近期更新重点

  • V2Ray v4.27.0+新增支持VLESS新协议
  • V2Ray v4.29.0+新增支持XTLS新协议
  • Vadminss AEAD will be used when alterId is 0 in V2Ray v4.28.0+
  • 安装脚本放废弃go.sh改用install-realese.sh
  • V2Ray v4.33.0移除了XTLS,建议使用V2Ray v4.32.1

详情参考

  1. https://v2ray.com/
  2. https://github.com/v2ray/v2ray-core
  3. https://toutyrater.github.io/
  4. https://guide.v2fly.org/
  5. https://github.com/veekxt/v2ray-template
  6. https://github.com/v2fly/v2ray-examples
  7. https://www.v2fly.org/
  8. https://github.com/rprx/v2ray-vless
  9. https://github.com/v2fly/v2ray-core
  10. https://github.com/XTLS/Xray-core

排名不分先后顺序 致敬开发者们的无私奉献


xray

https://github.com/XTLS/Xray-core

Install & Upgrade Xray-core and .dat files

bash <(curl -L https://raw.githubusercontent.com/XTLS/Xray-install/main/install-release.sh)

Update geoip.dat and geosite.dat only

bash <(curl -L https://raw.githubusercontent.com/XTLS/Xray-install/main/install-dat-release.sh)

Remove Xray, except json and logs

bash <(curl -L https://raw.githubusercontent.com/XTLS/Xray-install/main/install-release.sh) --remove

成功安装后会提示如下

# /etc/systemd/system/xray.service
[Unit]
Description=Xray Service
Documentation=https://github.com/xtls
After=network.target nss-lookup.target

[Service]
User=nobody
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
NoNewPrivileges=true
ExecStart=/usr/local/bin/xray run -config /usr/local/etc/xray/config.json
Restart=on-failure
RestartPreventExitStatus=23

[Install]
WantedBy=multi-user.target

# /etc/systemd/system/xray.service.d/10-donot_touch_single_conf.conf
# In case you have a good reason to do so, duplicate this file in the same directory and make your customizes there.
# Or all changes you made will be lost!  # Refer: https://www.freedesktop.org/software/systemd/man/systemd.unit.html
[Service]
ExecStart=
ExecStart=/usr/local/bin/xray run -config /usr/local/etc/xray/config.json

installed: /usr/local/bin/xray
installed: /usr/local/share/xray/geoip.dat
installed: /usr/local/share/xray/geosite.dat
installed: /usr/local/etc/xray/config.json
installed: /var/log/xray/
installed: /var/log/xray/access.log
installed: /var/log/xray/error.log
installed: /etc/systemd/system/xray.service
installed: /etc/systemd/system/xray@.service
removed: /tmp/tmp.S3mHoPXvIj
info: Xray v1.1.2 is installed.
You may need to execute a command to remove dependent software: apt purge curl unzip
Please execute the command: systemctl enable xray; systemctl start xray

解决SSL证书权限不足

sed -i 's/User=nobody/User=root/' /etc/systemd/system/xray.service
sed -i 's/User=nobody/User=root/' /etc/systemd/system/xray@.service

