This article explains how to configure a WS TLS node and why IP, DNS, and your browser environment can affect the connection. It’s intended for users who have received a V2Ray/VLESS/VMess WebSocket + TLS node but aren’t sure which settings to enter, can’t connect after importing it, or can’t open web pages.
1. Understand the information required for a WS TLS node
WS TLS typically refers to WebSocket transport secured with TLS. It’s commonly used with clients such as v2rayN, Clash, sing-box, and Shadowrocket. A working node usually includes a server address, port, UUID or password, protocol type, transport set to ws, TLS setting, SNI, Host, and Path. You don’t need to understand the underlying technical details—just make sure these fields are entered correctly.
- Address: This may be a domain name or an IP address. Prefer the original address provided by the service.
- Port: 443 is common, but don’t guess—use the port specified in the node details.
- Path: Usually something like /xxx. Match the capitalization and slashes exactly.
- Host/SNI: Usually the domain name provided with the node. Don’t leave these blank or change them arbitrarily.
- TLS: If the node is labeled ws tls and not reality, TLS usually needs to be enabled.
2. Configure a WS TLS node in your client
If you’re using the free nodes provided on this site, we recommend copying the subscription link and importing it to avoid manual entry errors. To configure a node manually, follow these steps:
- Open the client and add a node. Select VLESS or VMess as the protocol, as specified in the node details.
- Enter the server address, port, and user ID/UUID. Choose the encryption method as specified by the node or leave the default.
- Select WebSocket/ws as the transport and enter the provided path in the Path field.
- Enable TLS and enter the provided domain name as the SNI and Host. If there’s an option to “skip certificate verification,” it’s generally best to leave it off unless the node instructions say otherwise.
- Save the settings, select the node, and test its latency or connect directly. Then open a web page in your browser to verify the connection.
If you use Clash and import a YAML configuration, check that network is set to ws, tls is set to true, and the path and Host under ws-opts are correct. If you use sing-box, check that transport.type is set to ws and tls.server_name matches the node’s domain name.
3. Why IP, DNS, and your browser environment affect the connection
WS TLS nodes rely on domain name resolution and a TLS handshake, so your local network environment matters. If DNS is poisoned or resolves to an unexpected IP, the client may time out or show errors such as TLS handshake failed or connection reset. Try enabling remote DNS in the client or using a trusted DNS service, and remove any unfamiliar proxy software left on your system.
Your browser environment can also affect how you diagnose the issue. For example, browser cache, extensions, or outdated proxy settings may cause the client to show as connected while web pages remain inaccessible. Try opening the page in a private window or testing with another browser. Also make sure the client has correctly taken control of the system proxy. On Windows, a common issue is a proxy port left open from an earlier setup; on macOS, check the proxy entries in Network settings.
4. Quick checklist for troubleshooting connection failures
- Update your subscription first: Free nodes may have updated settings, so older configurations may no longer work.
- Check the system time: An incorrect system clock can cause TLS certificate verification to fail.
- Check the Host, SNI, and Path: These are the fields most likely to be entered incorrectly when copying.
- Switch networks: Try switching from Wi-Fi to a mobile hotspot to see whether the issue is with your local carrier or router.
- Check the logs: Search for keywords such as timeout, dns, tls, and 403 to determine whether the issue is with resolution, the handshake, or the path.
In short, the key to configuring a WS TLS node is to get the protocol, path, domain name, and DNS right. If you’re not comfortable entering settings manually, importing a subscription is the easiest option. If you do need to configure it by hand, check each field carefully and don’t change the parameters provided with the node.