VPS Proxy Setup Tutorial: A Detailed Guide for Beginners

Hello everyone, I'm Nayue. I recently spent some time researching VPS setup. Thanks to teacher codex; I really managed to figure out every step by asking codex, and after succeeding, I wanted to write an article to share with everyone.

I hope this helps you, and please let me know if I've made any mistakes~

1. Why You Need a Domain and a VPS

If you just need to bypass censorship temporarily, the easiest way is to buy a ready-made proxy. But if you want to control node configuration, protocol selection, certificate management, and client subscription methods yourself, building your own VPS is more controllable and better for long-term use.

This article aims to help you have your own proxy, but my tutorial is not the most comprehensive or perfect. To achieve more functions and more secure configurations, you need to study more tutorials. The purpose of this tutorial is to get you started quickly.

The final result is: you have your own domain, for example: node.example.com.

It points to the VPS you purchased. The proxy service runs on the VPS, the client connects to the VPS through this domain, and then the VPS accesses the target website.

The overall relationship can be understood as:

1Mobile / Computer Client
2        ↓
3node.example.com
4        ↓
5VPS Public Server
6        ↓
7Target Website

There are two key components here: the domain and the VPS.

The role of the domain is to provide a stable, readable, and certificate-signable entry point. In theory, you could connect directly using the VPS's IP, but this is not recommended in practice.

There are three reasons:

First, domains are easy to migrate. If the VPS IP is changed, the line quality degrades, or you switch providers, you only need to change the DNS record of the domain to the new IP, and the client still connects to the same domain.

Second, domains make it easy to apply for TLS certificates. This article uses a scheme with TLS, and the client verifies the certificate when connecting. Applying for a certificate with a domain is more natural and closer to how ordinary HTTPS services are used.

Third, domains are convenient for subsequent management. For example, you can name your main node:

node.example.com

Backup node:

node2.example.com

Subscription service:

sub.example.com

This is clearer than remembering a string of IPs.

The role of the VPS is to provide a public server. It needs a public IP, a stable network, sufficient traffic, and must allow you to log in via SSH to install services.

This article uses the Ubuntu 22.04 system. The configuration doesn't need to be very high; 1C2G is usually enough for personal use. What you really need to focus on is the data center location, bandwidth, and monthly traffic.

It should be noted that this solution is only suitable for personal learning and self-use. Do not share nodes with strangers, and do not post sensitive information such as subscription links, QR codes, UUIDs, or server IPs on public pages.

2. Preparation: Domain, VPS, Cloudflare Account, SSH Tools

Before starting, prepare the things that will be used this time. This part is not complicated, but it's recommended to organize everything at once to avoid back-and-forth troubleshooting later.

The combination I actually used this time is:

1Domain Registrar: Porkbun
2DNS Management: Cloudflare Free
3VPS Region: Hong Kong
4VPS System: Ubuntu 22.04
5VPS Config: 1C2G / 100Mbps / 30G Disk / 300G Monthly Traffic
6Server Script: v2ray-agent
7Proxy Core: Xray-core
8Final Protocol: VLESS + TCP + TLS + Vision
9Computer Client: Clash Verge
10Mobile Client: Shadowrocket

Some friends might ask, "Hey, if you buy a Hong Kong VPS, how do you subscribe to AI?"

Haha, don't panic. This VPS is not for playing with AI. If your goal is to use foreign AI, then look for a corresponding stable VPS to buy. You don't need to copy my VPS provider exactly; there are many VPS recommendations on X.

2.1 A Domain

Domains can be purchased on platforms like Porkbun, Namecheap, or Cloudflare Registrar. I used Porkbun this time, which costs about $11 a year, a normal price.

When buying a domain, you only need to buy the domain itself; you don't need extra web hosting services. Later, we will configure the service on the VPS ourselves, and the certificate will be applied for using the free Let's Encrypt.

When purchasing, it's recommended to confirm these items:

1Domain purchased successfully
2Whois privacy protection enabled
3Auto-renewal enabled
4Account 2FA enabled
5No extra Web Hosting purchased
6No extra paid SSL purchased

Again, buying a domain is not for making a website, but to provide a stable access entry for the VPS.

For example, we will later configure a subdomain:

node.example.com

Point it to the VPS's public IP. When the client connects, it accesses this domain instead of writing the VPS IP directly.