编辑创建xray配置文件

nano /usr/local/etc/xray/config.json

输入以下示范

{
    "log": {
        "loglevel": "warning"
    },
    "inbounds": [
        {
            "port": 443,
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "id": "", // 填写你的 UUID
                        "flow": "xtls-rprx-direct",
                        "level": 0,
                        "email": "love@v2fly.org"
                    }
                ],
                "decryption": "none",
                "fallbacks": [
                    {
                        "dest": 81
                    },
                    {
                        "path": "/websocket", // 必须换成自定义的 PATH
                        "dest": 1234,
                        "xver": 1
                    }
                ]
            },
            "streamSettings": {
                "network": "tcp",
                "security": "xtls",
                "xtlsSettings": {
                    "alpn": [
                        "http/1.1"
                    ],
                    "certificates": [
                        {
                            "certificateFile": "/etc/letsencrypt/live/example.com/fullchain.pem", // 换成你的证书,绝对路径
                            "keyFile": "/etc/letsencrypt/live/example.com/privkey.pem" // 换成你的私钥,绝对路径
                        }
                    ]
                }
            }
        },
        {
            "port": 1234,
            "listen": "127.0.0.1",
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "id": "", // 填写你的 UUID
                        "level": 0,
                        "email": "love@v2fly.org"
                    }
                ],
                "decryption": "none"
            },
            "streamSettings": {
                "network": "ws",
                "security": "none",
                "wsSettings": {
                    "acceptProxyProtocol": true, // 提醒:若你用 Nginx/Caddy 等反代 WS,需要删掉这行
                    "path": "/websocket" // 必须换成自定义的 PATH,需要和分流的一致
                }
            }
        },
        {
            "protocol": "shadowsocks",
            "port": 1038,
            "settings": {
            "method": "chacha20-ietf-poly1305",
            "password": "yourpassword###",
            "udp": true
            }
        },
        {
            "protocol": "shadowsocks",
            "port": 1039,
            "settings": {
            "method": "aes-128-gcm",
            "password": "youpassword###",
            "udp": true
            }
        },
		{
			"port": 5678,
			"protocol": "vmess",
			"settings": {
			"clients": [
				{
					"id": "",
					"alterId": 0
				}
			]
			},
			"streamSettings": {
			"network": "kcp",
			"security": "aes-128-gcm",
			"kcpSettings": {
					"mtu": 1350,
					"tti": 20,
					"uplinkCapacity": 5,
					"downlinkCapacity": 100,
					"congestion": false,
					"readBufferSize": 1,
					"writeBufferSize": 1,
					"header": {
						"type": "none"
					},
					"seed": "Password###"
				}
			}
		}
    ],
    "outbounds": [
        {
            "protocol": "freedom"
        }
    ]
}
wget -O /usr/local/etc/xray/config.json https://567899.xyz/uploads/xray-server-config.json

替换自己的UUID和域名

sed -i 's/""/"UUID"/' /usr/local/etc/xray/config.json
sed -i 's/example.com/你的域名/' /usr/local/etc/xray/config.json

启动xray

systemctl enable xray
systemctl start xray

解决IP谷歌搜索人机验证码

  1. warp双栈,v4v6出口全部由warp接管
bash <(curl -fsSL https://raw.githubusercontent.com/P3TERX/warp.sh/main/warp.sh) d
  1. 添加v4出口,v4出口warp接管
bash <(curl -fsSL https://raw.githubusercontent.com/P3TERX/warp.sh/main/warp.sh) 4
  1. 添加v6出口,v6出口warp接管,需要在扶墙配置文件里指定google走v6
bash <(curl -fsSL https://raw.githubusercontent.com/P3TERX/warp.sh/main/warp.sh) 6

然后编辑/usr/local/etc/xray/config.json修改替换outbounds和routing为以下内容

	"outbounds": [
             {
               "tag":"IP4_out",
               "protocol": "freedom",
               "settings": {}
             },
            {
               "tag":"IP6_out",
               "protocol": "freedom",
              "settings": {
                   "domainStrategy": "UseIPv6" // 指定使用 IPv6
                   }
             }
            ],
	"routing": {
            "rules": [
                {
                 "type": "field",
                 "outboundTag": "IP6_out",
                 "domain": ["domain:www.google.com"] // google走 IPv6
                 },
                {
                   "type": "field",
                   "outboundTag": "IP4_out",
                   "network": "udp,tcp"// 其余走 IPv4
                 }
             ]
          }

点击下载完整的配置文件示范

重启VPS查看效果

nginx配置示范

server {
    listen 80;
    listen [::]:80;
    server_name example.com;
    root /var/www/example.com;
    index index.html index.htm index.php;
    #return 301 https://$server_name$request_uri;
}
server {
    listen 81;
    listen [::]:81;
    server_name example.com;
    root /var/www/example.com;
    index index.html index.htm index.php;
    #php
    location ~ \.php$ {
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/run/php/php7.3-fpm.sock;
    }
}

