VLESS + WS Proxy Tunnel with Localtonet: Full Setup Guide
Most proxy setups fail the moment your ISP or network admin runs deep packet inspection. Standard protocols get fingerprinted and blocked. VLESS over WebSocket wraps your traffic inside a regular HTTPS connection, making it indistinguishable from browser traffic at the network layer. Localtonet now supports VLESS + WS as a first-class proxy tunnel type, giving you a public TLS endpoint without touching your router, firewall, or ISP settings. This guide walks you through creating and connecting to a VLESS + WS tunnel from start to finish.
Why Standard Proxies Get Blocked
Corporate networks, university firewalls, and many ISPs block outbound traffic on non-standard ports. Even when they don't block by port, deep packet inspection identifies and drops known proxy protocols like SOCKS5 or raw TCP tunnels by their handshake signatures. The result: your proxy works at home, fails everywhere else.
Port 443 is almost never blocked because it carries all HTTPS web traffic. A proxy that speaks WebSocket over TLS on port 443 is practically invisible to DPI. The connection looks identical to a browser loading a web app.
VLESS + WS is specifically designed for this scenario: high-resistance proxying that survives hostile networks.
What VLESS + WS Actually Does
VLESS is a lightweight proxy protocol from the Xray/V2Ray ecosystem. It has almost no overhead compared to VMess because it drops encryption at the protocol layer and delegates that to TLS instead. Your client sends VLESS frames, they get wrapped in WebSocket, and WebSocket runs inside a TLS connection. The server sees standard HTTPS. The DPI box sees standard HTTPS. Only your client and the tunnel endpoint know what's actually inside.
Localtonet handles the server side automatically. When you create a VLESS + WS tunnel, Localtonet provisions a public subdomain (e.g., pjrcaez2cb.localtonetproxy.com) with a valid TLS certificate on port 443. Your local Xray client connects to that endpoint. Traffic flows through Localtonet's servers without you needing any public IP, open port, or VPS.
How to Create a VLESS + WS Tunnel in Localtonet: Step-by-Step
Create a free account and copy your token
Sign up at Register page. After logging in, go to My Tokens and copy your personal auth token you'll need it in step 3.
Download and install the Localtonet agent
Head to Downloads and grab the binary for your OS. Works on Windows, Linux, macOS, Android, and Docker.
Select "VLESS + WS (Support UDP)" as the Proxy Type
In your Localtonet dashboard, click Proxy Server. Click the "Proxy Type" dropdown. You will see five options: HTTP, SOCKS5, ShadowSocks, VLESS + WS, and VLESS + Reality. Select "VLESS + WS (Support UDP)".
Choose your Auth Token and Server location
Select the auth token to associate with this tunnel. Under "Server", pick the Localtonet server closest to your device.
Set a Domain Type and click Create
Choose "Random SubDomain" unless you have a reserved domain on your plan. Click "Create". Localtonet provisions the tunnel instantly and assigns a public subdomain like pjrcaez2cb.localtonetproxy.com on port 443.
Retrieve your UUID from "VLESS Data"
Find your new tunnel in the list. Click the settings icon on the right to open the tunnel detail panel, then click "Manage" next to "Vless Data". A modal appears with your UUID, for example 7b637c36-9dd4-4005-a0cf-1960b31f1fb1 Copy it. You need this in your Xray client.
Configure your Xray client with the VLESS + WS settings
Open your Xray-compatible client (v2rayN, NekoBox, Shadowrocket, or raw Xray). Add a new VLESS outbound using the values below. All fields come directly from the Localtonet tunnel page.
Address : pjrcaez2cb.localtonetproxy.com (your assigned subdomain)
Port : 443
UUID : 7b637c36-9dd4-4005-a0cf-1960b31f1fb1 (from VLESS Data modal)
Flow : (leave empty)
Encryption: none
Network : ws
TLS : tls
Fingerprint: chrome
SNI : (leave empty, server cert covers the subdomain)
Path : (leave empty)
Allow Insecure: falseStart the tunnel and verify connectivity
Click the Start button on your tunnel row in Localtonet to activate it, then connect from your Xray client.
