⚡ XRay: Proper Masking and Fine-Tuning

The settings below are a technical best practice rather than a guarantee: they noticeably reduce how visible your traffic is to DPI and make the server's disguise plausible, but promising a hundred-percent bypass would not be honest.

Re-issue the configs after any change

Changing the port, the masking domain, or the fingerprint invalidates existing configurations. Hand out new ones to your users.

Port: always 443

Keep 443 — the standard port for encrypted web traffic. We disguise the VPN as an ordinary website, and a website on a non-standard port looks odd by itself and breaks the disguise.

Masking domain: look for a neighbour in your subnet

Popular sites such as google.com or github.com actually reduce security: censorship systems see the mismatch — your server's IP (say 15.x.x.x) and Google's real IP (182.x.x.x) live in completely different networks.

The goal is a donor site that resides in the same subnet as your server. The RealiTLScanner utility helps with that.

There is an option without a foreign domain

You can stand up your own site on your own domain and mask behind that — then the IP, the domain and the certificate match by construction: Self-SNI for VLESS + Reality.

Scan only from your own computer

Running the scanner from inside the VPS may look like network scanning to your host and get the server suspended. Work from your home machine.

Realistic expectations

VLESS Reality is popular, so within your host's subnet you will almost certainly find plenty of other XRay users. And bear in mind: Microsoft, VK, Mail.ru, GitHub or Samsung are not going to be hosted on a no-name provider.

Step 1. Prepare the scanner

1. Download a RealiTLScanner release for your system — e.g. RealiTLScanner-windows-amd64.exe or RealiTLScanner-darwin-amd64.
2. Open a terminal in the folder with the file:
   • Windows 11 — right-click empty space in the folder → “Open in Terminal”.
   • Windows 10 — click the folder's address bar, clear the path, type cmd, press Enter.
   • macOS — Cmd + Space, “Terminal”, then type cd (with a space) and drag the folder from Finder into the window.
   • Linux — right-click empty space → “Open in terminal”.

Step 2. Run the scan

Windows:

RealiTLScanner-windows-amd64.exe -addr YOUR_SERVER_IP -thread 5 -timeout 5

Look for ip= and cert-domain= in the output — the latter is the domain to use for masking.

macOS / Linux:

chmod +x RealiTLScanner-linux-64
./RealiTLScanner-linux-64 -addr YOUR_SERVER_IP -thread 5 -timeout 5 | awk '{
  ip=""; sni="";
  for(i=1; i<=NF; i++) {
    if ($i ~ /^ip=/) ip=substr($i, 4);
    if ($i ~ /^cert-domain=/) sni=substr($i, 13);
  }
  if (ip != "" && sni != "") print ip " " sni;
}'

The output lists working sites from the same subnet as your server. Any of them can go into the “masking site” field in AmneziaVPN, with the port left at 443.

Verifying the chosen domain

In a browser

1. Open https://domain_name without a VPN or proxy. The site must load correctly and the browser must show a secure connection with no certificate warnings. That confirms the target server is alive and serving a legitimate TLS certificate.

2. Check the domain's A records with nslookup and make sure the IP from DNS matches the target server's actual IP.

3. After adding the domain in AmneziaVPN, open https://YOUR_VPS_IP in a browser. You should see the ERR_CERT_COMMON_NAME_INVALID warning.

   A different error means the domain is unsuitable

   If the browser shows anything other than ERR_CERT_COMMON_NAME_INVALID, that masking domain automatically does not fit.