安装V2ray

安裝和更新 V2Ray

#安裝執行檔和 .dat 資料檔
curl -LROJ https://raw.githubusercontent.com/v2fly/fhs-install-v2ray/master/install-release.sh
bash install-release.sh

安裝最新發行的 geoip.dat 和 geosite.dat

#只更新 .dat 資料檔
curl -LROJ https://raw.githubusercontent.com/v2fly/fhs-install-v2ray/master/install-dat-release.sh
bash install-dat-release.sh

移除 V2Ray

bash install-release.sh --remove

指定版本安装示范

bash install-release.sh --version v4.32.1

完成安装会提示如下

[Service]
ExecStart=
ExecStart=/usr/local/bin/v2ray -config /usr/local/etc/v2ray/%i.json


installed: /usr/local/bin/v2ray
installed: /usr/local/bin/v2ctl
installed: /usr/local/share/v2ray/geoip.dat
installed: /usr/local/share/v2ray/geosite.dat
installed: /usr/local/etc/v2ray/config.json
installed: /var/log/v2ray/
installed: /var/log/v2ray/access.log
installed: /var/log/v2ray/error.log
installed: /etc/systemd/system/v2ray.service
installed: /etc/systemd/system/v2ray@.service
removed: /tmp/tmp.MMsycHU0KG
info: V2Ray v4.29.0 is installed.
You may need to execute a command to remove dependent software: apt purge curl unzip
Please execute the command: systemctl enable v2ray; systemctl start v2ray

V2ray在使用VLESS时证书权限的解决办法

使用證書時權限不足 会导致套用模板后V2ray无法启动且无错误日志

简单粗暴的解决方法是编辑修改/etc/systemd/system/v2ray.service找到User=nobody修改为User=root

sed -i 's/User=nobody/User=root/' /etc/systemd/system/v2ray.service

详情参考使用證書時權限不足

编辑配置文件

uuid可以通过

cat /proc/sys/kernel/random/uuid

或者

v2ctl uuid

随机生成

测试配置文件是否错误

v2ray -test -config=config.json

推荐组合模式

  1. VLESS TCP XTLS

极致性能,超低的CPU占用,在硬路由器,手机上表现突出

  1. VLESS over WS with TLS CDN

服务器公网IP被xxoo了就能套娃使用

  1. Vmess KCP udp2raw

在高丢包、高延迟、网络线路不佳的情况表现突出

V2Ray服务端配置文件

客户端可以同时通过下列方式连接到服务器,其中 WS 都可以通过 CDN

  • VLESS over TCP with XTLS
  • VLESS over TCP with TLS
  • VLESS over WS with TLS
  • VLESS over WS with TLS CDN
  • shadowsocks

