This guide answers the question “how do I configure a WS TLS node?” After getting a V2Ray/VLESS/VMess node using WS+TLS, learn how to enter the address, port, path, Host, and SNI correctly in common clients, and why IP, DNS, and browser proxy settings can affect connection reliability.
1. WS TLS node parameters to understand
WS is a WebSocket transport, and TLS is the encryption layer. This combination is commonly written as “ws+tls” or “WebSocket over TLS.” Importing a subscription usually configures everything automatically. If you’re adding a node manually, check these fields carefully:
- Address: Usually a domain name, though it can also be an IP address. When using TLS, a domain name is generally recommended.
- Port: Usually 443, but it may be another port provided by the service provider.
- UUID/password: Authentication credentials for protocols such as VLESS and VMess. Copy them in full.
- Transport: Select WebSocket / WS.
- Path: For example, /abc or /ray. Match the capitalization and slashes exactly.
- TLS: Enable it. For SNI/Server Name, enter the node’s domain name in most cases.
- Host: The Host header in the WS request. It usually matches the domain name or the Host provided by the service provider.
Many connection failures aren’t caused by the node itself, but by a mismatch between Path, Host, and SNI. If you copied a node from the free nodes page on this site, use “Import subscription” whenever possible to avoid manual entry errors.
2. Configuration examples for v2rayN / Clash / sing-box
- v2rayN: Click “Servers” – “Add custom server,” select VLESS or VMess, and enter the address, port, and UUID. Set the transport to ws, enter the Path, set TLS to tls, and enter the domain name for SNI. Save the settings and select the server as active.
- Clash Verge / Meta: Importing a subscription link is recommended. If writing the YAML manually, make sure type, server, port, uuid, network: ws, tls: true, servername, ws-opts.path, and ws-opts.headers.Host are all set correctly.
- sing-box: Using a subscription that supports sing-box is easier. If configuring it manually, make sure transport is set to ws, tls enabled is true, and server_name is set to the SNI value in the outbound configuration.
Once configured, test using “Global” or “Rule” mode, then visit an IP lookup site to confirm that your outgoing IP has changed. If webpages won’t load, don’t keep changing every setting at random. Troubleshoot in the order below.
3. How IP, DNS, and browser settings affect the connection
WS TLS nodes rely on domain name resolution and the TLS handshake. Incorrect DNS resolution can connect you to the wrong IP, resulting in timeouts, TLS handshake failures, or a 404 error. We recommend enabling remote DNS or Fake-IP in the client, or using its built-in DNS, to avoid DNS tampering by your local ISP. If the node address is a domain name, the SNI must match the certificate’s domain name, or you may see certificate errors.
Browser settings can also affect your results. Chrome and Edge may use Secure DNS, proxy extensions, or QUIC. If the system proxy is enabled but the browser still connects directly, a proxy extension may be overriding the proxy settings. When testing, disable other proxy extensions, use an incognito window, or confirm in the client that “System proxy” is enabled.
4. Quick checklist for connection failures
- Make sure the node hasn’t expired and the subscription is up to date. Don’t use an old cached version.
- Check the protocol type: Don’t add a VLESS node as VMess, or vice versa.
- Check the port, UUID, Path, Host, and SNI, paying particular attention to slashes and capitalization.
- Change your DNS settings or enable DNS in the client to avoid domain resolution problems.
- Test on a different network. Home broadband, mobile hotspots, and corporate networks have different restrictions.
- Disable browser proxy extensions and HTTPS scanning in antivirus software, then try again.
In short, the key to configuring a WS TLS node isn’t “entering lots of parameters”; it’s making sure the address, TLS domain, WS Host, and path all match. Most users should import a subscription. If you need to add a node manually, copy each parameter carefully and troubleshoot DNS, the system proxy, and browser extensions. This will greatly improve your chances of connecting successfully.