Can Xray create a decoupled Multi-Party Relay (MPR)?

[mcrmck]

Hello,

I'm exploring the possibility of creating a multi-hop relay using Xray with specific privacy properties. Specifically, I'm looking to implement a setup like this:

client → hop 1 → hop 2 → destination

With the following privacy constraints:

• Hop 1 should not be able to see/decrypt the ultimate destination domain name or IP address
• Hop 2 should not know the original client's identity
• Ideally, the client should be able to cryptographically ensure these privacy guarantees

This is similar to how Tor's onion routing works, where each relay only knows its immediate neighbors in the circuit.

Here's what I've tried so far

{
  "outbounds": [
    // Outbound A: Transport layer to Node1
    {
      "tag": "transport_to_node1",
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "xray-node1",
            "port": 1443,          
            "users": [
              {
                "id": "",
                "encryption": "none",
                "flow": "xtls-rprx-vision"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "fingerprint": "chrome",
          "serverName": "www.google.com", // Target for Node1's REALITY
          "publicKey": "",
          "shortId": "0000000000000000",
          "spiderX": "/"
        }
      }
    },
    // Outbound B: Logical exit connection via Node2, using Outbound A as transport
    {
      "tag": "exit_via_node2",
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "xray-node2", 
            "port": 2443, 
            "users": [
              {
                "id": "",
                "encryption": "none",
                "flow": "xtls-rprx-vision"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "tcp", // Will be tunnelled
        "security": "reality",
        "realitySettings": {
          "fingerprint": "chrome",
          "serverName": "www.apple.com", // Target for Node2's REALITY
          "publicKey": "",
          "shortId": "0000000000000001",
          "spiderX": "/"
        }
      },
      "proxySettings": {
        "tag": "transport_to_node1", // Use Outbound A for transport
        "transportLayer": true
      }
    }
  ],
  "routing": {
    "domainStrategy": "AsIs",
    "rules": [
      {
        "type": "field",
        "inboundTag": ["socks-in"],
        "outboundTag": "exit_via_node2"
      }
    ]
  }
}

Questions

• With the configuration above using proxySettings and transportLayer: true, does this actually achieve my privacy goals? Specifically:
• Does Node1 only see an encrypted connection to Node2, without being able to see the final destination?
• Is the REALITY handshake with Node2 (using www.apple.com) truly encapsulated within the Node1 connection?
• When using this type of configuration with transportLayer: true, what exactly happens at the protocol level? Does hop 1 fully decrypt traffic and then re-encrypt it to hop 2, or is the inner encryption layer preserved?

I've been exploring the proxy configurations and outbound handlers but would appreciate guidance on where to focus my attention.

Thanks for any insights!

[mcrmck]

你好，

我正在探索使用 Xray 实现一个具备特定隐私属性的[多跳中继](https://www.privacyguides.org/articles/2024/11/17/where-are-all-the-mprs/)（multi-hop relay）。具体而言，我想部署如下结构：

客户端 → 跳板1 → 跳板2 → 目标站点

隐私目标如下：

• 跳板1（Hop 1） 不应能看到或解密最终目标的域名或 IP 地址
• 跳板2（Hop 2） 不应知道原始客户端的身份
• 理想情况下，客户端应能通过加密手段保证上述隐私属性

这类似于 Tor 的洋葱路由设计，每个中继节点仅了解其相邻节点的信息。

以下是我目前尝试的配置：

{
  "outbounds": [
    // 出口A：传输层连接到 Node1
    {
      "tag": "transport_to_node1",
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "xray-node1",
            "port": 1443,          
            "users": [
              {
                "id": "",
                "encryption": "none",
                "flow": "xtls-rprx-vision"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "fingerprint": "chrome",
          "serverName": "www.google.com", // Node1 的 REALITY 目标
          "publicKey": "",
          "shortId": "0000000000000000",
          "spiderX": "/"
        }
      }
    },
    // 出口B：逻辑出口连接至 Node2，使用出口A作为传输层
    {
      "tag": "exit_via_node2",
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "xray-node2", 
            "port": 2443, 
            "users": [
              {
                "id": "",
                "encryption": "none",
                "flow": "xtls-rprx-vision"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "tcp", // 将被隧道传输
        "security": "reality",
        "realitySettings": {
          "fingerprint": "chrome",
          "serverName": "www.apple.com", // Node2 的 REALITY 目标
          "publicKey": "",
          "shortId": "0000000000000001",
          "spiderX": "/"
        }
      },
      "proxySettings": {
        "tag": "transport_to_node1", // 使用出口A作为传输
        "transportLayer": true
      }
    }
  ],
  "routing": {
    "domainStrategy": "AsIs",
    "rules": [
      {
        "type": "field",
        "inboundTag": ["socks-in"],
        "outboundTag": "exit_via_node2"
      }
    ]
  }
}

问题

• 上述配置中，使用了 proxySettings 和 transportLayer: true，是否真正实现了我的隐私目标？
• Node1 是否只能看到一条加密连接指向 Node2，而无法知晓最终目标？
• 与 Node2 的 REALITY 握手（使用 www.apple.com）是否真的封装在 Node1 的连接之内？
• 使用 transportLayer: true 时，在协议层面究竟发生了什么？Hop 1 是完全解密并重新加密后再传给 Hop 2，还是保持了内层加密？

我目前正在研究代理配置与出站处理逻辑，欢迎任何关于如何更好实现上述目标的建议。

谢谢！

[mcrmck]

Based on what I'm seeing in this V2Fly article, I'm assuming that it is the case that a first hop is unable to view destination information and the packet is doubly encrypted on the client.

Would love if anyone had stronger confirmation this is the case for Xray. Thank you!