现在正在进行xray的更新,因为最近xray有点出问题了

一切正常，最近斑马工好像有点不太稳定，所以加一个Docker IO显示走国外的步骤准备。
2026-06-29 16:32:18 +08:00 · 2026-06-26 10:28:08 +08:00
10 changed files with 109 additions and 50 deletions
@@ -10,7 +10,7 @@
 | 设备 | IP / 域名 | 角色 |
 |---|---|---|
 | **北京 VPS** | `salmonstill.cn` / `49.232.242.90` | 公网入口，Nginx + Xray + socat + WireGuard |
-| **搬瓦工 VPS** | `173.242.118.60` | 代理出口，Xray Reality 入站（客户端直连） |
+| **搬瓦工 VPS** | `67.230.189.235` | 代理出口，Xray Reality 入站（客户端直连） |
 | **旁路由** | `192.168.1.199` / WG `10.0.0.2` | 内网核心，Xray bridge + Mihomo 代理 |
 | **NAS** | `192.168.1.188` | 绿联云 UGOS，思源笔记等服务 |
 | **qBittorrent** | `192.168.1.200` (macvlan) | PT 下载，独立 IP |
@@ -59,6 +59,7 @@
 | `external_router_ssh` | 38657 | → portal → 旁路由 :22 |
 | `external_spark_ssh` | 38659 | → portal → Spark (166) :22 |
 | `external_spark_rdp` | 38660 | → portal → Spark (166) :3389 |
+| `external_win_rdp` | 38664 | → portal → Windows (177) :3389 |
 | `external_spark_38662` | 38662 | → portal → Spark (166) :38662 |
 | `external_router_web` | 39766 | → portal → 旁路由 :80 |
 | `external_tmp` | 8501 | → portal → Windows :8501 |
@@ -73,7 +74,7 @@
 | `proxy_in` | 10809 | mixed | SOCKS5/HTTP 代理 → 搬瓦工出口 |
 | `socks-dynamic` | 38658 | SOCKS5 (password) | 动态 LAN 端口访问 |

-**出站**：`direct`（freedom 直连）、`to_tokyo`（VLESS+Reality → `173.242.118.60:443`）
+**出站**：`direct`（freedom 直连）、`to_tokyo`（VLESS+Reality → `67.230.189.235:443`）

 **路由**：所有 `external_*` + `interconn` + `socks-dynamic` → `portal`（反向隧道）；`mihomo_in` + `proxy_in` → `to_tokyo`；`proxy_from_lan` → `direct`

@@ -119,6 +120,8 @@
 - 38659 → `to_spark_ssh`（Spark SSH 远程）
 - 38660 → `to_spark_rdp`（Spark xRDP 桌面远程）
 - 38662 → `to_spark_38662`
+- 38664 → `to_win_rdp`（Windows 远程桌面）
+- 38665 → `to_spark_3080`（Spark Web 3080）
 - 默认（catch-all）→ **`direct`**（不匹配端口规则的动态请求直连目标）
 - `socks-lan` 入站 → `to_beijing_direct`

@@ -146,12 +149,12 @@
 配合 **fake-ip DNS**（`enhanced-mode: fake-ip`），DNS 请求返回 `198.18.x.x` 假 IP，强制流量进入代理路由。

 **代理节点**：
- `US-Direct` — VLESS+Reality → `173.242.118.60:443`（默认国外出口，客户端直连搬瓦工）
+- `US-Direct` — VLESS+Reality → `67.230.189.235:443`（默认国外出口，客户端直连搬瓦工）

 **关键策略组**：
 - 国外 → `[US-Direct, 直连]`

-**防死循环 IP**：`49.232.242.90`（北京 VPS）、`173.242.118.60`（搬瓦工 VPS）强制直连。
+**防死循环 IP**：`49.232.242.90`（北京 VPS）、`67.230.189.235`（搬瓦工 VPS）强制直连。

