[2. Precautions] (#precautions)
[3. Installation time description](#Installation time description)
[4. Script usage instructions](#Script usage instructions)
[5. Run screenshot](#run screenshot)
[6. Pretend website description](#Pretend website description)
[7. About TLS handshake, TLS fingerprint and ALPN](#About tls handshake tls fingerprint and alpn)
[8. About gRPC and WebSocket](#About gRPC and WebSocket)
[9. Installation location](#installation location)
[10. Dependency list](#Dependency list)
-
Support (VLESS/VMess)-(TCP/gRPC/WebSocket)-(XTLS/TLS) + Web construction/management, and support the coexistence of multiple protocols
-
Integrated multi-version bbr/sharp installation options
-
Support multiple systems (Ubuntu CentOS Debian deepin fedora ...)
-
Support multiple instruction sets (x86 x86_64 arm64 ...)
-
Support ipv6only server (need to set dns64 by yourself)
-
Integrate the function of deleting Alibaba Cloud Shield and Tencent Cloud Shield (only valid for Alibaba Cloud and Tencent Cloud servers)
-
Use Nginx as a website service
-
Use Xray as a pre-splitter
-
Use acme.sh to automatically apply for/renew domain name certificates
-
Support the option to build a personal network disk as a camouflaged webpage
-
This script needs a domain name resolved to the server (supports cdn)
-
This script takes a long time to install, see [Installation Time Description](#Installation Time Description)
-
This script is designed for personal VPS users, not suitable for airport owners (this script does not have functions such as multi-user management/traffic statistics).
-
It is recommended to use this script on a clean system (VPS console - reset system)
The installation time of this script is relatively long ([Installation time reference](#Installation time reference)) , see [here](#Why the script installation time is so long) for the reason.
This script is suitable for long-term use after one installation, and is not suitable for repeatedly resetting the system installation, which will consume a lot of your time. If you need to change the configuration and domain name, etc., there are corresponding options in the management interface.
If there is a need for quick installation, it is recommended to choose other scripts in Xray-core#Installation
Installation process:
[Upgrade system components]->[install bbr]->[install php]->install Nginx->install Xray->apply for a certificate->configuration file->[configure fake website]
The part wrapped by []
is optional.
This is the average installation time of a single-core 1G server, for reference only:
Project | Duration |
---|---|
Upgrade installed software | 0-10 minutes |
Upgrade system | 10-20 minutes |
Install bbr | 0-3 minutes |
Install php | Centos8 (gcc8.3 4.18 kernel): 20-60 minutes |
Ubuntu20.10 (gcc10.2 5.11-rc3 kernel): 15-20 minutes | |
Debian10 (gcc8.3 4.19 kernel): 10-15 minutes | |
Install Nginx | 13-15 minutes |
Install Xray | <half a minute |
Application certificate | 1-2 minutes |
Profile | <100ms |
Configure fake website | Nextcloud: 1-3 minutes |
Cloudreve: 1-2 minutes |
There are three reasons why the time is longer than other scripts:
1. Integrated the function of installing bbr
2. Integrate the function of updating system and software package
3. (Main reason) Nginx and php of the script are compiled from source code, other scripts usually directly obtain the binary program
The main reasons for adopting the compiled form are:
1. Easy to manage
2. Easy to adapt to various systems
The advantages of compiling over installing binaries directly are:
1. High operating efficiency (-O3 optimization is used when compiling)
2. The software version is new (you can compare this script with other script Nginx versions)
The disadvantage is that it takes a long time to compile
Debian base system (including Ubuntu, Debian, deepin):
apt --no-install-recommends -y install wget ca-certificates || (apt update && apt --no-install-recommends -y install wget ca-certificates)
Red Hat base system (including CentOS, fedora):
dnf -y install wget ca-certificates || yum -y install wget ca-certificates
wget -O Xray-TLS+Web-setup.sh https://github.com/kirin10000/Xray-script/raw/main/Xray-TLS+Web-setup.sh
bash Xray-TLS+Web-setup.sh
This website is a website built with your domain name. After the construction is completed, you can directly enter your domain name on the browser to visit.
All traffic you proxy with Xray will be disguised as traffic to this website.
Note that fake websites are not a panacea. According to the experience of some people, as long as your monthly traffic exceeds a certain limit, the operator will block you, no matter what your fake website is. That is to say, even if you do not proxy at all, but visit your website normally and visit too much traffic, you may be blocked.
The common characteristics of traffic using VPS self-built Xray proxy are single point, large traffic, long time, GO-TLS fingerprint characteristics, **same access Sex ** and so on.
- Single point means that there are few people who use it, generally only yourself, even if you share it with friends, generally it will not be too much.
- Long time not only refers to a long time, but also refers to using the agent every day for a month or a year.
- GO-TLS fingerprint feature On the premise of not disguising the browser fingerprint, it can be judged from the TLS handshake information that the client is a GO program, see [here] for details (#about tls handshake tls fingerprint and alpn).
