VPS Relay (tunnel) with Reality

[hawshemi]

Hello everyone. hope you are having a good day.

In the diagram below I showed how I want to set up 2 VPSs and connect them with vless-xtls-vision.

On the domestic VPS, routing will be applied (direct for domestic websites and ad blocking)
On the Foreign VPS, WARP will be applied on Google, Spotify,...

Is it possible to do this instead of nftables (for ipforwarding)? Because domestic servers in Iran limits the DL/UL speed with nftables/iptables forwarding. I tested with vless protocol and the limitation is lifted.

[hawshemi]

No one ever did this?
Or is it possible at all?

[vahidx4r4x]

If you install xray, x-ui, v2ray, etc... on the iran server it will be blocked and useless untill you install fresh OS.
Its recommended to rename the proccess and services immediately after installing them.

[hawshemi]

How they detect it if I change the root password? Or use a privatekey ssh authentication?

[chika0801]

For the Chinese, we buy a VPS, whether that VPS is in mainland China or outside of mainland China. The 1st event we do is to log into the VPS and reinstall the system of the VPS by DD network installation. https://github.com/bohanyang/debi

To prevent, for example, being scanned by a VPS merchant in mainland China for the names of the files in your VPS. I am not sure if this method is effective for your VPS in Iran domestic, after doing this. So the guy replied to you and told you to change xray to some other name, I guess that's what it means.

[hawshemi]

Thanks.
I tested with the domestic VPS. when I use iptables for tunnelling, speed limitations are applied (1mb/s dl speed) but when deployed with vless, all of the limitations are lifted (with TLS). and because of this, I want to tunnel between 2 VPSs with vless-tcp-vision.

[chika0801]

How they detect it if I change the root password? Or use a privatekey ssh authentication?

Hello everyone. hope you are having a good day.

In the diagram below I showed how I want to set up 2 VPSs and connect them with vless-xtls-vision.

On the domestic VPS, routing will be applied (direct for domestic websites and ad blocking) On the Foreign VPS, WARP will be applied on Google, Spotify,...

Is it possible to do this instead of nftables (for ipforwarding)? Because domestic servers in Iran limits the DL/UL speed with nftables/iptables forwarding. I tested with vless protocol and the limitation is lifted.

This method is feasible. Please note: For your domestic Iranian VPS, please make sure that in the Xray configuration file, in the inbound parameters section, you add the domain sniffing parameter.

            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls",
                    "quic"
                ]
            }

to ensure that the requests received by this server are all attributes of the domain name.

    "routing": {
        "domainStrategy": "IPIfNonMatch",
        "rules": [
            {
                "type": "field",
                "ip": [
                    "geoip:cn",
                    "geoip:private"
                ],
                "outboundTag": "block"
            }
        ]
    },

    "domainStrategy": "IPIfNonMatch",

Because you're doing IP splitting, make sure that in your routing rule, the parameter above, uses the value IPIfNonMatch

[chika0801]

https://xtls.github.io/Xray-docs-next/document/level-1/routing-lv1-part1.html#_1-%E5%88%9D%E8%AF%86%E3%80%90%E8%B7%AF%E7%94%B1%E3%80%91%E4%B8%89%E5%85%84%E5%BC%9F

You can refer to the link above. If you have questions about the processing flow in the xray configuration file, please ask your questions, attach your configuration file, and we can help you analyze it further.

I looked at your flow chart and thought of the above notes to remind you. No problems otherwise.

We are in China and generally do not purchase a VPS in China for a usage like your scenario. This is because domestic VPS in China are expensive and the VPS has a very small uplink bandwidth of about 1Mbps-5Mbps.

So people who build their own in China usually buy a VPS directly from outside of mainland China and connect directly from within China to the VPS they bought themselves. The quality of these VPS access lines to China is usually specifically optimized. The merchants offering these VPS services are usually Chinese and specialize in doing business with Chinese people.

[hawshemi]

So people who build their own in China usually buy a VPS directly from outside of mainland China and connect directly from within China to the VPS they bought themselves. The quality of these VPS access lines to China is usually specifically optimized. The merchants offering these VPS services are usually Chinese and specialize in doing business with Chinese people.

The main problem in Iran is: ISPs block the IP address of VPSs randomly(net4people/bbs#253 (comment)). some ISPs block some VPS provider's ASN and on some ISPs, it's completely fine. there is no centralized blocking to understand. so the main idea is I find a Domestic VPS that could connect to -let's say Hetzner- and then I connect my clients to domestic with whatever ISP they have.

I'm studying the docs for XTLS and testing the inbound and outbound...
Do you have a template for domestic and foreign VPS for config.json?

[chika0801]

Have you resolved your issue?

[hawshemi]

Not really. say a config which tunnel with dokodemo-door but I want the tunnel with utls-vision.
Didn't have the time to tinker with it yet.

[chika0801]

You can post the profile you're using now, with the necessary privacy information removed, here, and we'll help see how to modify it.