 **额外监听器**：`:7891`（全局→US-Direct）、`:7892`（强制直连）

@@ -804,6 +807,20 @@ sudo tcpdump -i bridge0 udp port 19132 -n

 `Beijing-Direct` 节点必须 `skip-cert-verify: true`，因 Reality 返回 target（`www.apple.com`）的证书，而 SNI 是 `news.apple.com`，TLS SAN 校验会失败。

+### Reality 故障排查
+
+| 现象 | 根因 | 解决 |
+|---|---|---|
+| Mihomo 日志 `connect error: EOF`，Xray 日志 `handshake did not complete successfully` | 运营商检测并干扰特定 SNI（如 `www.microsoft.com`）。某次 VPS 迁移后开始出现，同配置在旧 VPS 正常 | 更换 SNI/serverNames/dest 为其他高信誉域名，如 `www.cloudflare.com`。仅 SNI 变换即可，无需更换密钥 |
+| Xray 日志 `target sent incorrect server hello or handshake incomplete` | Reality dest 目标不适合（如 `www.cloudflare.com` 不支持直连 TLS 1.3 或返回非标准 Server Hello） | 换用标准 Web 站点（如 `www.microsoft.com` 或 `www.youtube.com` 作为 dest，`www.cloudflare.com` 作为 SNI） |
+
+**Reality 参数一致性清单**（出现握手失败时逐项核对）：
+- Xray `privateKey` ←→ Mihomo `public-key`（`xray x25519 -i <私钥>` 验证）
+- Xray `shortIds` ←→ Mihomo `short-id`
+- Xray `id` ←→ Mihomo `uuid`
+- Xray `serverNames[0]` ←→ Mihomo `servername` ←→ Nginx stream map
+- VPS 能直连 Reality `dest` 目标（`curl -4s https://<dest> -o /dev/null -w '%{http_code}'`）
+
 ---

 ## 流量路径
@@ -816,7 +833,7 @@ sudo tcpdump -i bridge0 udp port 19132 -n

 ### 路径 2：代理翻墙（直连搬瓦工）
 ```
-Mihomo 客户端 → 173.242.118.60:443 (SNI=www.microsoft.com)
+Mihomo 客户端 → 67.230.189.235:443 (SNI=www.cloudflare.com)
  → Nginx 分流 → Xray :9443 → freedom → 互联网
 ```

@@ -64,14 +64,14 @@ proxies:

