V2Ray's VMess-over-WebSocket-over-TLS is the classic CDN-frontable proxy: put Cloudflare in front and the censor sees traffic to Cloudflare, never to your server. It's the mature, widely-documented choice with clients everywhere. Run it on a fresh offshore IP, paid in crypto, with an origin that stays hidden.
V2Ray (and its VMess protocol) pioneered the transport tricks everything else now borrows: wrap the proxy in WebSocket, wrap that in TLS, and route it through a big CDN. The magic is the CDN: when Cloudflare sits in front of your domain, a client connects to Cloudflare's IPs — which a censor won't blocklist wholesale because half the internet is behind them — and Cloudflare quietly forwards to your origin. Your real server IP never appears in the client's connection at all. It's a little heavier and needs a domain, but the origin-hiding property is unique, and V2Ray's decade of documentation and universal client support make it the safe, well-trodden path.
Behind Cloudflare, clients talk to the CDN, never your VPS. The censor can't block an IP it never sees, and can't easily block the CDN either.
Cloudflare's ranges are too important to blocklist wholesale. Your traffic hides in that crowd, indistinguishable from any other site on the CDN.
A decade of guides, configs and community knowledge. If you've used a proxy before, odds are it was V2Ray — the configs you know still work.
v2rayN, v2rayNG, NekoBox, sing-box, Shadowrocket — every client speaks VMess. Import the vmess:// link and connect.
What the protocol actually is, how it hides, and where it's strongest — described honestly. No proxy is magic; the right one for your network is.
| Server software | V2Ray / V2Fly core (or Xray) |
|---|---|
| Transport & camouflage | VMess + WebSocket + TLS, Cloudflare-CDN-frontable |
| DPI resistance | High behind a CDN — traffic looks like your CDN domain |
| Throughput | Good; CDN fronting adds a hop but hides the origin |
| RAM footprint | ≈ 60 MB |
| Setup | config + optional CDN, moderate |
| Port(s) | 443 via WS + TLS |
| Strongest in | CDN-fronting fans, existing v2ray/VMess configs |
A proxy is a tiny process — it needs a clean IP and steady bandwidth, not a big machine. Every plan is unmetered NVMe VPS with full root, rented with a token and paid in crypto.
One person wanting a hidden origin: VPS-S plus a free Cloudflare domain runs V2Ray with your real IP invisible.
Share behind a CDN: VPS-M handles a household while Cloudflare fronts every connection.
Reselling with origin protection: VPS-L runs many inbounds behind one CDN domain, IP never exposed.
Because Cloudflare fronts the connection, latency to your origin matters less than usual — pick Netherlands or Romania for a fast backhaul, or the cheapest node since the CDN does the heavy lifting. The domain lives at Cloudflare; the VPS just answers behind it.
| Location | CPU | RAM | Storage | Uplink | Price | |
|---|---|---|---|---|---|---|
| Moldova Budget Offshore | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $7.50/mo | Order |
| Russia Western-Proof | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $7.50/mo | Order |
| Panama No Data Retention | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $8.50/mo | Order |
| Romania Anti-Retention | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $8.50/mo | Order |
| Netherlands Best Peering | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $9.00/mo | Order |
| Iceland Free Speech Haven | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $10.00/mo | Order |
| Switzerland Premium Privacy | 2 vCPU | 4 GB DDR4 | 60 GB NVMe | 1 Gbps | $11.00/mo | Order |
From a blank VPS to a working endpoint. Commands are copy-paste ready for Ubuntu 24.04.
VPS-S is enough. Any jurisdiction works since the CDN fronts it — Netherlands for a fast origin. Pay in crypto, get root.
Add a domain to Cloudflare (free tier), create a proxied (orange-cloud) record to your VPS IP. This is what hides your origin.
The official installer drops in V2Ray (or the drop-in Xray core). One command, no dependencies.
# official installer (V2Ray or the drop-in Xray core)
bash <(curl -Ls https://raw.githubusercontent.com/v2fly/fhs-install-v2ray/master/install-release.sh)Set VMess over WebSocket with a secret path, terminate TLS, and let Cloudflare proxy it. Censors then see traffic to Cloudflare on your domain, not to your VPS.