[hawshemi]

@chika0801

This is the foreign server config.json:

{
    "log": {
        "loglevel": "warning"
    },

    "inbounds": [
        {
            "listen": "0.0.0.0",
            "port": 443,
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "id": "XXX1",
                        "flow": "xtls-rprx-vision"
                    }
                ],
                "decryption": "none"
            },
            "streamSettings": {
                "network": "tcp",
                "security": "reality",
                "realitySettings": {
                    "dest": "www.speedtest.net:443", 
                    "serverNames": [ 
                        "www.speedtest.net" 
                    ],
                    "privateKey": "XXX1",
                    "shortIds": [ 
                        ""
                    ]
                }
            },
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls",
                    "quic"
                ]
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "freedom",
            "tag": "direct"
        },
        {
            "protocol": "blackhole",
            "tag": "block"
        }
    ],
    "policy": {
        "levels": {
            "0": {
                "handshake": 2,
                "connIdle": 120
            }
        }
    }
}

I exported the client config.json from v2rayng:

{
  "dns": {
    "hosts": {
      "domain:googleapis.cn": "googleapis.com"
    },
    "servers": [
      "1.1.1.1",
      {
        "address": "178.22.122.100",
        "domains": [
          "domain:ir"
        ],
        "expectIPs": [
          "geoip:cn"
        ],
        "port": 53
      }
    ]
  },
  "fakedns": [
    {
      "ipPool": "198.18.0.0/15",
      "poolSize": 10000
    }
  ],
  "inbounds": [
    {
      "listen": "127.0.0.1",
      "port": 10808,
      "protocol": "socks",
      "settings": {
        "auth": "noauth",
        "udp": true,
        "userLevel": 8
      },
      "sniffing": {
        "destOverride": [
          "http",
          "tls",
          "fakedns"
        ],
        "enabled": true
      },
      "tag": "socks"
    },
    {
      "listen": "127.0.0.1",
      "port": 10809,
      "protocol": "http",
      "settings": {
        "userLevel": 8
      },
      "tag": "http"
    }
  ],
  "log": {
    "loglevel": "warning"
  },
  "outbounds": [
    {
      "mux": {
        "concurrency": 8,
        "enabled": false
      },
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "116.xxx.xxx.xxx",
            "port": 443,
            "users": [
              {
                "encryption": "none",
                "flow": "xtls-rprx-vision",
                "id": "XXX1",
                "level": 8,
                "security": "auto"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "tcp",
        "realitySettings": {
          "allowInsecure": false,
          "fingerprint": "chrome",
          "publicKey": "XXX2",
          "serverName": "www.speedtest.net",
          "shortId": "",
          "show": false,
          "spiderX": ""
        },
        "security": "reality",
        "tcpSettings": {
          "header": {
            "type": "none"
          }
        }
      },
      "tag": "proxy"
    },
    {
      "protocol": "freedom",
      "settings": {
        "domainStrategy": "UseIP"
      },
      "tag": "direct"
    },
    {
      "protocol": "blackhole",
      "settings": {
        "response": {
          "type": "http"
        }
      },
      "tag": "block"
    }
  ],
  "policy": {
    "levels": {
      "8": {
        "connIdle": 300,
        "downlinkOnly": 1,
        "handshake": 4,
        "uplinkOnly": 1
      }
    },
    "system": {
      "statsOutboundUplink": true,
      "statsOutboundDownlink": true
    }
  },
  "stats": {}
}

So how would I config the Domestic VPS? (using reality like the config above)

[chika0801]

{
    "log": {
        "loglevel": "warning"
    },
    "dns": {
        "servers": [
            "1.1.1.1"
        ]
    },
    "routing": {
        "domainStrategy": "IPIfNonMatch",
        "rules": [
            {
                "type": "field",
                "domain": [
                    "geosite:category-ads-all"
                ],
                "outboundTag": "block"
            },
            {
                "type": "field",
                "domain": [
                    "geosite:iran"
                ],
                "outboundTag": "direct"
            },
            {
                "type": "field",
                "ip": [
                    "geoip:iran" // You will need to verify for yourself that the geoip.dat file you are using contains data for your region.
                ],
                "outboundTag": "direct"
            }
        ]
    },
    "inbounds": [
        {
            "listen": "0.0.0.0",
            "port": 443,
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "id": "",
                        "flow": "xtls-rprx-vision"
                    }
                ],
                "decryption": "none"
            },
            "streamSettings": {
                "network": "tcp",
                "security": "reality",
                "realitySettings": {
                    "dest": "",
                    "serverNames": [
                        ""
                    ],
                    "privateKey": "",
                    "shortIds": [
                        ""
                    ]
                }
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "vless",
            "settings": {
                "vnext": [
                    {
                        "address": "",
                        "port": 443,
                        "users": [
                            {
                                "id": "",
                                "encryption": "none",
                                "flow": "xtls-rprx-vision"
                            }
                        ]
                    }
                ]
            },
            "streamSettings": {
                "network": "tcp",
                "security": "reality",
                "realitySettings": {
                    "fingerprint": "chrome",
                    "serverName": "",
                    "publicKey": "",
                    "shortId": "",
                    "spiderX": ""
                }
            },
            "mux": {
                "enabled": true,
                "concurrency": -1,
                "xudpConcurrency": 16,
                "xudpProxyUDP443": "reject"
            },
            "tag": "proxy"
        },
        {
            "protocol": "freedom",
            "tag": "direct"
        },
        {
            "protocol": "blackhole",
            "tag": "block"
        }
    ],
    "policy": {
        "levels": {
            "0": {
                "handshake": 2,
                "connIdle": 120
            }
        }
    }
}

