[Question] Not able to hide VPS IP (Vless + TLS + REALITY).

[deenle]

Good day everyone!
Sorry for a noob question.
Could somebody please explain the core feature of REALITY.
Am I right that it's impossible to hide VPS IP using Vless + TLS + REALITY (part of Wireshark dump in attached pic).
So it's easy that IP might be banned any time.
What is the point to put different SNI then?
Is it correct and as expected setup?
In my case IP resolved to VPS name and it's possible to change only to owned domain with corresponding A record.
Thanks!

[mmmray]

REALITY makes no attempt at IP camouflaging, it is still useful if you are able to purchase a VPS in the same IP range as the dest site. If you impersonate dl.google.com, your server is ideally on google cloud. If you cannot find a good website to impersonate, create your own website ("steal yourself")

What is the point to put different SNI then?

Because legitimate traffic to dl.google.com also has the dl.google.com SNI. The intent is to make traffic look exactly like legitimate traffic (but, as you said, except for IP)

Here is a thread that considers some followup questions you might have: #2230

[deenle]

@mmmray,
Thanks a lot for reply!
I wish I knew what famous services running next to my IP..

I've read that topic thoughtfully, RPRX mentioned it, but I didn't get the idea about "stealing yourself".
If it's not prohibited to explain.. does it mean that it's necessary to mimic your own domain and copy an html page from the original SNI and show it to one who want to check that IP/website?

Currently I've put resolved name from DDNS, so it's no more connected to a VPS.
While having your own domain, run a web server etc becomes a bit useless to use REALITY and it comes just to VISION (if I understand correctly).
So I would prefer to avoid that kind of complexity.

[mmmray]

If it's not prohibited to explain.. does it mean that it's necessary to mimic your own domain and copy an html page from the original SNI and show it to one who want to check that IP/website?

the idea is to use a website as dest you have created yourself. this makes it a lot easier to ensure that the IP matches (because you can run reality and the website literally on the same VPS)

there is also an issue with stealing foreign sites: they sometimes reflect the client IP back in the response body, and this can be used to reveal your server as well. whether that is actually how servers are being blocked in practice is a different topic, and depends on the country. (see also #3318)

While having your own domain, run a web server etc becomes a bit useless to use REALITY and it comes just to VISION (if I understand correctly).

generally, if you own the website you "steal", you have a lot more options than reality. you can deploy vless+ws on a subpath of the website too. reality and/or vision might even get in the way if you later decide to use a CDN for your website. I think in theory, reality still has better performance and eliminates some characteristics with regard to padding and ALPN where other protocols are more primitive, but it's possible that it doesn't make a difference in practice. Again, really depends on the country.

[mmmray]

I wish I knew what famous services running next to my IP..

you can check ipinfo. you don't have to match the subnet perfectly, often being within the same ASN will be ok