SNI Routing: Host VPN & Website on One VPS

To host a VPN (e.g., VLESS Reality) and a website on a single VPS, effectively utilizing the occupied port 443, SNI routing with Nginx or sing-box can be implemented, where Nginx, listening on port 443, redirects traffic based on SNI, sending HTTPS requests to the website and other TLS traffic to the VPN server, requiring a minimum of 2 vCPU and 4 GB RAM for stable operation.

Running your own VPN server for secure internet access and hosting a website over HTTPS often presents a conflict on a VPS, as both services typically default to using port 443. Modern technologies, however, offer an elegant and efficient solution through TLS traffic routing. This article details how to configure a VPN and website on a single server, leveraging Nginx or sing-box as an intelligent proxy to split incoming traffic and direct it appropriately, making your setup resilient against Deep Packet Inspection (DPI) systems.

Understanding the 'Port 443 in Use' Issue and the Need for SNI Routing on a VPS

Port 443 is the standard port for the Secure Hypertext Transfer Protocol (HTTPS), used for encrypted data exchange between a web browser and a web server. The vast majority of websites on the internet use HTTPS to ensure data confidentiality and integrity. Simultaneously, modern VPN protocols, such as VLESS Reality, also prefer to use port 443, masking their traffic as regular HTTPS to bypass blocking and DPI systems.

Fundamentals of Port 443 and TLS

When you open a website with an address starting with https://, your browser establishes a connection with the server on port 443. The first stage of this connection is the TLS (Transport Layer Security) handshake, during which the client and server exchange certificates, generate session keys, and establish an encrypted channel. If two different services (e.g., a web server and a VPN) simultaneously attempt to operate on the same IP address and port 443, a conflict will arise, as only one application can "listen" for traffic on a specific port.

How SNI Resolves Port Conflicts on a Single IP Address

Server Name Indication (SNI) is a TLS extension that allows the client (e.g., a browser or VPN client) to specify the hostname it is trying to connect to, even before the TLS handshake is complete. This is critical for servers that host multiple domains on a single IP address, as the server can determine which certificate to send and which website to serve based on the hostname provided in the SNI.

For our scenario, where port 443 is busy with a VPN or web server, SNI routing becomes the key solution. We can configure a single frontend proxy (like Nginx or sing-box) on port 443. This proxy will analyze the SNI header in the incoming TLS traffic:

• If the SNI matches your website's domain (e.g., yourdomain.com), the proxy will forward the traffic to your web server (e.g., Apache, Nginx, Node.js application), which can listen on another internal port (e.g., 8080).
• If the SNI does not match known website domains or has a specific value used by your VPN (e.g., example.com, as specified in your Reality configuration), the proxy will forward the traffic to your VPN server (Xray, sing-box), which will also listen on another internal port.

This approach allows for hosting a website and VPN on a single VPS to coexist, efficiently using one public IP address and port 443, while masking VPN traffic as regular web traffic. This significantly enhances the VPN's resilience against blocking. For a deeper understanding of running a VPN on your own server, we recommend reading VPN on Your VPS: The Complete Guide 2026.

Nginx: The Universal Frontend for Website and VPN SNI Routing

Nginx (Engine-X) is a high-performance HTTP server and reverse proxy, known for its efficiency and flexibility. It is ideally suited for the role of a frontend that will accept all incoming traffic on port 443 and route it based on SNI. Using Nginx not only allows you to host a VPN and website on a single server but also centralizes SSL certificate management and provides an additional layer of security.

How Nginx Handles TLS and SNI

Nginx is capable of terminating the TLS connection, meaning it decrypts incoming encrypted traffic, analyzes it (including the SNI header), and then, if necessary, re-encrypts and forwards it to the backend. This allows Nginx to act as an SSL/TLS gateway. For SNI routing, Nginx uses the ssl_preread_protocol on; directive and the ngx_stream_ssl_preread_module module, which allows it to extract the SNI from an incoming TLS connection before it is fully established.

After extracting the SNI, Nginx can use it to make routing decisions. For example, if the SNI matches your website's domain, traffic is directed to your web server. If the SNI matches the domain used for Reality, traffic is directed to your Xray or sing-box server. If the SNI is absent or does not match any of the rules, a "fallback" to the VPN can be configured, making it more resilient.

