installed on your VPS.

Can Cloudflare block my domain for using VLESS?

Theoretically, Cloudflare can block a domain or disable proxying (the orange cloud) for violating its Terms of Service, which typically prohibit the use of their free services for "tunneling" or non-HTTP(S) traffic. However, since VLESS over WebSocket+TLS appears as regular HTTPS traffic, such cases are rare in practice, especially with moderate use. Nevertheless, for very high traffic volumes or if unusual activity is detected, the risk increases. For such cases, VLESS Reality is a better option.

Do I need a real domain or is an IP address sufficient?

For the VLESS over Cloudflare CDN setup, you absolutely need your own domain or subdomain. Cloudflare operates at the domain name level, proxying traffic specifically for them. Additionally, the TLS certificates used for encryption are tied to the domain name. Using only an IP address will not allow you to leverage the benefits of Cloudflare CDN for masking and bypassing blockades.

What role does Nginx play in this setup?

Nginx acts as a reverse proxy server on your VPS. It accepts incoming encrypted TLS connections from Cloudflare on port 443, terminates SSL (decrypts the traffic), and then redirects the clean WebSocket traffic to a local port (e.g., 127.0.0.1:10000) where Xray-core is listening. Nginx also allows for masking VLESS traffic by adding HTTP headers and, if necessary, displaying a fake website on the root path of your domain, making it appear more like a regular web server.

Conclusion

Setting up VLESS over Cloudflare CDN with WebSocket and TLS on your VPS is a powerful and accessible solution for bypassing internet censorship and hiding your server's real IP address. This setup effectively masks your VPN traffic as regular HTTPS, leveraging Cloudflare's global network. For maximum stability and performance, it is recommended to use a VPS with NVMe drives and sufficient RAM, and to carefully follow all Nginx and Xray-core configuration steps, especially regarding SSL certificates and WebSocket paths.