xray-examples

This project provides a client-side template for performing MITM (Man-in-the-Middle) decryption of TLS requests and re-issuing them with a fake SNI (Server Name Indication). This mechanism achieves forced domain fronting.

Key Use Cases:

• Achieving domain fronting.
• TLS offloading for subsequent processing.
• Encrypting plaintext data into a TLS tunnel.

Prerequisites:

• A deep understanding of TLS and HTTPS protocols (specifically SNI and ALPN mechanisms).
• The target website must accept domain fronting or requests without SNI.
• The target IP must not be blocked by a firewall.

Note: This is a demonstration template. The example uses e-hentai because its frontend structure is simple, but other websites may require additional handling for various resource domains.

Using Xray-core, you can establish a Shadowsocks AEAD encrypted tunnel that supports Socks, HTTP proxies, and UDP FullCone.

Key features include:

• Single Port Multi-User Support: The server can handle multiple users with different credentials on a single port.
• Full UDP Support: Xray-core provides robust UDP support; Socks inbounds can accept UDP requests from any network interface.
• High Performance: Designed to be high-performance, cross-platform, and easy to compile.

VLESS-TLS-SplitHTTP-H3 is a configuration pattern that utilizes HTTP/3 (H3) for transport. It supports two primary connection modes:

1. Direct Connection: The Xray client communicates directly with the Xray server via HTTP/3. Xray client <--- HTTP3 ---> Xray server

2. CDN Integration: The Xray client communicates with a CDN via HTTP/3, while the CDN communicates with the Xray server via HTTP/2 or HTTP/1.1. Xray client <--- HTTP3 ---> CDN <--- HTTP2 or HTTP/1.1 ---> Xray server

This repository provides configuration examples for the Hysteria2 protocol, specifically focusing on the server-side inbound and the client-side outbound settings.

Note on Congestion Control: When using the brutal congestion control algorithm, ensure your bandwidth characteristics are compatible. If unsure, it is recommended to use bbr instead.

This advanced configuration implements VLESS over TCP with TLS on port 443. It utilizes VLESS fallback and distribution features to allow for the perfect coexistence of VLESS and any WebSocket Secure (WSS) protocol on the same port.

Key features:

• Coexistence: Allows connecting via VLESS over TCP with TLS and any WebSocket with TLS simultaneously.
• CDN Support: The WebSocket portion can be routed through a CDN.
• Performance: This configuration's performance for fallback shunting to WebSocket is measured to be stronger than using an Nginx reverse proxy for WebSocket generation.
• Migration: Traditional VMess + WSS solutions can be migrated to this setup without losing compatibility.

Note: This configuration is provided for reference. You can replace VLESS on WS with other protocols (like VMess) and define additional PATHs and protocol coexistence settings.

The Xray Reverse Proxy setup allows a client to connect to an internal device through a public-facing portal. The architecture follows this flow:

Xray Client <--- VMESS/SS ---> Xray Portal (Public IP) <--- VMESS/SS ---> Xray Bridge

In this setup:

• Xray Client: The end-user device.
• Xray Portal: A device with a public IP that acts as the intermediary.
• Xray Bridge: The internal device being accessed.

Commonly used transport protocols for the connections include VMESS-TCP and Shadowsocks-2022.

Xray's HTTP/2 and HTTP/3 transport modes strictly follow HTTP standards, allowing them to be proxied through standard HTTP servers like Caddy.

To prevent middlebox detection of Xray-core, use Caddy's reverse_proxy module with path-based routing. Configure a complex path for the proxy to disguise the traffic, while the main path serves a legitimate website. This ensures that an observer cannot easily distinguish Xray traffic from standard web traffic.

To use the minimal VLESS over TCP with TLS and fallback configuration, you must satisfy the following requirements:

1. Domain Name: A domain name pointing to your server's IP address.
2. SSL Certificate: A valid SSL certificate for your domain (e.g., obtained via Let's Encrypt).
3. Web Server: A web server such as Nginx or Caddy installed on the server to handle fallback traffic.

This configuration is an advanced superset of the minimal VLESS-TCP-TLS setup. It leverages VLESS's fallback and traffic splitting capabilities to allow VLESS over TCP with TLS and any WebSocket Secure (WSS) protocol to coexist on port 443.

Key Features:

• Allows simultaneous connections via VLESS over TCP with TLS and any WebSocket with TLS.
• WebSocket connections can be routed through a CDN.
• Provides better performance than using Nginx as a reverse proxy for WebSocket traffic.
• Compatible with traditional VMess + WSS migration paths.

⚠️ SECURITY WARNING: This configuration was previously recommended, but it has been identified as having security flaws. It is now considered deprecated. Use with caution and consider migrating to more modern configurations like XTLS.

This setup implements a VLESS protocol over HTTP/2 (H2) using Caddy as a proxy. The data flow follows this path:

Xray client <--- H2 ---> Caddy2 <--- H2C ---> Xray server

This architecture allows the client to communicate with Caddy via standard HTTP/2, while Caddy communicates with the Xray server using H2C (HTTP/2 over Cleartext).

Xray client <--- H2 ---> Caddy2 <--- H2C ---> Xray server