2.2 A Cloudflare Account

Cloudflare is mainly responsible for DNS management here; you don't have to buy the domain at Cloudflare.

My actual practice is:

1Domain purchased at Porkbun
2DNS managed by Cloudflare

That is, change the Nameservers in Porkbun to the two Nameservers assigned by Cloudflare. This way, all DNS records will be configured in Cloudflare in the future.

This step will be detailed later. For now, just prepare a Cloudflare account and choose the free plan.

Open https://dash.cloudflare.com/

After registering/logging in:

1Add a domain
2↓
3Enter your domain (e.g., xxx.com), enter the root domain
4↓
5Select the Free plan
6↓
7Cloudflare will scan existing DNS records
8↓
9Continue

Cloudflare will finally give you two nameservers, formatted like:

1xxxx.ns.cloudflare.com
2yyyy.ns.cloudflare.com

2.3 A VPS

The VPS is the machine that actually runs the service. It needs a public IPv4, SSH access, and ports 80 and 443 must be usable.

I bought mine from Global Cloud, https://my.locvps.net/idcSystem.aspx?

I'm not doing any advertising. Everyone's needs are different; you can buy the VPS you need elsewhere based on your requirements.

2.4 SSH Login Tool

I use the built-in terminal on Mac to log in to the VPS. macOS doesn't need extra SSH tools; just open the terminal.

The SSH login command format is:

1ssh root@<VPS_IP> -p <SSH_PORT>
2Example:
3ssh root@203.0.113.10 -p 43781

2.5 Client Software

After the server is set up, you need to import the node on your computer or phone.

I mainly used two clients this time:

1Mac: Clash Verge
2iPhone: Shadowrocket

Clash Verge is suitable for importing subscriptions. Later, v2ray-agent will generate a ClashMeta format subscription, which can be added directly to Clash Verge.

Shadowrocket is suitable for testing a single node on iPhone. Even if there is no specific Shadowrocket format in the subscription, you can copy the vless:// link output by the installation script and import it manually.

3. Connecting the Domain to Cloudflare

After buying the domain, the next step is to hand over DNS management to Cloudflare.

Remember the two nameservers from earlier? We are going to configure them.

The role of these two Nameservers is to tell the global DNS system:

This domain will be managed by Cloudflare for resolution records from now on.

In other words, Porkbun is still the domain registrar, but DNS records are moved to Cloudflare management.

I'll use Porkbun as an example to demonstrate how to modify it. If you bought from other platforms, you can find the modification method yourself.

Enter the domain details and find the Nameservers configuration.

Replace the original Porkbun Nameservers with the two provided by Cloudflare.

After saving, you should see these two Cloudflare addresses in the Nameserver area of Porkbun.

Saving this step doesn't mean it takes effect globally immediately. DNS changes take time to propagate, usually from a few minutes to a few hours. The Cloudflare page will also prompt:

Verifying if your domain is pointed to Cloudflare.

This is normal. The official prompt might say 1 to 2 hours, up to 24 hours. Actually, I only waited a short while this time.

After modification, go back to Cloudflare and wait for verification.

Once successful, Cloudflare will display something like:

Your domain is now protected by Cloudflare.

Or show the site status as Active.

This status means:

The domain has successfully pointed to Cloudflare. Subsequent DNS records can be configured in Cloudflare.

Before this step is completed, it's not recommended to rush into installing the server script. Because applying for certificates and verifying domain IPs later depends on correct DNS propagation. If the DNS hasn't fully switched, you'll likely encounter domain verification failures later.

After the Cloudflare page shows success, it's best to confirm once more with a command.

In the Mac terminal, execute:

dig +short NS example.com

Normally, it should return Cloudflare's Nameservers.

If it still returns Porkbun's Nameservers, it means DNS management hasn't fully switched to Cloudflare. At this time, don't continue configuring the node; wait a while and check again.

4. Configuring DNS: Adding Records and Keeping the Gray Cloud

After the domain is connected to Cloudflare, the next step is to add the DNS record in Cloudflare that actually points to the VPS.

What I actually used here is:

1Root domain: xxx.com
2Node domain: node.xxx.com
3VPS IPv4: xx.xx.xx.xx
4Cloudflare record status: DNS only

4.1 Enter the Cloudflare DNS Page

Log in to Cloudflare, enter your site, and then open:

1DNS → Records

Here you will see DNS records scanned or already existing in Cloudflare.

