Before REALITY took off, WS + TLS + CDN was the classic anti-blocking setup, and it's still useful whenever you need to hide the origin IP.

How it stacks

Proxy traffic is wrapped in WebSocket, then a TLS layer, then the domain is put behind a CDN like Cloudflare. The client connects to a CDN IP, and the CDN fetches from your server. A censor sees a visit to Cloudflare; your real server IP stays hidden.

SponsoredWhere does the subscription link come from?Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click.Get high-speed nodes

Upsides

  • Origin IP is hidden; what gets blocked is a CDN IP, recoverable by changing the domain or re-resolving.
  • A CDN's port 443 is a sea of HTTPS traffic — blending in makes you hard to single out.
  • You ride the CDN's nearby entry points, sometimes improving the route.

The cost

An extra CDN hop usually adds latency over a direct connection, and free CDNs may throttle or dislike heavy video traffic. For latency-sensitive use, direct REALITY is better.

With a CDN setup, the WebSocket path must match on both ends and should be a hard-to-guess random string to reduce active-probing exposure.