This article answers the question “How do I configure a WS TLS node?” If you have a V2Ray/VLESS/VMess WS+TLS node but aren’t sure where to enter the address, port, path, Host, or SNI—or you can’t access websites after connecting, your IP looks wrong, or you’re experiencing DNS leaks—follow the steps below.
1. What information do you need for a WS TLS node?
WS is a WebSocket transport, and TLS is an encryption layer. You don’t need to understand the underlying technical details; just make sure you have all the node information. Common fields include the server address, port, user ID or password, transport (ws), TLS toggle, WS path, Host, SNI, and encryption method.
- Address: This may be a domain name or an IP address. A domain name is generally recommended for WS+TLS.
- Port: Commonly 443, but use the port specified in the node details.
- Path: For example, /ray or /ws. It must match the node details exactly.
- Host/SNI: Usually the node’s domain name. Don’t change these arbitrarily.
- TLS: TLS must be enabled for a WS TLS node; otherwise, the handshake may fail.
2. How to configure it in Clash, V2RayN, or sing-box
If you’re using a free node provided by this site, import it using the subscription link first. The client will generate the configuration automatically. For manual setup, follow these steps:
- Open the client and select “Add node” or “Import from clipboard.”
- Select VLESS or VMess as the protocol, as specified in the node details.
- Select ws as the transport and tls for the security or TLS option.
- Enter the server address, port, UUID/ID, Path, Host, and SNI.
- Save the configuration, test the latency, and connect to an available node.
In clients such as Clash Verge and Clash Meta, configuration files are usually in YAML format. You don’t necessarily need to write the configuration yourself; just check that network is set to ws, tls is set to true, and the path and headers Host in ws-opts are correct.
3. How IP, DNS, and browser settings affect the connection
A working node doesn’t necessarily mean you’ll be able to access websites properly. Your IP, DNS, and browser settings also matter. After connecting, visit an IP-checking website to confirm that your exit IP has changed. If it still shows your local IP, the system proxy may be disabled, your browser may not be using the proxy, or you may have selected the wrong client mode.
DNS is also important. If DNS requests are still being resolved by your local ISP, you may be unable to access websites, get unexpected redirects, or experience DNS leaks. Try rule mode or global mode in your client, and use its built-in DNS or remote DNS feature. If certain sites won’t open, switch to global mode first to troubleshoot.
Browser settings can also affect your results. Cache, extensions, and WebRTC may all interfere. Try testing in a private window and disabling any suspicious proxy extensions. If you’re concerned about WebRTC exposing information about your local network, disable it in your browser settings or with an extension. Keep in mind that a correctly configured node doesn’t guarantee that your browser is actually using the proxy.
4. Quick troubleshooting for connection failures
- Check the time: An incorrect system time on your computer or phone can cause TLS certificate verification to fail.
- Check the Path, Host, and SNI: Differences in capitalization, slashes, or spaces can cause the connection to fail.
- Check the port: Don’t change ports such as 443 or 8443 based on guesswork.
- Switch networks: Some campus and company networks restrict proxy connections. Try using your phone’s hotspot.
- Update the client: Older core versions may not support newer configurations.
In summary, when configuring a WS TLS node, make sure the protocol, TLS, Path, Host, and SNI settings all match. After connecting, check whether your IP has changed, whether DNS is leaking, and whether your browser is actually using the proxy. Following these steps in order should help you identify most issues.