Practical guide
How to Set Up Your Own Xray VPN Server (VLESS + REALITY)
Set up your own Xray VPN to help bypass internet censorship and VPN protocol blocking. Install the server with a script and connect your devices using Hiddify.
Tested: Ubuntu server setup, device management, revocation, recovery after a reboot and real VPN connections. Speed tests on two VPS servers reached approximately 850 Mbps download and 900 Mbps upload. Full Hiddify checks on every supported platform, including DNS, IPv6 and disconnect protection, are not complete.
When can this VPN help?
If your usual VPNs no longer connect and censorship keeps websites or apps out of reach, your network may be blocking VPN servers or recognizable VPN protocols. A personal Xray server with VLESS and REALITY is another option to try.
REALITY helps make the connection resemble ordinary secure web traffic, making it harder to identify. This can help on networks that block conventional VPN protocols. It is not a universal fix: a blocked server IP or a network that only allows specific destinations can still prevent a connection.
The script in this guide sets up the server and creates your first connection profile. Install a compatible client, such as Hiddify, and add this profile. You can then turn the VPN on and off with the connection button in the app.
You do not need to buy a domain, obtain a TLS certificate or edit configuration files. Add and revoke device profiles through the script menu.
What speeds did we get?
In our tests with two VPS servers, Xray with VLESS + REALITY delivered approximately 850 Mbps download and 900 Mbps upload. These are the highest VPN speeds we have seen in our testing so far.
Your results may differ. Speed depends on your internet connection, the route between your device, the VPS and the measurement server, and the hosting provider’s network. VPS plans also differ in hardware performance, shared resources and network speed limits; even servers on the same plan can perform differently. These measurements show what we achieved, not a guaranteed speed for every server or connection.
1. Choose a server
This guide is for a clean Ubuntu VPS with a public IPv4 address. You need root access with a password or SSH key, and a Windows, macOS or Linux computer for setup. The installer supports x86_64 and ARM64; our server tests used Ubuntu 26.04.1 on x86_64.
Choose a hosting provider and country for your needs, including the country whose IP address you want and the resources you want to access. Some websites restrict data-center IP addresses, so a server in the right country does not guarantee access to a particular service.
Start with 1 vCPU and 1 GB of RAM. Speed depends on your connection, the route to the VPS, the hosting network and server performance. Plans with the same number of cores and amount of memory can use different processors, share CPU resources differently and impose different network speed limits. A more expensive plan will not necessarily fix a slow route.
Check the included traffic allowance and overage terms, especially for video and large downloads. If your provider has a separate firewall, allow your SSH port and inbound TCP 443.
The scripts use root SSH access. If your provider gives you a different account, arrange root access using its documentation before following this guide. Keep the VPS operating system updated.
2. Check that you can log in
Windows: open PowerShell from Start. macOS: press Command+Space and open Terminal. Linux: open Terminal.
Replace SERVER_IP with your VPS public IPv4 address. Choose the password command or the key command below.
On your first connection, SSH asks you to trust the server key. Compare its fingerprint with the hosting console if available, then type yes. Password characters are not displayed while you type.
After logging in, run exit to return to your computer.
ssh root@SERVER_IPssh -i ~/.ssh/id_ed25519 root@SERVER_IPexitIf SSH cannot connect
Check the server address, login details and VPS status. If your provider uses a different SSH port, replace 2222 below. For a changed server key warning, see the troubleshooting section.
If Windows cannot find ssh, open Start and search for Optional features. Open it, choose View features or Add a feature, search for OpenSSH Client and install it. Then reopen PowerShell. This is a Windows component; you do not need to download it from another website.
ssh -p 2222 root@SERVER_IP3. Download and run the installer
Download the ZIP below and extract it. Open the xray-guide folder containing the scripts.
Windows: in File Explorer, click the address bar of this folder, type powershell and press Enter. Run the Windows command below in the window that opens.
macOS or Linux: open Terminal, type cd followed by a space, drag the xray-guide folder into the window and press Enter. Then run the macOS or Linux command below.
Type the server IP address, then choose 1 — Set up server. If you use an SSH key, enter its path; otherwise press Enter. Give your first connection profile a name, such as my-xray-vpn, or press Enter to use that name.
A profile contains the server address and the credentials your VPN app needs to connect. Start with one profile for this computer. Create a separate one for each additional phone or computer so you can revoke access for one without disconnecting the others.
