v2rcA V2Ray client does not choose a protocol for you. The config you import does, and that config comes from your provider or from your own server. So the practical question is what to ask for, or what to set up. This article explains the differences that matter and ends with a short recommendation.
Three layers, not one choice
"VLESS or VMess" sounds like one decision. It is three:
- Protocol: how the client authenticates and what the payload looks like (VMess, VLESS, Trojan, Shadowsocks).
- Transport: how the bytes travel (plain TCP, WebSocket, gRPC and others).
- Security: what wraps the connection (nothing, TLS or REALITY).
The same protocol can be nearly invisible or easy to spot depending on the other two layers. What a censor sees is decided mostly by transport and security.
What a censor can see
- Random-looking bytes. Shadowsocks and VMess over plain TCP have no recognisable header. That is itself a signal: since late 2021 the Great Firewall has blocked connections whose first packet looks like fully encrypted data. The China article has the details.
- A TLS handshake. Trojan, and VLESS or VMess over TLS, look like HTTPS. A censor can still check the server name, the IP address, the certificate and how the connection behaves.
- A borrowed handshake. REALITY imitates the TLS handshake of a real website that you choose. A probe that does not hold the key is passed on to that real site and sees its real pages. You need no domain name or certificate of your own.
The four protocols side by side
| VMess | VLESS | Trojan | Shadowsocks | |
|---|---|---|---|---|
| Encrypts the payload itself | Yes | No, relies on TLS or REALITY | No, relies on TLS | Yes |
| Looks like, by default | Random bytes on plain TCP | Depends on security: random bytes, TLS or REALITY | HTTPS | Random bytes |
| Needs your own domain and certificate | Only with TLS | Only with TLS, not with REALITY | Yes | No |
| Fails if the clock is wrong | Yes | No | No | No |
| Imports into v2rc | Yes | Yes | Yes | Yes |
- VMess is the original V2Ray protocol. It authenticates with a UUID and a timestamp, which is why a phone or server clock that is off by a couple of minutes makes it fail without an error message. Use alterId 0 (the AEAD mode); a non-zero alterId is legacy.
- VLESS is the lighter successor. It does no encryption of its own, so it is only as private as the layer under it. Use it with TLS or REALITY, never with security
noneacross the open internet. - Trojan copies HTTPS: a password inside an ordinary TLS connection. A client that does not know the password is shown a normal web page instead. It needs a real certificate for a real domain, and a domain can be blocked.
- Shadowsocks is a long-established encrypted proxy and the simplest to run. Use an AEAD cipher; old stream ciphers such as
rc4-md5oraes-256-cfbare weak. Without a plug-in or wrapper its traffic is the fully encrypted kind.
What REALITY and Vision add
In a REALITY config you will see security=reality, a server name (sni), a public key (pbk) and a short ID (sid). The server name must be a real website that supports TLS 1.3 and HTTP/2; the REALITY documentation asks for exactly that.
flow=xtls-rprx-vision is the Vision flow. A TLS connection carried inside another TLS connection leaves a recognisable pattern; the research literature calls it TLS-in-TLS, and Xue et al. (USENIX Security 2024) showed that such patterns can expose obfuscated proxies. Vision was designed to reduce that pattern for traffic that is itself HTTPS.
Neither is magic. The IP address and hosting network of your server still matter, and REALITY does not hide the fact that a connection goes to a foreign data-centre address.
What to ask for
- On a restrictive network (Russia, Iran, China and similar): VLESS with REALITY and Vision over TCP, on port 443.
- A second config of a different kind: Trojan, or VLESS over TLS with WebSocket or gRPC, optionally behind a CDN. A CDN hides your server's IP address, but it depends on the CDN itself being reachable and not throttled where you are.
- On an open network: any of the four. Use whatever your provider already supports.
- If your provider gives you a subscription: you do not choose, but you can read the links so you know what you got. See how to read a config link.
- Keep at least two configs from different hosts. When one fails, you want a different IP address and ideally a different protocol, not another config from the same server.
What v2rc can and cannot import
v2rc imports VMess, VLESS (including REALITY), Shadowsocks and Trojan from a link, a V2Ray JSON file, the clipboard or a subscription URL. It does not import Hysteria 2, TUIC, WireGuard, AmneziaWG or NaiveProxy. The first four run over UDP, which many restrictive networks drop; NaiveProxy runs over HTTPS but needs its own client. For those you need a different app.
v2rc ships no servers: you bring your own configs. Smart Connect picks the fastest config and checks that the tunnel really passes traffic before it switches.
Sources
- REALITY documentation and Xray configuration examples
- Trojan protocol description
- Shadowsocks AEAD specification
- Xue, Kallitsis, Houmansadr, Ensafi: Fingerprinting Obfuscated Proxy Traffic with Encapsulated TLS Handshakes, USENIX Security 2024
- Wu et al.: How the Great Firewall of China Detects and Blocks Fully Encrypted Traffic, USENIX Security 2023