V2Ray WS + CDN Setup: Hiding Your Server IP with Cloudflare (Practical Guide)

Introduction: The Ultimate Camouflage Defense

The single greatest vulnerability of any self-hosted proxy is its IP address. Once a censor identifies your VPS IP as hosting a VPN or proxy, they can blacklist that single number, and your server is blocked instantly.

The solution is to hide your server behind a massive, unblockable intermediary. This is achieved by combining WebSocket (WS) transport with a Content Delivery Network (CDN), such as Cloudflare. This setup ensures that all external probes and traffic analyzers see the CDN’s IP address, not your actual VPS anchor.

Section 1: The Principle of IP Obfuscation via CDN

A CDN’s primary purpose is to deliver web content quickly to users around the world. However, for V2Ray users, it acts as a permanent, highly trusted security shield.

The “Collateral Damage” Defense

Why don’t censors just block Cloudflare? Because Cloudflare hosts millions of legitimate websites, from banks to hospitals to shopping sites. If a censor blocks the Cloudflare IP that your V2Ray uses, they inadvertently block thousands of innocent websites sharing that same IP. This “collateral damage” makes blocking CDNs extremely costly and difficult for censorship regimes.

The Traffic Flow

Visually, the connection looks like this:

You –> [Encrypted Tunnel] –> Cloudflare Edge Server –> [Cloudflare Internal Network] –> Your VPS

1. The Public Face: To the outside world, you are connecting to a valid Cloudflare IP address on port 443 (HTTPS).
2. The Relay: Cloudflare receives the data, checks which domain it is for (tunnel.mydomain.com), and forwards the data to your secret VPS IP.
3. The Origin: Your VPS receives the traffic from Cloudflare, not directly from you.

Section 2: Prerequisites and Cloudflare Setup

To implement this highly effective camouflage, you need to configure both your domain registrar and the CDN settings correctly.

Prerequisites Checklist:

1. Registered Domain: You must own a domain (e.g., mydomain.com) and it must be managed by Cloudflare’s DNS.
2. VLESS over WS: Your V2Ray server must be configured to use VLESS protocol over WebSocket transport (as detailed in Article 12).
3. Port 443 Open: Your VPS firewall must allow traffic on Port 443.

Cloudflare Configuration (Step-by-Step)

1. Create an ‘A’ Record: In your Cloudflare DNS panel, create an A record linking your chosen subdomain to your VPS IP.
   • Type: A
   • Name: tunnel (creates tunnel.mydomain.com)
   • IPv4 Address: Your actual VPS IP address.
2. Enable Proxy (The Orange Cloud): This is the crucial step. Ensure the “Proxy status” switch is set to Proxied (the orange cloud icon).
   • If it is Grey: Cloudflare is just acting as a phonebook (DNS only) and your IP is exposed.
   • If it is Orange: Cloudflare is acting as a shield (CDN) and your IP is hidden.
3. SSL/TLS Mode (Critical): Navigate to the SSL/TLS section in Cloudflare. You MUST set the encryption mode to Full (Strict).
   • Off: No encryption (Unsafe).
   • Flexible: Encrypts from User to Cloudflare, but sends plain text to your server. This breaks V2Ray.
   • Full (Strict): Encrypts the entire path. Cloudflare talks to your server using the valid SSL certificate you installed on V2Ray.

Section 3: Server and Client Configuration

The configuration is almost identical to a standard WebSocket setup, with one key difference: the Host header.

Server V2Ray Configuration (Inbound)

Your server needs to know that the incoming traffic from Cloudflare is intended for your specific domain.

// --- SERVER SIDE INBOUND ---
"inbounds": [
  {
    "port": 443,
    "protocol": "vless",
    "streamSettings": {
      "network": "ws",
      "security": "tls",
      "tlsSettings": {
        // Use your real certificate paths here (e.g., Let's Encrypt)
        "certificates": [
          {
            "certificateFile": "/etc/ssl/v2ray/fullchain.pem",
            "keyFile": "/etc/ssl/v2ray/privkey.pem"
          }
        ]
      },
      "wsSettings": {
        "path": "/ws-secret-path", 
        "headers": {
          "Host": "tunnel.mydomain.com" // Matches the domain Cloudflare is forwarding
        }
      }
    }
  }
]

Client V2Ray Configuration (Outbound)

The client connects to the domain name. The domain resolves to a Cloudflare IP, starting the chain.

// --- CLIENT SIDE OUTBOUND ---
"outbounds": [
  {
    "tag": "cdn_proxy",
    "protocol": "vless",
    "settings": {
      "vnext": [
        {
          "address": "tunnel.mydomain.com", // Address must be the DOMAIN, not an IP
          "port": 443,
          "users": [ { "id": "YOUR-UUID-HERE", "encryption": "none" } ]
        }
      ]
    },
    "streamSettings": {
      "network": "ws",
      "security": "tls",
      "tlsSettings": {
        "serverName": "tunnel.mydomain.com" // SNI: Tells Cloudflare which cert to present
      },
      "wsSettings": {
        "path": "/ws-secret-path", // MUST MATCH the server path exactly
        "headers": {
          "Host": "tunnel.mydomain.com"
        }
      }
    }
  }
]

Section 4: The Trade-off (The “Latency Tax”)

Security always comes at a price. While CDN obfuscation is the safest method, it is often slower than a direct connection.

• Increased Latency (Ping): Your data has to travel to the nearest Cloudflare server, be processed, travel to your VPS, and then back again. This extra hop can add 50ms-200ms of delay.
• Speed Limits: Free CDN accounts typically have lower priority during peak hours compared to enterprise traffic.
• Conclusion: Use CDN (WS+TLS) for browsing, reading, and unblocking sites where stealth is the priority. For gaming or latency-sensitive tasks, this method is usually not ideal.

Section 5: Troubleshooting Common Errors

If your setup fails, the error is usually in the Cloudflare settings.

1. Error: “502 Bad Gateway”

• Cause: Cloudflare cannot talk to your V2Ray server.
• Fix 1: Check your Cloudflare SSL setting. Is it set to “Flexible”? Change it to Full (Strict).
• Fix 2: Check your VPS firewall. Is Port 443 actually open?
• Fix 3: Is V2Ray running? Check systemctl status v2ray.

2. Error: “404 Not Found”

• Cause: The request reached your server, but the path was wrong.
• Fix: Ensure the path in your client config (e.g., /ws-secret-path) matches the server config exactly, including the leading slash /.

3. Connection Works but is Very Slow

• Cause: You might be routed to a slow Cloudflare node.
• Fix: This is the nature of the “Free Tier” CDN. Advanced users can use “IP Selection” (scanning for faster Cloudflare IPs), but that is a complex topic for a future guide.

Conclusion: Operational Resilience

The V2Ray + WebSocket + CDN combination is the highest level of IP obfuscation you can achieve with standard tools. It turns your biggest vulnerability (your static IP) into a strength by hiding it behind the massive shield of the global internet infrastructure. While it introduces a slight speed penalty, the immunity to IP blocking makes it the gold standard for long-term stability.

Next Up: Article 14 explores V2Ray’s alternative camouflage: using HTTP Obfuscation, a legacy technique, and its modern role.