370 lines
10 KiB
Markdown
370 lines
10 KiB
Markdown
---
|
||
title: 使用 sing-box 配置高级功能的 VLESS 协议
|
||
subtitle:
|
||
date: 2024-03-09T22:44:42-05:00
|
||
slug: vless-tcp-reality-xtls-utls-xudp
|
||
draft: false
|
||
author:
|
||
name: James
|
||
link: https://www.jamesflare.com
|
||
email:
|
||
avatar: /site-logo.avif
|
||
description: 本文提供了使用 sing-box 设置 VLESS + TCP + REALITY + XTLS + uTLS + XUDP 配置的详细步骤，包括服务器和客户端的设置、安装和运行 sing-box，以实现一个安全高效的代理解决方案。
|
||
license:
|
||
comment: true
|
||
weight: 0
|
||
tags:
|
||
- sing-box
|
||
- 代理
|
||
- 安全
|
||
- 网络
|
||
categories:
|
||
- 教程
|
||
- 代理
|
||
hiddenFromHomePage: false
|
||
hiddenFromSearch: false
|
||
hiddenFromRss: false
|
||
hiddenFromRelated: false
|
||
summary: 本文提供了使用 sing-box 设置 VLESS + TCP + REALITY + XTLS + uTLS + XUDP 配置的详细步骤，包括服务器和客户端的设置、安装和运行 sing-box，以实现一个安全高效的代理解决方案。
|
||
resources:
|
||
- name: featured-image
|
||
src: featured-image.jpg
|
||
- name: featured-image-preview
|
||
src: featured-image-preview.jpg
|
||
toc: true
|
||
math: false
|
||
lightgallery: false
|
||
password:
|
||
message:
|
||
repost:
|
||
enable: true
|
||
url:
|
||
|
||
# 查看详细的前言字段：https://fixit.lruihao.cn/documentation/content-management/introduction/#front-matter
|
||
---
|
||
|
||
<!--more-->
|
||
|
||
## 简介
|
||
|
||
VLESS + TCP + REALITY + XTLS + uTLS + XUDP 是一个非常优秀的组合。[XUDP](https://github.com/XTLS/Xray-core/discussions/252) 可以让 VLESS 支持全锥型 NAT。使用 [REALITY](https://github.com/XTLS/REALITY#vless-xtls-utls-reality-example-for-xray-core-%E4%B8%AD%E6%96%87) 代替 TLS 可以消除服务器端 TLS 指纹特征，同时仍然提供前向保密并使证书链攻击无效，其安全性超过了传统的 TLS。它可以指向其他网站，而无需购买域名或配置 TLS 服务器，使用起来更加方便。它实现了具有指定 SNI 的端到端真正 TLS 呈现给中间人。
|
||
|
||
## 获取 sing-box
|
||
|
||
## sing-box 基础知识
|
||
|
||
sing-box 使用 JSON 格式的配置文件。
|
||
|
||
```json
|
||
// 结构
|
||
{
|
||
"log": {},
|
||
"dns": {},
|
||
"ntp": {},
|
||
"inbounds": [],
|
||
"outbounds": [],
|
||
"route": {},
|
||
"experimental": {}
|
||
}
|
||
```
|
||
|
||
你可以在[这里](https://sing-box.sagernet.org/configuration)获取详细的文档。我不会详细介绍每一项配置。
|
||
|
||
## 服务器端配置
|
||
|
||
在开始之前，我们需要为 REALITY 生成一个 x25519 密钥对。在 sing-box 中可以通过运行以下命令来生成：
|
||
|
||
```bash
|
||
sing-box generate reality-keypair
|
||
```
|
||
|
||
你应该会得到类似这样的输出：
|
||
|
||
```text
|
||
PrivateKey: 0H5tYLhpDT_r675UC93iWAS2LqN6mPZoDcVDqsff018
|
||
PublicKey: SeIw41mp1LFEd6CEGArmnSoaIXzNlwnkIbduoEY-OXk
|
||
```
|
||
|
||
可选地，你还可以为 REALITY 生成一个短 ID。通过运行以下命令，你应该会得到一个 8 位的十六进制数：
|
||
|
||
```bash
|
||
sing-box generate rand 8 --hex
|
||
```
|
||
|
||
输出大概是这样：
|
||
|
||
```text
|
||
26079ba8291ff0fc
|
||
```
|
||
|
||
最后，你还需要生成一个 UUID：
|
||
|
||
```bash
|
||
sing-box generate uuid
|
||
```
|
||
|
||
输出类似这样：
|
||
|
||
```text
|
||
11391936-7544-4af5-ad02-e9f3970b1f64
|
||
```
|
||
|
||
现在，让我们将它们填写到正确的位置并完成配置。如果你想节省时间，不想深入研究细节，可以参考这个配置示例：
|
||
|
||
```json
|
||
{
|
||
"log":{
|
||
"level":"info"
|
||
},
|
||
"inbounds":[
|
||
{
|
||
"type":"vless",
|
||
"tag":"vless-in",
|
||
"listen":"0.0.0.0",
