From 58f6a2a67fb6b45c3b47c4e092d713afb6de19da Mon Sep 17 00:00:00 2001 From: salmonstill Date: Tue, 30 Jun 2026 13:52:46 +0800 Subject: [PATCH] =?UTF-8?q?=E8=B4=9F=E8=BD=BD=E5=9D=87=E8=A1=A1=E7=BB=88?= =?UTF-8?q?=E4=BA=8E=E6=95=B4=E4=B8=8A=E4=BA=86=EF=BC=8C=E6=8E=A5=E4=B8=8B?= =?UTF-8?q?=E6=9D=A5=E8=AF=A5=E5=BC=84qb=E4=BB=A3=E7=90=86=E4=BA=86?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 53 ++++++++++++----------- xray-北京vps-config.json | 91 +++++----------------------------------- xray-旁路由-config.json | 79 +++++++++++++++++++++++++++++++++- 北京vps-stream.conf | 39 ++++++++++++----- 4 files changed, 145 insertions(+), 117 deletions(-) diff --git a/README.md b/README.md index 394fc3a..c088b2e 100644 --- a/README.md +++ b/README.md @@ -19,19 +19,20 @@ --- -## Nginx SNI 分流 (`beijing-vps-stream.conf`) +## Nginx SNI 分流 (`北京vps-stream.conf`) -监听 `:443`，按 SNI 将流量分发到不同后端： +**端口 443 — 公网入口**，按 SNI 分发流量： | SNI | 后端 | 端口 | 用途 | |---|---|---|---| -| `www.apple.com` | Xray interconn | :9443 | 反向代理隧道 | -| `www.microsoft.com` | Xray mihomo_in | :9444 | Mihomo 客户端 → 搬瓦工出口 | -| `news.apple.com` | Xray proxy_from_lan | :9445 | 北京直连代理 | +| `www.apple.com` / `www.samsung.com` / `addons.mozilla.org` | Xray interconn | :9443 | 反向代理隧道（多 SNI 轮换） | +| `news.apple.com` | Xray proxy_from_lan | :9445 | 北京直连代理（qBittorrent 出站） | | `drive.salmonstill.cn` | NAS | :38653 | 绿联云直接转发 | | 默认 | NPM | :8443 | Nginx Proxy Manager | -搬瓦工 VPS（部署 `东京-vps-stream.conf` + `tokyo-vps-config.json`）：`www.microsoft.com` → Xray :9443，默认 → NPM。 +**端口 9447 — 数据中心回落**：Reality 探针/探测流量回落到此，按 SNI 代理到真实网站。 + +搬瓦工 VPS（部署 `代理vps-stream.conf` + `xray-代理服务器-config.json`）：`www.cloudflare.com` → Xray :9443，默认 → NPM。 --- @@ -41,11 +42,12 @@ **Reality 入站** — 共享 privateKey `GGT9LfN_...`，由 Nginx SNI 转发： -| Tag | 端口 | SNI | Reality target | -|---|---|---|---| -| `interconn` | :9443 | `www.apple.com` | `www.apple.com:443` | -| `mihomo_in` | :9444 | `www.microsoft.com` | `www.microsoft.com:443` | -| `proxy_from_lan` | :9445 | `news.apple.com` | `www.apple.com:443` | +| Tag | 端口 | serverNames | Reality target | 说明 | +|---|---|---|---|---| +| `interconn` | :9443 | apple/samsung/mozilla 轮换 | `127.0.0.1:9447` | 反向隧道，多 SNI 防封 + 数据中心回落 | +| `proxy_from_lan` | :9445 | `news.apple.com` | `www.apple.com:443` | 北京直连代理（qBittorrent） | + +> `mihomo_in`（旧 Mihomo 中转）已删除，客户端直接连接搬瓦工。 **dokodemo-door 入站** — 端口转发到旁路由反向隧道，共 11 个： @@ -71,12 +73,13 @@ | Tag | 端口 | 类型 | 用途 | |---|---|---|---| -| `proxy_in` | 10809 | mixed | SOCKS5/HTTP 代理 → 搬瓦工出口 | | `socks-dynamic` | 38658 | SOCKS5 (password) | 动态 LAN 端口访问 | -**出站**：`direct`（freedom 直连）、`to_tokyo`（VLESS+Reality → `67.230.189.235:443`） +**出站**：`direct`（freedom 直连） -**路由**：所有 `external_*` + `interconn` + `socks-dynamic` → `portal`（反向隧道）；`mihomo_in` + `proxy_in` → `to_tokyo`；`proxy_from_lan` → `direct` +**路由**：所有 `external_*` + `interconn` + `socks-dynamic` → `portal`（反向隧道）；`interconn` 探测流量（baidu.com）→ `direct`；`proxy_from_lan` → `direct` + +> `mihomo_in` + `proxy_in` + `to_tokyo` 旧中转链路（北京→搬瓦工），已删除。 ### 旁路由 (`xray-旁路由-config.json`) @@ -100,7 +103,7 @@ | `to_spark_ssh` | `192.168.1.166:22` | Spark SSH 远程 | | `to_spark_rdp` | `192.168.1.166:3389` | Spark xRDP 桌面远程 | | `to_spark_38662` | `192.168.1.166:38662` | Spark 自定义服务 | -| `interconn` | VLESS+Reality → `salmonstill.cn:443` (SNI=www.apple.com) | 隧道链接 | +| `interconn-apple/samsung/mozilla` | VLESS+Reality → `salmonstill.cn:443` (多 SNI 轮换) | 隧道链接（balancer + leastPing + fallback） | | `to_beijing_direct` | VLESS+Reality → `salmonstill.cn:443` (SNI=news.apple.com) | 北京直连 | | `direct` | freedom | 直连 | @@ -127,9 +130,9 @@ > 所有显式端口规则优先于 catch-all，现有端口转发不受影响。 -### 搬瓦工 VPS / 洛杉矶 (`tokyo-vps-config.json`) +### 搬瓦工 VPS (`xray-代理服务器-config.json`) -极简：VLESS+Reality 入站 `:9443`（SNI=www.microsoft.com），freedom 出站。 +极简：VLESS+Reality 入站 `:9443`（SNI=www.cloudflare.com, dest=www.cloudflare.com），freedom 出站。 所有客户端（Spark、旁路由、macOS）直连此服务器，不再经北京 VPS 中转。 --- @@ -149,7 +152,9 @@ 配合 **fake-ip DNS**（`enhanced-mode: fake-ip`），DNS 请求返回 `198.18.x.x` 假 IP，强制流量进入代理路由。 **代理节点**： -- `US-Direct` — VLESS+Reality → `67.230.189.235:443`（默认国外出口，客户端直连搬瓦工） +- `US-Direct` — VLESS+Reality → `67.230.189.235:443`（默认国外出口，客户端直连搬瓦工，SNI=www.cloudflare.com） + +> `Xray-Real` 代理节点（经北京 VPS 中转）已移除，Mihomo 全部直连搬瓦工。 **关键策略组**： - 国外 → `[US-Direct, 直连]` @@ -862,15 +867,15 @@ BT Peer → salmonstill.cn:51413 → portal → 隧道 → bridge → to_qbit | 文件 | 目标设备 | 部署路径 | -|---|---|---| -| `beijing-vps-stream.conf` | 北京 VPS | `/etc/nginx/stream.conf.d/` | +|---|---|---|---| +| `北京vps-stream.conf` | 北京 VPS | `/etc/nginx/nginx.conf` 的 `stream {}` 块 | | `xray-北京vps-config.json` | 北京 VPS | `/usr/local/etc/xray/config.json` | -| `东京-vps-stream.conf` | 搬瓦工 VPS | `/etc/nginx/stream.conf.d/` | -| `tokyo-vps-config.json` | 搬瓦工 VPS | `/usr/local/etc/xray/config.json` | +| `代理vps-stream.conf` | 搬瓦工 VPS | `/etc/nginx/nginx.conf` 的 `stream {}` 块 | +| `xray-代理服务器-config.json` | 搬瓦工 VPS | `/usr/local/etc/xray/config.json` | | `xray-旁路由-config.json` | 旁路由 | `/etc/xray/config.json` | | `旁路由的mihomo config.yaml` | 旁路由 | `/opt/mihomo/config.yaml` | -| `非tun模式的主机mihomo config.yaml` | macOS | `~/Library/LaunchAgents/` (launchctl 管理) | -| `tun模式的主机mihomo config.yaml` | Spark (Ubuntu) | `/opt/mihomo/config.yaml` (systemd) | +| `非tun模式的主机mihomo config.yaml` | macOS | `~/Library/Application Support/mihomo/config.yaml` (launchctl 管理) | +| `tun模式的主机mihomo config.yaml` | Spark (Ubuntu) | `/opt/mihomo/config.yaml` | `subscribe-7891-only.yaml` | 通用 | 精简版模板（单独 7891 端口） | | `qbittorrent流量转发.md` | — | 方案文档（已合并到 README，可删除） | | `我的世界udp转发.md` | — | 方案文档（已合并到 README，可删除） | diff --git a/xray-北京vps-config.json b/xray-北京vps-config.json index 3e30a5b..ba8b89d 100644 --- a/xray-北京vps-config.json +++ b/xray-北京vps-config.json @@ -77,15 +77,7 @@ "network": "tcp" } }, - { - "tag": "proxy_in", - "listen": "127.0.0.1", - "port": 10809, - "protocol": "mixed", - "settings": { - "udp": true - } - }, + { "tag": "external_router_web", "listen": "0.0.0.0", @@ -160,8 +152,11 @@ "security": "reality", "realitySettings": { "show": false, - "target": "www.apple.com:443", + "target": "127.0.0.1:9447", + "xver": 0, "serverNames": [ + "www.samsung.com", + "addons.mozilla.org", "www.apple.com" ], "privateKey": "GGT9LfN_2JdQG68cwrULgUK-adfT6wIokLzWjaB0fXs", @@ -171,36 +166,7 @@ } } }, - { - "tag": "mihomo_in", - "listen": "127.0.0.1", - "port": 9444, - "protocol": "vless", - "settings": { - "clients": [ - { - "id": "113e167a-a2be-4b46-9010-60020108626c", - "flow": "xtls-rprx-vision" - } - ], - "decryption": "none" - }, - "streamSettings": { - "network": "raw", - "security": "reality", - "realitySettings": { - "show": false, - "target": "www.microsoft.com:443", - "serverNames": [ - "www.microsoft.com" - ], - "privateKey": "GGT9LfN_2JdQG68cwrULgUK-adfT6wIokLzWjaB0fXs", - "shortIds": [ - "7c947a71b94f369e" - ] - } - } - }, + { "tag": "proxy_from_lan", "listen": "127.0.0.1", @@ -307,37 +273,6 @@ { "tag": "direct", "protocol": "freedom" - }, - { - "tag": "to_tokyo", - "protocol": "vless", - "settings": { - "vnext": [ - { - "address": "67.230.189.235", - "port": 443, - "users": [ - { - "id": "4d222c16-53bb-4402-814e-c8188cebcea6", - "encryption": "none", - "flow": "xtls-rprx-vision" - } - ] - } - ] - }, - "streamSettings": { - "network": "raw", - "security": "reality", - "realitySettings": { - "show": false, - "fingerprint": "chrome", - "serverName": "www.microsoft.com", - "password": "jr_zQjC4mvlQITuG5Ap5Mxqe5EBbGyyvwbVLDEi8OCA", - "shortId": "a1b2c3d4", - "spiderX": "/" - } - } } ], "routing": { @@ -458,9 +393,12 @@ { "type": "field", "inboundTag": [ - "proxy_in" + "interconn" ], - "outboundTag": "to_tokyo" + "domain": [ + "full:www.baidu.com" + ], + "outboundTag": "direct" }, { "type": "field", @@ -469,13 +407,6 @@ ], "outboundTag": "portal" }, - { - "type": "field", - "inboundTag": [ - "mihomo_in" - ], - "outboundTag": "to_tokyo" - }, { "type": "field", "inboundTag": [ diff --git a/xray-旁路由-config.json b/xray-旁路由-config.json index 3b25528..f10c95b 100644 --- a/xray-旁路由-config.json +++ b/xray-旁路由-config.json @@ -2,6 +2,11 @@ "log": { "loglevel": "info" }, + "observatory": { + "subjectSelector": ["interconn-apple", "interconn-samsung", "interconn-mozilla"], + "probeUrl": "https://www.baidu.com", + "probeInterval": "1m" + }, "reverse": { "bridges": [ { @@ -136,7 +141,7 @@ } }, { - "tag": "interconn", + "tag": "interconn-apple", "protocol": "vless", "settings": { "vnext": [ @@ -166,6 +171,68 @@ } } }, + { + "tag": "interconn-mozilla", + "protocol": "vless", + "settings": { + "vnext": [ + { + "address": "salmonstill.cn", + "port": 