Commenters heavily criticize the project's security claims, arguing that wrapping WireGuard in a custom transport increases attack surface and that 'stealth' capabilities are easily defeated by modern deep packet inspection. Conversely, other voices defend the approach as a pragmatic solution for circumventing censorship and argue that layering transports does not inherently compromise the underlying protocol's security.
77 readable replies · Supporting reply 1 · Supporting reply 2 · Supporting reply 3 · Supporting reply 4XTLS
Xray-core
Go2023–2026
XTLS / Xray-core
Xray-core
Xray, Penetrates Everything. Also the best v2ray-core. Where the magic happens. An open platform for various uses.
12Distinct people
12Mentions
0Explicit recommenders
42.9KGitHub stars
What to know before exploring
What it is
Xray, Penetrates Everything. Also the best v2ray-core. Where the magic happens. An open platform for various uses.
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- v2fly/v2ray-core · linked in 3 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:03:16 PM UTC.
Mentions over time
HN mentions by year12 dated mentions
Observed mentions: 2023-08-10 10:38:49 UTC to 2026-10-07 03:12:41 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 3 | 0 | 3 |
What Hacker News says
12 sourcesTItimbill·Oct 7, 2026
https://github.com/XTLS/Xray-core/issues/6477#issuecomment-6...
Unfortunately, the Xray author publicly downplayed the severity of the vulnerability and used insulting language toward the vulnerability reporter.
In Xray-core concealed a certificate verification bypass vulnerabilityJust swap mac address if you have to use such a wifi. Or set up Xray[0] with the captive portal as domain if you have a VPS and are so inclined. Can also use this on locked down airplane wifi.
0. https://github.com/XTLS/Xray-core
In Show HN: Will my flight have Starlink?https://github.com/XTLS/Xray-core
It won't help you get around the endpoint compliance software, I use this for my byod phone (Streisand is a nice ios client). VLESS is the proxy protocol, kinda like SOCKS I guess. It uses xhttp over TLS as the transport.
In TrustTunnel: AdGuard VPN protocol goes open-source> What's the most commonly used tool for proxying now?
https://github.com/XTLS/Xray-core
In Staying ahead of censors in 2025This is basically what Xray [1] does. For any connection request matching a particular SNI and not presenting a secret key, it proxies the entire SSL handshake and data to a camouflage website. Otherwise it can be used as a regular proxy disguised as SSL traffic to that website (with the camouflage website being set as the SNI host, so for all purposes legit traffic to that host for an external observer).
It's meant to get around the great firewall in China, so it has to avoid the GFW's active probers that check to make sure the external website is a (legit) host. However a friend was able to get it to work American's in-flight firewall if the proxy SNI is set to Google Analytics.
[1] https://github.com/XTLS/Xray-core
In Unlocking free WiFi on British AirwaysIf VPNs don't work for you, I recommend using an anti-censorship tool with an obfuscation protocol like v2ray which is commonly used in China.
https://github.com/v2fly/v2ray-core
https://github.com/XTLS/Xray-core
https://github.com/net4people/bbs
https://en.wikipedia.org/wiki/Great_Firewall
In Ask HN: The government of my country blocked VPN access. What should I use?This might not be the case for Indonesia currently, but for countries like Russia, China, Iran most of the mentioned solutions will not work. I've had to evade Russian censorship for years now - the censors (Roskomnadzor) use DPI and other means of classifying network traffic, and currently the following things are outright blocked:
- Tor
- Wireguard and derivatives (incl. Mullvad, Tailscale, ProtonVPN)
- OpenVPN
- Shadowsocks (incl. Outline)
What still works is Xray-core [1] with vless and Reality protocols, whatever those mean. Xray-core is an innovation over v2ray [2]. v2ray might also still work, but I've never tried it. If you have the capacity to run your own VPS, the simplest solution would be to install the 3x-ui [3], which is something like "Xray-core with a simple to use UI in a single package ready-to-use", but you'd also need
Read the rest
to setup some basic security measures and a firewall.
For those technically inclined, here [4] is a rough ansible playbook to install 3x-ui on a blank Debian machine. Additional configuration will be needed in the UI itself, there is a lot of online tutorials, and I link to one of them in [5] (in Russian, unfortunately). Don't just trust me blindly, please review before running!
There are also commercial xray-aware VPN providers, but I wouldn't publicly vouch for any of them.
I found it very strange that there is not much info on HN about xray and v2ray, and I also hope it stays this way for most of the people here and not here. However, we live in a weird reality and have to actively engage in such an arms race now.
As a side note, if anyone here has quality info about security of the xray-core implementation, I'd be happy to get familiar. I didn't look at the code myself and still am slightly suspicious, but oh well it works :shrug:
[1]: https://github.com/XTLS/Xray-core
[2]: https://github.com/v2fly/v2ray-core
[3]: https://github.com/MHSanaei/3x-ui/
[4]: https://pastebin.com/DjFQ8c6Z
[5]: https://habr.com/ru/articles/731608/
If you live in a part of the world where you never have to bother with VPNs, this post if not for you. Yet, if even your grandma already heard that she needs to access Youtube or any other web resource - welcome aboard!