The launcher uses SSH port 22 first. If the connection times out or is refused, it lets you enter another port. Incorrect input is explained so you can retry. SSH handles your password; the launcher does not save it.
Check the server address in the confirmation and type y to install. Keep the terminal open until it finishes.
The script installs Xray and tests REALITY destinations automatically, starting with www.google.com. If it fails, the script tries www.googletagmanager.com (used by Amnezia), dl.google.com and www.cloudflare.com. You do not need to choose a website: leave the terminal open while the checks run. The script saves the first destination that passes a real VPN connection test, configures the firewall while preserving SSH access, and creates your profile. Your VPN traffic exits through your VPS. Existing installations keep their saved destination.
.\Connect-XrayServer.ps1bash ./connect-xray-server.shIf PowerShell blocks the script
If the error says the file is not digitally signed, run this command in the same folder, then try starting the script again.
Unblock-File -LiteralPath .\Connect-XrayServer.ps1If the error says running scripts is disabled, run these commands, confirm the prompt and try starting the script again. The policy change lasts until you close this PowerShell window.
Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned
Unblock-File -LiteralPath .\Connect-XrayServer.ps1If a policy error remains, keep the error message for troubleshooting.
If no REALITY destination works
The script tries the candidates automatically and reports why each check failed. It does not issue a working profile if none passes. Save those error messages. You do not need to search for another website yourself.
Check the hosting account for network problems. If the errors mention timeouts or DNS failures, ask the provider to check outbound HTTPS and DNS from your VPS. Retry the same launcher after the problem is fixed. If it still fails, use the error text for troubleshooting; do not share passwords or connection links.
README.txt explains the automatic checks and optional custom-hostname settings. A successful server-side test does not guarantee that your internet provider allows the connection. The script does not change the destination of an existing installation or invalidate existing profiles.
4. Find your connection profile
When setup finishes, the script displays your connection link, starting with vless://, and saves it in a text file. Copy the entire link from the terminal or open the file at the path printed by the script. With the default profile name, the file is Xray/SERVER_IP/my-xray-vpn.txt in your home folder.
The link and its QR code grant access to your VPN. Keep them private and do not include them in public screenshots or support requests.
If setup stops, fix the reported problem and rerun the launcher with the same server and device name. Existing device identities are preserved on this installer’s managed server. It refuses to overwrite an unrelated Xray installation.
5. Connect Windows, macOS or Linux
Open the official Hiddify GitHub page using the link below and download the app for Windows, macOS or Linux.
Copy the complete vless:// link shown at the end of setup, or copy it from the saved my-xray-vpn.txt file. Open Hiddify, click + and choose Add from clipboard. Select the imported profile.
Use VPN mode (also called TUN) to send traffic from applications through the VPN, including apps that do not use the system proxy. In system proxy mode, a browser may work through the VPN while another application connects directly.
The official Hiddify guide shows this setting under Settings → Advanced → Config Options → Enable TUN. If your version instead has a connection-mode selector, choose VPN. On Windows, if administrator access is required, fully exit Hiddify, right-click its shortcut and choose Run as administrator. Approve the system permissions requested on macOS or Linux, then press the connection button. Screenshots and separate instructions for each platform will be added later.
For the first connection check, use routing that sends internet traffic through the VPN. Rules that bypass the VPN for selected countries or websites can send those connections directly.
6. Connect iPhone or Android
Run the launcher again and choose Manage devices. Select Add device, enter a name such as my-iphone or my-android, then choose Show QR code and enter that name.
iPhone: install Hiddify from the App Store using the link below. In Hiddify, add a profile by scanning the QR code on your computer, connect and allow the VPN configuration when iOS asks. Availability depends on your App Store region; check that you can install a suitable client before buying a VPS.
Android: install Hiddify from Google Play using the link below. Scan the profile QR code in the app, connect and approve the Android VPN request.
If scanning is unavailable, transfer the link privately and import it from the clipboard. Use a separate profile for each device so you can revoke one without changing the others.
7. Check your connection
Open My IP before and after connecting. With Hiddify connected, the external IPv4 address should be your VPS address, or the hosting provider’s assigned outbound address.
Open the websites and apps you need and check that they are accessible and work correctly.
Check IPv6 as well: the test should not reveal your original provider IPv6 address while you intend to route all traffic through the VPN. This server configuration uses IPv4 for internet exit. The client must route or block IPv6 appropriately; native Hiddify IPv6 behavior has not yet been verified for every platform.
