Xray-core: how the core behind modern proxy connections works

What Xray-core is

Xray-core is an open-source network core that can accept connections over several protocols, apply rules and send traffic out through the right exit. The core has no familiar window with a big button. The interface, QR code import and server list come from a separate client app.

On a server, Xray usually runs as a background service. On a phone or computer, it can be built into an app. That’s why two clients with similar interfaces sometimes use the same core but differ in how they store profiles, how often they’re updated and which system features they offer.

The path of a single request

Once you connect, the app creates a local VPN interface. A request from your browser reaches the client core, gets matched against the routing rules, is packaged according to the profile and goes out to the server. The server checks the parameters of the incoming connection and picks an exit to the internet.

The response travels the same path in reverse. DNS queries may be handled separately: the configuration decides which resolver to use and whether a query should go through the secure route. A wrong DNS setting can look like the whole VPN is broken, even though the connection to the server is up.

The main configuration blocks

The terms in Xray’s JSON configuration describe where traffic goes and how it’s handled. You don’t have to edit them by hand, but knowing the structure helps you make sense of diagnostic messages.

• inbound accepts traffic: VLESS, SOCKS, HTTP or a local TUN interface;
• outbound defines the exit: direct, through a remote server, or blocked;
• routing picks an outbound by domain, IP, port or other attributes;
• dns sets the resolvers and the rules for resolving domain names;
• policy and stats control limits, technical statistics collection and session behavior.

How Xray relates to VLESS and REALITY

VLESS is one of the protocols Xray understands. REALITY is one of the ways to secure the transport connection in this ecosystem. They often show up together but do different jobs: the core manages the flow, VLESS sets the format and authentication, and the security layer protects the connection.

This separation makes it possible to update individual components and change the transport without overhauling the whole architecture. At the same time, more parameters have to match on the client and the server. That’s why a subscription profile is more convenient than typing in a long string by hand.

Routing: all traffic or just some of it

Xray lets you send different requests along different routes. For example, local resources can open directly while the rest of the traffic goes through the secure connection. This mode is called split tunneling.

Rules need careful upkeep. An exception that’s too broad can send a sensitive request directly, and conflicting rules can break an app. If you don’t understand a particular setup, it’s safer to start with your provider’s default profile.

Updates and troubleshooting

The client, the core and the server must support a matching set of parameters. A badly outdated version may not understand a new transport or security mode. Update the app from an official source, and reload your subscription after the update.

To troubleshoot, first check the system time, whether the internet works without the VPN, and whether a different network helps. Then update the profile and try another location. Logs are useful to support staff, but before you send them, make sure they don’t contain your full subscription link, UUID or other secrets.