This guide explains how to configure a WS TLS node and why the same node may behave differently across networks, DNS settings, or browser environments. It’s for everyday users of clients such as V2RayN, Clash Verge, and sing-box. Follow the steps to import a node, check its settings, and troubleshoot connection failures.
1. What to check in a WS TLS node
WS TLS usually refers to a WebSocket + TLS transport combination, commonly used with protocols such as VLESS, VMess, and Trojan. When you get a node link or subscription, your client will usually recognize it automatically. If you need to check the settings manually, pay particular attention to these items:
- Address: Usually a domain name. Avoid changing it to an IP address without a good reason.
- Port: Commonly 443, but it may be another port. Use the value provided in the node details.
- Transport: Select ws / websocket.
- TLS: Must be enabled. SNI is usually the node’s domain name.
- Path: The WS path, such as /ray or /ws. It must match exactly.
- Host: Enter the Host value if one is provided. Otherwise, it usually matches the domain name.
If you’re using the free nodes listed on this site, we recommend importing them through a subscription to reduce the chance of mistakes when entering the path, SNI, or Host manually.
2. Client configuration steps
- Install a client: On Windows, use V2RayN or Clash Verge; on Android, use v2rayNG; on iOS, use a subscription-compatible app such as Shadowrocket or Stash.
- Copy the node link or subscription URL, then select “Import from clipboard” or “Add subscription” in your client.
- After importing, open the node details and confirm that the transport is set to WS, TLS is enabled, and the SNI, Host, and Path contain no extra spaces or capitalization errors.
- Select the node and enable system proxy or VPN mode.
- Open a test website in your browser to confirm that it loads normally, then test other apps.
For Clash-based clients, also check the rule mode. Beginners can start with “Global mode” to test connectivity, then switch back to rule mode once the connection works.
3. How IP, DNS, and browser settings affect the connection
WS TLS nodes usually rely on domain name resolution, so incorrect DNS resolution can cause connection timeouts, TLS handshake failures, or resolution to an unavailable IP address. If you run into problems, try enabling remote DNS or Fake-IP in your client, or use a reliable system DNS server, then restart the client and test again.
Your IP network environment can also affect the connection. Some networks interfere with certain ports, domain names, or TLS handshakes, so the same node may behave differently on home broadband, campus Wi-Fi, a corporate network, or mobile data. When troubleshooting, try switching networks rather than assuming the node is unavailable.
Browser settings mainly affect whether you appear to be able to access the internet. If the client is connected but your browser can’t open webpages, check whether the browser has its own proxy settings, whether an extension is changing the proxy, and whether secure DNS is enabled. Secure DNS in Chrome or Edge can sometimes bypass the system proxy, so try disabling it temporarily.
4. Quick troubleshooting for connection failures
- Connection timeout: Switch networks or nodes, and check the port and DNS settings.
- TLS handshake failure: Check the SNI, domain name, and system time.
- Connected but webpages won’t load: Make sure system proxy or VPN mode is enabled and that the browser has no separate proxy settings.
- Subscription stops working after an update: Delete the old node and refresh the subscription to avoid conflicts from cached settings.
In short, the key to configuring a WS TLS node is to keep the domain name, TLS, SNI, Host, and Path consistent, then troubleshoot the IP network, DNS, and browser environment one by one. Avoid changing unfamiliar settings repeatedly. Import the node through a subscription when possible, then use the logs to pinpoint the issue. This is usually the fastest way to restore the connection.