# VMess + WebSocket + TLS. Put Cloudflare (proxied, orange cloud)
# in front of a domain that points at this VPS; set path=/your-secret-path.
# GFW/Iran then see traffic to Cloudflare, not to your origin IP.Export the vmess:// link and import into v2rayN, v2rayNG or sing-box. Every connection now rides Cloudflare to your hidden origin.
# share the vmess:// link; import into v2rayN / v2rayNG / sing-box
systemctl restart v2ray && journalctl -u v2ray -n 20 --no-pagerNormally a client connects straight to your server's IP — which a censor can log and blocklist. CDN fronting breaks that chain: you put your domain behind Cloudflare with the proxy (orange cloud) enabled, so DNS resolves to Cloudflare's IPs, not yours. The client's TLS connection terminates at Cloudflare, which forwards the WebSocket stream to your origin over its own network. From the censor's vantage point, you're connecting to Cloudflare — the same IPs serving millions of ordinary sites. To block you specifically, they'd have to block those Cloudflare ranges and take a large slice of the normal web down with you, which most are unwilling to do.
VMess is V2Ray's original protocol; it works and is universally supported, but it carries a bit more overhead and a timestamp-based handshake that, on its own, modern DPI can sometimes spot. That's exactly why it's paired with WebSocket+TLS+CDN — the wrapping is what provides the stealth, not VMess itself. If you don't need CDN fronting, the newer VLESS (especially with REALITY) is leaner and stealthier on its own. Think of V2Ray+CDN as the choice specifically when hiding your origin IP behind Cloudflare is the property you want.
You don't need a paid plan or an expensive domain. A cheap domain (our no-KYC registrar has them from $4.99) plus Cloudflare's free tier gives you the proxied DNS record that does all the work. Keep the record orange-clouded, use a non-obvious WebSocket path, and you're fronted. One caveat to be honest about: your traffic passes through Cloudflare, so trust is split between us (your origin, no logs) and the CDN — for most threat models focused on beating a national firewall, that's a fine trade; for maximum trust-nobody setups, a plain REALITY endpoint keeps everything on your own box.
Once it's up it's low-maintenance: keep V2Ray updated, keep the Cloudflare record proxied, and rotate the WebSocket path if you ever suspect it's been discovered. Because the origin is hidden, your VPS IP rarely gets blocked directly — the usual failure mode is the domain being flagged, which you fix by swapping domains (cheap and fast) rather than redeploying the server. If Cloudflare itself is being interfered with in your country, that's the signal to fall back to REALITY or Hysteria2 on the same VPS.
For the CDN-fronting setup, yes — a domain behind Cloudflare is what hides your origin. A cheap one is fine; our no-KYC registrar has domains from $4.99/yr, payable from your balance. Without CDN you can run VMess+TLS on the IP directly, but you lose the origin-hiding benefit.
With the proxy (orange cloud) on, clients connect to Cloudflare's IPs and Cloudflare forwards to your VPS. Your real IP never appears in the connection, and Cloudflare's ranges are too widely used for a censor to blocklist wholesale.
Wrapped in WebSocket+TLS behind a CDN, yes — the wrapping provides the stealth. On its own, exposed VMess can be fingerprinted, so don't run it bare on a censored network. If you want stealth without a CDN, use VLESS+REALITY instead.
Choose V2Ray+CDN when hiding your origin IP behind Cloudflare is the goal. Choose VLESS+REALITY when you want maximum on-box stealth with no domain, no cert and no third party in the path. Full root lets you run both and compare.
It adds a hop, so it's marginally slower than a direct protocol — but Cloudflare's network is fast and close to most users, so in practice it's smooth. If raw speed on a throttled network is the priority, Hysteria2 is the faster pick.
Swap in a different domain (cheap and quick) while keeping the same server and Cloudflare account — much easier than migrating a server. Because your origin IP stayed hidden, it's usually still clean and reusable.
Related reading: Self-Hosted VPN on a No-KYC VPS: WireGuard vs OpenVPN · The First Hour of VPS Hardening: A Checklist · Self-hosted VPN use case
V2Ray + WebSocket + TLS behind Cloudflare on a fresh offshore IP, paid in crypto. From $7.50/mo, origin invisible.