VLESS monitoring

TunnelHQ auto-detects vless:// links for Xray-core and V2Ray-core servers, supports XTLS/Vision flow and REALITY, and tests all common transports: raw, ws, grpc, xhttp and httpupgrade.

Why VLESS needs specialized monitoring

VLESS is a stateless Xray/V2Ray protocol designed to minimize detectable fingerprints. A typical deployment combines several layers:

• A transport (raw / TCP, WebSocket, gRPC, xhttp, httpupgrade, KCP)
• A security layer (TLS, REALITY, XTLS/Vision flow, none)
• Optional fallback to a real website on 443 to appear legitimate

Port probing tells you almost nothing. A VLESS server running REALITY on 443 is indistinguishable from a normal HTTPS web server at the TCP level. That's the entire point of REALITY. If the Xray process crashes but nginx is still running on 443 as a fallback, a naive monitor sees "up" while users see failed connections.

TunnelHQ parses the vless:// URI, performs the actual VLESS handshake over the correct transport with the correct security layer, and verifies that you get a real VLESS response. Not a TLS handshake from a fallback website.

URI auto-detection

Paste any standard vless:// URI and TunnelHQ identifies the config parameters automatically:

vless://[email protected]:443?
  encryption=none&
  flow=xtls-rprx-vision&
  security=reality&
  sni=www.microsoft.com&
  pbk=aH5L8_JK2M...&
  sid=01ab&
  fp=chrome&
  type=tcp#Production-Server

From this, TunnelHQ extracts:

• UUID (5b8d8f2e-...)
• Endpoint (vpn.yourdomain.com:443)
• Security (reality) and the public key / short ID / fingerprint
• Flow (xtls-rprx-vision)
• Transport (tcp, or ws / grpc / xhttp as applicable)
• SNI masquerade target

Supported VLESS configurations

Security layers

• TLS. Standard, with SNI and ALPN
• REALITY. Full support with public key, short ID, and fingerprint
• XTLS/Vision flow.xtls-rprx-vision, including the udp443 variant
• None. For dev/testing deployments

Transports

• raw/tcp
• WebSocket. Path and Host header parsed from URI
• gRPC. Service name parsed
• xhttp. Xray v1.8.8+ transport
• httpupgrade. Lightweight WS alternative

REALITY-aware checks

REALITY is deliberately hard to detect. But it's also unusually sensitive to misconfigs. Common failure modes TunnelHQ catches:

• Short ID not matching any configured entry
• Public key rotation without client update
• SNI target changed / certificate on the masquerade target expired
• Fingerprint drift (browser minor version rollout changing expected behavior)

What a failed check tells you

A failed check comes with a message that says where to look. On a VLESS tunnel the most common is Tunnel established - Internet is stuck, followed by Tunnel unreachable.

• Tunnel established - Internet is stuck. The proxy connection worked, but traffic through it didn't reach the internet. Check the server's routing and NAT, its DNS, and whether its outbound traffic is blocked.
• Tunnel unreachable. The connection didn't come up. Check that the server is running, that the host and port in the link are reachable, and that the link's credentials and transport settings (such as security, sni, and type) match the server's.

Pricing for VLESS monitoring

All plans include VLESS monitoring.

See the full plan comparison

Read more

• VLESS in the docs
• Monitoring V2Ray subscription URLs in production
• VMess monitoring
• Trojan monitoring