V2Ray Glossary: VLESS, REALITY, Xray, and Routing

PROTOCOL

Proxy protocols

A protocol defines how the client and server exchange proxy requests and authenticate. Matching protocols are only the starting point; transport and security settings must also align.

VMess: A proxy protocol in the Project V ecosystem, with user authentication and data protection. Common configurations include fields such as UUID. The client and server must match not only on protocol, but also on transport and security settings. A device clock that is out of sync can affect authentication. If a connection fails, check automatic time synchronization instead of repeatedly changing the local proxy port.

VLESS: A lightweight protocol that separates the proxy protocol from its underlying security layer, often used with TLS or REALITY. Configurations typically rely on the outer layer for transport security, so the name alone does not tell you how the entire connection is encrypted. Support for newer extensions depends on the core versions at both ends. After importing, check the UUID, transport type, security type, and flow—not just the server address.

Trojan: A proxy protocol that typically uses TLS for transport security and password-based authentication. A correct password does not guarantee that the other settings are right: the server name, certificate validation, and transport also affect the connection. For certificate errors, first check the domain, device clock, and server certificate. Disabling certificate verification should not be a routine setting.

Shadowsocks / SS: An encrypted proxy protocol family commonly abbreviated as SS in clients. Key settings include the server, port, encryption method, and key. Variants differ in key format and core support, so do not swap in an encryption method just because it looks familiar. If import fails, identify the exact variant first, then check the client version and share format.

CORE & PROJECT

Cores and projects

The client provides the interface; the core runs the connection. Understanding how the projects relate helps you determine whether a setting is supported.

Project V: A project and tooling ecosystem concept associated with V2Ray's origins, built around composable proxy, transport, and routing capabilities. It is neither a graphical installer nor another spelling of VMess. When reading documentation, check whether it refers to the project ecosystem, a specific core, or a client that manages a core, so features from different layers are not confused.

V2Fly: A community project continuing V2Ray development and maintaining its core and configuration capabilities. v2flyNG is primarily based on this core, but client setting names do not always correspond word for word to underlying configuration fields. V2Fly and Xray have evolved separately; check support in the actual version for any protocol extension or transport option rather than assuming compatibility.

Xray: A proxy core project that evolved from a V2Ray fork and handles protocols, transport security, routing, and more. v2rayNG commonly uses this core. Check features such as REALITY against the specific Xray version and configuration. An option appearing in the graphical interface does not guarantee support in the running core; record both client and core versions when troubleshooting.

Proxy core: The program that actually listens on a local inbound, handles proxy requests, applies routing, and connects to remote servers. Graphical clients such as v2rayN manage configuration, generate runtime parameters, and display logs; the core executes the configuration. If the interface is open but the core fails to start, the proxy still will not work, so the startup result in the runtime log is usually more useful than the interface toggle.

TRANSPORT & SECURITY

Transports and obfuscation

A client may place the transport and security type next to each other, but they solve different problems. Changes to either must match the server configuration.

TCP: A transport-layer protocol that provides a reliable, ordered byte stream, handling fundamentals such as retransmission, ordering, and congestion control. Interpret TCP or raw in client settings according to the core version; neither is an encryption switch. After choosing a transport, check separately whether TLS or REALITY is enabled. Reliable transport and secure transport are not the same thing.

WebSocket / WS: A bidirectional communication method typically established through an HTTP upgrade, used as a transport in proxy configurations. Common fields include the path and Host, while the TLS server name belongs to a separate layer. If the handshake fails, check the path, request headers, reverse proxy, and certificate settings separately. Do not blindly set every domain field to the same value.

gRPC: A remote procedure call framework based on HTTP/2, used as a transport by some proxy cores. The client service name must match the server, and any reverse proxy in front must support the required HTTP/2 forwarding. If connections keep dropping after they are established, check intermediate devices' idle timeouts and keepalive settings as well as authentication.

REALITY: A transport security mechanism in the Xray ecosystem, commonly used in VLESS connection profiles, but not another proxy protocol on the same level as VLESS. Configure authentication material, server name, shortId, and other parameters using the server's details; field names may change between versions. It is separate from Vision flow, so check both independently when importing—they are not interchangeable.

