VPN Setup by sergei-thinker

This project provides a multi-layer VPN infrastructure designed to bypass internet censorship (DPI/TSPU) using VLESS Reality. The system masks VPN traffic as standard HTTPS requests to major providers like Microsoft, Google, or Apple.

Key features include:

• Automatic Failover: The system switches between connection layers if one is blocked.
• Split Routing: Russian websites (banks, government services, VK, Yandex) are routed directly without VPN to ensure speed and avoid suspicion.
• Layered Architecture:
  • Layer 0 (Primary): VLESS Reality via a foreign VPS.
  • Layer 1 (Relay): Russian Relay VPS (e.g., Timeweb, VDSina) used if the primary VPS IP is blocked.
  • Layer 2 (Emergency): WebRTC / Telemost (Desktop only).
  • Layer 3 (Backup): Cloudflare CDN (for Wi-Fi environments).

TSPU (Technical Means of Counteracting Threats) devices managed by regulators use DPI (Deep Packet Inspection) to analyze traffic. They use several methods to identify and block VPNs:

Note on Network Types: Mobile operators (e.g., MTS, Megafon, Beeline) apply much more aggressive blocking than home Wi-Fi providers. A VPN configuration that works on Wi-Fi may fail on LTE.

Certain applications are known to use system calls (like getifaddrs() or GetAdaptersAddresses()) to bypass VPN tunnels or leak the real IP to local services. It is recommended NOT to run these on the same machine as an active VPN:

Alternatives: Use web versions in containerized browsers, an isolated VM/Docker, or a separate Windows user profile.

VLESS Reality is a protocol designed to make VPN traffic indistinguishable from a standard HTTPS connection to a major website (like Microsoft, Google, or Apple).

The workflow is as follows:

1. The client establishes a TLS connection with your server.
2. To an external observer (DPI), the connection appears to be directed at a legitimate site (e.g., www.microsoft.com).
3. If a 'suspicious' check is performed, Reality provides the real certificate of the target site.
4. Your actual traffic is transmitted via the VLESS protocol inside the TLS tunnel.
5. The xtls-rprx-vision flow is used to optimize data transmission by avoiding double-encryption of already encrypted data.

Layer 3 uses Cloudflare CDN to mask your VPS IP address. This is useful on home Wi-Fi if your provider blocks your VPS IP directly. Instead of connecting to your VPS, the client connects to Cloudflare, which then proxies the traffic to your VPS.

Warning: As of April 2026, Cloudflare is actively being blocked by TSPU. Layer 3 does not work on mobile networks with white-list restrictions. For mobile internet, use Layer 1 (relay on a Russian VPS).

The client follows a specific priority order when attempting to establish a connection. It will attempt to use the highest priority method that is currently unblocked:

1. reality-main:443 (Lowest latency)
2. reality-google:8443 (Fallback SNI)
3. reality-apple:2053 (Fallback SNI)
4. Relay via Russian VPS (Timeweb/VDSina/Selectel/VK Cloud) - Used if the main VPS IP is blacklisted. Note: Yandex Cloud is not recommended for this layer as it does not bypass TSPU white-lists effectively.
5. WebRTC (Emergency fallback for strict white-lists)
6. ws-cloudflare:2082 (Cloudflare CDN - Wi-Fi only, subject to TSPU blocks).

When choosing a router setup, consider the platform and the protocol. Standard protocols like WireGuard or OpenVPN are easily detected by DPI in Russia. VLESS Reality is recommended because it masks traffic as standard HTTPS (e.g., to microsoft.com).

The proxy facilitates a connection between a client and a VLESS backend through the Cloudflare CDN using the following flow:

Client (v2ray/xray) ──WSS 443──▶ Cloudflare CDN ──WS 2082──▶ VPS (VLESS)

1. The client initiates a WebSocket connection to the worker URL on port 443.
2. Cloudflare terminates the TLS connection.
3. The Worker forwards the WebSocket connection to the backend VPS on port 2082.
4. Any requests that do not match the configured WS_PATH are served a generic landing page, hiding the existence of the proxy.

Split routing allows Russian domains and IP addresses to connect directly (DIRECT) while routing all other traffic through the VLESS Reality VPN. This prevents latency issues, avoids CAPTCHAs on Yandex/VK, and prevents banks or government services (Gosuslugi) from blocking Swedish IP addresses.

Ready-to-use configuration files are located in the client-configs/ directory for various platforms:

• shadowrocket-rules.conf: iOS (Shadowrocket)
• v2rayng-routing.json: Android (v2rayNG)
• hiddify-routing.txt: Windows (Hiddify)
• xray-server-routing.json: Server (3X-UI)