Setting up VLESS or VMess you keep running into three similar-looking fields: address, SNI (some clients call it serverName), and the camouflage domain or Host. They operate at different layers, their values may or may not match, and they need to be understood separately.

Address: who you actually dial

The target of the TCP connection. It can be an IP or a hostname; if it is a hostname the client resolves it first. For a node behind a CDN this field usually holds the CDN endpoint, not your own server.

SponsoredWhere does the subscription link come from?Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click.Get high-speed nodes

SNI: the name announced during the TLS handshake

The TLS ClientHello carries a plaintext field saying which hostname you want, and the server uses it to pick a certificate. If the SNI does not match the certificate the handshake fails outright, and the log shows a handshake failure or a certificate name mismatch.

Worth noting: the SNI travels in the clear, so middleboxes can see which domain you asked for. That visibility is exactly what many blocking systems key on, and the reason REALITY borrows a real website's name.

Host: the domain at the HTTP layer

Only WebSocket and HTTP transports have this one, and it goes into the HTTP request header. A CDN reads it to decide which origin to fetch from, so behind a CDN the Host must be the domain you configured there. Get it wrong and the CDN answers with a 404 or 502 before your server ever sees the request.

Typical combinations

  • Direct to your own server: address = server IP, SNI = certificate domain, Host usually the same as SNI.
  • Behind a CDN: address = a preferred CDN IP or the CDN hostname, SNI = your domain, Host = your domain.
Do not reach for allowInsecure when a connection fails. All it does is stop the client from validating the certificate — the handshake succeeds, and so does anyone sitting in the middle. Check the SNI against the certificate instead; see WebSocket + TLS + CDN.