VLESS Reality Behind Nginx: General Architecture

The general architecture for the Reality and Nginx combination works as follows:

1. The client (browser or VPN client) establishes a TLS connection with your VPS on port 443.
2. Nginx, listening on port 443, accepts this connection.
3. Nginx uses the ngx_stream_ssl_preread_module module to extract the SNI from the request.
4. • If the SNI matches your website's domain, Nginx proxies the traffic to the internal port where your web server is running (e.g., localhost:8080).
   • If the SNI matches the domain name specified in your Reality configuration (e.g., microsoft.com or apple.com), Nginx proxies the traffic to the internal port where your Xray or sing-box server is running (e.g., localhost:10000).
   • If the SNI does not match any configured domains, Nginx can be set to redirect traffic to the VPN (fallback), which increases VPN reliability.
5. The web server or VPN server processes the traffic and returns the response to the client via Nginx.

This scheme allows for efficient traffic separation, while to an external observer (including DPI), all traffic passing through port 443 appears as regular HTTPS traffic to a legitimate web server, significantly increasing the chances of bypassing blocks.

Preparing Your VPS: Resource Requirements and Initial Setup for SNI Routing

Before proceeding with the configuration, it's important to ensure your VPS has sufficient resources for simultaneously hosting a website and a VPN, and to perform basic operating system setup and install the necessary components.

Minimum VPS Specifications for Hosting a Website and VPN

The choice of VPS depends on the expected load for both the website and the VPN. For a small personal website and a VPN for a few users, the requirements will be minimal, but more resources will be needed for more demanding projects. Valebyte.com offers various plans suitable for any task.

For 50 concurrent users, 4 vCPU, 8 GB RAM, and an 80 GB NVMe disk are sufficient.

Concurrent Users	vCPU	RAM	Disk	Port Speed	Price (approx., $/mo)
1-5 (personal)	1-2	1-2 GB	20-40 GB NVMe/SSD	1 Gbps	$5 - $10
5-20 (small business/blog)	2	2-4 GB	40-60 GB NVMe	1 Gbps	$10 - $20
20-50 (medium project/team)	4	8 GB	80-120 GB NVMe	1 Gbps	$20 - $40
50-100+ (large project)	6-8+	16 GB+	160 GB+ NVMe	1-10 Gbps	$40+

For most scenarios involving hosting a website and VPN on a single VPS, especially with VLESS Reality, a VPS with 2 vCPU and 4 GB RAM on an NVMe disk will be an optimal choice, providing good performance and responsiveness. It's also crucial to consider a stable network connection for uninterrupted operation, so choose a provider with a gigabit port.

Installing Nginx, Xray/sing-box, and Obtaining an SSL Certificate (Let's Encrypt)

After selecting and configuring your VPS, you need to install all components. We will use Ubuntu 22.04 LTS as an example.

1. Update System and Install Nginx:

sudo apt update && sudo apt upgrade -y
sudo apt install nginx -y
sudo systemctl enable nginx
sudo systemctl start nginx

2. Install Certbot for Let's Encrypt:

sudo snap install core; sudo snap refresh core
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

3. Obtain an SSL Certificate for Your Domain:

Ensure your domain (e.g., yourdomain.com) points to your VPS's IP address. Then run:

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

Follow Certbot's instructions. It will automatically configure Nginx to use the certificate. If you are already familiar with Nginx and SSL, you can refer to our guide on Hosting Node.js on VPS: PM2, Nginx, and SSL in 15 Minutes, which details the steps for Nginx SSL configuration.

4. Install Xray or sing-box:

For Xray-core, you can use the official installation script:

bash -c "$(curl -L https://raw.githubusercontent.com/XTLS/Xray-install/main/install-release.sh)" @ install

For sing-box, installation can be done manually or via scripts, as described in the article sing-box on VPS: Universal Server for VLESS, Reality, and Hysteria.

# Пример установки sing-box (для Ubuntu/Debian)
wget https://github.com/SagerNet/sing-box/releases/download/v1.7.0/sing-box-1.7.0-linux-amd64.tar.gz
tar -xvf sing-box-1.7.0-linux-amd64.tar.gz
sudo mv sing-box-1.7.0-linux-amd64/sing-box /usr/local/bin/
sudo chmod +x /usr/local/bin/sing-box
# Создайте service-файл для systemd при необходимости

After installing all components, you can proceed to their configuration.

Nginx SNI Routing Configuration Examples

The key element of our setup is Nginx, which will act as a TLS router. We will configure it to listen on port 443 and redirect traffic based on SNI.

Simple Configuration for Website and VLESS Reality

This Nginx configuration will listen on port 443 and route traffic either to your web server or to Xray/sing-box with Reality. We assume your web server listens on localhost:8080, and the Reality server on localhost:10000.