编辑修改/usr/local/etc/v2ray/config.json替换成以下内容

{
    "log": {
        "loglevel": "warning"
    },
    "inbounds": [
        {
            "port": 443,
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "id": "", // 填写你的 UUID
                        "flow": "xtls-rprx-origin",
                        "level": 0,
                        "email": "love@v2fly.org"
                    }
                ],
                "decryption": "none",
                "fallbacks": [
                    {
                        "dest": "/dev/shm/default.sock",
                        "xver": 1
                    },
                    {
                        "alpn": "h2",
                        "dest": "/dev/shm/h2c.sock",
                        "xver": 1
                    },
                    {
                        "path": "/websocket", // 必须换成自定义的 PATH
                        "dest": 1234,
                        "xver": 1
                    }
                ]
            },
            "streamSettings": {
                "network": "tcp",
                "security": "xtls",
                "xtlsSettings": {
                    "alpn": [
                        "h2",
                        "http/1.1"
                    ],
                    "certificates": [
                        {
                            "certificateFile": "/path/to/fullchain.crt", // 换成你的证书,绝对路径
                            "keyFile": "/path/to/private.key" // 换成你的私钥,绝对路径
                        }
                    ]
                }
            }
        },
        {
            "port": 1234,
            "listen": "127.0.0.1",
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "id": "", // 填写你的 UUID
                        "level": 0,
                        "email": "love@v2fly.org"
                    }
                ],
                "decryption": "none"
            },
            "streamSettings": {
                "network": "ws",
                "security": "none",
                "wsSettings": {
                    "acceptProxyProtocol": true, // 提醒:若你用 Nginx/Caddy 等反代 WS,需要删掉这行
                    "path": "/websocket" // 必须换成自定义的 PATH,需要和分流的一致
                }
            }
        },
        {
            "protocol": "shadowsocks",
            "port": 1038,
            "settings": {
            "method": "chacha20-ietf-poly1305",
            "password": "yourpassword",
            "udp": true
            }
        },
        {
            "protocol": "shadowsocks",
            "port": 1039,
            "settings": {
            "method": "aes-128-gcm",
            "password": "youpassword",
            "udp": true
            }
        },
		{
			"port": 7777,
			"protocol": "vmess",
			"settings": {
			"clients": [
				{
					"id": "", // 填写你的 UUID
					"alterId": 0
				}
			]
			},
			"streamSettings": {
			"network": "kcp",
			"security": "aes-128-gcm",
			"kcpSettings": {
				"mtu": 1350,
				"tti": 20,
				"uplinkCapacity": 5,
				"downlinkCapacity": 100,
				"congestion": false,
				"readBufferSize": 1,
				"writeBufferSize": 1,
				"header": {
					"type": "none"
				},
				"seed": "Password"
				}
			}
		}
    ],
    "outbounds": [
        {
            "protocol": "freedom"
        }
    ]
}

V2ray v4.31.0+可以更改xtls-rprx-origin为xtls-rprx-direct

sed -i 's/xtls-rprx-origin/xtls-rprx-direct/' /usr/local/etc/v2ray/config.json

替换自己的UUID

sed -i 's/"id": ""/"id": "这里替换成你的UUID值"/' /usr/local/etc/v2ray/config.json

配置Nginx

server {
    listen  unix:/dev/shm/default.sock proxy_protocol;
    listen  unix:/dev/shm/h2c.sock http2 proxy_protocol;
    server_name example.com;
    root /var/www/example.com;
    index index.html index.htm index.php;
    #php
    location ~ \.php$ {
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/run/php/php7.3-fpm.sock;
    }
}
server {
    listen 80;
    listen [::]:80;
    server_name example.com;
    root /var/www/example.com;
    index index.html index.htm index.php;
    return 301 https://$server_name$request_uri;
}

客户端连接

VLESS & TCP & XTLS

{
    "log": {
        "loglevel": "warning"
    },
    "inbounds": [
        {
            "port": 10800,
            "listen": "127.0.0.1",
            "protocol": "socks",
            "settings": {
                "udp": true
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "vless",
            "settings": {
                "vnext": [
                    {
                        "address": "example.com", // 换成你的域名或服务器 IP(发起请求时无需解析域名了)
                        "port": 443,
                        "users": [
                            {
                                "id": "", // 填写你的 UUID
                                "flow": "xtls-rprx-origin",
                                "encryption": "none",
                                "level": 0
                            }
                        ]
                    }
                ]
            },
            "streamSettings": {
                "network": "tcp",
                "security": "xtls", // 需要使用 XTLS
                "xtlsSettings": {
                    "serverName": "example.com" // 换成你的域名
                }
            }
        }
    ]
}

vless_ws_tls.json

{
    "log": {
        "loglevel": "warning"
    },
    "inbounds": [
        {
            "port": 10800,
            "listen": "127.0.0.1",
            "protocol": "socks",
            "settings": {
                "udp": true
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "vless",
            "settings": {
                "vnext": [
                    {
                        "address": "example.com", // 换成你的域名或服务器 IP(发起请求时无需解析域名了)
                        "port": 443,
                        "users": [
                            {
                                "id": "", // 填写你的 UUID
                                "encryption": "none",
                                "level": 0
                            }
                        ]
                    }
                ]
            },
            "streamSettings": {
                "network": "ws",
                "security": "tls",
                "tlsSettings": {
                    "serverName": "example.com" // 换成你的域名
                },
                "wsSettings": {
                    "path": "/websocket" // 必须换成自定义的 PATH,需要和服务端的一致
                }
            }
        }
    ]
}