|
||
"listen_port":443,
|
||
"users":[
|
||
{
|
||
"name":"jamesflare",
|
||
"uuid":"11391936-7544-4af5-ad02-e9f3970b1f64",
|
||
"flow":"xtls-rprx-vision"
|
||
}
|
||
],
|
||
"tls":{
|
||
"enabled":true,
|
||
"server_name":"www.rpi.edu",
|
||
"reality":{
|
||
"enabled":true,
|
||
"handshake":{
|
||
"server":"www.rpi.edu",
|
||
"server_port":443
|
||
},
|
||
"private_key":"0H5tYLhpDT_r675UC93iWAS2LqN6mPZoDcVDqsff018",
|
||
"short_id":[
|
||
"26079ba8291ff0fc"
|
||
]
|
||
}
|
||
},
|
||
"multiplex":{
|
||
"enabled":false
|
||
}
|
||
}
|
||
],
|
||
"outbounds":[
|
||
{
|
||
"type":"direct",
|
||
"tag":"direct"
|
||
}
|
||
]
|
||
}
|
||
```
|
||
|
||
我强烈建议你根据自己的情况修改以下字段：
|
||
|
||
- `name`
|
||
- `uuid`
|
||
- `server_name`
|
||
- `server`
|
||
- `server_port`
|
||
- `private_key`
|
||
- `short_id`
|
||
|
||
## 客户端配置
|
||
|
||
我希望 sing-box 使用 `TUN` 作为入站，这样我们就可以实现全局代理。当然你也可以将其作为 http/socks 代理运行。无论如何，我将以 `TUN` 为例。
|
||
|
||
你需要将以下字段更改为你自己的值：
|
||
|
||
- `server`
|
||
- `server_port`
|
||
- `uuid`
|
||
- `server_name`
|
||
- `public_key`
|
||
- `short_id`
|
||
|
||
确保你的值与服务器端信息匹配。这里是一个配置示例：
|
||
|
||
```json
|
||
{
|
||
"log":{
|
||
"level":"info",
|
||
"timestamp":true
|
||
},
|
||
"dns":{
|
||
"servers":[
|
||
{
|
||
"tag":"cloudflare",
|
||
"address":"1.1.1.1"
|
||
}
|
||
],
|
||
"rules":[
|
||
{
|
||
"outbound":"any",
|
||
"server":"cloudflare"
|
||
}
|
||
],
|
||
"strategy":"ipv4_only"
|
||
},
|
||
"inbounds":[
|
||
{
|
||
"type":"tun",
|
||
"tag":"tun-in",
|
||
"interface_name":"tun0",
|
||
"inet4_address":"172.28.0.1/30",
|
||
"auto_route":true,
|
||
"strict_route":true,
|
||
"stack":"system",
|
||
"sniff":true
|
||
}
|
||
],
|
||
"outbounds":[
|
||
{
|
||
"type":"vless",
|
||
"tag":"vless-out",
|
||
"server":"your.server.ip.or.domain",
|
||
"server_port":443,
|
||
"uuid":"11391936-7544-4af5-ad02-e9f3970b1f64",
|
||
"flow":"xtls-rprx-vision",
|
||
"tls":{
|
||
"enabled":true,
|
||
"server_name":"www.rpi.edu",
|
||
"utls":{
|
||
"enabled":true,
|
||
"fingerprint":"chrome"
|
||
},
|
||
"reality":{
|
||
"enabled":true,
|
||
"public_key":"SeIw41mp1LFEd6CEGArmnSoaIXzNlwnkIbduoEY-OXk",
|
||
"short_id":"26079ba8291ff0fc"
|
||
}
|
||
},
|
||
"packet_encoding":"xudp",
|
||
"multiplex":{
|
||
"enabled":false
|
||
}
|
||
},
|
||
{
|
||
"type":"direct",
|
||
"tag":"direct"
|
||
},
|
||
{
|
||
"type":"dns",
|
||
"tag":"dns"
|
||
}
|
||
],
|
||
"route":{
|
||
"geoip":{
|
||
"download_url":"https://github.com/SagerNet/sing-geoip/releases/latest/download/geoip.db",
|
||
"download_detour":"vless-out"
|
||
},
|
||
"geosite":{
|
||
"download_url":"https://github.com/SagerNet/sing-geosite/releases/latest/download/geosite.db",
|
||
"download_detour":"vless-out"
|
||
},
|
||
"rules":[
|
||
{
|
||
"protocol":"dns",
|
||
"outbound":"dns"
|
||
},
|
||
{
|
||
"geoip":[
|
||
"private"
|
||
],
|
||
"outbound":"direct"
|
||
}
|
||
],
|
||
"auto_detect_interface":true
|
||
}
|
||
}
|
||
```
|
||
|
||