Create a new Nginx configuration file, for example, /etc/nginx/conf.d/proxy.conf:

# Включаем модуль ssl_preread
stream {
    map $ssl_preread_server_name $backend_name {
        # Домен вашего сайта
        yourdomain.com      website_backend;
        www.yourdomain.com  website_backend;

        # Домен для Reality (должен быть реальным, но не обязательно вашим)
        # Например, microsoft.com, apple.com, google.com
        microsoft.com       vpn_backend;
        apple.com           vpn_backend;

        # Fallback по умолчанию на VPN, если SNI не совпал
        default             vpn_backend;
    }

    upstream website_backend {
        server 127.0.0.1:8080; # Ваш веб-сервер
    }

    upstream vpn_backend {
        server 127.0.0.1:10000; # Ваш Xray/sing-box с Reality
    }

    server {
        listen 443 ssl_preread;
        proxy_pass $backend_name;
        proxy_socket_keepalive on;
    }
}

# HTTP-сервер для Certbot и перенаправления HTTP на HTTPS
http {
    server {
        listen 80;
        listen [::]:80;
        server_name yourdomain.com www.yourdomain.com;
        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl;
        server_name yourdomain.com www.yourdomain.com;

        ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
        ssl_prefer_server_ciphers on;
        
        # Настройка HTTP/2
        http2 on; # Важно для производительности сайта

        location / {
            proxy_pass http://127.0.0.1:8080; # Перенаправляем на ваш веб-сервер
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
}

Remember to replace yourdomain.com with your actual domain, and microsoft.com/apple.com with the domains you use for Reality. Reality domains must be real and active websites to successfully deceive DPI. Save the file, test the Nginx configuration with the command sudo nginx -t, and reload Nginx: sudo systemctl reload nginx.

Advanced Configuration with Fallback for Xray/sing-box

In the configuration above, we already implemented a fallback using default vpn_backend;. This means any traffic on port 443 whose SNI does not match your website or Reality domains will be directed to the VPN. This is very useful, as some older clients or specific requests might not send SNI or send an unknown SNI. This setup makes VLESS behind Nginx more robust.

Additionally, to enhance security and prevent leaks, you can configure a firewall (e.g., UFW) to block all ports except 80 and 443:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

This ensures that only Nginx is externally accessible on standard web ports, while all internal services (web server on 8080, VPN on 10000) are only accessible locally.

VLESS Reality (Xray/sing-box) Configuration for Nginx SNI Routing

After configuring Nginx, you need to adapt the configuration of your VPN server (Xray or sing-box) to work behind this proxy. They should listen on an internal port (e.g., 10000) and be configured to receive traffic that Nginx will forward to them.

Configuring Xray-core with Reality Inbound and SNI

For Xray-core, the Reality configuration with a VLESS inbound protocol must be set up to listen on an internal port and expect traffic that has already passed through Nginx. In this case, Xray will not directly listen on port 443 but will receive traffic from Nginx.

Example /usr/local/etc/xray/config.json file:

{
  "log": {
    "loglevel": "warning"
  },
  "inbounds": [
    {
      "port": 10000, # Внутренний порт, который слушает Xray
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "ВАШ_UUID", # Сгенерируйте уникальный UUID
            "flow": "xtls-rprx-vision"
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "dest": "microsoft.com:443", # Домен целевого сайта для Reality
          "xver": 0,
          "serverNames": [
            "microsoft.com", # Домены, которые Nginx перенаправляет на VPN
            "apple.com"
          ],
          "privateKey": "ВАШ_ПРИВАТНЫЙ_КЛЮЧ", # Сгенерированный приватный ключ Reality
          "minClientVer": "",
          "maxClientVer": "",
          "maxTimeDiff": 0,
          "shortIds": [
            "ВАШ_КОРОТКИЙ_ID" # Сгенерированный короткий ID
          ]
        }
      },
      "sniffing": {
        "enabled": true,
        "destOverride": ["http", "tls"]
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom",
      "settings": {}
    },
    {
      "protocol": "blackhole",
      "settings": {},
      "tag": "blocked"
    }
  ]
}

Replace ВАШ_UUID, ВАШ_ПРИВАТНЫЙ_КЛЮЧ, ВАШ_КОРОТКИЙ_ID with your generated values. You can use the xray x25519 command to generate Reality keys and a short ID. Note that dest in realitySettings must be a real domain that will be used for TLS fingerprinting. serverNames must match those you specified in Nginx for routing to the VPN. More detailed information on quickly setting up VLESS Reality can be found in the article Your Own VPN on VPS: VLESS Reality + Xray-core in 10 Minutes.