If your domain just came over from Porkbun, you might see some default records, such as:

1A record
2CNAME record
3MX record
4TXT record

You can delete these first; we will configure a new one ourselves.

Since I plan to use 'node' as the node domain, I need to add a record for 'node'.

4.2 Add an A Record

Click:

1Add record

Then fill in:

1Type: A
2Name: node
3Content: VPS Public IPv4
4TTL: Auto
5Proxy status: DNS only

4.3 Why You Must Choose the Gray Cloud Here

There are two common states for Proxy status in Cloudflare:

1Proxied: Orange cloud
2DNS only: Gray cloud

In this article, you must choose:

DNS only

Which is the gray cloud.

The difference can be simply understood as:

Gray cloud: Cloudflare is only responsible for DNS resolution; the client connects directly.

Orange cloud: The client connects to Cloudflare first, and then Cloudflare forwards it to the origin site.

For ordinary websites, like blogs, official sites, or static pages, using the orange cloud allows you to use Cloudflare's CDN, WAF, caching, and hide the origin IP.

But this tutorial uses:

VLESS + TCP + TLS + Vision

It's not an ordinary HTTP website reverse proxy scenario. To allow the client to establish a direct connection with the Xray service on the VPS, this 'node' record should remain a gray cloud.

4.4 Verify if DNS Resolves to the VPS

After saving the DNS record, execute in the Mac terminal:

1dig @1.1.1.1 +short A [your domain, e.g., node.example.com]
2dig @8.8.8.8 +short A [your domain, e.g., node.example.com]
3dig @223.5.5.5 +short A [your domain, e.g., node.example.com]

The normal result should return your VPS IP.

Note: If your computer has a proxy enabled and uses TUN mode, it might affect the terminal output. Please turn off TUN mode before performing this verification.

5. Initializing the Server

First, log in to the server via SSH:

1Example:
2ssh root@203.0.113.10 -p 43781

When logging in for the first time, the terminal might prompt whether to trust the server fingerprint:

1Are you sure you want to continue connecting (yes/no/[fingerprint])?

Enter: yes.

Then enter the root password.

After logging in, first update the package list:

1apt update
2apt upgrade -y

If it gets stuck on a blue or purple configuration interface midway, don't just close the window. Ubuntu will ask whether to keep local configuration files when upgrading certain packages.

I encountered two configuration file prompts this time.

The first one was:

The second one was:

1/etc/cloud/cloud.cfg

The terminal prompt looked like:

1cloud.cfg (Y/I/N/O/D/Z) [default=N] ?

Press Enter directly here to use the default: N

Before the upgrade completes, Ubuntu might pop up an interface:

1Daemons using outdated libraries
2Which services should be restarted?

It's asking: some services are still loading old versions of libraries; should these services be restarted?

Generally, keep the default selections and choose: OK

After the system update is complete, install some tools that will be used later:

1apt install -y curl wget sudo vim ufw lsof unzip socat jq qrencode dnsutils

These tools will be used for:

1curl / wget: Downloading scripts, testing access
2ufw: Configuring the firewall
3lsof / ss: Checking port occupancy
4unzip: Unzipping files
5socat: Might be used when applying for certificates
6jq: Processing JSON
7qrencode: Generating QR codes
8dnsutils: Providing the dig command

Final step to check if the domain points to the server:

1curl -4 ifconfig.me
2dig +short A [your domain, e.g., node.example.com]

These two results should be consistent.

6. Configuring the Firewall and Making a Pre-installation Backup

After the VPS initialization is complete, don't rush to install v2ray-agent. Do two things first:

First, configure the firewall and confirm that SSH, 80, and 443 ports are available.

Second, back up current key configurations to facilitate rollback if problems occur later.

This step doesn't look complicated, but it's very important. Especially the firewall; if the order is wrong, you might lock yourself out of the server.

6.1 Confirm the Current Login Port First

Before configuring the firewall, confirm which port you are currently using to log in to the VPS.

If your login command is:

ssh root@203.0.113.10 -p 43781

Then your SSH port is:

43781

Don't guess this step. Many VPS providers don't use the default port 22 but give you a custom SSH port. I was given a custom port this time.

If you enable the firewall later but forget to allow this port, you might find:

The current SSH session isn't disconnected, but new windows can never connect to the server again.

So the first firewall rule must allow the SSH port.

