This article answers the question “How do you configure a WS+TLS node?” It explains how to correctly enter the details of a V2Ray/VLESS/VMess WS+TLS node in clients such as Clash, v2rayN, and sing-box, and why your IP, DNS, and browser environment can affect connection success.
1. Understand the information required for a WS+TLS node
WS is the WebSocket transport, and TLS is the encryption layer. These nodes are commonly disguised as HTTPS traffic. You’ll usually receive a share link or subscription link, though you may also be given parameters to enter manually. The key fields are server address, port, UUID or user ID, protocol, WS transport, TLS setting, SNI, Host, and Path.
- Address: Can be a domain name or an IP address; for most WS+TLS nodes, using a domain name is recommended.
- Port: Commonly 443, but follow the details provided by your node provider.
- Path: For example, /abc or /ray. It must match exactly.
- Host/SNI: Usually the node’s domain name. An incorrect value can cause the TLS handshake to fail.
If you’re using the free nodes provided on this site, we recommend copying the complete subscription or share link to reduce the chance of errors when entering parameters manually.
2. Importing and manually configuring a node
- Install a client: On Windows, you can use v2rayN or Clash Verge; on Android, v2rayNG or sing-box; on iOS, choose a client that supports VLESS/VMess.
- Import a subscription: Find “Subscription Management” or “Configuration,” paste in the subscription link, and click Update.
- Import a single node: Copy the vmess://, vless://, or Clash YAML snippet, then select “Import from clipboard” in the client.
- Enter the details manually: Select VLESS or VMess for the protocol, WS for transport, and enable TLS. Enter the port, UUID, Path, Host, and SNI as specified in the node details.
- Save the configuration and test the latency. Choose an available node, enable system proxy or VPN mode, then open a browser and visit a test site.
Note: Path, Host, and SNI are the fields most likely to be entered incorrectly. In particular, don’t omit the leading slash in Path or change Host to an IP address without a good reason.
3. How IP, DNS, and your browser environment are related
WS+TLS nodes generally rely on domain certificates. If you change the server address to an IP, the certificate’s domain may no longer match, causing the connection to fail. Some clients allow you to enter an IP as the address and a domain as SNI, but we don’t recommend changing these values unless the node instructions explicitly say to.
DNS affects domain name resolution. If your local DNS is poisoned or not working correctly, the node’s domain may resolve to the wrong IP. You can enable remote DNS or DoH in the client, or change your system DNS to a common public DNS provider and test again. Clash and sing-box users should also check their rule mode to make sure DNS requests are routed through the proxy.
Your browser environment can also affect the results. With the proxy enabled, browser proxy extensions, privacy extensions, or a custom DNS-over-HTTPS setting may bypass the system proxy. When troubleshooting, try an incognito window, disable any extra proxy extensions, and check that the client is showing traffic.
4. Quick troubleshooting for connection failures
- “TLS handshake failed”: Check that TLS, SNI, and Host are configured correctly.
- Connected, but webpages won’t load: Check that system proxy or VPN mode is enabled and that your browser is using the proxy.
- Latency is -1: The subscription may have expired, the node may be unavailable, the port may be blocked, or your local network may be restricting the connection.
- Only some websites won’t load: Switch to Global mode to test, then check your rules and DNS.
Finally, we recommend keeping the original node details and avoiding frequent changes. The key to configuring WS+TLS is ensuring that the domain, certificate, and path all match. With stable DNS and a clean browser proxy setup, the node should usually work as expected.