Troubleshooting

VLESS not connecting: diagnose transport, TLS and routing

Troubleshoot VLESS by layer. A timeout, TLS error, authentication rejection and “connected but no internet” state point to different causes and should not be fixed by disabling security.

Technical review: 2026-09-03 · PublicVPNList Editorial Team

Before the protocol handshake

Resolve the hostname, confirm the port and test whether the required TCP or UDP path is reachable. A port check shows reachability only; it cannot authenticate VLESS. Try a different network only to isolate filtering, not to prove that a server is healthy.

Security and transport failures

For TLS, check SNI, certificate time and hostname match. For REALITY, check public key, short ID, fingerprint, serverName and flow. For WebSocket verify path and Host; for gRPC verify serviceName; for XHTTP confirm both client and server versions support the same mode.

Connected but traffic fails

Confirm the client mode and routes, then compare public IPv4 and IPv6. Inspect DNS and per-app bypass rules. If only some sites fail, check MTU symptoms and whether the server can reach IPv6 destinations.

Decision reference

Decision point	What to verify
Before the protocol handshake	Run the local validator and address errors before retrying.
Security and transport failures	Update the client core without altering profile fields.
Connected but traffic fails	Keep certificate verification enabled.

Practical checklist

Run the local validator and address errors before retrying.
Update the client core without altering profile fields.
Keep certificate verification enabled.
Test exit IP and DNS, not just the client status.

Limitations

Public profiles can expire without notice.
A remote port may be open while authentication is invalid.
Only the server operator can diagnose server-side logs.

Privacy and interpretation

A successful configuration or connectivity result proves only the tested technical behavior at that time. It does not prove a no-logging policy, legal status, operator identity or safety for sensitive accounts. Public profiles should be used for low-risk testing with end-to-end HTTPS.

Technical source: Xray-core issue and release source.

Continue with a relevant check

Frequently asked questions

What should I verify first for “VLESS not connecting: diagnose transport, TLS and routing”?: Run the local validator and address errors before retrying.
What is the main limitation of this troubleshooting?: Public profiles can expire without notice.
Where is the underlying behavior for this page documented?: Use the linked Xray-core issue and release source as the primary technical reference, then confirm fields against the client version you run.