6.2 Allow Necessary Ports

Three ports are needed later in this article:

1SSH port: For remote login to the VPS
280/tcp: For HTTP certificate verification
3443/tcp: For the final proxy service

Execute on the VPS:

1ufw allow 43781/tcp
2ufw allow 80/tcp
3ufw allow 443/tcp

If your SSH port is not 43781, please replace it with your own port.

After execution, you can check the rules first:

ufw status verbose

If it says:

Status: inactive

It's okay; it means the rules have been added, but the firewall hasn't been enabled yet.

6.3 Enable UFW Firewall

After confirming the SSH port is allowed, enable UFW:

ufw enable

The system will prompt:

Enter:

y

Then check again:

ufw status verbose

Normally you should see something like:

1Status: active
2
3To                         Action      From
4--                         ------      ----
543781/tcp                  ALLOW       Anywhere
680/tcp                     ALLOW       Anywhere
7443/tcp                    ALLOW       Anywhere
843781/tcp (v6)             ALLOW       Anywhere (v6)
980/tcp (v6)                ALLOW       Anywhere (v6)
10443/tcp (v6)               ALLOW       Anywhere (v6)

If you don't need IPv6, you can ignore the v6 rules for now. The key here is that IPv4 SSH, 80, and 443 must all be ALLOW.

6.4 Open a New Terminal to Test SSH

After enabling the firewall, don't close the current SSH window immediately.

The correct way is: keep the current window open, open a new terminal window on the Mac, and log in to the VPS again.

Execute:

ssh root@203.0.113.10 -p 43781

If the new window can log in normally, it means the firewall didn't block SSH.

After confirming everything is fine, continue with the subsequent steps.

If the new window cannot log in but the old window is still there, you can immediately check:

ufw status verbose

Confirm if you forgot to allow the SSH port. If it's indeed misconfigured, you can temporarily disable UFW:

ufw disable

Then reconfigure.

6.5 Make a Pre-installation Backup

After confirming the firewall is fine, start the backup.

The goal of this step is to save the key state before installing v2ray-agent. Later, the script will change Nginx, certificate directories, Xray configurations, etc. If the installation fails, at least you know what it was like before.

Execute:

mkdir -p /root/backup-before-v2ray-agent

Back up Nginx configuration:

Back up Let's Encrypt certificate directory:

Back up SSH configuration:

Record current port occupancy:

ss -tulpn > /root/backup-before-v2ray-agent/ports-before.txt

Record current firewall status:

ufw status verbose > /root/backup-before-v2ray-agent/ufw-status.txt

Finally, check the backup results:

ls -lah /root/backup-before-v2ray-agent

My output at the time was similar to:

1total 28K
2drwxr-xr-x 4 root root 4.0K May  2 08:02 .
3drwx------ 6 root root 4.0K May  2 08:02 ..
4drwxr-xr-x 9 root root 4.0K May  2 07:56 letsencrypt
5drwxr-xr-x 8 root root 4.0K May  2 07:56 nginx
6-rw-r--r-- 1 root root 1.1K May  2 08:02 ports-before.txt
7-rw-r--r-- 1 root root 3.1K May  2 06:58 sshd_config
8-rw-r--r-- 1 root root  600 May  2 08:02 ufw-status.txt

6.6 Check Current Port Occupancy

Before installing v2ray-agent, it's best to see if 80 and 443 are already occupied.

Execute:

If there is no output, it means no process is currently listening on 80 or 443.

If Nginx is already installed, you might see Nginx listening on 80 or 443. Later, the v2ray-agent script will usually handle Nginx configuration, but you should at least know the state before installation.

7. Installing v2ray-agent and Choosing Xray + VLESS Vision

After the server is ready, you can officially install the server program.

What I used this time is:

1Server script: v2ray-agent
2Core: Xray-core
3Protocol: VLESS + TCP + TLS + Vision
4Port: 443
5Domain: node.example.com
6Certificate: Let's Encrypt

7.1 Download and Run the Installation Script

Execute on the VPS:

wget -P /root -N --no-check-certificate "https://raw.githubusercontent.com/mack-a/v2ray-agent/master/install.sh"; && chmod 700 /root/install.sh && /root/install.sh

This command does three things:

1Download install.sh to /root
2Add execution permission to install.sh
3Run the installation script

When I ran it, the information displayed by the script was similar to:

1Author: mack-a
2Current version: v3.5.14
3Github: https://github.com/mack-a/v2ray-agent
4Description: Eight-in-one coexistence script

The main menu will appear after the installation script runs:

11. Install
22. Custom combination installation
33. One-click no domain
44. Hysteria 2 management
55. REALITY management
66. Tuic management
77. User management
88. Fake site management
99. Certificate management
1010. CDN node management
11...