Using sing-box as a Universal Proxy with Reality

Sing-box is a more modern and versatile solution that also works perfectly with the Reality and Nginx combination. Its configuration for VLESS Reality is similar to Xray but has its own specifics. Sing-box will also listen on an internal port.

Example /etc/sing-box/config.json file:

{
  "log": {
    "level": "info"
  },
  "inbounds": [
    {
      "type": "vless",
      "listen": "127.0.0.1",
      "listen_port": 10000, # Внутренний порт, который слушает sing-box
      "users": [
        {
          "uuid": "ВАШ_UUID",
          "flow": "xtls-rprx-vision"
        }
      ],
      "tls": {
        "enabled": true,
        "reality": {
          "enabled": true,
          "handshake_server": "microsoft.com:443", # Домен целевого сайта для Reality
          "server_names": [
            "microsoft.com", # Домены, которые Nginx перенаправляет на VPN
            "apple.com"
          ],
          "private_key": "ВАШ_ПРИВАТНЫЙ_КЛЮЧ",
          "short_id": ["ВАШ_КОРОТКИЙ_ID"]
        }
      },
      "sniff": {
        "enabled": true,
        "route_only": true,
        "override_destination": true
      }
    }
  ],
  "outbounds": [
    {
      "type": "direct"
    },
    {
      "type": "block",
      "tag": "block"
    }
  ]
}

Similarly, replace all placeholders. For generating keys and IDs in sing-box, you can use the command sing-box generate reality-keypair. After saving the configuration, restart the Xray or sing-box service. For example, for Xray: sudo systemctl restart xray. For sing-box, if you created a systemd service, the command will be similar.

Nginx + Reality: Advantages and Survivability Against DPI

The combination of Nginx with the Reality protocol in Xray or sing-box is one of the most effective ways to bypass Deep Packet Inspection (DPI) systems and censorship. This combination provides a high level of obfuscation and resilience.

Masking VPN Traffic as Regular HTTPS

The key advantage of the Reality and Nginx combination is that all traffic passing through port 443 appears as a regular HTTPS connection to a legitimate website. This is achieved in several ways:

1. Using Port 443: The standard port for HTTPS, which is rarely completely blocked.
2. SNI Routing: Nginx directs traffic based on SNI, which in the case of a VPN points to a real, popular domain (e.g., microsoft.com).
3. TLS Fingerprint (Reality): The Reality protocol is specifically designed to mimic the TLS fingerprints of well-known web servers (e.g., Google, Apple, Microsoft), making it virtually indistinguishable from regular HTTPS traffic for DPI.
4. No SSL Certificate on VPN: In Reality, the VPN server does not use its own SSL certificate, eliminating one of the common detection points for VPNs.

For DPI, which analyzes packet headers, SNI, and TLS fingerprints, the connection to your server will appear as a normal request to microsoft.com or apple.com, making it significantly harder to identify as VPN traffic. This allows the VPN and website on a single server to remain undetected.

Comparison with Other Anti-Censorship Methods

Compared to other protocols and methods, the Nginx + Reality combination offers several advantages:

• OpenVPN/IPsec: These protocols often use specific ports and traffic patterns that are easily detected and blocked by DPI.
• Shadowsocks/V2Ray (without Reality): Although they can use TLS, their TLS fingerprints might be unique and expose them as VPNs. Reality actively addresses this issue.
• Proxies on Non-Standard Ports: Simply changing the VPN port to 80 or another non-standard port often leads to quick blocking, as these ports are rarely used for legitimate TLS traffic.
• WireGuard: An excellent protocol, but its UDP traffic and specific handshake can be detected and blocked in aggressive environments.

Thanks to its obfuscation, SNI routing on a VPS in conjunction with Reality provides high survivability, making it a preferred choice for users in regions with active internet censorship.

Common Pitfalls and Troubleshooting for SNI Routing on a VPS

Despite all its advantages, setting up a VPN and website on a single server via SNI routing can encounter some difficulties. Knowing these potential issues will help you avoid or quickly resolve them.

SSL Certificate and HTTP/2 Issues

1. Incorrect Certificate Paths: Ensure that the paths to fullchain.pem and privkey.pem in your Nginx configuration (for the HTTP part) are correct and point to valid Let's Encrypt certificates. Certbot usually places them in /etc/letsencrypt/live/yourdomain.com/.
2. Expired Certificates: Let's Encrypt certificates are valid for 90 days. Certbot typically sets up automatic renewal, but sometimes it might fail. Regularly check the status with the command sudo certbot renew --dry-run.
3. HTTP/2 Conflict: Nginx supports HTTP/2 (http2 on;), which is important for fast website loading. Ensure that your web server, if proxied by Nginx, also works correctly with this protocol or that Nginx converts HTTP/2 to HTTP/1.1 when proxying to the backend. Issues can arise if the backend does not support HTTP/2, and Nginx is configured to strictly use it for proxying. In our example, Nginx proxies to an HTTP/1.1 backend (proxy_pass http://127.0.0.1:8080;), so there should be no problems.
4. Incorrect Reality Domain: The domain used for Reality (in dest and serverNames) must be real and accessible from the internet for Reality to successfully mimic its TLS fingerprint. Using a non-existent or blocked domain can lead to connection problems.

