SpellVPN icon

Beginner one-click setup

From server login to SpellVPN import

Bring your own Debian or Ubuntu cloud server and run two commands. The installer prints ready-to-import VLESS Reality and Shadowsocks links, with no domain or TLS certificate required.

Download installer Advanced guide SpellVPN page
Before you begin

Use this only on a server you own or are authorized to administer. The installer requires Debian or Ubuntu, root, and systemd. It uses TCP 443 and TCP/UDP 8388 and stops without overwriting anything if it finds occupied ports or an existing Xray installation.

1. Prepare a server

  • Use a cloud server with a public IPv4 address and Debian 12/13 or Ubuntu 22.04/24.04.
  • Keep the server IP and root password handy, or prepare an SSH private key.
  • Allow TCP 22, TCP 443, and TCP/UDP 8388 in the cloud firewall or security group.
  • If SSH uses a custom port, allow that port instead of TCP 22.
Never send your password to someone else. Type it only in your own terminal. It is normal for the password field to show no characters while you type.

2. Sign in with SSH

Open Terminal on a Mac or PowerShell on Windows. Replace the placeholder with your server's public IP:

ssh root@YOUR_SERVER_IP

On the first connection, type yes, then enter the root password. A prompt such as root@server:~# means you are signed in.

Example: ssh root@203.0.113.10. The example address is documentation only and cannot be used as a real server.

3. Download and run the installer

After signing in, run these two lines. The script is downloaded first so you can inspect it instead of piping an unseen download directly into Bash.

curl -fsSL https://cnc980.github.io/downloads/spellvpn-quick-server.sh -o spellvpn-quick-server.sh
bash spellvpn-quick-server.sh

To read the script before running it, insert this command between the two lines:

less spellvpn-quick-server.sh

The installer checks the operating system and ports, downloads the latest Xray release from the official GitHub repository, verifies its SHA-256 digest, generates unique credentials, and enables automatic startup through systemd. If UFW is already active, it adds the required rules but never enables a firewall automatically.

The cloud firewall still matters. Your phone cannot connect until the provider's security group allows TCP 443 plus TCP and UDP 8388.

4. Import into SpellVPN

When installation succeeds, the terminal displays one complete vless:// link and one complete ss:// link.

  1. Copy one full link without dropping its beginning or ending.
  2. Open SpellVPN and tap Add or the “+” button.
  3. Choose import from Clipboard or Proxy Link.
  4. Select the new node and connect, then repeat with the other link to test both protocols.

To show the links again later, sign in to the server and run:

cat /root/spellvpn-links.txt

If it does not connect

systemctl status xray --no-pager
journalctl -u xray --no-pager -n 50
ss -lntup | grep -E ':443|:8388'
  • Confirm that the server address in SpellVPN matches the cloud server's public IP.
  • Confirm the cloud security group allows TCP 443, TCP 8388, and UDP 8388.
  • Switch between Wi-Fi and cellular data to rule out a restriction on the current network.
  • Credentials are stored in a root-only file. Do not publish them or commit them to a repository.

What does the installer create?

VLESS Reality · TCP 443No domain or certificate is needed. It uses a unique UUID, Reality key pair, and Short ID.
Shadowsocks · TCP/UDP 8388AES-256-GCM with a unique random password provides a simple compatibility test.
Xray + systemdThe service starts at boot, restarts after failures, and stores its configuration at /etc/xray/config.json.

For Hysteria2, TUIC, AnyTLS, Trojan, VMess, a subscription URL, or coexistence with existing services, follow the advanced multi-protocol guide instead of rerunning this installer over an existing setup.