This guide explains how to configure a WS TLS node. Once you have a VMess/VLESS node using WS+TLS, learn how to enter its details correctly in clients such as Clash, V2RayN, and sing-box. It also explains how your local IP, DNS, and browser setup can affect the connection, helping you avoid common problems like connection failures or being connected but unable to open webpages.
1. Understand the information required for a WS+TLS node
WS is the WebSocket transport, and TLS is the encryption layer. A typical node includes these fields: server address, port, UUID or user ID, transport protocol (ws), TLS toggle, SNI, Host, and Path. The labels may vary slightly between clients, but the fields mean essentially the same thing.
- Address: The node’s domain name or IP address. Use the domain name provided by the service provider whenever possible.
- Port: Commonly 443, but other ports may be used. Enter the value exactly as provided.
- UUID: Your user ID. Make sure there are no extra spaces or missing characters.
- Transport: Select WebSocket / ws.
- TLS: Enable it. If there is an option to skip certificate verification, leave it off to start with.
- SNI/ServerName: Usually the node’s domain name.
- Host: Usually the same as the camouflage domain. If it is included in the subscription, leave it unchanged.
- Path: Must start with /, for example, /ray. Match the capitalization exactly.
2. Configure a WS TLS node in your client
If you have a subscription link, the easiest option is to import it directly. This site also collects some free nodes. When using them, we recommend copying the subscription or full share link to avoid mistakes when entering the details manually.
- Open your client: On Windows, use V2RayN or Clash Verge; on Android, use v2rayNG or Clash Meta; on iOS, use a client that supports the relevant protocol.
- Select “Subscription” or “Import from clipboard,” then paste the subscription link or node share link.
- Update the subscription, then select a node labeled WS, TLS, 443, or ws+tls.
- Choose a proxy mode. Beginners can start with “Rule mode.” If pages won’t open, temporarily switch to “Global mode” to test.
- Enable the system proxy, then test it in your browser by visiting a search engine or a familiar website.
When adding a node manually, check these three fields in particular: Path, Host, and SNI. If even one of them is incorrect, the client may show that it is connected while webpages remain inaccessible.
3. How IP, DNS, and your browser setup affect the connection
Whether a WS TLS node works depends on more than the node itself. Your local network’s public IP, DNS resolution, and browser proxy settings can all affect the outcome.
IP: If your current network restricts certain ports or domains, the node may time out. Try comparing the connection over a mobile hotspot, home broadband, or another Wi-Fi network. It’s normal for the same node to behave differently on different networks.
DNS: If the node address is a domain name, it must first be resolved to an IP address. DNS poisoning or resolution errors can direct the connection to the wrong address. You can enable the client’s built-in DNS or use a trusted system DNS server. For Clash-based clients, keep the rule-based DNS configuration and don’t delete fields such as fake-ip or nameserver without a good reason.
Browser setup: Your browser must use the system proxy or the local proxy port provided by the client. If the browser has another proxy extension installed, it may conflict with the VPN client. To troubleshoot, first disable browser proxy extensions, privacy extensions, and network filtering features in security software, then test again.
4. Checklist for troubleshooting connection failures
- Make sure your system clock is accurate; TLS is sensitive to time settings.
- Make sure TLS is enabled and the transport protocol is set to ws, not tcp or grpc.
- Check that the UUID, port, and Path contain no copied spaces or line breaks.
- If the subscription node has expired, update the subscription or test another node.
- If the client log shows a timeout, the issue is most likely the network, DNS, or an unavailable node. If it shows certificate or handshake errors, check the SNI and certificate verification settings first.
In summary, when configuring a WS TLS node, don’t just check whether it imports successfully. Make sure ws, TLS, SNI, Host, and Path all match. If the connection fails, troubleshoot your IP network, DNS resolution, and browser proxy setup one by one to identify the problem.