VLESS + REALITY is a VPN-style tunnel from the Xray project. It makes your connection look like an ordinary TLS 1.3 visit to a real, popular website. VLESS carries the traffic and REALITY disguises it. That’s why it keeps working on networks where WireGuard and OpenVPN are quickly detected and blocked.
VLESS: a lightweight transport protocol
VLESS is a stateless proxy protocol used by Xray-core and V2Ray. It has almost no overhead of its own. It authenticates the client with a user ID and forwards the traffic. VLESS doesn’t encrypt anything itself. It relies on the layer underneath, usually TLS, and with REALITY on REALITY’s TLS 1.3 session.
REALITY: borrowing a real website’s identity
Classic TLS-based tunnels like Trojan or VLESS over TLS need their own domain and certificate. Censors learned to spot them through the domain, the certificate, or the way the server answers an unknown visitor. REALITY, introduced in Xray-core in 2023, removes all three tells:
- No certificate of its own. The server is configured with a real target site, such as a large software download domain. A visitor without the right key gets that site’s genuine certificate and content, passed through untouched.
- Key-based authentication hidden in the handshake. Authorised clients prove themselves with an x25519 key exchange and a short ID tucked inside an otherwise normal TLS 1.3 handshake. Only they get the tunnel.
- Browser-identical fingerprint. The client uses uTLS to produce the same TLS ClientHello as a mainstream browser like Firefox or Chrome. The first packet looks like everyone else’s.
To a deep packet inspection system, a REALITY session looks like someone browsing the target website over HTTPS. If the censor actively probes the server, it sees that website too.
Fallback protocols: Hysteria2, Trojan and Shadowsocks
VLESS + REALITY over TCP is the main connection and works well on most home, office and mobile networks. Every HorusVPN location also offers three fallbacks in the same subscription:
- Hysteria2 runs over UDP (QUIC). It is fast on long-distance and lossy links, and often survives networks that throttle or reset long-lived TCP sessions.
- Trojan + REALITY uses the same REALITY disguise as VLESS with a different inner protocol, which helps when a network singles out VLESS.
- Shadowsocks-2022 is a lightweight encrypted proxy over TCP and UDP. It suits routers and older clients.
If one protocol misbehaves on a given network, switching to another for the same country is the first thing to try.
VLESS + REALITY vs other VPN protocols
| Protocol | Encryption | How it looks to DPI | Easy to block? |
|---|---|---|---|
| WireGuard | Noise protocol (ChaCha20) | Distinct UDP handshake | Yes, a fixed signature |
| OpenVPN | TLS-based | Recognisable OpenVPN framing | Yes |
| Shadowsocks | AEAD ciphers | High-entropy random bytes | Increasingly, by entropy analysis |
| Trojan / VLESS + TLS | TLS 1.3 | HTTPS to the provider’s own domain | Possible via domain or certificate |
| VLESS + REALITY | TLS 1.3 | HTTPS to a well-known third-party site | Hard, with no unique domain, certificate or handshake |
What REALITY can’t do
It’s worth being clear about the limits:
- A censor can still block a server’s IP address once it’s identified, for example through traffic volume. Running more than one location and refreshing servers helps.
- Networks in “whitelist mode”, which allow only a short list of approved services, can stop any tunnel, including REALITY.
- REALITY hides that you use a VPN. It doesn’t make you anonymous to the websites you log in to.
How to use VLESS + REALITY
You need a server running Xray-core with REALITY and a client that supports it. HorusVPN subscriptions are built for Happ, a free client for iOS, Android, Windows, macOS and Linux. With HorusVPN you don’t configure anything by hand. You get a subscription link that loads ready-made REALITY profiles into your app.
- Get a VLESS Reality VPN subscription
- Follow the Happ setup guide to add it
- Connect to any of our live locations: 12 locations, 6 live and more coming soon