Alex designs and hardens EU VPS fleets in Frankfurt and Amsterdam. He spends most days on Docker, KVM networking, NVMe layouts, and keeping Ubuntu 24.04 boxes boringly reliable for production workloads.
Scope of this guide
You will install Xray-core (V2Ray-compatible) on Ubuntu 24.04, enable it under systemd, and start from a minimal inbound config. Clients (v2rayN, Streisand, etc.) then point at your VPS IP or domain.
Prefer a clean KVM VPS. OrbitHost Frankfurt/Amsterdam locations give low latency inside Europe. Follow your region’s laws and the hosting acceptable use policy.
Install Xray-core
Official install scripts fetch the latest Linux amd64 release and place binaries under `/usr/local/bin` with a systemd unit. Review scripts before piping to bash, or download the release tarball manually from GitHub if you want full auditability.
sudo apt update && sudo apt install -y curl unzip
bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install
xray version
sudo systemctl enable xrayMinimal config skeleton
Xray reads `/usr/local/etc/xray/config.json` by default on the official unit. Start with a VLESS inbound on a high port and a freedom outbound. Replace UUIDs with `xray uuid` output — never reuse sample UUIDs from blogs on the public internet.
This example is intentionally simple for connectivity testing. Production setups usually add TLS, REALITY, or a reverse proxy — see upstream docs for those patterns.
{
"log": { "loglevel": "warning" },
"inbounds": [
{
"port": 44333,
"protocol": "vless",
"settings": {
"clients": [
{ "id": "REPLACE_WITH_XRAY_UUID", "flow": "" }
],
"decryption": "none"
},
"streamSettings": { "network": "tcp" }
}
],
"outbounds": [
{ "protocol": "freedom" }
]
}Generate UUID and validate JSON
Generate a UUID, paste it into the config, then run `xray -test` before restarting the service. Invalid JSON is the most common first-boot failure.
xray uuid
sudo nano /usr/local/etc/xray/config.json
sudo xray -test -config /usr/local/etc/xray/config.json
sudo systemctl restart xray
sudo systemctl status xray --no-pagerFirewall and SSH hygiene
Open only the inbound proxy port and SSH. Do not expose panel UIs on the same host without auth and TLS. Keep the VPS updated; proxy nodes are internet-facing by design.
sudo ufw allow OpenSSH
sudo ufw allow 44333/tcp
sudo ufw enable
sudo ufw statusClient checklist
In the client, match protocol (VLESS), address (VPS IP or domain), port, UUID, and transport (tcp in the sample). Test with a simple HTTPS request once connected.
If the handshake fails, confirm the service is listening (`ss -tulpn | grep 44333`), UFW allows the port, and the UUID matches exactly. Cloud security groups — if any — must allow the same port.
Hardening next steps
Move to 443 with proper TLS or REALITY when you leave lab mode. Restrict client UUIDs, rotate them if a device is lost, and monitor bandwidth for abuse.
For a private LAN between machines rather than an application proxy, WireGuard is usually simpler — see our WireGuard VPS guide. OrbitHost `/vps-for-v2ray` and `/vps-for-xray` plans are the same KVM NVMe fleet; choose based on the stack you document for yourself.
- Prefer unique UUIDs per device
- Log at warning unless debugging
- Keep fail2ban/SSH keys enabled
- Document your inbound port inventory
Related products
FAQ
V2Ray or Xray?
Xray-core is a widely used fork with active protocol work (including REALITY). Many operators standardize on Xray while keeping V2Ray-compatible client apps. Pick one core and stick to its release channel.
Do I need a domain and TLS?
Plain VMess on a raw port works for labs. For anything long-lived, put TLS (or REALITY) in front with a real hostname. That improves client compatibility and reduces obvious plaintext fingerprints.
Is this legal?
Running a proxy on infrastructure you rent is subject to local law and the provider AUP. Use it for your own privacy and lab traffic; do not abuse networks or third-party services.
How much CPU does it need?
Personal use is fine on Nano/Core VPS. Throughput scales with crypto and concurrent streams — Ryzen NVMe plans handle typical single-user and small-team loads easily.