VLESS

VLESS is the lightweight successor to VMess from the Xray project. It authenticates with a UUID and adds no encryption of its own, relying on the security layer underneath. In practice that layer is almost always REALITY or TLS. MeowX supports VLESS with TLS and REALITY, XTLS Vision (flow: xtls-rprx-vision), Xray’s post-quantum VLESS encryption, the WebSocket / gRPC / XHTTP transports, and UDP with optional XUDP full-cone.

Examples

Minimal (VLESS + REALITY + Vision, the most common setup):

proxies:
  - name: vless-reality
    type: vless
    server: 192.0.2.1
    port: 443
    uuid: 00000000-0000-0000-0000-000000000000
    flow: xtls-rprx-vision
    tls: true
    servername: www.example.com
    reality-opts:
      public-key: "SERVER-PUBLIC-KEY-BASE64URL"
      short-id: "0123456789abcdef"

All supported options (VLESS over WebSocket + TLS, with XUDP):

proxies:
  - name: vless-ws-tls
    type: vless
    server: example.com
    port: 443
    uuid: 00000000-0000-0000-0000-000000000000
    udp: true
    packet-encoding: xudp
    encryption: none
    tls: true
    servername: cdn.example.com
    alpn:
      - http/1.1
    skip-cert-verify: false
    network: ws
    ws-opts:
      path: /vless
      headers:
        Host: cdn.example.com
    dialer-proxy: relay-group

Parameters

Field	Type	Required	Default	Description
`name`	string	yes	—	Node name.
`type`	string	yes	—	`vless`
`server`	string	yes	—	Server domain or IP.
`port`	integer	yes	—	Server port.
`uuid`	string	yes	—	User ID. A standard UUID (32 hex digits, with or without hyphens), or any string of 1–30 characters, which is mapped to a UUID the same way Xray does.
`flow`	string	no	—	`xtls-rprx-vision` enables XTLS Vision. Any other value is ignored (no flow).
`encryption`	string	no	`none`	VLESS encryption string, see VLESS encryption. Empty or `none` disables it.
`udp`	boolean	no	`false`	Relay UDP.
`packet-encoding`	string	no	—	`xudp` enables full-cone UDP over XUDP (not combined with Vision). Other values are ignored.
`tls`	boolean	no	`false`	Wrap the connection in TLS. Not needed for REALITY, but harmless.
`servername` / `sni`	string	no	`server`	TLS / REALITY server name (SNI). If both are set, `servername` wins.
`alpn`	list of strings	no	—	TLS ALPN protocols (ignored with REALITY).
`skip-cert-verify`	boolean	no	`false`	Accept any server certificate (TLS only).
`reality-opts`	map	no	—	`public-key` (required for REALITY) and `short-id`. See REALITY.
`network`	string	no	`tcp`	Transport: `tcp`, `ws`, `grpc` or `xhttp`. See Transports.
`ws-opts`	map	no	—	WebSocket options (`path`, `headers`). Also supplies the path for `xhttp`.
`grpc-opts`	map	no	—	gRPC options (`grpc-service-name`).
`dialer-proxy`	string	no	—	Connect to the server through another proxy or group.

Security layers

REALITY is used whenever reality-opts.public-key is set. MeowX sends a Chrome-style ClientHello and verifies the server through REALITY’s own mechanism. See REALITY.
TLS is used when tls: true and there is no REALITY public key.
Without either, VLESS runs in the clear. This is only sensible inside another encrypted layer, or with VLESS encryption.

XTLS Vision

With flow: xtls-rprx-vision, MeowX pads the start of the inner TLS handshake to hide its length pattern. Once the inner TLS connection is established, application data is copied directly without being re-wrapped. Use it the way the server is set up: normally network: tcp (no transport) with REALITY or TLS.

Vision applies to TCP only:

UDP requests are sent without the flow, as Xray’s own client does.
UDP to port 443 is refused on Vision nodes. This blocks QUIC so that browsers and apps fall back to HTTPS over TCP, which Vision handles well.
XUDP full-cone is turned off on Vision nodes; other UDP still works (one destination per stream).

VLESS encryption

encryption enables Xray’s VLESS encryption, a post-quantum hybrid handshake (ML-KEM-768 + X25519) that encrypts everything, including the VLESS header. It works even without TLS. The value is the client string the server prints, for example:

encryption: "mlkem768x25519plus.native.0rtt.SERVER-X25519-KEY-BASE64URL"

Supported:

the mlkem768x25519plus scheme with the native appearance,
server authentication with an X25519 key (the 32-byte key block),
padding blocks in the string are accepted and ignored (MeowX uses its own default padding).

Not supported: the xorpub and random appearances, and authentication with an ML-KEM-768 server key. MeowX always performs the 1-RTT handshake, even when the string says 0rtt; this works with servers configured for 0-RTT.

VLESS encryption requires iOS 26 / macOS 26 or later. On older systems, or with an unsupported string, the node stays in the list but every connection fails with an error explaining why.

UDP

UDP requires udp: true.

Without packet-encoding, each UDP flow opens its own VLESS stream bound to one destination (Xray’s standard UDP encoding).
With packet-encoding: xudp (and no Vision), one stream carries datagrams for many destinations and receives replies from any of them (full-cone NAT).

UDP keeps working through dialer-proxy, because VLESS carries UDP inside its TCP stream.

Validation

Problem	Result
`uuid` missing or empty	The whole configuration is rejected.
`uuid` is not a valid UUID and not a 1–30 character string	The node is skipped when the connection starts (reason in the log).
Invalid REALITY `public-key`	Connections fail with an error naming the key.
Unsupported `encryption` string, or OS older than iOS / macOS 26	Connections fail with an error.
Unknown `network` value (for example `h2`, `httpupgrade`)	No warning. The node connects without any transport framing and will fail against such a server.