vmess_ws_tls.json

{
    "log": {
        "loglevel": "warning"
    },
    "inbounds": [
        {
            "port": 10800,
            "listen": "127.0.0.1",
            "protocol": "socks",
            "settings": {
                "udp": true
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "vmess",
            "settings": {
                "vnext": [
                    {
                        "address": "example.com", // 换成你的域名或服务器 IP(发起请求时无需解析域名了)
                        "port": 443,
                        "users": [
                            {
                                "id": "", // 填写你的 UUID
                                "security": "none",
                                "level": 0
                            }
                        ]
                    }
                ]
            },
            "streamSettings": {
                "network": "ws",
                "security": "tls",
                "tlsSettings": {
                    "serverName": "example.com" // 换成你的域名
                },
                "wsSettings": {
                    "path": "/vmessws" // 必须换成自定义的 PATH,需要和服务端的一致
                }
            }
        }
    ]
}

VLESS-H2C-Caddy2

注意: 目前仅 caddy2 的 v2.2.0-rc.1 版及以后完美支持 v2ray 的 H2C,实现 H2(HTTP/2)应用。

V2ray配置文件

{
    "log": {
        "loglevel": "none"
    },
    "inbounds": [
        {
            "sniffing": {
                "enabled": true,
                "destOverride": ["http","tls"]
            },
            "listen": "127.0.0.1",
            "port": 10443,
            "tag": "vless-in",
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "id": "", // uuid
                        "level": 0
                    }
                ],
                "decryption": "none"
            },
            "streamSettings": {
                "network": "h2",
                "security": "none",
                "httpSettings": {
                    "path": "/path",
                    "host": [
                        ""
                    ]
                }
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "freedom",
            "settings": { },
            "tag": "direct"
        },
        {
            "protocol": "blackhole",
            "settings": { },
            "tag": "block"
        }
    ],
    "dns": {
        "servers": [
            "https://cloudflare-dns.com/dns-query",
            "https://dns.google/dns-query"
        ]
    },
    "routing": {
        "domainStrategy": "AsIs",
        "rules": [
            {
                "type": "field",
                "inboundTag": [
                  "vless-in"
                ],
                "outboundTag": "direct"
            },
            {
                "type": "field",
                "outboundTag": "block",
                "protocol": [
                    "bittorrent"
                ]
            }
        ]
    }
}

Caddy2的Caddyfile

example.com {
encode zstd gzip
root * /usr/share/caddy/example.com
file_server

tls admin@example.com {
    protocols tls1.3
    curves x25519
    alpn h2
}

header {
        Strict-Transport-Security max-age=31536000;
        X-Content-Type-Options nosniff
        X-Frame-Options DENY
        Referrer-Policy no-referrer-when-downgrade
}

reverse_proxy /v2ray?id=v2ray 127.0.0.1:10443 {
     header_up Host {http.request.host}
     header_up X-Real-IP {http.request.remote}
     header_up X-Forwarded-For {http.request.remote}
     header_up X-Forwarded-Port {http.request.port}
     header_up X-Forwarded-Proto {http.request.scheme}
     header_up Connection {http.request.header.Connection}
     header_up Upgrade {http.request.header.Upgrade}
     transport http {
         versions h2c
    }
  }
}

客户端

{
  "log":{},
  "inbounds":[
    {
      "port":"1080",
      "protocol":"socks",
      "settings":{
        "auth":"noauth",
        "udp":true
      }
    },
    {
      "port":"1081",
      "protocol":"http",
      "settings":{}
    }
  ],
  "outbounds":[
    {
      "protocol":"vless",
      "settings":{
        "vnext":[
          {
            "address":"example.com",
            "port":443,
            "users":[
              {
                "id":"",
                "encryption":"none"
              }
            ]
          }
        ]
      },
      "streamSettings":{
        "network":"h2",
        "security":"tls",
        "httpSettings":{
          "host":[
            "example.com"
          ],
          "path":"/path"
        }
      }
    },
    {
      "tag":"direct",
      "protocol":"freedom",
      "settings":{}
    },
    {
      "tag":"blocked",
      "protocol":"blackhole",
      "settings":{}
    }
  ],
  "routing":{
    "domainStrategy":"IPOnDemand",
    "rules":[
      {
        "type":"field",
        "ip":[
          "geoip:private"
        ],
        "outboundTag":"direct"
      }
    ]
  }
}

