From ad496cb607ef4ea39f4f7e5b2663fc9cecfbaf53 Mon Sep 17 00:00:00 2001 From: chika0801 <88967758+chika0801@users.noreply.github.com> Date: Tue, 7 Mar 2023 12:57:12 +0800 Subject: [PATCH] =?UTF-8?q?Vision=E9=85=8D=E7=BD=AE=E7=A4=BA=E4=BE=8B?= =?UTF-8?q?=E6=9B=B4=E6=96=B0=20(#128)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Update config_client.json * Update config_server.json * Update config_server.json * Update config_server.json * Update config_server.json * Create nginx.conf * Create README.md --- VLESS-TCP-XTLS-Vision/README.md | 16 ++++++ VLESS-TCP-XTLS-Vision/config_client.json | 22 ++++---- VLESS-TCP-XTLS-Vision/config_server.json | 35 +++++++++--- VLESS-TCP-XTLS-Vision/nginx.conf | 69 ++++++++++++++++++++++++ 4 files changed, 126 insertions(+), 16 deletions(-) create mode 100644 VLESS-TCP-XTLS-Vision/README.md create mode 100644 VLESS-TCP-XTLS-Vision/nginx.conf diff --git a/VLESS-TCP-XTLS-Vision/README.md b/VLESS-TCP-XTLS-Vision/README.md new file mode 100644 index 0000000..b682d31 --- /dev/null +++ b/VLESS-TCP-XTLS-Vision/README.md @@ -0,0 +1,16 @@ +:+1:**XTLS Vision [简介](https://github.com/XTLS/Xray-core/discussions/1295)** + +**使用提醒：** + +:exclamation:相对于 XTLS Vision 的使用基数，目前几乎没有收到 **配置正确** 的 Vision 被封端口的报告，**配置正确** 指的是： + +1. 服务端使用合理的端口，禁回国流量 +2. 只配置 XTLS Vision，不兼容普通 TLS 代理 +3. 回落到网页，不回落/分流到其它代理协议 +4. 客户端启用 uTLS（fingerprint） [#1](https://github.com/XTLS/Xray-core/issues/1544#issuecomment-1399194727) + +首先，如果你特别不想被封，**请先选择一个干净的 IP**，并按照 **配置正确** 去搭建、使用 XTLS Vision。 + +**但是，即使你这样做了，也无法保证 100% 不被封**。自去年底始，很多人的未知流量秒封 IP，TLS in TLS 流量隔天封端口。XTLS Vision 不是未知流量，且完整处理了 TLS in TLS 特征，目前看来效果显著。**但这并不意味着，用 XTLS Vision 可以 100% 不被封，认识到这一点是非常、非常重要的，不要自己偶然被封就大惊小怪**。 + +**因为除了协议本身，还有很多角度能封你**。以 IP 为例，你无法保证 IP 真的干净，无法避免被邻居波及，无法避免整个 IP 段被重点拉清单。也有可能某些地区的 GFW 有独特的标准，比如某个 IP 只有寥寥数人访问连却能跑那么多流量，封。**如果你的 XTLS Vision 被封了，但没有出现去年底 TLS 那样的大规模被封报告，我真心建议你换端口、换 IP、换服务商依次试一遍**。 [#2](https://github.com/XTLS/Xray-core/issues/1544#issuecomment-1402118517) diff --git a/VLESS-TCP-XTLS-Vision/config_client.json b/VLESS-TCP-XTLS-Vision/config_client.json index c6725d5..783fe04 100644 --- a/VLESS-TCP-XTLS-Vision/config_client.json +++ b/VLESS-TCP-XTLS-Vision/config_client.json @@ -25,8 +25,8 @@ }, "inbounds": [ { - "listen": "127.0.0.1", - "port": 10808, // v2rayN 本地监听端口 + "listen": "127.0.0.1", // 填 0.0.0.0 表示允许来自局域网的连接 + "port": 10808, // v2rayN 本地socks监听端口 "protocol": "socks", "settings": { "udp": true @@ -40,8 +40,8 @@ } }, { - "listen": "127.0.0.1", - "port": 10809, // v2rayN 本地监听端口 + "listen": "127.0.0.1", // 填 "0.0.0.0" 表示允许来自局域网的连接 + "port": 10809, // v2rayN 本地http监听端口 "protocol": "http", "sniffing": { "enabled": true, @@ -58,11 +58,11 @@ "settings": { "vnext": [ { - "address": "", // VPS的IP - "port": 16387, // VPS的端口 + "address": "", // 地址，服务端的域名或IP + "port": 443, // 端口，与服务端一致 "users": [ { - "id": "", // 用户ID + "id": "", // 用户ID，与服务端一致 "encryption": "none", "flow": "xtls-rprx-vision" } @@ -74,9 +74,9 @@ "network": "tcp", "security": "tls", "tlsSettings": { - "serverName": "", // 证书中包含的域名 + "serverName": "", // SNI，如果"address"填的是服务端的域名，可留空，如果"address"填的是服务端的IP，此处填服务端的证书中包含的域名 "allowInsecure": false, - "fingerprint": "chrome" // 通过 uTLS 库 模拟 Chrome / Firefox / Safari 或随机生成的指纹 + "fingerprint": "chrome" // 用于配置指定 TLS Client Hello 的指纹，Xray 将通过 uTLS 库 模拟 TLS 指纹，或随机生成 } }, "tag": "proxy" @@ -84,6 +84,10 @@ { "protocol": "freedom", "tag": "direct" + }, + { + "protocol": "blackhole", + "tag": "block" } ] } diff --git a/VLESS-TCP-XTLS-Vision/config_server.json b/VLESS-TCP-XTLS-Vision/config_server.json index 6ef0bcb..d7c3a82 100644 --- a/VLESS-TCP-XTLS-Vision/config_server.json +++ b/VLESS-TCP-XTLS-Vision/config_server.json @@ -16,26 +16,40 @@ }, "inbounds": [ { - "listen": "0.0.0.0", - "port": 16387, // 端口 + "listen": "0.0.0.0", // "0.0.0.0" 表示同时监听IPv4和IPv6 + "port": 443, // 服务端监听的端口 "protocol": "vless", "settings": { "clients": [ { - "id": "", // 用户ID + "id": "", // 用户ID，执行 xray uuid 生成，或 1-30 字节的字符串 "flow": "xtls-rprx-vision" } ], - "decryption": "none" + "decryption": "none", + "fallbacks": [ + { + "dest": "8001", + "xver": 1 + }, + { + "alpn": "h2", + "dest": "8002", + "xver": 1 + } + ] }, "streamSettings": { "network": "tcp", "security": "tls", "tlsSettings": { + "rejectUnknownSni": true, + "minVersion": "1.2", "certificates": [ { - "certificateFile": "/etc/ssl/private/fullchain.cer", // 证书 - "keyFile": "/etc/ssl/private/private.key" //私钥 + "ocspStapling": 3600, + "certificateFile": "/etc/ssl/private/fullchain.cer", // 证书文件，建议用fullchain（全SSL证书链），若只有网站证书，会出现v2rayN能使用，v2rayNG不能使用的情况，通常不区分扩展名 + "keyFile": "/etc/ssl/private/private.key" // 私钥文件 } ] } @@ -58,5 +72,12 @@ "protocol": "blackhole", "tag": "block" } - ] + ], + "policy": { + "levels": { + "0": { + "handshake": 2, // 连接建立时的握手时间限制，单位为秒，默认值为 4，建议与默认值不同 + "connIdle": 120 // 连接空闲的时间限制，单位为秒，默认值为 300，建议与默认值不同 + } + } } diff --git a/VLESS-TCP-XTLS-Vision/nginx.conf b/VLESS-TCP-XTLS-Vision/nginx.conf new file mode 100644 index 0000000..4f72071 --- /dev/null +++ b/VLESS-TCP-XTLS-Vision/nginx.conf @@ -0,0 +1,69 @@ +user nginx; +worker_processes auto; + +error_log /var/log/nginx/error.log notice; +pid /var/run/nginx.pid; + +events { + worker_connections 1024; +} + +http { + log_format main '[$time_local] $proxy_protocol_addr "$http_referer" "$http_user_agent"'; + access_log /var/log/nginx/access.log main; + + map $http_upgrade $connection_upgrade { + default upgrade; + "" close; + } + + map $proxy_protocol_addr $proxy_forwarded_elem { + ~^[0-9.]+$ "for=$proxy_protocol_addr"; + ~^[0-9A-Fa-f:.]+$ "for=\"[$proxy_protocol_addr]\""; + default "for=unknown"; + } + + map $http_forwarded $proxy_add_forwarded { + "~^(,[ \\t]*)*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*([ \\t]*,([ \\t]*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*)?)*$" "$http_forwarded, $proxy_forwarded_elem"; + default "$proxy_forwarded_elem"; + } + + server { + listen 80; + return 301 https://$host$request_uri; + } + + server { + listen 127.0.0.1:8001 proxy_protocol; + listen 127.0.0.1:8002 http2 proxy_protocol; + set_real_ip_from 127.0.0.1; + + location / { + sub_filter $proxy_host $host; + sub_filter_once off; + + proxy_pass https://www.lovelive-anime.jp; + proxy_set_header Host $proxy_host; + + proxy_http_version 1.1; + proxy_cache_bypass $http_upgrade; + + proxy_ssl_server_name on; + + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_set_header X-Real-IP $proxy_protocol_addr; + proxy_set_header Forwarded $proxy_add_forwarded; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-Port $server_port; + + proxy_connect_timeout 60s; + proxy_send_timeout 60s; + proxy_read_timeout 60s; + + resolver 1.1.1.1; + } + } +}