This tutorial shows how to install VLESS with TCP + REALITY and Cloudflare WARP on a Unix-based VPS using a domain name linked via an A record. The setup runs on port 443, requires no TLS certificates, and provides strong traffic camouflage with high compatibility. Using WARP as outbound improves privacy and stability, making this solution ideal for a fast and secure VLESS server deployment.
This method is clean, easy to update, and recommended for most production environments.
Prerequisites
Before you start, make sure you have:
A fresh Linux servers (minimal install is fine).
- Ubuntu 22.04
- Ubuntu 20.04
- Ubuntu 18.04
- Debian 11
- Debian 10
- CentOS Stream 9
- CentOS Stream 8
- CentOS 7
- Fedora 37
Root access, or a user with sudo.
A static public IP address and working DNS record (FQDN recommended).
Required ports open on your firewall.
1️⃣ DNS setup (domain → server IP)
In your DNS manager (Cloudflare, Namecheap, etc.):
Create an A record:
| Type | Name | Value (IP) | TTL | Proxy |
|---|---|---|---|---|
| A | vpn (or @) | YOUR_SERVER_IP | Auto | DNS only |
⚠️ Important
If using Cloudflare, the cloud must be OFF (gray cloud)
REALITY + TCP does NOT work behind Cloudflare proxy.
Example final domain:
vpn.example.com
2️⃣ Install VLESS + TCP + REALITY + WARP (menu mode)
On your VPS:
bash <(curl -sL https://bit.ly/realityez) -m
3️⃣ Correct menu choices (very important)
When the menu appears, choose:
Core
✅ sing-box (default) or xray
Protocol
✅ VLESS
Security
✅ letsencrypt
Transport
✅ TCP
Port
✅ 443
🔑 Server address (THIS PART)
When it asks for server address / listen address / host:
vpn.example.com
Step 4: Refresh and Upgrade Packages
Update the package list and upgrade your system:
www.google.com
www.cloudflare.com
www.microsoft.com
⚠️ Do NOT use your own domain as SNI
WARP
✅ Enable WARP outbound
get the license of warp from below bot in telegram and confirm then enable it.
https://t.me/generatewarpplusbot
4️⃣ What the final client config should look like
Your generated VLESS link will contain something similar to:
vless://UUID@vpn.example.com:443
sudo /usr/sbin/3CXWizard --cleanup
Key fields:
Address:
vpn.example.comPort:
443Network:
tcpSecurity:
letsencryptSNI:
www.google.comReality public key: auto-generated
Fingerprint: chrome (default)
✅ This is 100% correct
5️⃣ Why this works (and is safe)
The domain resolves to your IP (A record)
REALITY uses:
Domain → IP only for routing
Fake SNI for TLS camouflage
Your real domain is never exposed in TLS handshake
WARP handles outbound traffic
This is the recommended production setup.
