VLESS and Rotation: Keep the Tunnel Up While the IP Changes

A question we get from people who rotate aggressively: if the IP changes every few minutes, does an encrypted tunnel to the modem survive it? It does. The tunnel ends at our server, not at the carrier, and the modem behind it takes a new address without the tunnel noticing. This guide explains that relationship first, because it changes how you think about rotation on a VLESS line, and then goes through the setup on Windows, Android, iPhone and Linux with the rotation controls you can use from inside the tunnel.

Where the tunnel ends and where rotation happens

Your device connects to the Xray server on our rack. That connection uses REALITY, so to anyone in between it looks like a normal HTTPS session to a well-known site. Inside it, your traffic is handed to the modem assigned to your line, which exits onto the carrier network with whatever IP the carrier has given it at that moment.

Rotation acts on the modem. When you press the rotation link, call the API or let a timer fire, the modem re-registers with the carrier and receives a fresh address. The Xray server does not restart and your client does not reconnect. Open connections that were in flight at the moment of rotation are cut, as they would be on any rotation, but the tunnel itself stays up and the next request simply exits on the new IP.

The practical result is that rotation on a VLESS line is invisible to the client. You can set an interval of a few minutes and leave the tunnel connected all day.

Get the line

Open the DoubleProx dashboard, go to My proxies, and copy the VLESS / Xray row from the line's card. That vless:// string is the full credential and contains your id, so keep it private and use Revoke access if it leaks. It is offered on our server-based lines; tick VLESS / Xray in the filters when buying or moving so you only see locations that run it.

Windows and Linux desktop with Nekoray or v2rayN

Nekoray runs on both Windows and Linux and handles several lines cleanly, which matters when you rotate across a group. v2rayN is the simpler choice on Windows alone.

1. Download Nekoray for your platform from its releases page and run it. On Windows, v2rayN with the bundled core is the alternative.
2. Copy the vless:// line. In Nekoray choose Program, then Add profile from clipboard. In v2rayN press Ctrl and V.
3. Select the profile and press Start, or in v2rayN set it as the active server.
4. Turn on System Proxy from the top bar so browsers use the line, or point tools at the local mixed port, 2080 in Nekoray, 10808 for SOCKS5 in v2rayN.
5. Use the built-in URL test on the profile to confirm the tunnel answers.

• Nekoray releases
• v2rayN releases

Android and iPhone

1. Android: install v2rayNG, tap the plus button, Import config from clipboard, select the line and tap V. Allow the VPN request.
2. iPhone: install V2Box, open Configs, tap the plus button, Import from clipboard, select the line and connect. Allow the VPN configuration.
3. On either phone, add the rotation link from your dashboard as a bookmark in the browser. Opening it while connected rotates the modem without leaving the tunnel.

• v2rayNG on Google Play
• V2Box on the App Store

Rotating from inside the tunnel

The rotation link and the API both work while the tunnel is connected, because they are ordinary HTTPS requests to our platform and travel through the line like anything else. Three patterns cover most needs.

• Interval rotation set in the dashboard, for scraping and monitoring where you want a steady stream of fresh addresses and do not care about the exact moment of change.
• Rotation on demand by calling the link between jobs, which gives a clean boundary: finish the batch, rotate, wait for the new IP to be up, start the next batch.
• A script that calls the rotation API and then polls the status link until the IP differs, for pipelines that must not start on a stale address.

Things to watch

A request in flight at the instant of rotation fails and must be retried; build that retry into anything automated. The device clock must be roughly right or the REALITY handshake fails. If a client reports an invalid user id, the line was moved or its modem switched since you copied the link, which issues a new id; copy the current link from the dashboard. And if you rotate on a timer and also on demand, expect occasional double rotations; the modem handles them, but your job may see two short interruptions.

Frequently asked