  - name: US-Direct
    type: vless
-    server: 173.242.118.60
+    server: 67.230.189.235
    port: 443
    uuid: "4d222c16-53bb-4402-814e-c8188cebcea6"
    udp: true
    flow: xtls-rprx-vision
    packet-encoding: xudp
    tls: true
-    servername: www.microsoft.com
+    servername: www.cloudflare.com
    client-fingerprint: chrome
    reality-opts:
      public-key: "jr_zQjC4mvlQITuG5Ap5Mxqe5EBbGyyvwbVLDEi8OCA"
@@ -297,11 +297,13 @@ rules:
  - DOMAIN-SUFFIX,hf-mirror.com,国内
  - DOMAIN-KEYWORD,raylink,直连
  - IP-CIDR,49.232.242.90/32,直连
-  - IP-CIDR,173.242.118.60/32,直连
+  - IP-CIDR,67.230.189.235/32,直连
  - DOMAIN-SUFFIX,ubuntu.com,国外
  - DOMAIN-SUFFIX,canonical.com,国外
  - DOMAIN-SUFFIX,okx.com,国外
  - DOMAIN-SUFFIX,okxc.com,国外
+  - DOMAIN-SUFFIX,services.googleapis.cn,国外
+  - DOMAIN,connectivitycheck.gstatic.com,国外
  - RULE-SET,Ads,Block
  - RULE-SET,Private_Domain,国内
  - RULE-SET,Private_IP,国内,no-resolve
@@ -22,10 +22,10 @@
        "security": "reality",
        "realitySettings": {
          "show": false,
-          "dest": "www.microsoft.com:443",
+          "dest": "www.cloudflare.com:443",
          "xver": 0,
          "serverNames": [
-            "www.microsoft.com"
+            "www.cloudflare.com"
          ],
          "privateKey": "iBlu3eH1VLf1S5Qw87m_1w0TGYUktDwHAzgpQ2aKuGI",
          "shortIds": [
@@ -279,6 +279,28 @@
        "port": 38660,
        "network": "tcp"
      }
+    },
+    {
+      "tag": "external_win_rdp",
+      "listen": "0.0.0.0",
+      "port": 38664,
+      "protocol": "dokodemo-door",
+      "settings": {
+        "address": "127.0.0.1",
+        "port": 38664,
+        "network": "tcp"
+      }
+    },
+    {
+      "tag": "external_spark_3080",
+      "listen": "0.0.0.0",
+      "port": 38665,
+      "protocol": "dokodemo-door",
+      "settings": {
+        "address": "127.0.0.1",
+        "port": 38665,
+        "network": "tcp"
+      }
    }
  ],
  "outbounds": [
@@ -292,7 +314,7 @@
      "settings": {
        "vnext": [
          {
-            "address": "173.242.118.60",
+            "address": "67.230.189.235",
            "port": 443,
            "users": [
              {
@@ -419,6 +441,20 @@
        ],
        "outboundTag": "portal"
      },
+      {
+        "type": "field",
+        "inboundTag": [
+          "external_win_rdp"
+        ],
+        "outboundTag": "portal"
+      },
+      {
+        "type": "field",
+        "inboundTag": [
+          "external_spark_3080"
+        ],
+        "outboundTag": "portal"
+      },
      {
        "type": "field",
        "inboundTag": [
@@ -100,6 +100,20 @@
        "redirect": "192.168.1.200:51413"
      }
    },
+    {
+      "tag": "to_win_rdp",
+      "protocol": "freedom",
+      "settings": {
+        "redirect": "192.168.1.177:3389"
+      }
+    },
+    {
+      "tag": "to_spark_3080",
+      "protocol": "freedom",
+      "settings": {
+        "redirect": "192.168.1.166:3080"
+      }
+    },
    {
      "tag": "to_spark_ssh",
      "protocol": "freedom",
@@ -319,6 +333,22 @@
        "port": "38662",
        "outboundTag": "to_spark_38662"
      },
+      {
+        "type": "field",
+        "inboundTag": [
+          "bridge"
+        ],
+        "port": "38664",
+        "outboundTag": "to_win_rdp"
+      },
+      {
+        "type": "field",
+        "inboundTag": [
+          "bridge"
+        ],
+        "port": "38665",
+        "outboundTag": "to_spark_3080"
+      },
      {
        "type": "field",
        "inboundTag": [
@@ -1,6 +1,6 @@
 stream {
    map $ssl_preread_server_name $backend {
-        www.microsoft.com xray;
+        www.cloudflare.com xray;
        default npm;
    }
    upstream xray {
@@ -54,32 +54,16 @@ proxies:
  - name: 拒绝
    type: reject