- Sameness of entry and exit means that the traffic entering and exiting the VPS is almost the same in time and size, such as using Xray proxy to browse
BiliBili
, traffic fromBiliBili
toVPS(Xray server)
, and The traffic fromVPS
toXray Client
is almost the same in time and size. The sameness of entry and exit is a common problem of all proxies. There is no good way to disguise it yet, but because the VPS is not located in the mainland, if it is not the object of special attention, it will generally not be censored.
Since all the traffic that is proxied by Xray will be disguised as the traffic to visit this website, then we choose to disguise the website to try to choose the website with the same traffic characteristics as Xray proxy traffic characteristics**.
- Cloudreve and Nextcloud
They are all personal network disks. Personal network disks can be understood as Baidu network disks built using their own VPS. The difference is that files are stored in the VPS, and they are the administrators of the network disks.
Personal network disks have the most matches with the characteristics mentioned above, including single point, large traffic, GO-TLS fingerprint characteristics, long-term, etc., it is recommended choose.
Regarding GO-TLS fingerprint feature, under the premise of not disguising the browser fingerprint, set alpn to http/1.1, which can be disguised as a WebDav client implemented in GO language, see [here] for details (# about tls handshake tls fingerprint and alpn).
The differences between Cloudreve and Nextcloud are as follows:
Advantages | Disadvantages | |
---|---|---|
Nextcloud | More functions and more powerful, more users | Need to install php, which takes a lot of extra time (see [Installation time reference](#Installation time reference)), and it also takes up more time than Cloudreve Many system resources, so it is not recommended for small computers. |
Cloudreve | Lightweight, fast installation (no php required), less system resources occupied | fewer functions, less people use |
- 403 page
Basically all large websites have a website background. For example, the website of Bilibili is www.bilibili.com
. But when the video is playing, the video file is provided by another URL. When playing the video, right-click on Video Statistics
, where Video Host
is. This type of URL has content only when a specific URL suffix is opened. If the URL is incorrect, an error page will be returned. The 403 page is disguised as a website background.
In other words, it is disguised as a 403 page, and no one knows whether your website has anything except yourself.
- Custom static website
You can place your own static website source code, which is not recommended for Xiaobai.
- Custom Reverse Proxy Website
It is not recommended to choose, because the reverse proxy is often only a few html and js files, and most of the content in the website is still provided by the background of the website. Does not meet the characteristics of large flow.
Although TLS is an encryption technology, there will be some plaintext information transmission during the TLS handshake process, including SNI information (specified by the serverName parameter), ALPN, cipher suite, etc.
The current TLS standard does not have strict requirements on these plaintexts, so the formats of these plaintext information can be described as varied under different TLS implementations. The different plaintext features of these different TLS implementations are TLS fingerprints.
Through the TLS fingerprint, you can reverse the TLS implementation you are using, such as Chrome's TLS, FireFox's TLS, and the TLS of the GO language official library.
By default, Xray uses the TLS library officially provided by the GO language, which is also the TLS library used by almost all GO language programs. Xray can also simulate fingerprints of Chrome, FireFox, and Safari, but currently only supported by the TCP protocol.
When using TCP and not masquerading browser fingerprints, ALPN can be freely defined. It is recommended to set it to http/1.1, so that the Xray client can be disguised as a WebDav client implemented in GO language (such as gowebdav). WebDav is a network-specific protocol, and the protocol is based on HTTP/1.1, see: WebDav for details.
If you choose to fake browser fingerprints, the alpn parameter in the client configuration will be invalid, and the ALPN will be fixed to h2, http/1.1. Similarly, when using WebSocket, ALPN will be fixed to http/1.1; when using gRPC, ALPN will be forced to add h2. Therefore, using WebSocket can still pretend to be a GO language WebDav client, but gRPC cannot.
When the CDN being used supports both gRPC and WebSocket, how to choose between the two? Their main differences are reflected in the following three aspects: ALPN, latency and performance.
For ALPN, see [here] (#about tls handshake tls fingerprint and alpn).
Regarding latency, gRPC comes with mux, so the latency is lower. Note that this refers to the delay of opening the website, mux cannot reduce the delay of the game.
Regarding performance, WebSocket has stronger performance. If your device has weaker performance, such as a common home router, using WebSocket will be faster.