## 安装 sing-box
|
||
|
||
你可能会问"我如何使用上述配置运行 sing-box？"。首先你需要安装 sing-box。你可以在[官方文档](https://sing-box.sagernet.org/installation/package-manager/)中找到更多安装信息。
|
||
|
||
### 在 Debian 12 中安装
|
||
|
||
我在 Linux 服务器上运行 sing-box 服务器端，操作系统是 Debian 12。在这种情况下，我使用了 debian 的官方安装脚本：
|
||
|
||
```bash
|
||
bash <(curl -fsSL https://sing-box.app/deb-install.sh)
|
||
```
|
||
|
||
你可以通过运行以下命令检查是否安装成功：
|
||
|
||
```bash
|
||
sing-box help
|
||
```
|
||
|
||
它应该会返回类似以下内容：
|
||
|
||
```text
|
||
Usage:
|
||
sing-box [command]
|
||
|
||
Available Commands:
|
||
check Check configuration
|
||
completion Generate the autocompletion script for the specified shell
|
||
format Format configuration
|
||
generate Generate things
|
||
help Help about any command
|
||
merge Merge configurations
|
||
run Run service
|
||
tools Experimental tools
|
||
version Print current version of sing-box
|
||
|
||
Flags:
|
||
-c, --config stringArray set configuration file path
|
||
-C, --config-directory stringArray set configuration directory path
|
||
-D, --directory string set working directory
|
||
--disable-color disable color output
|
||
-h, --help help for sing-box
|
||
|
||
Use "sing-box [command] --help" for more information about a command.
|
||
```
|
||
|
||
对于使用 systemd 的 Linux 系统，通常安装已经包括了一个 sing-box 服务，你可以使用以下命令管理该服务：
|
||
|
||
### 在 Windows 11 中安装
|
||
|
||
我的客户端是 Windows 11，我选择使用 [Chocolatey](https://chocolatey.org/install#individual) 进行托管安装。要安装 Chocolatey，你需要使用以下命令运行管理员 PowerShell：
|
||
|
||
```bash
|
||
Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
|
||
```
|
||
|
||
如果你没有看到任何错误，就可以开始使用 Chocolatey 了！输入 `choco` 或 `choco -?` 检查是否安装成功。请记住，这只是一个非常简单的 Chocolatey 安装说明，还有许多其他安装方法和选项，请查看官网以获取更多信息。
|
||
|
||
现在，我们可以使用 Chocolatey 安装 sing-box：
|
||
|
||
```bash
|
||
choco install sing-box
|
||
```
|
||
|
||
你可以通过运行以下命令检查是否安装成功：
|
||
|
||
```bash
|
||
sing-box help
|
||
```
|
||
|
||
## 运行 sing-box
|
||
|
||
服务器端和客户端的 sing-box 程序没有区别。唯一的区别在于配置文件。
|
||
|
||
在开始之前，你应该将配置保存到 JSON 文件中。我会将它们命名为：`client.json`、`server.json`。然后在命令中指定配置文件，例如：
|
||
|
||
```bash
|
||
sing-box run -c client.json
|
||
```
|
||
|
||
你需要在客户端和服务器端都运行 sing-box。输出应该类似于：
|
||
|
||
```text
|
||
C:\Users\James\Desktop\Softwares\sing-box>sing-box run -c xray-ny-a-client.json
|
||
-0500 2023-12-27 23:23:32 INFO router: updated default interface Wi-Fi, index 18
|
||
-0500 2023-12-27 23:23:32 INFO inbound/tun[tun-in]: started at tun0
|
||
-0500 2023-12-27 23:23:32 INFO sing-box started (0.288s)
|
||
-0500 2023-12-27 23:23:32 INFO [832064929 0ms] inbound/tun[tun-in]: inbound packet connection from 172.28.0.1:55770
|
||
-0500 2023-12-27 23:23:32 INFO [1067986987 0ms] inbound/tun[tun-in]: inbound packet connection from 172.28.0.1:58423
|
||
-0500 2023-12-27 23:23:32 INFO [2253360887 0ms] inbound/tun[tun-in]: inbound connection from 172.28.0.1:60610
|
||
-0500 2023-12-27 23:23:32 INFO outbound/vless[vless-out]: outbound packet connection to 1.1.1.1:53
|
||
``` |