Choose here:

Custom combination installation

The reason is we want to explicitly choose:

1Xray-core
2VLESS + TLS_Vision + TCP

Don't let the script take us down the no-domain or other default paths.

7.2 Choose Core: Xray-core

After entering the custom combination installation, the script will prompt to choose a core:

1Function 1/1: Select core installation
2
31. Xray-core
42. sing-box

I choose here:

Xray-core

The reason is I'm going with the classic Xray + VLESS Vision scheme, which has mature compatibility, and clients like Clash Verge and Shadowrocket can support it.

Enter:

1

Then press Enter.

7.3 Choose Protocol: VLESS + TLS Vision + TCP

Next, the script will display a list of protocols. The options I saw at the time were similar to:

10. VLESS+TLS_Vision+TCP [Recommended]
21. VLESS+TLS+WS [Recommended for CDN only]
33. VMess+TLS+WS [Recommended for CDN only]
44. Trojan+TLS [Not recommended]
57. VLESS+Reality+uTLS+Vision [Recommended]
612. VLESS+Reality+X_HTTP+TLS [CDN available]

Choose here:

VLESS+TLS_Vision+TCP [Recommended]

Enter:

0

Then press Enter.

7.4 Install Basic Components

After choosing the protocol, the script will start installing dependencies.

The process I saw was similar to:

1Progress 1/12: Installing tools
2---> Checking and installing updates
3---> Installing unzip
4---> Installing socat
5---> Installing crontabs
6---> Installing jq
7---> Installing ping6
8---> Installing qrencode
9---> Installing nginx
10---> Installing acme.sh

Several components that will be used later will be installed here:

1nginx: Related to fake sites and local forwarding
2acme.sh: Applying for TLS certificates
3jq: Processing configurations
4qrencode: Generating QR codes
5socat: Might be used during certificate application

This step might be slower on a new machine. If there is no output for a long time, wait a while; don't interrupt frequently.

7.5 Enter Node Domain

The script will then enter the Nginx and certificate initialization process, prompting for a domain:

Please enter the domain to be configured Example: www.v2ray-agent.com --->

Enter your domain, such as:

node.example.com

Note that you should enter the full subdomain here, not the root domain.

7.6 Enter Port: Use Default 443

After entering the domain, the script will prompt for a port:

Please enter the port [Default: 443], custom port available [Press Enter for default]

Press Enter directly here to use the default:

443

My script displayed:

---> Port: 443

The firewall already allowed:

443/tcp

So it can be used directly here.

7.7 Wait for Domain IP Verification

After the port is confirmed, the script will check if the domain resolution is correct.

Normally you will see something like:

1---> Domain IP verification passed
2---> Deleting Nginx default configuration
3---> Nginx started successfully
4---> Nginx closed successfully
5---> Detected port 443 is open
6---> Checking domain IP
7---> Current domain IP is correct

If this fails, don't force the installation. Go back to the DNS check first:

dig @1.1.1.1 +short A node.example.com

dig @8.8.8.8 +short A node.example.com

Ensure it returns the VPS IP.

Also check if this record in Cloudflare is a gray cloud:

Proxy status: DNS only

If it's set to orange cloud, script detection and subsequent connections might be abnormal.

7.8 Apply for TLS Certificate

Next, enter the certificate application stage:

Progress 3/12: Applying for TLS certificate

The script will ask:

Do you want to use DNS API to apply for the certificate [NAT supported]? [y/n]

I choose here:

n

The reason is this VPS has a public IPv4, and ports 80 and 443 are already allowed, so there's no need to use DNS API to apply for the certificate.

Then the script will let you choose a certificate authority:

11. letsencrypt [Default]
22. zerossl
33. buypass [DNS application not supported]

Press Enter directly here to use the default:

letsencrypt

Let's Encrypt is a free certificate, which is completely sufficient for personal use. The certificate itself is not the key factor causing node abnormalities; what really needs to be guaranteed is:

Correct domain resolution

Successful certificate application

Normal renewal tasks

Correct server configuration

7.9 UUID and Username

Later, the script will prompt for a UUID:

Please enter a custom UUID [must be legal], [Press Enter] for a random UUID

It's recommended to press Enter directly to let the script generate one randomly.