4. Confirm that the masking site's certificate (https://domain_name) matches the one XRay serves at https://YOUR_VPS_IP.

Via a Telegram bot

The bot @gig_reality_bot is a convenient way to assess a domain — it returns detailed information about the server. What to look at:

Parameter	Requirement
Port 443 (TCP)	must be open
TLS 1.3	mandatory — Reality specifically mimics modern certificates
HTTP/2	highly desirable, and required in newer versions
Geography and ASN	ideally at least roughly matching your VPS location: do not pick an Australian site if your server is in Germany
Ping from your VPS	always check it; 1–6 ms is ideal
Redirects	if the bot shows a redirect, check the final domain. For example samsung.com leads to www.samsung.com, so check the latter. And a domain behind a CDN is a poor fit for masking

Speeding up TCP: BBR

BBR is a congestion-control algorithm — roughly speaking, a TCP accelerator. A ready-made script enables it:

wget -qO- https://raw.githubusercontent.com/VadimBoev/bbr/main/enable_bbr.sh | bash

Updating the XRay core

Only for a container deployed through AmneziaVPN

Everything below applies to the amnezia-xray container that the AmneziaVPN app deploys. If XRay was installed some other way — by hand, with your own script, or through the 3X-UI panel — the container name and paths differ and these commands will not fit.

The latest check was done with XRay-core v26.3.27.

Compare the versions first — otherwise you may roll back

This procedure installs the latest release core. Recent AmneziaVPN builds may ship a core that is newer than the latest release — a non-release build. Check your current version with the first command and compare it against the latest release: if yours is already newer, there is nothing to update and you would only move backwards.

Exactly which app version this starts from is still being confirmed; presumably 5.0.1.5.

# current core version
docker exec amnezia-xray xray -version

# enter the container
docker exec -it amnezia-xray /bin/bash

# download the latest release core
cd /tmp && wget https://github.com/XTLS/Xray-core/releases/latest/download/Xray-linux-64.zip

# unpack, install, exit
unzip Xray-linux-64.zip && cp xray /usr/bin/xray && exit

# restart the container and check the version
docker restart amnezia-xray && docker exec amnezia-xray xray -version

If XRay stopped connecting

1. Check the core version and update it if needed — see Updating the core.
2. Re-run the domain verification: it may have gone offline, changed its certificate, or moved behind a CDN.
3. If the checks pass, switch the fingerprint from chrome to firefox on the client. This helps most often; how exactly you do it depends on the key format — see the next section.

Switching the fingerprint from chrome to firefox

The edit is always the same — the word chrome becomes firefox — but where you find it differs.

Native XRay format (a .json file)

Open the file in a text editor, find the line "fingerprint": "chrome",, replace chrome with firefox, save, and load the file into AmneziaVPN.

A vless:// link

The simplest case: it is just a string. Find fp=chrome in it, change it to fp=firefox, and add the new link to the app.

An AmneziaVPN key (vpn://)

A vpn:// key is a packed config, so you cannot edit it by hand. There are two ways.

Option 1 — Windows only. Download the official decoder amnezia-vpn/config-decoder (the cfgview.exe file) and run it.

1. Paste the vpn:// link into the top field — the decoded config appears below.
2. Find "fingerprint\": \"chrome\" in the decoded text and change chrome to firefox.
3. The vpn:// link in the top field updates itself — add it to AmneziaVPN.

Option 2 — universal, works anywhere. Open architect.vai-rice.space/mergekeys.

1. Paste your vpn:// key and press the JSON button.
2. In the "last_config" line, find "fingerprint\": \"chrome\" and change chrome to firefox.
3. Export the modified vpn:// — it is copied to your clipboard. Add it to AmneziaVPN.

The 3X-UI panel

Here the fingerprint is the uTLS field: 3X-UI Panel.

Only the first user shows up in the app

This affects very old AmneziaVPN builds: the XRay protocol was installed by an outdated app version. A full reinstall is required — remove XRay from the server through the app (the “Management” menu) and install it again.

Protocol tuning is outside hosting support

We sell a server, not a VPN service. Choosing the masking domain, the fingerprint and the routing rules is on your side — see the scope of responsibility. This page shares what we and the community have collected, but we cannot debug individual configurations.

• Questions about the protocol and its parameters belong in the Amnezia community: Russian chat, English.
• Write to hosting support when the server itself is the problem: it will not power on, is unreachable, or shows Bad State.

Sources

The material on this page comes from Shidla's XRay instructions — thank you for collecting and verifying it.