Check DNS routing. DNS requests should not go directly to your provider outside the intended VPN connection. Seeing a third-party resolver in a test is not, by itself, evidence of a leak.
The Connected label alone does not prove that every application is using the VPN. A successful proxy test also does not prove full-device DNS, IPv6 or disconnect protection.
8. Manage your devices
Run the same launcher and choose Manage devices. The menu lets you add a device, show its link or QR code, list profiles, revoke access and check the server.
To revoke access, choose Remove device and enter its name twice. Deleting a profile only inside Hiddify does not revoke the server credentials. A copied link can still be used elsewhere.
Adding or removing a device briefly restarts Xray. Other devices may reconnect, but their profiles stay valid. A name such as my-iphone is just a convenient label: the same profile can be imported on another device. Use separate profiles when you want to control their access independently.
The menu includes Check server. Use it if the VPN stops working: the script checks whether Xray is running, whether its settings are valid and, when a profile exists, whether a test VPN connection works on the server. A successful result means the server-side checks passed. It does not check the internet connection or Hiddify settings on your phone or computer.
.\Connect-XrayServer.ps1 -Server SERVER_IP -Action menubash ./connect-xray-server.sh SERVER_IP menu9. If something does not work
Cannot log in: check the IP address, credentials and VPS status. Use the correct SSH port if your provider changed it.
SSH says REMOTE HOST IDENTIFICATION HAS CHANGED: your computer remembers the identity of the server previously used at this address, but the server is now presenting a different key. This is expected after you reinstall the VPS. Confirm the address and reinstall in your hosting account, and compare the new key fingerprint in the hosting console where available. Only then remove the old saved key with the command below and reconnect. If you did not reinstall the server, ask your hosting provider about the change before accepting a new key.
Setup stopped: follow the installer message. Unsupported systems, a busy port or a failed component download can stop installation. Do not run multiple setups at once.
Connected but websites do not load: select the profile you imported, check that Hiddify is using VPN mode as explained in step 5, and turn off other VPN apps. Then open Manage devices in the script and select Check server. If it reports an error, use that message to investigate the server.
Works on Wi-Fi but not on mobile data: the server is reachable through your Wi-Fi provider, but the mobile operator may filter the connection or have a routing problem. To narrow this down, try a SIM or hotspot from a different mobile operator. Reinstalling Xray does not necessarily solve a provider-specific problem.
Previously worked, now stopped: check that the VPS is running and its traffic allowance has not run out. Run the server check and try another network.
Low speed: check whether your internet connection is also slow with the VPN turned off. If only the VPN is slow, the route to the VPS, hosting network limits or server load may be responsible. Check your hosting traffic allowance and network limits before changing the plan.
The installer adds rules that prevent VPN users from accessing the hosting provider’s private network and cloud service interfaces. It also blocks direct email sending over SMTP ports 25, 465 and 587 to reduce abuse if a profile is shared or stolen. Webmail in a browser still works; sending mail from some email apps may fail while connected.
ssh-keygen -R SERVER_IPFor a custom SSH port, use: ssh-keygen -R "[SERVER_IP]:PORT". Then reconnect and verify the new fingerprint.
10. Backups and updates
You do not need this menu for everyday use. A backup keeps a copy of your server settings and existing device credentials before an update or server reinstall. The connection link alone is not a complete server backup. Updates let you apply fixes included in a newer script bundle.
Choose Back up settings before making changes. The menu saves a private archive on the server and prints its path. Download it to your computer before rebuilding the VPS; a server-side copy will not survive deletion of the server.
Use the command below on your computer, replacing EXACT_FILENAME with the filename printed by the menu. Add -i KEY_PATH for a specific SSH key or -P PORT for a custom SSH port. Keep the downloaded backup private: it contains access keys.
Update to bundled Xray version installs the Xray version included in your script bundle. To use a newer reviewed bundle, download it, run Set up server with your existing profile name to upload the new management script, then choose the update option in the menu. Existing profiles are preserved. Running this option with the same bundle does not fetch newer releases. Ubuntu updates are separate.
Automatic backup restoration will be added later. For now, a backup is useful for manual recovery with technical assistance. If you prefer to set up a replacement server from scratch, create new profiles and import them on your devices.
For everyday use, open Hiddify and connect. The script menu is only needed for device management and server maintenance.
scp root@SERVER_IP:/etc/internetspeed-xray/backups/EXACT_FILENAME.tar.gz .