udp2raw vmess kcp

udp2raw-tunnel

下载udp2raw-tunnel

udp2raw服务端设置(Debain,Ubuntu,Centos)

wget https://github.com/wangyu-/udp2raw-tunnel/releases/download/20200818.0/udp2raw_binaries.tar.gz
tar -zxvf udp2raw_binaries.tar.gz
mv udp2raw_amd64 /usr/bin/udp2raw

运行

假设你有一个server,ip为44.55.66.77,有一个服务监听在udp 7777端口。 假设你本地的主机到44.55.66.77的UDP流量被屏蔽了,或者被qos了

在server端运行:

udp2raw -s -l0.0.0.0:4096  -r127.0.0.1:7777   -k "passwd" --raw-mode faketcp   --cipher-mode xor  -a

(以上例子需要用root账号运行。 用非root运行udp2raw需要一些额外的步骤,具体方法请看 这个 链接。用非root运行更安全)

udp2raw创建开机自动启动服务

echo "[Unit]
Description=udp2raw server
After=network.service

[Service]
Type=simple
User=root
Group=root
ExecStart=/usr/bin/udp2raw  -s -l0.0.0.0:4096  -r127.0.0.1:7777   -k "passwd" --raw-mode faketcp   --cipher-mode xor  -a &
PrivateTmp=true
Restart=on-failure

[Install]
WantedBy=multi-user.target" > /etc/systemd/system/udp2raw.service

udp2raw管理进程

systemctl daemon-reload
systemctl enable udp2raw.service
systemctl start udp2raw.service
systemctl status udp2raw.service

udp2raw在client端运行:

./udp2raw_amd64 -c -l0.0.0.0:3333  -r44.55.66.77:4096 -k "passwd" --raw-mode faketcp   --cipher-mode xor  -a

android设备上运行udp2raw(arm cpu)

照常运行udp2raw_arm,除了必须将-a选项更改为-g

./udp2raw_arm -c -r 44.55.66.77:4096 -l 0.0.0.0:3333 -k1234 --cipher xor -g

从udp2raw的输出中找到生成的iptables规则,通过运行手动将其添加:

iptables -I INPUT -s 44.55.66.77/32 -p tcp -m tcp --sport 4096 -j DROP

在不使用-g命令的情况下运行udp2raw_ram

./udp2raw_arm -c -r 44.55.66.77:4096 -l 0.0.0.0:3333 -k1234 --cipher xor

注意将44.55.66.77替换成你自己服务器的公网IP地址

Vmess KCP客户端V2ray配置

{
    "inbounds": [
        {
            "port": 10808,
            "listen": "127.0.0.1",
            "protocol": "socks",
            "settings": {
                "udp": true
            }
        }
    ],
  "outbounds": [
    {
      "protocol": "vmess",
      "settings": {
        "vnext": [
          {
            "address": "127.0.0.1",
            "port": 3333,
            "users": [
              {
                "id": "",  // 填写你的 UUID
                "alterId": 0
              }
            ]
          }
        ]
      },
      "streamSettings": {
			"network": "kcp",
			"security": "aes-128-gcm",
			"kcpSettings": {
				"mtu": 1350,
				"tti": 20,
				"uplinkCapacity": 5,
				"downlinkCapacity": 100,
				"congestion": false,
				"readBufferSize": 1,
				"writeBufferSize": 1,
				"header": {
					"type": "none"
				},
				"seed": "Password"
				}
			}
    }
  ]
}