Nginx: /usr/local/nginx
php:* /usr/local/php
Cloudreve: /usr/local/cloudreve
Xray: See Xray-install
The script may automatically install the following dependencies:
Use | Debian-based system | Red Hat-based system |
---|---|---|
yumdb set (mark package manual installation) | yum-utils | |
dnf config-manager | dnf-plugins-core | |
setenforce/getenforce(close SELinux) | selinux-utils | libselinux-utils |
ss (check port usage) | iproute2 | iproute |
wget | wget | wget |
curl | curl | curl |
wget/curl https | ca-certificates | ca-certificates |
kill/pkill/ps/sysctl/free | procps | procps-ng |
epel source | epel-release | |
epel source | epel-next-release | |
remi-source | remi-release | |
do-release-upgrade (upgrade system) | ubuntu-release-upgrader-core | |
unzip | unzip | unzip |
curl | curl | curl |
Install bbr kernel | linux-base | |
Compilation basis: | ||
Download source file | wget | wget |
Decompress the tar source file | tar | tar |
Decompress tar.gz source code file | gzip | gzip |
Decompress tar.xz source code file | xz-utils | xz |
gcc | gcc | gcc |
g++ | g++ | gcc-c++ |
make | make | make |
acme.sh depends on: | ||
curl | curl | |
openssl | openssl | |
cron | crontabs | |
Compile openssl: | ||
perl-base (included in libperl-dev) | perl-IPC-Cmd | |
perl-modules-5.32 (included in libperl-dev) | perl-Getopt-Long | |
libperl5.32 (included in libperl-dev) | perl-Data-Dumper | |
perl-FindBin | ||
Compile Nginx: | ||
libpcre2-dev | pcre2-devel | |
zlib1g-dev | zlib-devel | |
--with-http_xslt_module | libxml2-dev | libxml2-devel |
--with-http_xslt_module | libxslt1-dev | libxslt-devel |
--with-http_image_filter_module | libgd-dev | gd-devel |
--with-google_perftools_module | libgoogle-perftools-dev | gperftools-devel |
--with-http_geoip_module | libgeoip-dev | geoip-devel |
--with-http_perl_module | perl-ExtUtils-Embed | |
libperl-dev | perl-devel | |
Compile php: | ||
pkg-config | pkgconf-pkg-config | |
libxml2-dev | libxml2-devel | |
libsqlite3-dev | sqlite-devel | |
--with-fpm-systemd | libsystemd-dev | systemd-devel |
--with-fpm-acl | libacl1-dev | libacl-devel |
--with-fpm-apparmor | libapparmor-dev | |
--with-openssl | libssl-dev | openssl-devel |
--with-kerberos | libkrb5-dev | krb5-devel |
--with-external-pcre | libpcre2-dev | pcre2-devel |
--with-zlib | zlib1g-dev | zlib-devel |
--with-bz2 | libbz2-dev | bzip2-devel |
--with-curl | libcurl4-openssl-dev | libcurl-devel |
--with-qdbm | libqdbm-dev | |
--with-gdbm | gdbm-devel | |
--with-db4 | libdb-dev | libdb-devel |
--with-tcadb | libtokyocabinet-dev | tokyocabinet-devel |
--with-lmdb | liblmdb-dev | lmdb-devel |
--with-enchant | libenchant-2-dev/libenchant-dev | enchant-devel |
--with-ffi | libffi-dev | libffi-devel |
--enable-gd | libpng-dev | libpng-devel |
--with-external-gd | libgd-dev | gd-devel |
--with-webp | libwebp-dev | libwebp-devel |
--with-jpeg | libjpeg-dev | libjpeg-turbo-devel |
--with-xpm | libxpm-dev | libXpm-devel |
--with-freetype | libfreetype6-dev | freetype-devel |
--with-gmp | libgmp-dev | gmp-devel |
--with-imap | libc-client2007e-dev | uw-imap-devel |
--enable-intl | libicu-dev | libicu-devel |
--with-ldap | libldap2-dev | openldap-devel |
--with-ldap-sasl | libsasl2-dev | openldap-devel |
--enable-mbstring | libonig-dev | oniguruma-devel |
--with-unixODBC, --with-pdo-odbc | unixodbc-dev | unixODBC-devel |
--with-pdo-dblib | freetds-dev | freetds-devel |
--with-pdo-pgsql, --with-pgsql | libpq-dev | libpq-devel |
--with-pspell | libpspell-dev | aspell-devel |
--with-libedit | libedit-dev | libedit-devel |
--with-mm | libmm-dev | |
--with-snmp | libsnmp-dev | net-snmp-devel |
--with-sodium | libsodium-dev | libsodium-devel |
--with-password-argon2 | libargon2-dev | libargon2-devel |
--with-tidy | libtidy-dev | libtidy-devel |
--with-xsl | libxslt1-dev | libxslt-devel |
--with-zip | libzip-dev | libzip-devel |
Compile php-imagick: | ||
autoconf | autoconf | |
git | git | |
libmagickwand-dev | ImageMagick-devel |
-
Link to this article (official website): https://github.com/kirin10000/Xray-script
-
Reference tutorial: https://www.v2fly.org/config/overview.html https://guide.v2fly.org/ https://docs.nextcloud.com/server/latest/admin_manual/installation/source_installation. html https://docs.cloudreve.org/
-
Domain name certificate application: https://github.com/acmesh-official/acme.sh
-
The bbr script comes from: https://github.com/teddysun/across/blob/master/bbr.sh
-
The bbr2 script comes from: https://github.com/yeyingorg/bbr2.sh (Ubuntu Debian) https://github.com/jackjieYYY/bbr2 (CentOS)
-
The bbrplus script comes from: https://github.com/chiakge/Linux-NetSpeed