VLESS Tunnels for a Team: One Line per Seat

Some teams want a whole device on a line rather than a browser profile: a laptop in the field, a test phone, a seat that should look like one US mobile user all day. VLESS is how we do that. Every line on your account has a vless link in the dashboard that tunnels the whole device through the line, carrying TCP and UDP and working on networks that block ordinary proxy ports. This guide is the team version: one tunnel per line, one line per seat, and the bookkeeping that keeps twelve tunnels from becoming a puzzle.

What a VLESS tunnel does differently

A proxy setting sends one application through the line. A VLESS tunnel sends the whole device: every browser, every app, every background check. The client software on the device connects out over port 443, so it passes through hotel and office networks that would block a raw SOCKS5 port, and the connection is encrypted between the device and our gateway. The exit is still the line's carrier address in its metro; nothing about the line changes, only how the device reaches it.

For a team this means a seat can be handed a phone or laptop that is already on its line, with no per-app configuration. It also means that seat is on that line for everything, so the pairing should be one seat, one line.

Where the link lives

Open the dashboard at lines.mobileproxiesusa.com, open the row for the line, and find the VLESS section. The link starts with vless:// and encodes the server, the port, the line's identity and the transport settings. Copy it whole. Each line has its own link; a link from one line cannot reach another. After a free move to a new metro the link may be reissued, so copy it again from the row after a move.

Treat the link like a credential. Whoever holds it can use the line. Hand it to the seat by a vault or a direct message, not a shared document.

Clients by platform

Hiddify runs on Android, Windows, Mac and Linux and imports the link from the clipboard; it is the one we point most teams to because one client covers almost every device. v2rayN is the long-standing Windows client for people who like to see the configuration. Streisand and Shadowrocket are the usual iPhone and iPad choices and import the link from the clipboard or a QR code. All of them connect, ask for the VPN permission once, and then route everything.

After connecting, open an IP lookup page and confirm the carrier and the state. Then check that WebRTC shows no other address and that the device's clock is accurate; the handshake needs correct time, and a device with a wrong clock will connect and then fail to load anything.

1. Install Hiddify (any platform), v2rayN (Windows), Streisand or Shadowrocket (iOS) on the seat's device.
2. Copy the vless link from the line's dashboard row.
3. In the client choose add from clipboard (or scan the QR shown in the dashboard), then connect and approve the VPN permission.
4. Confirm carrier and state on an IP lookup page and check WebRTC leaks nothing else.
5. Name the client profile after the line's label so the seat knows which line it is on.

One tunnel per line, one line per seat

Two devices can technically use the same link at the same time, but then two seats share one carrier address for everything they do, which is the shared-line situation you bought separate lines to avoid. Give each seat its own line. The price per line is the same whether you run two or twenty, so the decision is about keeping seats apart, not about saving.

Keep a sheet with three columns: seat, line label, device. When the sheet, the dashboard labels and the client profile names agree, the fleet is in order. When a seat changes hands, reset the line's credentials from the dashboard, which reissues the link, and load the new link on the new device; the old device drops off.

Rotation and sticky sessions through a tunnel

The tunnel does not change how the line rotates. Call the rotation link from the dashboard row, use the timer, or leave it; the device on the tunnel simply continues on the new address. Because a tunnelled device carries every app, a rotation affects everything on it at once, so for seats doing sticky session work, leave the timer off and rotate by hand between tasks.

Left alone, the address holds as long as the carrier keeps it. A new address is from the same carrier in the same metro, so the seat's locale settings do not need to change.

When to use the tunnel and when a proxy setting

Use the tunnel when a whole device should be on the line (field laptops, test phones, a seat that runs native apps), when the network blocks proxy ports, or when a tool has no proxy setting of its own. Use the plain HTTP or SOCKS5 setting when only one application should go through the line, such as a profile browser holding several profiles on different lines on one machine. Many teams use both: the profile browser on proxies for account work, the tunnel on a phone for the apps that only run on a phone.

Both access methods are included with every line. If a tunnel will not connect, the usual causes are a stale link after a move, a wrong device clock, or a client that needs a restart after the VPN permission; support at [email protected] or the Telegram bot can check the line side any hour.

Frequently asked