[帮助] Did not work out on xtls+vision+nginx. pls help (config provided).

[bernnika]

no errors, but also no responses.
the fallback website returns at very begining, but later no responses either.
let me know if you need more inputs.
thanks

=====SERVER SIDE=====

TCP 80/443 verified opened
UDP 53 opened (localhost only, to be accessed by dokodemo-door)

• server.json:

{
  "log": {
    "access": "none",
    "loglevel": "warning"
  },
  "inbounds": [
    {
      "listen": "0.0.0.0",
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "flow": "xtls-rprx-vision",
            "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
          }
        ],
        "decryption": "none",
        "fallbacks": [
          {
            "dest": "/dev/shm/http.sock",
            "xver": 2
          }
        ]
      },
      "streamSettings": {
        "network": "tcp",
        "security": "tls",
        "sockopt": {
          "tcpNoDelay": true
        },
        "tlsSettings": {
          "certificates": [
            {
              "certificateFile": "/somewhere/fullchain.cer",
              "keyFile": "/somewhere/example.org.key",
              "ocspStapling": 3600
            }
          ],
          "minVersion": "1.2",
          "rejectUnknownSni": true
        }
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom"
    }
  ]
}

• nginx.conf:

events {
    worker_connections  64;
}

http {
    keepalive_timeout   0;
    sendfile            on;
    server_tokens       off;

    server {
        listen      0.0.0.0:80;
        error_page  301 @30x;
        location    @30x {
            default_type  "";
            return        300;
        }
        return      301 https://$host$request_uri;
    }

    server {
        http2                       on;
        listen                      unix:/dev/shm/http.sock proxy_protocol;
        real_ip_header              proxy_protocol;
        server_name                 example.org www.example.org;
        set_real_ip_from            unix:;

        location / {
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
            return 200 '200';
        }
    }
}

=====CLIENT SIDE=====

pppoe gateway, debian, iptables
dns is well-managed separately (queries of oversea domains are forward to UDP 1053 via dokodemo-door)

• client.json:

{
  "log": {
    "access": "none",
    "loglevel": "warning"
  },
  "inbounds": [
    {
      "listen": "127.0.0.1",
      "port": 1080,
      "protocol": "dokodemo-door",
      "settings": {
        "network": "tcp,udp",
        "followRedirect": true
      },
      "streamSettings": {
        "sockopt": {
          "tcpMaxSeg": 1440,
          "tcpNoDelay": true,
          "tproxy": "tproxy"
        }
      }
    },
    {
      "listen": "127.0.0.1",
      "port": 1053,
      "protocol": "dokodemo-door",
      "settings": {
        "address": "127.0.0.1",
        "port": 53,
        "network": "udp",
        "timeout": 0
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "www.example.org",
            "port": 443,
            "users": [
              {
                "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
                "encryption": "none",
                "flow": "xtls-rprx-vision"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "tcp",
        "security": "tls",
        "tlsSettings": {
          "fingerprint": "android",
          "serverName": "www.example.org"
        },
        "sockopt": {
          "tcpMaxSeg": 1440,
          "tcpNoDelay": true
        }
      }
    }
  ],
  "policy": {
    "levels": {
      "0": {
        "bufferSize": 8192,
        "statsUserDownlink": false,
        "statsUserUplink": false,
        "downlinkOnly": 0,
        "uplinkOnly": 0
      }
    },
    "system": {
      "statsInboundDownlink": false,
      "statsInboundUplink": false,
      "statsOutboundDownlink": false,
      "statsOutboundUplink": false
    }
  }
}

• iptables:

work for hysteria, but not xray

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.0.0.0/24 -o ppp0 -j MASQUERADE
COMMIT

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:PPP0 - [0:0]
-A INPUT -i ppp0 -j PPP0
-A INPUT -i br0 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A FORWARD -i ppp0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i br0 -j ACCEPT
-A PPP0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
COMMIT

*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:CLIENT - [0:0]
:CLIENT_LOCAL - [0:0]
:DIVERT - [0:0]
:PPP0 - [0:0]
-A PREROUTING -p tcp -m socket --transparent -j DIVERT
-A PREROUTING -i ppp0 -j PPP0
-A PREROUTING ! -i ppp0 -j CLIENT
-A FORWARD -o ppp0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A OUTPUT -o ppp0 ! -p icmp -j CLIENT_LOCAL
-A POSTROUTING -o ppp0 -j DSCP --set-dscp 0x2e
-A CLIENT -m set --match-set whitelist dst -j RETURN  ## xray server ip is included in 'whitelist'
-A CLIENT -p udp -j TPROXY --on-port 1080 --on-ip 127.0.0.1 --tproxy-mark 0x1/0xffffffff
-A CLIENT -p tcp -j TPROXY --on-port 1080 --on-ip 127.0.0.1 --tproxy-mark 0x1/0xffffffff
-A CLIENT_LOCAL -m set --match-set whitelist dst -j RETURN  ## xray server ip is included in 'whitelist'
-A CLIENT_LOCAL -j MARK --set-xmark 0x1/0xffffffff
-A DIVERT -j MARK --set-xmark 0x1/0xffffffff
-A DIVERT -j ACCEPT
-A PPP0 -m conntrack --ctstate INVALID -j DROP
-A PPP0 -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j DROP
COMMIT

[bernnika]

anyone help pls~

[bernnika]

@RPRX @lxhao61 @Fangliding can anyone at least tell me this configuration is valid or not? any possible hints or suggestions would be sincerely appreciated.

[surfacing7336]

https://github.com/lxhao61/integrated-examples/tree/main/Xray(VLESS%2BVision%2BTLS)%2BNginx

https://github.com/chika0801/Xray-install

https://github.com/chika0801/Xray-examples/tree/main/VLESS-Vision-TLS

https://github.com/chika0801/Xray-examples/blob/main/v2rayNG_custom_remote_dns.json

The examples I provided are not related to setting up tproxy.
These configurations are actually about setting up REALITY vision with Nginx.