From d5d02f65c44012fa515f486f6485342f3d416415 Mon Sep 17 00:00:00 2001 From: salmonstill Date: Mon, 29 Jun 2026 16:32:18 +0800 Subject: [PATCH] =?UTF-8?q?=E7=8E=B0=E5=9C=A8=E6=AD=A3=E5=9C=A8=E8=BF=9B?= =?UTF-8?q?=E8=A1=8Cxray=E7=9A=84=E6=9B=B4=E6=96=B0,=E5=9B=A0=E4=B8=BA?= =?UTF-8?q?=E6=9C=80=E8=BF=91xray=E6=9C=89=E7=82=B9=E5=87=BA=E9=97=AE?= =?UTF-8?q?=E9=A2=98=E4=BA=86?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 24 +++++++++++++++++++----- tun模式下的主机mihomo config.yaml | 6 +++--- xray-代理服务器-config.json | 4 ++-- xray-北京vps-config.json | 2 +- 代理vps-stream.conf | 2 +- 旁路由的mihomo config.yaml | 22 +++------------------- 非tun模式下的主机mihomo config.yaml | 22 +++------------------- 7 files changed, 32 insertions(+), 50 deletions(-) diff --git a/README.md b/README.md index dbbf448..394fc3a 100644 --- a/README.md +++ b/README.md @@ -10,7 +10,7 @@ | 设备 | IP / 域名 | 角色 | |---|---|---| | **北京 VPS** | `salmonstill.cn` / `49.232.242.90` | 公网入口，Nginx + Xray + socat + WireGuard | -| **搬瓦工 VPS** | `173.242.118.60` | 代理出口，Xray Reality 入站（客户端直连） | +| **搬瓦工 VPS** | `67.230.189.235` | 代理出口，Xray Reality 入站（客户端直连） | | **旁路由** | `192.168.1.199` / WG `10.0.0.2` | 内网核心，Xray bridge + Mihomo 代理 | | **NAS** | `192.168.1.188` | 绿联云 UGOS，思源笔记等服务 | | **qBittorrent** | `192.168.1.200` (macvlan) | PT 下载，独立 IP | @@ -74,7 +74,7 @@ | `proxy_in` | 10809 | mixed | SOCKS5/HTTP 代理 → 搬瓦工出口 | | `socks-dynamic` | 38658 | SOCKS5 (password) | 动态 LAN 端口访问 | -**出站**：`direct`（freedom 直连）、`to_tokyo`（VLESS+Reality → `173.242.118.60:443`） +**出站**：`direct`（freedom 直连）、`to_tokyo`（VLESS+Reality → `67.230.189.235:443`） **路由**：所有 `external_*` + `interconn` + `socks-dynamic` → `portal`（反向隧道）；`mihomo_in` + `proxy_in` → `to_tokyo`；`proxy_from_lan` → `direct` @@ -149,12 +149,12 @@ 配合 **fake-ip DNS**（`enhanced-mode: fake-ip`），DNS 请求返回 `198.18.x.x` 假 IP，强制流量进入代理路由。 **代理节点**： -- `US-Direct` — VLESS+Reality → `173.242.118.60:443`（默认国外出口，客户端直连搬瓦工） +- `US-Direct` — VLESS+Reality → `67.230.189.235:443`（默认国外出口，客户端直连搬瓦工） **关键策略组**： - 国外 → `[US-Direct, 直连]` -**防死循环 IP**：`49.232.242.90`（北京 VPS）、`173.242.118.60`（搬瓦工 VPS）强制直连。 +**防死循环 IP**：`49.232.242.90`（北京 VPS）、`67.230.189.235`（搬瓦工 VPS）强制直连。 **额外监听器**：`:7891`（全局→US-Direct）、`:7892`（强制直连） @@ -807,6 +807,20 @@ sudo tcpdump -i bridge0 udp port 19132 -n `Beijing-Direct` 节点必须 `skip-cert-verify: true`，因 Reality 返回 target（`www.apple.com`）的证书，而 SNI 是 `news.apple.com`，TLS SAN 校验会失败。 +### Reality 故障排查 + +| 现象 | 根因 | 解决 | +|---|---|---| +| Mihomo 日志 `connect error: EOF`，Xray 日志 `handshake did not complete successfully` | 运营商检测并干扰特定 SNI（如 `www.microsoft.com`）。