Replies: 2 comments 8 replies
-
|
各位大佬出手吧，帮小弟指点迷津呀 |
Beta Was this translation helpful? Give feedback.
-
|
参考 https://github.com/lxhao61/integrated-examples 中 Xray(E+H+G+B+A)+Caddy 或 Xray(E+H+G+B+A)+Nginx 服务端示例及对应客户端示例，你就知道错了那些地方。 |
Beta Was this translation helpful? Give feedback.
-
|
你为什么不仔细对比看！？PROXY protocol 发送与接收需对应。 |
Beta Was this translation helpful? Give feedback.
-
|
您好， |
Beta Was this translation helpful? Give feedback.
-
|
是的。 |
Beta Was this translation helpful? Give feedback.
-
问题按照您推荐的Xray(E+H+G+B+A)+Nginx，回落给88端口的Nginx，在验证连接xhttp时，报错：PROXY Protocol 配置不正确，还请帮忙看下
xray配置{
// 1_日志设置
"log": {
"loglevel": "debug", // 内容从少到多: "none", "error", "warning", "info", "debug"
"access": "/var/log/xray/access.log", // 访问记录
"error": "/var/log/xray/error.log" // 错误记录
},
// 2_DNS 设置
"dns": {
"servers": [
"https+local://1.1.1.1/dns-query", // 首选 1.1.1.1 的 DoH 查询，牺牲速度但可防止 ISP 偷窥
"localhost"
]
},
// 3_分流设置
"routing": {
"domainStrategy": "IPIfNonMatch",
"rules": [
{
// 3.1 防止服务器本地流转问题：如内网被攻击或滥用、错误的本地回环等
"type": "field",
"ip": [
"geoip:private" // 分流条件：geoip 文件内，名为"private"的规则（本地）
],
"outboundTag": "block" // 分流策略：交给出站"block"处理（黑洞屏蔽）
},
{
// 3.2 防止服务器直连国内
"type": "field",
"ip": ["geoip:cn"],
"outboundTag": "block"
},
{
// 3.3 屏蔽广告
"type": "field",
"domain": [
"geosite:category-ads-all" // 分流条件：geosite 文件内，名为"category-ads-all"的规则（各种广告域名）
],
"outboundTag": "block" // 分流策略：交给出站"block"处理（黑洞屏蔽）
}
]
},
// 4_入站设置
// 4.1 这里只写了一个最简单的 vless+xtls 的入站，因为这是 Xray 最强大的模式。如有其他需要，请根据模版自行添加。
"inbounds": [
{
"listen": "0.0.0.0",
"port": 443,
"protocol": "vless",
"settings": {
"clients": [
{
"id": "REDACTED-UUID-2", // 填写你的 UUID
"flow": "xtls-rprx-vision",
"level": 0,
"email": "[email protected]"
}
],
"decryption": "none",
"fallbacks": [
{
"dest": 88, // 回落给 H2C server 及 HTTP/1.1 server 监听端口
"xver": 1 // 开启 PROXY protocol 发送，发送真实来源 IP 和端口给 Nginx。 1 或 2 表示 PROXY protocol 版本。
} // 对应 Nginx 版本不小于 v1.25.1 配置，否则此部分必须删除。
]
},
"streamSettings": {
"network": "raw",
"security": "tls",
"tlsSettings": {
"alpn": ["h2", "http/1.1"],
"certificates": [
{
"certificateFile": "/path/to/certificate.pem",
"keyFile": "/path/to/key.key"
}
]
}
},
"sniffing": {
"enabled": true,
"destOverride": ["http", "tls", "quic"],
"metadataOnly": false
}
},
{
"listen": "0.0.0.0",
"port": 8443,
"protocol": "vless",
"settings": {
"clients": [
{
"id": "REDACTED-UUID-3", // 填写你的 UUID
"level": 0,
"email": "[email protected]"
}
],
"decryption": "none"
},
"streamSettings": {
"network": "xhttp",
"xhttpSettings": {
"path": "/path/to/xhttp" // 在这里指定您的路径
},
"security": "none"
}
},
{
"listen": "0.0.0.0",
"port": 6443,
"protocol": "vless",
"settings": {
"clients": [
{
"id": "REDACTED-UUID-4", // 填写你的 UUID
"level": 0,
"email": "[email protected]"
}
],
"decryption": "none"
},
"streamSettings": {
"network": "ws",
"wsSettings": {
"path": "/path/to/ws" // 在这里指定您的路径
},
"security": "none"
}
}
],
// 5_出站设置
"outbounds": [
// 5.1 第一个出站是默认规则，freedom 就是对外直连（vps 已经是外网，所以直连）
{
"tag": "direct",
"protocol": "freedom"
},
// 5.2 屏蔽规则，blackhole 协议就是把流量导入到黑洞里（屏蔽）
{
"tag": "block",
"protocol": "blackhole"
}
]
}Nginx配置 |
Beta Was this translation helpful? Give feedback.