管理V2Ray进程

启动

systemctl start v2ray.service

停止

systemctl stop v2ray.service

状态

systemctl status v2ray.service

重启

systemctl restart v2ray.service

日常SSL证书申请的路径

宝塔Nginx的SSL证书路径

/www/server/panel/vhost/cert/example.com/fullchain.pem
/www/server/panel/vhost/cert/example.com/privkey.pem

Caddy1的SSL证书路径

/etc/ssl/caddy/acme/acme-v02.api.letsencrypt.org/sites/example.com/example.com.crt
/etc/ssl/caddy/acme/acme-v02.api.letsencrypt.org/sites/example.com/example.com.key

Caddy2的SSL证书路径

/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/example.com/example.com.crt
/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/example.com/example.com.key

Certbot的SSL证书路径

/etc/letsencrypt/live/example.com/fullchain.pem
/etc/letsencrypt/live/example.com/privkey.pem

如果需要配置多个域名证书,可以增加certificates值,例如

"certificates": [
			{
			"certificateFile": "/path/to/tls1.crt", // 换成你的证书,绝对路径
			"keyFile": "/path/to/tls1.key" // 换成你的私钥,绝对路径
			},
			{
			"certificateFile": "/path/to/tls2.crt", // 换成你的证书,绝对路径
			"keyFile": "/path/to/tls2.key" // 换成你的私钥,绝对路径
			},
			{
			"certificateFile": "/path/to/tls3.crt", // 换成你的证书,绝对路径
			"keyFile": "/path/to/tls3.key" // 换成你的私钥,绝对路径
			}
		]

配置WEB服务器WebSocket的规则

在配置文件中添加v2ray的WebSocket的规则,然后重启在WEB服务器生效。

Caddy2

@v2ray_websocket {
    path /ray
    header Connection *Upgrade*
    header Upgrade websocket
    }
reverse_proxy @v2ray_websocket localhost:22782

Caddy

    proxy /ray localhost:22782 {
        websocket
        header_upstream -Origin
    }

Nginx

location /ray {
    proxy_redirect off;
    proxy_pass http://127.0.0.1:22782;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $http_host;
    proxy_read_timeout 300s;
    }

Apache

把以下配置加到VirtualHost值

  <Location "/ray/">
    ProxyPass ws://127.0.0.1:22782/ray/ upgrade=WebSocket
    ProxyAddHeaders Off
    ProxyPreserveHost On
    RequestHeader append X-Forwarded-For %{REMOTE_ADDR}s
  </Location>

REALITY

Reality不支持CDN、不需要配置ssl证书。

安装最新版本–beta

bash -c "$(curl -L https://raw.githubusercontent.com/XTLS/Xray-install/main/install-release.sh)" @ install -u root  --beta

安装预发布版本1.8.0+

bash -c "$(curl -L https://raw.githubusercontent.com/XTLS/Xray-install/main/install-release.sh)" install --version 1.8.0
  • 使用xray uuid 生成生成id
  • 使用xray x25519生成Private key和Public key

修改服务端配置文件/usr/local/etc/xray/config.json

{
    "inbounds": [
        {
            "listen": "0.0.0.0",
            "port": 443,
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "id": "id",
                        "flow": "xtls-rprx-vision"
                    }
                ],
                "decryption": "none"
            },
            "streamSettings": {
                "network": "tcp",
                "security": "reality",
                "realitySettings": {
                    "show": false,
                    "dest": "www.microsoft.com:443",
                    "xver": 0,
                    "serverNames": [
                        "www.iq.com",
			"www.microsoft.com",
			"www.cloudflare.com",
			"www.amazon.com",
			"dl.google.com",
                        "www.example.com"
                    ],
                    "privateKey": "填写privateKey值",
                    "minClientVer": "",
                    "maxClientVer": "",
                    "maxTimeDiff": 0,
                    "shortIds": [
                        "",
                        "0123456789abcdef"
                    ]
                }
            }
        }
    ],
    "outbounds": [
        {
        "protocol": "freedom",
        "settings": {}
        }
    ]
}

目标网站最低标准是支持 TLSv1.3 和 H2 的国外网站

重启xray

systemctl enable xray
systemctl restart xray