By default, the "Is Reserved?" checkbox in your tunnel's Settings panel is enabled. This means your subdomain stays the same across Localtonet client restarts. If you disable it, every restart assigns a new random subdomain, and you have to update every device using that tunnel. Leave "Is Reserved?" checked unless you specifically want a rotating endpoint.
Localtonet issues a valid TLS certificate for every proxy subdomain under *.localtonetproxy.com. You do not need to disable certificate verification. Setting "Allow Insecure" to false enforces proper certificate checking, which is the correct and more secure configuration. Only set it to true if you are testing a self-signed cert on a private endpoint.
Tips for Getting the Most Out of VLESS + WS
Frequently Asked Questions
What is the difference between VLESS + WS and VLESS + Reality in Localtonet?
VLESS + WS uses WebSocket as the transport layer wrapped in TLS. It's widely supported by all Xray/V2Ray clients. VLESS + Reality uses a newer TLS camouflage technique that mimics a real website's TLS fingerprint more closely, offering stronger resistance against advanced censorship systems. VLESS + WS is the better starting point for most users due to broader client compatibility.
Do I need to install anything on my machine to use this tunnel?
Yes. The Localtonet client must be running on the machine that receives the tunneled traffic. You also need an Xray-compatible client on each device that sends traffic through the tunnel. The Localtonet client handles the server-side connection; Xray handles the client-side VLESS protocol. Download the Localtonet client at localtonet.com/download.
Which Xray clients work with a Localtonet VLESS + WS tunnel?
Any client that supports VLESS over WebSocket with TLS will work: v2rayN (Windows), v2rayNG (Android), NekoBox (Android/Desktop), Shadowrocket (iOS), Hiddify (cross-platform), and the raw Xray binary on Linux. Use the configuration values from Step 6 above. The "Configuration" field in Shadowrocket and similar clients should be set to "Xray" if the option exists.
Why does the tunnel show as connected but traffic doesn't flow?
The most common cause is a mismatch between the Path field. Localtonet's VLESS + WS endpoint does not require a custom path. If your Xray client has a Path value set (e.g., /ws or /vless), clear it and leave the field empty. A non-empty Path that doesn't match the server will complete the WebSocket handshake but drop all VLESS frames silently.
Can multiple devices share the same VLESS + WS tunnel simultaneously?
Yes. Multiple clients can connect to the same tunnel using the same UUID and domain. All sessions share the tunnel's total bandwidth. If you want per-device access control, use the "Access Control" setting in the tunnel panel, or create a separate tunnel with its own UUID for each device or user group.
Does this work on Android or iOS without a desktop PC?
The Xray client side works on Android (v2rayNG, NekoBox, Hiddify) and iOS (Shadowrocket, Streisand). However, the Localtonet client that receives the inbound tunnel connection must run on a machine that stays online, typically a Linux server, a Windows PC, or a NAS. The Localtonet client is not available as a standalone mobile app for the server-side role.
What does "Is Reserved?" do in the tunnel settings?
When "Is Reserved?" is checked, the tunnel keeps the same subdomain every time the Localtonet client reconnects. This is the default and the correct setting for any tunnel you share with multiple devices, since those devices have the subdomain hardcoded in their Xray config. If "Is Reserved?" is off, the subdomain rotates on each reconnect and every client config must be updated manually.
How much does a VLESS + WS proxy tunnel cost on Localtonet?
VLESS + WS tunnels are available on all Localtonet plans including the free tier. The free plan includes bandwidth limits and non-reserved subdomains by default. Paid plans start with reserved subdomains, higher bandwidth caps, and speed limit controls. Check the current pricing at localtonet.com, as plans are updated periodically.
Ready to set up your first VLESS + WS tunnel?
Create your Localtonet account for free. No credit card needed. Your first proxy tunnel is a few clicks away.
Get Started Free →