-  - name: Xray-Real
-    type: vless
-    server: 49.232.242.90
-    port: 443
-    uuid: "113e167a-a2be-4b46-9010-60020108626c"
-    udp: true
-    flow: xtls-rprx-vision
-    packet-encoding: xudp
-    tls: true
-    servername: www.microsoft.com
-    client-fingerprint: chrome
-    reality-opts:
-      public-key: "62y5gDjPrdeuePGl-D2IW4Cw9Kb8_bSBBTmArvL7Nhs"
-      short-id: "7c947a71b94f369e"
-    network: tcp
-
  - name: US-Direct
    type: vless
-    server: 173.242.118.60
+    server: 67.230.189.235
    port: 443
    uuid: "4d222c16-53bb-4402-814e-c8188cebcea6"
    udp: true
    flow: xtls-rprx-vision
    packet-encoding: xudp
    tls: true
-    servername: www.microsoft.com
+    servername: www.cloudflare.com
    client-fingerprint: chrome
    reality-opts:
      public-key: "jr_zQjC4mvlQITuG5Ap5Mxqe5EBbGyyvwbVLDEi8OCA"
@@ -305,11 +289,13 @@ rules:
  - DOMAIN-SUFFIX,volces.com,直连
  - DOMAIN-KEYWORD,raylink,直连
  - IP-CIDR,49.232.242.90/32,直连
-  - IP-CIDR,173.242.118.60/32,直连
+  - IP-CIDR,67.230.189.235/32,直连
  - DOMAIN-SUFFIX,ubuntu.com,国外
  - DOMAIN-SUFFIX,canonical.com,国外
  - DOMAIN-SUFFIX,okx.com,国外
  - DOMAIN-SUFFIX,okxc.com,国外
+  - DOMAIN-SUFFIX,services.googleapis.cn,国外
+  - DOMAIN,connectivitycheck.gstatic.com,国外
  - RULE-SET,Ads,Block
  - RULE-SET,Private_Domain,国内
  - RULE-SET,Private_IP,国内,no-resolve
@@ -51,32 +51,16 @@ proxies:
  - name: 拒绝
    type: reject

-  - name: Xray-Real
-    type: vless
-    server: salmonstill.cn
-    port: 443
-    uuid: "113e167a-a2be-4b46-9010-60020108626c"
-    udp: true
-    flow: xtls-rprx-vision
-    packet-encoding: xudp
-    tls: true
-    servername: www.microsoft.com
-    client-fingerprint: chrome
-    reality-opts:
-      public-key: "62y5gDjPrdeuePGl-D2IW4Cw9Kb8_bSBBTmArvL7Nhs"
-      short-id: "7c947a71b94f369e"
-    network: tcp
-
  - name: US-Direct
    type: vless
-    server: 173.242.118.60
+    server: 67.230.189.235
    port: 443
    uuid: "4d222c16-53bb-4402-814e-c8188cebcea6"
    udp: true
    flow: xtls-rprx-vision
    packet-encoding: xudp
    tls: true
-    servername: www.microsoft.com
+    servername: www.cloudflare.com
    client-fingerprint: chrome
    reality-opts:
      public-key: "jr_zQjC4mvlQITuG5Ap5Mxqe5EBbGyyvwbVLDEi8OCA"
@@ -302,11 +286,13 @@ rules:
  - DOMAIN-SUFFIX,hf-mirror.com,国内
  - DOMAIN-KEYWORD,raylink,直连
  - IP-CIDR,49.232.242.90/32,直连
-  - IP-CIDR,173.242.118.60/32,直连
+  - IP-CIDR,67.230.189.235/32,直连
  - DOMAIN-SUFFIX,ubuntu.com,国外
  - DOMAIN-SUFFIX,canonical.com,国外
  - DOMAIN-SUFFIX,okx.com,国外
  - DOMAIN-SUFFIX,okxc.com,国外
+  - DOMAIN-SUFFIX,services.googleapis.cn,国外
+  - DOMAIN,connectivitycheck.gstatic.com,国外
  - RULE-SET,Ads,Block
  - RULE-SET,Private_Domain,国内
  - RULE-SET,Private_IP,国内,no-resolve
Author	SHA1	Message	Date
salmonstill	d5d02f65c4	现在正在进行xray的更新,因为最近xray有点出问题了	2026-06-29 16:32:18 +08:00
salmonstill	cb62839e19	一切正常，最近斑马工好像有点不太稳定，所以加一个Docker IO显示走国外的步骤准备。	2026-06-26 10:28:08 +08:00