How do you configure a WS TLS node? Using common VLESS and VMess nodes as examples, this guide explains how to enter WebSocket and TLS parameters in a client and distinguish the effects of IP, DNS, and browser settings when a connection fails. After getting a share link or subscription, import it first, then verify the settings against the parameters provided by the node provider. Don’t guess and change settings at random.
1. Confirm the node type and required parameters
WS is a WebSocket transport method, and TLS encrypts the connection. Neither is a standalone proxy protocol. Before configuring a node, confirm whether it uses VLESS or VMess, since their authentication fields are not interchangeable. We recommend installing a client version that supports the relevant protocol from the client’s official release channel.
- Basic information: server address, port, UUID, and any protocol-specific options required by the node.
- Transport settings: select ws or WebSocket, then enter the Path and Host specified by the provider.
- TLS settings: enable TLS and verify the server name (SNI). If the provider specifies additional parameters such as ALPN, enter those as well.
The server address, WS Host, and TLS SNI do not have to be the same. The server address is used to establish the connection, Host is used in the WebSocket request, and SNI identifies the name during the TLS handshake. They may use the same domain or be specified separately, so follow the original node details.
2. Import the node and make your first connection
- Copy the complete share link and choose the clipboard import option in a client such as v2rayN or v2rayNG. If you have a subscription URL, go to subscription management, add the URL, and update the subscription.
- Open the imported node’s edit page and make sure the protocol, address, port, and UUID are present, the transport type is WebSocket, and TLS is enabled.
- Check the Path’s leading slash, capitalization, and query parameters, then verify Host and SNI. Do not replace the path with a webpage URL or remove parameters arbitrarily.
- Save and select the node. On desktop, enable the system proxy if needed; on mobile, allow the client to create a VPN connection. Use rule mode for the initial test.
- Open a webpage you want to access and check the client’s connection log. Latency tests can help with diagnosis, but do not replace a real access test.
When using free nodes from this site or elsewhere, also check that the configuration is complete and up to date. Subscription URLs may contain access credentials, so don’t post them in public comments or screenshots.
3. If you can’t connect, check IP, DNS, and browser settings in that order
Check the logs first to identify the type of failure. If you see a domain resolution error, first check your local network and the client’s DNS settings. If the connection times out, check the address, port, current network, and node availability. If you see a certificate error, check the system time, SNI, and whether the certificate name matches. Don’t simply disable certificate verification.
If the server address is an IP address, TLS may still require a domain name for SNI, and WS Host should remain set to the value required by the provider. Don’t replace a domain with its resolved IP address yourself: the service may use a CDN or address routing, and replacing it could prevent the connection.
DNS determines how domain names are resolved, but switching to a public DNS service is not a universal fix. First check whether the client has its own DNS, remote resolution, or TUN mode enabled, then adjust settings according to the client’s documentation. Avoid changing several options at once, or it may be difficult to pinpoint the cause.
If the client shows a successful connection but pages won’t open in the browser, check browser extensions, separate proxy settings, and Secure DNS, then compare results in an incognito window. Secure DNS in the browser may use a different resolution path, but it usually won’t fix a TLS handshake error in the client itself. Finally, try updating the subscription again or switching nodes to determine whether the issue is a configuration error or a temporarily unavailable node.