443, + "users": [ + { + "id": "113e167a-a2be-4b46-9010-60020108626c", + "encryption": "none", + "flow": "xtls-rprx-vision" + } + ] + } + ] + }, + "streamSettings": { + "network": "raw", + "security": "reality", + "realitySettings": { + "show": false, + "fingerprint": "chrome", + "serverName": "addons.mozilla.org", + "password": "62y5gDjPrdeuePGl-D2IW4Cw9Kb8_bSBBTmArvL7Nhs", + "shortId": "7c947a71b94f369e", + "spiderX": "/search?q=xray" + } + } + }, + { + "tag": "interconn-samsung", + "protocol": "vless", + "settings": { + "vnext": [ + { + "address": "salmonstill.cn", + "port": 443, + "users": [ + { + "id": "113e167a-a2be-4b46-9010-60020108626c", + "encryption": "none", + "flow": "xtls-rprx-vision" + } + ] + } + ] + }, + "streamSettings": { + "network": "raw", + "security": "reality", + "realitySettings": { + "show": false, + "fingerprint": "chrome", + "serverName": "www.samsung.com", + "password": "62y5gDjPrdeuePGl-D2IW4Cw9Kb8_bSBBTmArvL7Nhs", + "shortId": "7c947a71b94f369e", + "spiderX": "/search?q=xray" + } + } + }, { "tag": "to_beijing_direct", "protocol": "vless", @@ -203,6 +270,14 @@ } ], "routing": { + "balancers": [ + { + "tag": "interconn-balancer", + "selector": ["interconn-apple", "interconn-samsung", "interconn-mozilla"], + "fallbackTag": "interconn-samsung", + "strategy": { "type": "leastPing" } + } + ], "rules": [ { "type": "field", @@ -219,7 +294,7 @@ "domain": [ "full:reverse-proxy.xray.internal" ], - "outboundTag": "interconn" + "balancerTag": "interconn-balancer" }, { "type": "field", diff --git a/北京vps-stream.conf b/北京vps-stream.conf index 5ff51dc..3a399fd 100644 --- a/北京vps-stream.conf +++ b/北京vps-stream.conf @@ -1,19 +1,27 @@ stream { + resolver 223.5.5.5; + + # === 端口 443：Nginx SNI 分流 === map $ssl_preread_server_name $backend { - www.apple.com xray; # 旁路由反向代理隧道 - www.microsoft.com mihomo; # 新增：mihomo出站流量 - news.apple.com xray_lan; # 新增：旁路由代理直连流量 - drive.salmonstill.cn nas; # 绿联云服务 - default npm; # Nginx Proxy Manager + www.samsung.com xray; + addons.mozilla.org xray; + www.apple.com xray; + news.apple.com xray_lan; + drive.salmonstill.cn nas; + default npm; } + + # === 端口 9447：Reality 回落数据中心 === + map $ssl_preread_server_name $fallback { + www.samsung.com www.samsung.com:443; + addons.mozilla.org addons.mozilla.org:443; + www.apple.com www.apple.com:443; + default 127.0.0.1:1; + } + upstream xray { server 127.0.0.1:9443; } - # 新增mihomo upstream - upstream mihomo { - server 127.0.0.1:9444; - } - # 旁路由代理直连 upstream xray_lan { server 127.0.0.1:9445; } @@ -23,10 +31,19 @@ stream { upstream npm { server 127.0.0.1:8443; } + server { listen 443 reuseport; listen [::]:443 reuseport; ssl_preread on; proxy_pass $backend; } -} \ No newline at end of file + + server { + listen 127.0.0.1:9447; + ssl_preread on; + proxy_pass $fallback; + proxy_download_rate 1m; + proxy_upload_rate 512k; + } +}