Then it prompts for a username:

Please enter a custom username [must be legal], [Press Enter] for a random username

You can also press Enter directly to generate one randomly. You can also enter a name that's easy for you to identify, but don't use real names, phone numbers, emails, or other personal information.

7.10 Account Output After Installation

After the installation is complete, the script will enter the final step:

Progress 12/12: Account

My output at the time was:

1VLESS TCP TLS_Vision [Recommended]
2General format (VLESS+TCP+TLS_Vision)
3vless://...
4Formatted plaintext (VLESS+TCP+TLS_Vision)
5Protocol type: VLESS
6Address: node.example.com
7Port: 443
8User ID: ...
9Security: tls
10client-fingerprint: chrome
11Transmission method: tcp
12flow: xtls-rprx-vision
13Account name: ...
14QR Code VLESS

This indicates that the server has generated a VLESS Vision node.

7.11 Check Xray and Nginx Status

After installation, don't rush to import to the client. Check the service status on the VPS first:

1systemctl status xray --no-pager
2systemctl status nginx --no-pager
3ss -tulpn | grep -E '(:443|:80|xray|nginx)'

The key results I checked were:

1xray.service active (running)
2nginx.service active (running)
3xray listening on public *:443
4nginx listening on 127.0.0.1:31300 and 127.0.0.1:31302

This means:

The public 443 entry is taken over by Xray, Nginx provides fake sites or auxiliary services on local ports, and the services have started normally.

If xray.service is not active (running), you need to look at the logs first; don't continue importing to the client.

You can execute:

journalctl -u xray --no-pager -n 80

8. Generating Subscription Links and Preparing for Clash Verge

After the installation in the previous section, the script has already output a single vless:// node link. This link can be directly imported into clients like Shadowrocket.

But if you are using Clash Verge on Mac, it's more recommended to generate a subscription link.

The benefits of subscription links are:

1The client only needs to add the subscription once
2Refresh the subscription after node information changes
3Easier management for multiple users or multiple nodes
4Clash Verge can directly use the ClashMeta format

When I actually generated the subscription, I used the user management function of v2ray-agent:

1vasma
2→ 7. User management
3→ 2. View subscription
4→ Select ClashMeta format

8.1 Reopen the v2ray-agent Menu

After the installation script is finished, it will automatically create a shortcut command:

vasma

Execute on the VPS:

vasma

This will reopen the v2ray-agent main menu.

In the menu, you can see:

11. Install
22. Custom combination installation
33. One-click no domain
44. Hysteria 2 management
55. REALITY management
66. Tuic management
77. User management
88. Fake site management
99. Certificate management
1010. CDN node management
11...

Choose here:

User management

8.2 Enter View Subscription

After entering user management, you will see a menu like:

1Function 1/1: Account management
2
31. View account
42. View subscription
53. Manage other subscriptions
64. Add user
75. Delete user

Choose here:

View subscription

This step will regenerate the subscription content for the local account.

The script will also prompt something like:

Viewing the subscription will regenerate the subscription for the local account. You need to manually enter the md5 encrypted salt value. If you don't know, just use a random one. It doesn't affect the content of already added remote subscriptions.

If you are just using it for yourself, just use the default random value.

8.3 Enter Subscription Port

The script will prompt:

1Starting subscription configuration, please enter the subscription port
2
3Please enter a custom port [must be legal], ports cannot be repeated, [Press Enter] for a random port

There are two choices here:

Press Enter directly: The script generates a random port

Manually enter a port: Easy for you to remember, but it cannot conflict with existing ports

I suggest beginners press Enter directly to let the script generate a random port.

If you choose a custom port, you need to extra confirm:

The port is not occupied

The firewall has allowed this port

The provider's security group also allows this port

To reduce variables, using a random port for the first configuration is easier.

8.4 Fake Site Prompt

The script might prompt:

Starting to add fake site

Detected fake site installation, do you need to reinstall [y/n]

If you already configured a fake site when installing VLESS Vision earlier, usually choose:

n

Which means do not reinstall.

Reinstalling is not impossible, but there's no need to add variables in a beginner tutorial. Our current goal is just to generate a subscription link, not to reconfigure the fake site.

