reality-inbound

Scan candidate camouflage targets with scan_reality_targets, generate an X25519 key pair, then create the inbound with protocol vless, security reality, and the target's host:port as dest. Finally add a client with flow xtls-rprx-vision and retrieve the connection link.

A valid REALITY dest must support TLS 1.3, HTTP/2 in ALPN, X25519 key exchange, and a trusted certificate chain. Avoid CDN-fronted sites, major domains like google.com or apple.com, and anything blocked in your users' region; prefer low-latency hosts near your VPS.

The most common cause is the camouflage target changing: losing HTTP/2, moving behind a CDN, or serving a certificate that no longer covers your serverNames. Re-scan the current dest and update dest and serverNames together if it now fails.

No, the xtls-rprx-vision flow is valid only on TCP-based VLESS inbounds. Setting it on ws, grpc, or xhttp clients causes connection failures that look like a server-side problem.

shortIds must be hex strings of even length, at most 16 characters, and the array itself must not be empty or Xray refuses to start. An empty string inside the array is legal and admits clients that send no shortId.

The scan_reality_target and scan_reality_targets tools require panel version 3.4.2 or newer. On older panels they return 404, so you must pick the target manually against the same TLS and certificate criteria.