-
|
请自行折腾！己有服务/客户端示例及介绍、注意等提示照搬也出问题，那建议就不要折腾了。买机场帐号或一键脚本应是你最好选择。 |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
背景
TCP+TLS 组合，做443入口站，分别回落到
问题日志
客户端连接时，提示连接终止和错误
客户端xhttp传输方式
错误日志
日志解读
连接初始信息
firstLen = 1333：表示收到的第一个数据包长度为 1333 字节。这通常是协议握手的一部分。
无效请求版本
fallback starts > proxy/vless/encoding: invalid request version：表示收到的请求使用了无效的协议版本，导致启动了回退机制。这通常是由客户端和服务端协议不匹配引起的。
域名相关信息
3.1 realName = [CLOUDFRONT_DOMAIN]：表明请求试图通过 CloudFront 这个域名进行连接。
3.2 没看到 realPath 的信息，而且端口也是8000，说明没有按预期回落到8443端口
连接失败和错误
4.1 failed to dial to 127.0.0.1:8000：在回退机制尝试连接到本地端口 8000 时失败，通常表示该端口上没有服务在监听。
4.2 connect: connection refused：明确指出连接请求被拒绝，这意味着目标端口没有被监听。
4.3 common/retry: all retry attempts failed：表明系统尝试了多次连接，但最终都失败了。
客户端ws传输方式
错误日志
日志解读
firstLen = 410：表示收到的第一个数据包长度为 410 字节。这通常是协议握手的一部分。
无效请求版本
3.1 realName = [CLOUDFRONT_DOMAIN]：表明请求试图通过 CloudFront 这个域名进行连接。
3.2 realPath = /[REAL_PATH]：请求路径信息。这在诊断路径设置是否正确时很有用。
4.1 connection ends > proxy/vless/inbound: fallback ends > proxy/vless/inbound: failed to deliver response payload：连接结束，并且在回退过程中无法传递响应数据。
4.2 read: connection reset by peer 和 use of closed network connection：分别表示连接被对端重置以及尝试在已关闭的连接上进行读操作。这可能是由于网络不稳定、配置错误或资源不可用导致的。
配置
服务端
{ "log": { "loglevel": "debug", "access": "/var/log/xray/access.log", "error": "/var/log/xray/error.log" }, "dns": { "servers": [ "https+local://1.1.1.1/dns-query", "localhost" ] }, "routing": { "domainStrategy": "IPIfNonMatch", "rules": [ { "type": "field", "ip": ["geoip:private"], "outboundTag": "block" }, { "type": "field", "ip": ["geoip:cn"], "outboundTag": "block" }, { "type": "field", "domain": ["geosite:category-ads-all"], "outboundTag": "block" } ] }, "inbounds": [ { "listen": "0.0.0.0", "port": 443, "protocol": "vless", "settings": { "clients": [ { "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", "level": 0, "email": "[email protected]" } ], "decryption": "none", "fallbacks": [ { "path": "/path1", "dest": 8443, "xver": 1 }, { "path": "/path2", "dest": 6443, "xver": 1 }, { "dest": 8000 } ] }, "streamSettings": { "network": "tcp", "security": "tls", "tlsSettings": { "alpn": ["http/1.1"], "certificates": [ { "certificateFile": "/path/to/fullchainfile.pem", "keyFile": "/path/to/keyfile.key" } ] } } }, { "listen": "0.0.0.0", "port": 8443, "protocol": "vless", "settings": { "clients": [ { "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", "level": 0, "email": "[email protected]" } ], "decryption": "none" }, "streamSettings": { "network": "xhttp", "xhttpSettings": { "path": "/path1" }, "security": "none" } }, { "listen": "0.0.0.0", "port": 6443, "protocol": "vless", "settings": { "clients": [ { "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", "level": 0, "email": "[email protected]" } ], "decryption": "none" }, "streamSettings": { "network": "ws", "wsSettings": { "path": "/path2" }, "security": "none" } } ], "outbounds": [ { "tag": "direct", "protocol": "freedom" }, { "tag": "block", "protocol": "blackhole" } ] }客户端-xhttp传输
