Outbound

Outbound Security

Match None, TLS, or Reality for the server handshake.

Updated

Security describes the handshake around the node connection. If it is wrong, the connection often fails before any traffic can pass. Use the mode and fields from the provider profile.

Security modes

None

No TLS or Reality handshake fields are used.

Good fit The provider says the node has no transport security or security is handled elsewhere.

Not ideal The profile includes Server Name, fingerprint, Reality Public Key, or Short ID.

TLS

A website-like secure handshake with server name, ALPN, fingerprint, and optional certificate checks.

Good fit The node connects through a TLS endpoint, CDN, or web server.

Not ideal The profile says Reality or gives Reality keys.

Reality

An Xray security mode that makes the handshake look like ordinary web browsing when configured correctly.

Good fit The provider gives Reality fields such as Public Key, Short ID, SpiderX, and fingerprint.

Not ideal You do not have exact provider values. Reality fields should not be invented.

Important handshake fields

TLS identity

These fields describe how Tunna appears to the secure endpoint.

Server Name

The name expected during the secure handshake. It can differ from the node address.

Fingerprint

The browser-style client identity, such as Chrome, Safari, iOS, Random, or Randomized.

ALPN

The HTTP protocol list expected by the server, such as H3, H2, or HTTP/1.1.

ECH Config List

An advanced TLS field. Use only the exact ECH config list supplied by the provider, and leave it empty otherwise.

Reality identity

Reality is strict. The provider values must belong together.

Public Key

The server public key value supplied to the client.

Short ID

A short hex identifier. Copy it character for character.

SpiderX and ML-DSA-65 Verify

Provider-specific Reality fields. Leave empty unless the profile supplies them.

Certificate checks can make a good node fail

Pinned certificate values and peer-name verification are strict checks. Use them only when your provider gives exact values and you know why they are required.