Sadly, internet became fragmented over the last few years. You move from one country to another and to your surprise find that REPLACE_WITH_YOUR_FAVORITE_RESOURCE is all of a sudden is not available anymore. WTF?
It is a minor inconvenience when it is a feed with cat memes, but a major problem when it is, say, Youtube.
About a year ago I left London to go back to school. As you can guess, the school network (network provider actually, but who cares?) had an extensive blacklist. It hurt my studies and studies of other students. I decided to setup a VPN for me and other students. Well, I am a damn computer science student, a
Read the rest
ren't I?
Below if the blueprint on how to setup an VPN for your entire org (my uni in this case) in broad strokes.
You will need:
- Any VPS with a good network connection;
- marzban (https://github.com/Gozargah/Marzban) - SOTA proxy management tool powered by [Xray-core](https://github.com/XTLS/Xray-core);
- marzban-verify (https://github.com/aigoncharov/marzban-verify) - sidecar for mazrban to create new accounts with email verification;
- Telegram account.
What you will get:
- A Telegram bot where people can create VPN accounts on their own as long as they have access to their org emails. For instance, you can provide VPN access to all email holder at `@wtf.com`.
- Sane defaults with a 3 month expiration date and 50 GB traffic limit for new accounts (can be changed).
The blueprint:
- Find a decent VPS. Do not trust speed filters on aggregators. They lie. I had to manually search Reddit for a shortlist of suitable providers and then test them one by one. Do not go with the largest ones if you want your VPN to last. The largest providers are the first targets for censors.
- Install marzban (https://github.com/Gozargah/Marzban?tab=readme-ov-file#insta...). Set `DOCS` to `True`.
- Get SSL (https://gozargah.github.io/marzban/en/examples/marzban-ssl) and optionally set it up to work on one port (https://gozargah.github.io/marzban/en/examples/all-on-one-po...). I have a simpler Haproxy config that still works well:
```
listen front
mode tcp
bind \*:443
tcp-request inspect-delay 5s
tcp-request content accept if { req_ssl_hello_type 1 }
use_backend marz if { req.ssl_sni -i end ADDRESS_OF_MY_VPN_SERVER }
use_backend reality
backend reality
mode tcp
server srv1 127.0.0.1:12000 send-proxy-v2 tfo
backend marz
mode tcp
server srv1 127.0.0.1:10000
```
- Use BotFather (https://core.telegram.org/bots/tutorial#obtain-your-bot-toke...) in Telegram to create a new bot that your colleagues are going to use to setup their accounts.
- Setup marzban-verify (https://github.com/aigoncharov/marzban-verify?tab=readme-ov-...). Currently, it can send confirmation emails by setting up a standalone SMTP server (prone to being identified as spam, also some VPS hosters block port 25) or by using your own Exchange email (popular in enterprise envs).
- Profit!
No wise closing words. Just send your PRs if you need more email providers.
> something standard and indistinguishable, like QUIC, DTLS or TLS1.3, for their transport layer.
Exactly this does exist, search for xray / xtls-reality.
A node pretends to be a valid web site, with a valid third-party TLS certificate (like a CDN node serving that website), until a correct secret key is presented, then it looks like regular TLS-encrypted web traffic.
E.g. https://github.com/XTLS/Xray-core — most documentation, sadly but expectedly, is in Chinese and Russian, because these folks seem to need this most.
In 17-year-old student exposes Germany's 'secret' pirate site blocklistSeveral multi-protocol proxy clients support this functionality, some notable open-source examples include:
- [sing-box](https://github.com/SagerNet/sing-box)
- [clash-meta](https://github.com/muink/Clash.Meta) and other clash-based clients
- [xray](https://github.com/xtls/xray-core)
Close-sourced client include [Surge Mac/iOS](https://nssurge.com/).
In Wireproxy: WireGuard client that exposes itself as a HTTP/SOCKS5 proxyHey there! Lots of experience with this having lived in China for 2 years. I recommend you look into xray-core or v2ray.
https://github.com/v2fly/v2ray-core
https://github.com/XTLS/Xray-core
Here are my configs: https://github.com/acheong08/notes/tree/main/xray
Why this over WireGuard or OpenVPN or commercial solutions? Because it’s obfuscated and you’re much less likely to get caught. Try hosting a small game server on the same machine as well so the traffic doesn’t look too out of place.
In Tell HN: Russia has started blocking OpenVPN/WireGuard connectionsI have been researching VPN protocols that work in China and found that Xray [0] is the most recommended route to escape the GFW. An ideal VPN setup is one where packets appear as normal https traffic. Some VPN setups take it a step further and proxy the traffic through Cloudflare. Setting all this up is nowhere as easy as Wireguard. Coincidentally, I came across this project on Github earlier today which is an obfuscation proxy for Wireguard [1], but I haven't found any information about how well it works.
[0] https://github.com/XTLS/Xray-core
[1] https://github.com/database64128/swgp-go
In Russia Starts Blocking VPN Protocols