Connect to REALITY from v2rayN, v2rayNG, sing-box and Shadowrocket

This guide connects four common apps to the server from VLESS and REALITY with Xray. v2rayN, v2rayNG and Shadowrocket import the vless:// link from step 7 of that guide. sing-box does not read links, so it gets a short config file instead. We tested v2rayN 7.25.4, v2rayNG 2.3.11, sing-box 1.14.3 and Shadowrocket 2.2.92.

1. Get the apps from the right place

Download only from these places:

• v2rayN and v2rayNG: the GitHub releases pages of the 2dust account. Each file has a .sig signature you can check with the public key published next to it. We found no official v2rayNG listing on Google Play.
• sing-box: the apps listed on sing-box.sagernet.org under Clients. Its docs warn that some apps using the sing-box name are third-party projects that carry ads.
• Shadowrocket: the App Store only, US$2.99.

Neither Shadowrocket nor the sing-box iPhone app is listed in the mainland China App Store, so iPhone users there need an Apple account from another region.

2. v2rayN on Windows, macOS and Linux

Copy the link, then in v2rayN choose Configuration and Import Share Links from clipboard (or press Ctrl+V in the main window). The server appears as a VLESS row with reality in the TLS column. Then click Reload in the top menu; in our test the proxy did not start until we did.

v2rayN runs a proxy on your own computer, on port 10808. The bar at the bottom of the window decides which apps use it:

• In the system proxy menu, choose Set system proxy. Your browser and most other apps then go through it.
• Enable Tun sends every app through it, including apps that ignore the system proxy. It needs administrator rights on Windows and your sudo password on Linux and macOS.
• The routing menu next to them defaults to the preset ending in (Whitelist), which sends Chinese sites and local addresses direct and everything else through the server.

On macOS the download is unsigned and the system reports the app as damaged. After you install it, run xattr -cr /Applications/v2rayN.app once.

To check the connection from a terminal:

$ curl -x socks5h://127.0.0.1:10808 https://api.ipify.org

It should print your VPS address.

3. v2rayNG on Android

Install the APK from the releases page; the arm64-v8a file is the right one for most phones. Copy the link, tap + and choose Import from Clipboard. Tap the new entry, tap the round button at the bottom, and allow the VPN request. The bottom line changes to Connected. Tap to check connection. Tap it: it should show your VPS address.

Two settings in the side menu control what goes through the proxy:

• Routing Settings. The default rules already send Chinese sites and local addresses direct. To restore them, tap the three dots, choose Import predefined rulesets, then China Whitelist. This replaces your current rules.
• Per-app settings. Turn on Enable per-app and tick apps: only ticked apps use the proxy. With Bypass Mode on, it works the other way round: ticked apps connect directly and the rest use the proxy.

Disconnect and connect again after changing either one. Until you do, the old rules stay active.

4. sing-box on Android, iPhone and desktop

sing-box needs a settings file in JSON instead of a link. Fill in the values from your link:

• the address after @ goes into server
• sni goes into server_name
• pbk goes into public_key
• sid goes into short_id

Save the file as d4.json:

{
  "inbounds": [ { "type": "tun", "address": ["172.19.0.1/30", "fdfe:dcba:9876::1/126"], "auto_route": true, "strict_route": true } ],
  "http_clients": [ { "tag": "rule-sets", "detour": "proxy" } ],
  "outbounds": [
    { "type": "vless", "tag": "proxy", "server": "203.0.113.10", "server_port": 443,
      "uuid": "YOUR-UUID", "flow": "xtls-rprx-vision",
      "tls": { "enabled": true, "server_name": "www.example.com",
        "utls": { "enabled": true, "fingerprint": "chrome" },
        "reality": { "enabled": true, "public_key": "YOUR-PUBLIC-KEY", "short_id": "YOUR-SHORT-ID" } } },
    { "type": "direct", "tag": "direct" }
  ],
  "dns": { "servers": [ { "type": "udp", "tag": "dns", "server": "1.1.1.1", "detour": "proxy" } ] },
  "route": {
    "rule_set": [
      { "type": "remote", "tag": "geoip-cn", "format": "binary", "url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs" },
      { "type": "remote", "tag": "geosite-cn", "format": "binary", "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-cn.srs" }
    ],
    "rules": [ { "rule_set": ["geoip-cn", "geosite-cn"], "action": "route", "outbound": "direct" } ],
    "final": "proxy", "auto_detect_interface": true, "default_domain_resolver": "dns"
  },
  "experimental": { "cache_file": { "enabled": true } }
}

Do not remove the utls block; sing-box will not connect to REALITY without it. The two rule sets list Chinese sites and addresses, and those connect directly. sing-box downloads the lists over the proxy, because GitHub is often unreachable from China. cache_file saves a copy, so later starts do not wait for the download.

On Android, open the sing-box app, tap + next to Profiles, choose Import from file and pick d4.json. Tap the start button and allow the VPN request. The iPhone and desktop apps take the same file; we tested the Android app only.

To use the command-line version on a computer instead, replace the tun entry in inbounds with { "type": "mixed", "listen": "127.0.0.1", "listen_port": 2080 }, then run:

$ sing-box check -c d4.json
$ sing-box run -c d4.json

sing-box check prints nothing when the file is valid.

5. Shadowrocket on iPhone and Mac

Copy the link, open Shadowrocket and add the server from the clipboard, then turn the connection on and allow the VPN request. The same purchase covers the Mac app. In our test on a Mac, the REALITY link imported and connected without changes.

6. Troubleshooting

• If v2rayN or v2rayNG shows received real certificate in its log, the link does not match the server. Check pbk, sid and sni. In v2rayN the log is the lower panel; in v2rayNG open Logcat from the side menu.
• In sing-box, reality verification failed means the same thing. uTLS is required by reality client means the utls block is missing.
• If sites load in one app but not another, check the per-app list and Bypass Mode.
• If nothing works in any app, check the server side with step 8 of the REALITY guide.

Where to go next

If a network blocks REALITY, a second setup on the same server may still work. Hysteria2 runs over UDP and imports into v2rayNG and Shadowrocket the same way. Before you order, use the Looking Glass to test the route from your network to each location.