When a Second VPS Makes More Sense: Cost and Risk Analysis

While hosting a website and VPN on a single VPS is cost-effective and technically feasible, sometimes using two separate VPS instances is simpler and more reliable.

Recommendations for choice:

1. Project Scale: If you have a very high-traffic website (thousands of visitors per day) or a VPN for a large number of active users (hundreds), separating services onto two VPS instances (one for the website, one for the VPN) will provide better performance and stability for each.
2. Blocking Risks: In environments with very aggressive censorship, where blocks occur frequently and based on various indicators, separating services can reduce the risk of complete unavailability. If the VPN IP is blocked, your website will remain accessible on another IP.
3. Configuration Complexity: Setting up SNI routing requires specific technical knowledge. If you are not confident in your skills or don't have time for debugging, two separate VPS instances will be easier to manage.
4. Budget: The price difference between one powerful VPS and two basic VPS instances might be negligible. For example, two VPS instances at $5/mo might offer more flexibility than one at $10/mo. Valebyte.com offers affordable plans that allow you not to be limited to a single server.
5. Management Convenience: Using management panels like Hiddify (see Hiddify on VPS: Your Own Panel and Subscriptions for VLESS Reality) simplifies VPN management, but the website will still require separate configuration.

Ultimately, the decision on the number of VPS instances depends on your needs, budget, and technical expertise. For most individual users and small projects, a single VPS with proper SNI routing configuration will be the optimal solution.

Frequently Asked Questions

Here we answer the most common questions regarding hosting a VPN and a website on a single server.

Can I use VLESS Reality without Nginx if I don't have a website?

Yes, VLESS Reality can operate directly on port 443 without Nginx if you don't need to host a website. In this scenario, Xray or sing-box will directly listen on port 443, simplifying the configuration as SNI routing is not required. However, for DPI circumvention, it is still critical to use a real domain in your Reality settings, such as microsoft.com, to make the traffic appear as a regular HTTPS request.

Which domains are best to use for Reality's dest and serverNames?

For Reality, it's recommended to use domains of large, popular, and reputable services, such as microsoft.com, apple.com, google.com, amazon.com, or other major cloud providers. These domains have stable TLS fingerprints that are well-known and rarely blocked. Avoid using obscure or suspicious domains, as this may raise suspicion with DPI. For stable Reality operation, several such domains are required.

Will my website slow down due to the VPN running on the same VPS?

With proper configuration and sufficient VPS resources, the VPN's impact on website performance will be minimal. Nginx efficiently routes traffic, and modern VPN protocols like VLESS Reality are optimized for low resource consumption. If your VPS has 2 vCPU and 4 GB RAM, there will be no slowdowns for a small website and a few VPN users. However, for high-traffic projects, a more powerful VPS or separating the services is recommended.

Do I need to open additional ports besides 80 and 443?

In most cases, no. The Nginx and SNI routing setup allows all services to operate on port 443. Your web server and VPN server will listen on internal ports (e.g., 8080 and 10000) that should not be externally accessible. Thus, only ports 80 (for HTTP to HTTPS redirection) and 443 remain open to the outside world, enhancing security and reducing your server's 'visibility'.

Can I use a different web server instead of Nginx, such as Apache?

Technically yes, but Nginx is the preferred choice for this task due to its high performance and native support for the ngx_stream_ssl_preread_module for stream-level SNI routing. Apache can also be configured for proxying, but its configuration for TLS handshake-based SNI routing might be more complex and less efficient than Nginx. For most scenarios, especially when high speed and flexibility are required, Nginx is the optimal solution.

Conclusion

Hosting a VPN (VLESS Reality) and a website on a single VPS using port 443 is not only feasible but also a highly effective solution for bypassing censorship by masking VPN traffic as regular HTTPS. Intelligent SNI-based routing via Nginx or sing-box allows these services to coexist, ensuring high VPN survivability. For most users, especially those with small to medium projects, this approach offers an optimal balance between resource efficiency and reliability, requiring only a basic VPS with 2 vCPU and 4 GB RAM.