[hawshemi]

Thanks. so much help.
After some playing around I came up with this:

DOMESTIC config.json:
(Download iran.dat from https://github.com/MasterKia/iran-hosted-domains/releases/latest and put it alongside geosite.dat and geoip.dat)

{
    "log": {
        "loglevel": "warning"
    },
    "dns": {
        "servers": [
            "1.1.1.1"
        ]
    },
    "routing": {
        "domainStrategy": "IPIfNonMatch",
        "rules": [
            {
                "type": "field",
                "domain": [
                                   "geosite:category-ads-all",
		                   "ext:iran.dat:ads"
                ],
                "outboundTag": "block"
            },
            {
                "type": "field",
                "domain": [
				"regexp:.*\\.ir$",
                                "geosite:category-ir",
			        "ext:iran.dat:ir",
			        "ext:iran.dat:other"
                ],
                "outboundTag": "direct"
            },
            {
                "type": "field",
                "ip": [
                    "geoip:ir"
                ],
                "outboundTag": "direct"
            }
        ]
    },
    "inbounds": [
        {
            "listen": "0.0.0.0",
            "port": 443,
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "id": "domestic-id",
                        "flow": "xtls-rprx-vision"
                    }
                ],
                "decryption": "none"
            },
            "streamSettings": {
                "network": "tcp",
                "security": "reality",
                "realitySettings": {
                    "dest": "www.speedtest.net:443",
                    "serverNames": [
                        "www.speedtest.net"
                    ],
                    "privateKey": "domestic-private-key",
                    "shortIds": [
                        ""
                    ]
                }
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "vless",
            "settings": {
                "vnext": [
                    {
                        "address": "foreign address (ip or domain)",
                        "port": 443,
                        "users": [
                            {
                                "id": "foreign-id",
                                "encryption": "none",
                                "flow": "xtls-rprx-vision"
                            }
                        ]
                    }
                ]
            },
            "streamSettings": {
                "network": "tcp",
                "security": "reality",
                "realitySettings": {
                    "fingerprint": "chrome",
                    "serverName": "www.speedtest.net",
                    "publicKey": "foreign-public-key",
                    "shortId": "",
                    "spiderX": ""
                }
            },
            "mux": {
                "enabled": true,
                "concurrency": -1,
                "xudpConcurrency": 16,
                "xudpProxyUDP443": "reject"
            },
            "tag": "proxy"
        },
        {
            "protocol": "freedom",
            "tag": "direct"
        },
        {
            "protocol": "blackhole",
            "tag": "block"
        }
    ],
    "policy": {
        "levels": {
            "0": {
                "handshake": 2,
                "connIdle": 120
            }
        }
    }
}

FOREIGN config.json: (Install WARP service on port 40000)

{
    "log": {
        "loglevel": "warning"
    },

    "inbounds": [
        {
            "listen": "0.0.0.0",
            "port": 443,
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "id": "foreign-id",
                        "flow": "xtls-rprx-vision"
                    }
                ],
                "decryption": "none"
            },
            "streamSettings": {
                "network": "tcp",
                "security": "reality",
                "realitySettings": {
                    "dest": "www.speedtest.net:443", 
                    "serverNames": [ 
                        "www.speedtest.net" 
                    ],
                    "privateKey": "foreign-private-key",
                    "shortIds": [ 
                        ""
                    ]
                }
            },
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls",
                    "quic"
                ]
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "freedom",
            "tag": "direct"
        },
        {
            "protocol": "blackhole",
            "tag": "block"
        },
		{
			"protocol": "socks",
			"settings": {
				"servers": [
					{
						"address": "127.0.0.1",
						"port": 40000
					}
							]
						},
			"tag": "WARP"
		}
    ],
    "policy": {
        "levels": {
            "0": {
                "handshake": 2,
                "connIdle": 120
            }
        }
    },
	"routing": {
		"domainStrategy": "IPIfNonMatch",
		"rules": [
			{
        "domain": [
          "geosite:google",
          "geosite:openai",
          "geosite:netflix",
          "geosite:spotify",
          "geosite:cloudflare",
          "geosite:meta",
          "geosite:microsoft",
          "geosite:vimeo"
				],
        "outboundTag": "WARP",
        "type": "field"
			}
    ]
  }
}

[chika0801]

I looked at your 2 profiles and the config file I didn't find a problem. The config file implements what is expressed in the picture you drew.

If you still have questions about the config files, I recommend you to post here for help, asking for help in telegram Xray's community is not a good idea.

[chika0801]

If you don't want to use the tool in the link (https://github.com/fscarmen/warp) to get into the WARP program, you can refer to this link (https://github.com/chika0801/Xray-examples/blob/main/wireguard.md) and use the wireguard feature built into Xray to get into the WARP network.

The latest 1.8.3 server version of Xray is recommended.