8.5 How to Choose the Salt Value

Later, the script will prompt for a salt:

Please enter the salt value, [Press Enter] to use random

Just press Enter here.

The role of salt can be simply understood as:

A random value used to generate subscription-related content

There's no need to manually specify it for personal use. A random value is actually safer and avoids reusing fixed strings.

8.6 Choose ClashMeta Format Subscription

After the subscription is generated, the script will display multiple formats.

You will actually see:

Default

ClashMeta

sing-box

For using Clash Verge on Mac, it's recommended to choose:

ClashMeta

The reason is Clash Verge has better support for ClashMeta configurations, and fields like VLESS Vision, fingerprint, and flow are also more suitable for the ClashMeta format.

If you are using other clients, you can choose based on client support:

Clash Verge: ClashMeta

sing-box: sing-box

Shadowrocket: Usually can directly import single vless:// links

Don't just copy the "Default" format to Clash Verge. Use ClashMeta if available.

8.7 Save the Subscription Link

After the script outputs the subscription link, copy the ClashMeta subscription link and save it in a safe local place first.

Note: Do not save it in public repositories, do not post it in articles, and do not show the full link in screenshots.

The reason is simple: if others get your subscription link, they might use your node directly, consume your VPS traffic, and even cause the node to be abused.

9. Importing the Subscription into Clash Verge and Testing

The server is already installed, and the subscription link has been generated. Next, configure the client on the Mac.

9.1 Add Subscription

Open Clash Verge and enter the configuration page. Different versions might have slightly different interface text, usually called:

Profiles

Or:

Configuration

Click to add a new subscription and fill in the ClashMeta subscription link generated in the previous step.

Generally, you need to fill in:

Name: Custom, e.g., My VPS

Type: Remote

URL: ClashMeta subscription link

Don't put the full subscription link in the name.

After filling it in, save it, and then click to update the subscription.

If the subscription is normal, Clash Verge will pull the node configuration and display the VLESS Vision node just generated in the node list.

9.2 Select Node

After the subscription is updated successfully, enter the node selection page.

Usually, you will see one or more policy groups, such as:

ProxyAutoGlobalNodeName

Select the node just generated.

9.3 Turn on System Proxy or TUN

Clash Verge usually has two common switches:

System Proxy

TUN Mode

Simple understanding:

System Proxy: Let most applications that follow system proxy settings go through Clash

TUN Mode: More low-level, takes over more traffic, including some applications that don't follow system proxy

When testing for the first time, you can turn on:

System Proxy

Then use a browser to access a test website.

If some applications don't follow the system proxy, then consider turning on TUN.

9.4 Test Exit IP

Open the browser and visit:

https://ifconfig.me

If the proxy is working, the IP displayed on the page should be the exit IP of the VPS, not your local broadband IP or mobile operator IP.

You can also execute in the terminal:

curl https://ifconfig.me

If Clash Verge's system proxy doesn't work for the terminal, use the browser page result as the standard.

9.5 Test External Websites and Videos

After the exit IP is normal, you can continue testing several websites:

1Google
2YouTube
3GitHub
4Telegram
5The websites you actually need to access

When testing, don't just check if the homepage can be opened, but also check:

Whether the webpage can load normally

1Whether the webpage can load normally
2Whether the video can play
3Whether it's stable for a few minutes
4Whether there are frequent disconnections
5Whether the speed meets expectations

If YouTube can be opened but the video is very laggy, it's not necessarily a configuration error; it might be:

1Average VPS line quality
2Peak hour congestion
3Monthly traffic throttling
4Client rules not set correctly

If a specific website reports an error but other websites are normal, don't rush to reinstall the server. You can judge according to the following ideas:

1Only one website is abnormal: Prioritize checking rules, DNS, and target site restrictions
2All websites are abnormal: Prioritize checking node connection, subscription, and server status
3Mobile can access but Mac cannot: Prioritize checking Clash Verge / TUN / Fake-IP
4VPS can access via curl but client cannot: Prioritize checking client configuration

Final Words

Once all the above steps are completed, congratulations, you have your own proxy!

Be very careful not to share it with others, and especially do not involve money transactions, as it can be very dangerous~

Also, to reiterate, this tutorial is just for getting started. Many experts will perform more extra configurations or use different protocols; explore those on your own!

This article was automatically converted and formatted from Markdown by YouMind.