ROUTING

Routing and traffic splitting

First decide how traffic enters the client, then choose which outbound it uses. Traffic capture and routing policy are separate things.

Routing rules and traffic splitting: A mechanism for choosing an outbound—such as direct, proxy, or block—based on a domain, IP, port, or other condition. Rules are generally matched in order, so a broad rule near the top can override more specific rules below it. Domain strategy, DNS results, and the default outbound also affect the outcome; a rule's name alone does not tell you how all traffic will be routed.

GeoIP: A collection of IP addresses grouped by region or another label, which routing rules can use to match destination IPs. The grouping reflects the dataset, not a site's language, business affiliation, or exact location. For sites using dynamic addresses or content delivery services, consider domain rules as well. Missing data files, incorrect labels, or stale data can also produce unexpected matches.

GeoSite: A collection of domains grouped by service, purpose, or another label, useful for routing a category of websites. It is not another name for GeoIP. It requires the core to have domain information and load the data file containing the relevant labels. If a site is not matched, check the domain in the actual request and the rule contents instead of only updating the client interface.

TUN mode: An access method that captures and processes IP traffic through a virtual network interface, often used to cover apps that do not read system proxy settings. Actual coverage also depends on system routing, DNS, permissions, and the client implementation; enabling the switch does not guarantee that all traffic will be handled as expected. If DNS problems or routing loops appear, check route exclusions and conflicts with other virtual networking tools.

System proxy: Points the operating system's proxy settings to the client's local listening endpoint, allowing apps that support the setting to use the proxy. Some apps have their own network settings and may ignore the system proxy, so access in a browser does not mean other programs use the same route. If pages stop working after you close the client, check whether the system proxy still points to a local port that is no longer active.

SUBSCRIPTION & CONFIGURATION

Subscriptions and configuration

Subscriptions distribute configurations; share links usually describe a single connection. After importing, check core support and local runtime settings too.

Subscription: A way to retrieve and update a set of connection profiles from a URL. The client must understand the format returned by that URL. A subscription URL is not the same as a website login URL, and a successful update does not mean every profile can connect. The URL may contain personal access credentials, so hide it before sharing screenshots, logs, or configuration details.

Node: A common client term for a remote connection profile, typically containing a server address, port, protocol, authentication, transport, and security settings. The display name is just a label; it does not indicate the server's actual location or connection quality. Profiles with different names can point to the same server, while one address can provide different protocols on different ports. Check the actual fields.

Syncing configurations across devices: A way to reuse the same subscription or connection settings across devices; it does not necessarily rely on a client account or automatic cloud sync. Reusing connection details does not mean routing, DNS, listening ports, or permissions can be copied unchanged. Check traffic capture settings separately on desktop and Android. If the subscription provider limits simultaneous devices, follow its usage rules when connecting.

DNS & NETWORK

DNS and networking basics

Connecting, resolving a domain, and reaching the target service are different outcomes at different layers. Before testing, identify which layer you are measuring.

DNS: The system that resolves domain names to records such as IP addresses. Resolution results affect later connections and some routing decisions. The operating system, browser, and proxy core may each send their own queries, so changing DNS in one place does not mean every request uses that setting. When troubleshooting, identify what performs the lookup, which path it takes, which upstream it uses, and whether it falls back after a failure.

FakeDNS: A mechanism that assigns synthetic IPs to domains and maintains a mapping between them, making it possible to recover the domain for later connections. Synthetic addresses are not the target service's real public IPs; this mechanism must work with traffic capture, address-range routing, and core mappings. If an app still uses stale results after you enable or disable it, clear the DNS cache or restart the app.

DNS leak: A DNS leak occurs when queries take an unintended resolution path and reach an unexpected resolver. First establish which DNS service is expected. Secure DNS built into a browser, system fallback, and app-specific resolution can all change the actual path. An unfamiliar provider shown by a leak test is a clue, not proof; also check the upstream provider, client logs, and configuration.

Real connection latency: The time measured when reaching a test target through an actual proxy connection, which is not the same as an ICMP ping or TCP connection test. Whether the measurement includes DNS, protocol negotiation, TLS, or the target's response depends on the client and test settings. Compare using the same target and method. A lower result on one test does not mean higher download speed or guarantee access to every site.