{ "dns": { "hosts": { "geosite:category-ads-all": "127.0.0.1", "domain:example.cn": "example.com", "dns.example.com": [ "223.5.5.5", "223.6.6.6", "2400:3200::1", "2400:3200:baba::1" ], "one.example.one": [ "1.1.1.1", "1.0.0.1", "2606:4700:4700::1111", "2606:4700:4700::1001" ], "dot.example": [ "1.12.12.12", "120.53.53.53" ], "dns.example": [ "8.8.8.8", "8.8.4.4", "2001:4860:4860::8888", "2001:4860:4860::8844" ], "dns.quad9.net": [ "9.9.9.9", "149.112.112.112", "2620:fe::fe", "2620:fe::9" ], "common.dot.dns.example.net": [ "77.88.8.8", "77.88.8.1", "2a02:6b8::feed:0ff", "2a02:6b8:0:1::feed:0ff" ] }, "servers": [ "1.1.1.1", { "address": "1.1.1.1", "domains": [ "domain:example.cn", "domain:gstatic.com" ] }, { "address": "223.5.5.5", "domains": [ "domain:example.com", "domain:doh.example", "domain:dot.example", "domain:360.cn", "domain:example.net", "geosite:cn" ], "expectIPs": [ "geoip:cn" ], "skipFallback": true } ] }, "inbounds": [ { "listen": "127.0.0.1", "port": 10770, "protocol": "socks", "settings": { "auth": "noauth", "udp": true, "userLevel": 8 }, "sniffing": { "destOverride": [ "http", "tls" ], "enabled": true, "routeOnly": false }, "tag": "socks" }, { "listen": "127.0.0.1", "port": 10853, "protocol": "dokodemo-door", "settings": { "address": "1.1.1.1", "network": "tcp,udp", "port": 53 }, "tag": "dns-in" } ], "log": { "loglevel": "debug" }, "outbounds": [ { "mux": { "concurrency": -1, "enabled": false, "xudpConcurrency": 8, "xudpProxyUDP443": "" }, "protocol": "vless", "settings": { "vnext": [ { "address": "[CLOUDFRONT_DOMAIN]", "port": 443, "users": [ { "encryption": "none", "flow": "", "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", "level": 8 } ] } ] }, "streamSettings": { "network": "xhttp", "security": "tls", "tlsSettings": { "allowInsecure": false, "alpn": [ "h3", "h2", "http/1.1" ], "show": false }, "xhttpSettings": { "host": "", "mode": "auto", "path": "/[PATH]" } }, "tag": "proxy" }, { "protocol": "freedom", "settings": { "domainStrategy": "UseIP" }, "tag": "direct" }, { "protocol": "blackhole", "settings": { "response": { "type": "http" } }, "tag": "block" }, { "protocol": "dns", "tag": "dns-out" } ], "policy": { "levels": { "8": { "connIdle": 300, "downlinkOnly": 1, "handshake": 4, "uplinkOnly": 1 } }, "system": { "statsOutboundUplink": true, "statsOutboundDownlink": true } }, "remarks": "xray-vless-xhttp", "routing": { "domainStrategy": "AsIs", "rules": [ { "inboundTag": [ "dns-in" ], "outboundTag": "dns-out", "type": "field" }, { "ip": [ "1.1.1.1" ], "outboundTag": "proxy", "port": "53", "type": "field" }, { "ip": [ "223.5.5.5" ], "outboundTag": "direct", "port": "53", "type": "field" }, { "domain": [ "domain:example.cn", "domain:gstatic.com" ], "outboundTag": "proxy", "type": "field" }, { "network": "udp", "outboundTag": "block", "port": "443", "type": "field" }, { "domain": [ "geosite:category-ads-all" ], "outboundTag": "block", "type": "field" }, { "ip": [ "geoip:private" ], "outboundTag": "direct", "type": "field" }, { "domain": [ "geosite:private" ], "outboundTag": "direct", "type": "field" }, { "ip": [ "223.5.5.5", "223.6.6.6", "2400:3200::1", "2400:3200:baba::1", "119.29.29.29", "1.12.12.12", "120.53.53.53", "2402:4e00::", "2402:4e00:1::", "180.76.76.76", "2400:da00::6666", "114.114.114.114", "114.114.115.115", "114.114.114.119", "114.114.115.119", "114.114.114.110", "114.114.115.110", "180.184.1.1", "180.184.2.2", "101.226.4.6", "218.30.118.6", "123.125.81.6", "140.207.198.6", "1.2.4.8", "210.2.4.8", "52.80.66.66", "117.50.22.22", "2400:7fc0:849e:200::4", "2404:c2c0:85d8:901::4", "117.50.10.10", "52.80.52.52", "2400:7fc0:849e:200::8", "2404:c2c0:85d8:901::8", "117.50.60.30", "52.80.60.30" ], "outboundTag": "direct", "type": "field" }, { "domain": [ "domain:example.com", "domain:doh.example", "domain:dot.example", "domain:360.cn", "domain:example.net" ], "outboundTag": "direct", "type": "field" }, { "ip": [ "geoip:cn" ], "outboundTag": "direct", "type": "field" }, { "domain": [ "geosite:cn" ], "outboundTag": "direct", "type": "field" }, { "outboundTag": "proxy", "port": "0-65535", "type": "field" } ] }, "stats": {} }客户端-ws传输
{ "dns": { "hosts": { "geosite:category-ads-all": "127.0.0.1", "domain:example.cn": "example.com", "dns.example-alidns.com": [ "223.5.5.5", "223.6.6.6", "2400:3200::1", "2400:3200:baba::1" ], "one.example.one": [ "1.1.1.1", "1.0.0.1", "2606:4700:4700::1111", "2606:4700:4700::1001" ], "dot.example": [ "1.12.12.12", "120.53.53.53" ], "dns.example-google": [ "8.8.8.8", "8.8.4.4", "2001:4860:4860::8888", "2001:4860:4860::8844" ], "dns.example-quad9.net": [ "9.9.9.9", "149.112.112.112", "2620:fe::fe", "2620:fe::9" ], "common.dot.dns.example-yandex.net": [ "77.88.8.8", "77.88.8.1", "2a02:6b8::feed:0ff", "2a02:6b8:0:1::feed:0ff" ] }, "servers": [ "1.1.1.1", { "address": "1.1.1.1", "domains": [ "domain:example.cn", "domain:gstatic.com" ] }, { "address": "223.5.5.5", "domains": [ "domain:example-alidns.com", "domain:doh.example", "domain:dot.example", "domain:360.cn", "domain:onedns.net", "geosite:cn" ], "expectIPs": [ "geoip:cn" ], "skipFallback": true } ] }, "inbounds": [ { "listen": "127.0.0.1", "port": 10770, "protocol": "socks", "settings": { "auth": "noauth", "udp": true, "userLevel": 8 }, "sniffing": { "destOverride": [ "http", "tls" ], "enabled": true, "routeOnly": false }, "tag": "socks" }, { "listen": "127.0.0.1", "port": 10853, "protocol": "dokodemo-door", "settings": { "address": "1.1.1.1", "network": "tcp,udp", "port": 53 }, "tag": "dns-in" } ], "log": { "loglevel": "debug" }, "outbounds": [ { "mux": { "concurrency": -1, "enabled": false, "xudpConcurrency": 8, "xudpProxyUDP443": "" }, "protocol": "vless", "settings": { "vnext": [ { "address": "[CLOUDFRONT_DOMAIN]", "port": 443, "users": [ { "encryption": "none", "flow": "", "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", "level": 8 } ] } ] }, "streamSettings": { "network": "ws", "security": "tls", "tlsSettings": { "allowInsecure": false, "alpn": [ "h3", "h2", "http/1.1" ], "show": false }, "wsSettings": { "headers": { "Host": "" }, "path": "/[SECURE_PATH]" } }, "tag": "proxy" }, { "protocol": "freedom", "settings": { "domainStrategy": "UseIP" }, "tag": "direct" }, { "protocol": "blackhole", "settings": { "response": { "type": "http" } }, "tag": "block" }, { "protocol": "dns", "tag": "dns-out" } ], "policy": { "levels": { "8": { "connIdle": 300, "downlinkOnly": 1, "handshake": 4, "uplinkOnly": 1 } }, "system": { "statsOutboundUplink": true, "statsOutboundDownlink": true } }, "remarks": "xray-vless-ws", "routing": { "domainStrategy": "AsIs", "rules": [ { "inboundTag": [ "dns-in" ], "outboundTag": "dns-out", "type": "field" }, { "ip": [ "1.1.1.1" ], "outboundTag": "proxy", "port": "53", "type": "field" }, { "ip": [ "223.5.5.5" ], "outboundTag": "direct", "port": "53", "type": "field" }, { "domain": [ "domain:example.cn", "domain:gstatic.com" ], "outboundTag": "proxy", "type": "field" }, { "network": "udp", "outboundTag": "block", "port": "443", "type": "field" }, { "domain": [ "geosite:category-ads-all" ], "outboundTag": "block", "type": "field" }, { "ip": [ "geoip:private" ], "outboundTag": "direct", "type": "field" }, { "domain": [ "geosite:private" ], "outboundTag": "direct", "type": "field" }, { "ip": [ "223.5.5.5", "223.6.6.6", "2400:3200::1", "2400:3200:baba::1", "119.29.29.29", "1.12.12.12", "120.53.53.53", "2402:4e00::", "2402:4e00:1::", "180.76.76.76", "2400:da00::6666", "114.114.114.114", "114.114.115.115", "114.114.114.119", "114.114.115.119", "114.114.114.110", "114.114.115.110", "180.184.1.1", "180.184.2.2", "101.226.4.6", "218.30.118.6", "123.125.81.6", "140.207.198.6", "1.2.4.8", "210.2.4.8", "52.80.66.66", "117.50.22.22", "2400:7fc0:849e:200::4", "2404:c2c0:85d8:901::4", "117.50.10.10", "52.80.52.52", "2400:7fc0:849e:200::8", "2404:c2c0:85d8:901::8", "117.50.60.30", "52.80.60.30" ], "outboundTag": "direct", "type": "field" }, { "domain": [ "domain:example-alidns.com", "domain:doh.example", "domain:dot.example", "domain:360.cn", "domain:onedns.net" ], "outboundTag": "direct", "type": "field" }, { "ip": [ "geoip:cn" ], "outboundTag": "direct", "type": "field" }, { "domain": [ "geosite:cn" ], "outboundTag": "direct", "type": "field" }, { "outboundTag": "proxy", "port": "0-65535", "type": "field" } ] }, "stats": {} }Beta Was this translation helpful? Give feedback.
All reactions