某次 VPS 迁移后开始出现，同配置在旧 VPS 正常 | 更换 SNI/serverNames/dest 为其他高信誉域名，如 `www.cloudflare.com`。仅 SNI 变换即可，无需更换密钥 | +| Xray 日志 `target sent incorrect server hello or handshake incomplete` | Reality dest 目标不适合（如 `www.cloudflare.com` 不支持直连 TLS 1.3 或返回非标准 Server Hello） | 换用标准 Web 站点（如 `www.microsoft.com` 或 `www.youtube.com` 作为 dest，`www.cloudflare.com` 作为 SNI） | + +**Reality 参数一致性清单**（出现握手失败时逐项核对）： +- Xray `privateKey` ←→ Mihomo `public-key`（`xray x25519 -i <私钥>` 验证） +- Xray `shortIds` ←→ Mihomo `short-id` +- Xray `id` ←→ Mihomo `uuid` +- Xray `serverNames[0]` ←→ Mihomo `servername` ←→ Nginx stream map +- VPS 能直连 Reality `dest` 目标（`curl -4s https:// -o /dev/null -w '%{http_code}'`） + --- ## 流量路径 @@ -819,7 +833,7 @@ sudo tcpdump -i bridge0 udp port 19132 -n ### 路径 2：代理翻墙（直连搬瓦工） ``` -Mihomo 客户端 → 173.242.118.60:443 (SNI=www.microsoft.com) +Mihomo 客户端 → 67.230.189.235:443 (SNI=www.cloudflare.com) → Nginx 分流 → Xray :9443 → freedom → 互联网 ``` diff --git a/tun模式下的主机mihomo config.yaml b/tun模式下的主机mihomo config.yaml index dcb4a76..06f1bbe 100644 --- a/tun模式下的主机mihomo config.yaml +++ b/tun模式下的主机mihomo config.yaml @@ -64,14 +64,14 @@ proxies: - name: US-Direct type: vless - server: 173.242.118.60 + server: 67.230.189.235 port: 443 uuid: "4d222c16-53bb-4402-814e-c8188cebcea6" udp: true flow: xtls-rprx-vision packet-encoding: xudp tls: true - servername: www.microsoft.com + servername: www.cloudflare.com client-fingerprint: chrome reality-opts: public-key: "jr_zQjC4mvlQITuG5Ap5Mxqe5EBbGyyvwbVLDEi8OCA" @@ -297,7 +297,7 @@ rules: - DOMAIN-SUFFIX,hf-mirror.com,国内 - DOMAIN-KEYWORD,raylink,直连 - IP-CIDR,49.232.242.90/32,直连 - - IP-CIDR,173.242.118.60/32,直连 + - IP-CIDR,67.230.189.235/32,直连 - DOMAIN-SUFFIX,ubuntu.com,国外 - DOMAIN-SUFFIX,canonical.com,国外 - DOMAIN-SUFFIX,okx.com,国外 diff --git a/xray-代理服务器-config.json b/xray-代理服务器-config.json index f50017b..7e0ca97 100644 --- a/xray-代理服务器-config.json +++ b/xray-代理服务器-config.json @@ -22,10 +22,10 @@ "security": "reality", "realitySettings": { "show": false, - "dest": "www.microsoft.com:443", + "dest": "www.cloudflare.com:443", "xver": 0, "serverNames": [ - "www.microsoft.com" + "www.cloudflare.com" ], "privateKey": "iBlu3eH1VLf1S5Qw87m_1w0TGYUktDwHAzgpQ2aKuGI", "shortIds": [ diff --git a/xray-北京vps-config.json b/xray-北京vps-config.json index 905927b..3e30a5b 100644 --- a/xray-北京vps-config.json +++ b/xray-北京vps-config.json @@ -314,7 +314,7 @@ "settings": { "vnext": [ { - "address": "173.242.118.60", + "address": "67.230.189.235", "port": 443, "users": [ { diff --git a/代理vps-stream.conf b/代理vps-stream.conf index 6cdccc7..7ba1725 100644 --- a/代理vps-stream.conf +++ b/代理vps-stream.conf @@ -1,6 +1,6 @@ stream { map $ssl_preread_server_name $backend { - www.microsoft.com xray; + www.cloudflare.com xray; default npm; } upstream xray { diff --git a/旁路由的mihomo config.yaml b/旁路由的mihomo config.yaml index 0064ab1..ce86c17 100644 --- a/旁路由的mihomo config.yaml +++ b/旁路由的mihomo config.yaml @@ -54,32 +54,16 @@ proxies: - name: 拒绝 type: reject - - name: Xray-Real - type: vless - server: 49.232.242.90 - port: 443 - uuid: "113e167a-a2be-4b46-9010-60020108626c" - udp: true - flow: xtls-rprx-vision - packet-encoding: xudp - tls: true - servername: www.microsoft.com - client-fingerprint: chrome - reality-opts: - public-key: "62y5gDjPrdeuePGl-D2IW4Cw9Kb8_bSBBTmArvL7Nhs" - short-id: "7c947a71b94f369e" - network: tcp - - name: US-Direct type: vless - server: 173.242.118.60 + server: 67.230.189.235 port: 443 uuid: "4d222c16-53bb-4402-814e-c8188cebcea6" udp: true flow: xtls-rprx-vision packet-encoding: xudp tls: true - servername: www.microsoft.com + servername: www.cloudflare.com client-fingerprint: chrome reality-opts: public-key: "jr_zQjC4mvlQITuG5Ap5Mxqe5EBbGyyvwbVLDEi8OCA" @@ -305,7 +289,7 @@ rules: - DOMAIN-SUFFIX,volces.com,直连 - DOMAIN-KEYWORD,raylink,直连 - IP-CIDR,49.232.242.90/32,直连 - - IP-CIDR,173.242.118.60/32,直连 + - IP-CIDR,67.230.189.235/32,直连 - DOMAIN-SUFFIX,ubuntu.com,国外 - DOMAIN-SUFFIX,canonical.com,国外 - DOMAIN-SUFFIX,okx.com,国外 diff --git a/非tun模式下的主机mihomo config.yaml b/非tun模式下的主机mihomo config.yaml index 67a5257..228f60d 100644 --- a/非tun模式下的主机mihomo config.yaml +++ b/非tun模式下的主机mihomo config.yaml @@ -51,32 +51,16 @@ proxies: - name: 拒绝 type: reject - - name: Xray-Real - type: vless - server: salmonstill.cn - port: 443 - uuid: "113e167a-a2be-4b46-9010-60020108626c" - udp: true - flow: xtls-rprx-vision - packet-encoding: xudp - tls: true - servername: www.microsoft.com - client-fingerprint: chrome - reality-opts: - public-key: "62y5gDjPrdeuePGl-D2IW4Cw9Kb8_bSBBTmArvL7Nhs" - short-id: "7c947a71b94f369e" - network: tcp - - name: US-Direct type: vless - server: 173.242.118.60 + server: 67.230.189.235 port: 443 uuid: "4d222c16-53bb-4402-814e-c8188cebcea6" udp: true flow: xtls-rprx-vision packet-encoding: xudp tls: true - servername: www.microsoft.com + servername: www.cloudflare.com client-fingerprint: chrome reality-opts: public-key: "jr_zQjC4mvlQITuG5Ap5Mxqe5EBbGyyvwbVLDEi8OCA" @@ -302,7 +286,7 @@ rules: - DOMAIN-SUFFIX,hf-mirror.com,国内 - DOMAIN-KEYWORD,raylink,直连 - IP-CIDR,49.232.242.90/32,直连 - - IP-CIDR,173.242.118.60/32,直连 + - IP-CIDR,67.230.189.235/32,直连 - DOMAIN-SUFFIX,ubuntu.com,国外 - DOMAIN-SUFFIX,canonical.com,国外 - DOMAIN-SUFFIX,okx.com,国外