Xray科学上网简要

Jun 3, 2022 · 4 min read · Xray linux vpn ·

分享到:

在中国大陆，科学上网的需求对于技术人员，或者特定人群，始终是存在的。从最开始的vpn到shadowsocks，再到v2ray，最新的为xray，包括其它的，目的都是为了自由访问互联网，获取必要资讯。本文介绍在linux pc环境下，命令行模式科学上网配置, 非GUI外部依赖少，不需要等其它软件更新，即可获得最新功能，mac应该也可以类似操作，但mac软件生态较好，一般下载对应的app安装即可，不要手动配置。

1. 购买海外主机

建议日本/新加坡/美西，或者香港主机，看云服务商，自己测试下速度，选速度快晚高峰不卡顿的

2. 服务端配置

去xray github仓库下载最新的平台软件包

解压软件包到自定义目录, 我选择的目录为/opt/xray, 如下所示，config.json为稍后创建的配置文件，其它4个为压缩包默认提供，无需更改

  [email protected]:~# ls -al /opt/xray/
  total 40188
  drwxr-xr-x 2 root root     4096 Jun  3 17:07 .
  drwxr-xr-x 4 root root     4096 Jun  3 13:36 ..
  -rw-r--r-- 1 root root     1141 Jun  3 17:07 config.json
  -rw-r--r-- 1 root root  9243256 Jan  1 08:00 geoip.dat
  -rw-r--r-- 1 root root  1161963 Jan  1 08:00 geosite.dat
  -rw-r--r-- 1 root root    16725 Jan  1 08:00 LICENSE
  -rw-r--r-- 1 root root     3613 Jan  1 08:00 README.md
  -rwxr-xr-x 1 root root 20606976 Jan  1 08:00 xray

使用 vim或者vscode等编辑器配置config.json文件

 [email protected]:~# cat /opt/xray/config.json 
 {
     "log": {
     "access": "/var/log/xray/access.log",
     "error": "/var/log/xray/error.log",
     "loglevel": "warning",
     "dnsLog": false
     },
     "inbounds": [
     {
         "port": 444,     # 监听端口, 可根据喜好设定
         "protocol": "vless",
         "settings": {
         "clients": [
             {
             "id": "your_uuid", # 你的uuid，由xray uuid命令生成 
             "flow": "xtls-rprx-direct",
             "level": 0,
             "email": "[email protected]"
             }
         ],
         "decryption": "none",
         "fallbacks": [
             {
             "dest": 80
             }
         ]
         },
         "streamSettings": {
         "network": "tcp",
         "security": "xtls",
         "xtlsSettings": {
             "alpn": [
             "http/1.1"
             ],
             "certificates": [
             {
                 "certificateFile": "/root/.acme.sh/mephisto.cc/fullchain.cer",   # 改成你的证书
                 "keyFile": "/root/.acme.sh/mephisto.cc/mephisto.cc.key"  # 改成你的key
             }
             ]
         }
         }
     }
     ],
     "outbounds": [
     {
         "protocol": "freedom"
     }
     ]
 }

mephisto.cc是我购买的域名，证书部分由caddy2自动搞定，找到证书地址填到上面对应行即可, 无域名的配置方式，请参考xray的相关文档

systemd配置，不会操作的搜索学习下，结果如下

文件路径在这里/lib/systemd/system/xray.service

  [email protected]:~# systemctl status xray.service 
  xray.service - XRay Service
      Loaded: loaded (/lib/systemd/system/xray.service; enabled; vendor preset: enabled)
      Active: active (running) since Fri 2022-06-03 17:07:22 CST; 3h 18min ago
      Docs: https://xtls.github.io/
  Main PID: 2403220 (xray)
      Tasks: 7 (limit: 1036)
      Memory: 10.5M
      CGroup: /system.slice/xray.service
              └─2403220 /opt/xray/xray -config /opt/xray/config.json
  Jun 03 17:07:22 tokyo systemd[1]: Started XRay Service.
  Jun 03 17:07:22 tokyo xray[2403220]: Xray 1.5.6 (Xray, Penetrates Everything.) Custom (go1.18.2 linux/amd64)
  Jun 03 17:07:22 tokyo xray[2403220]: A unified platform for anti-censorship.
  Jun 03 17:07:22 tokyo xray[2403220]: 2022/06/03 17:07:22 [Info] infra/conf/serial: Reading config: /opt/xray/config.json

配置内容

  [email protected]:~# cat /lib/systemd/system/xray.service
  [Unit]
  Description=XRay Service
  Documentation=https://xtls.github.io/
  After=network.target nss-lookup.target

  [Service]
  User=root
  CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
  AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
  NoNewPrivileges=true
  ExecStart=/opt/xray/xray -config /opt/xray/config.json
  Restart=on-failure
  RestartPreventExitStatus=23

  [Install]
  WantedBy=multi-user.target

开机启动检查

  [email protected]:~# systemctl is-enabled xray.service
  enabled

进程监听状态确认, xray的444端口已经开启监听，这个端口是上面配置的

  [email protected]:~# ss -lntp |grep xray
  LISTEN 0      4096               *:444             *:*    users:(("xray",pid=2403220,fd=3))

至此，服务端相关配置完成

3. 客户端配置，linux命令行客户端配置, 和服务端相差不大，只是配置文件config.json 内容不同

客户端配置结果

  ➜  ~ ls -al /opt/xray 
      total 15381
      drwxr-xr-x  2 root     root            9 Jun  3 20:42 .
      drwxr-xr-x 11 root     root           11 Jun  3 13:12 ..
      -rw-r--r--  1 root     root         3324 Jun  3 17:07 config.json
      -rw-r--r--  1 mephisto mephisto  9243256 Jan  1 08:00 geoip.dat
      -rw-r--r--  1 mephisto mephisto  1161963 Jan  1 08:00 geosite.dat
      -rw-r--r--  1 mephisto mephisto    16725 Jan  1 08:00 LICENSE
      -rw-r--r--  1 mephisto mephisto     3613 Jan  1 08:00 README.md
      -rwxr-xr-x  1 mephisto mephisto 20606976 Jan  1 08:00 xray
  ➜  ~ cat /opt/xray/config.json 
  {
      "log": {
          "access": "/var/log//xray/access.log",
          "error": "/var/log/xray/error.log",
          "loglevel": "warning"
      },
      "dns": {
          "servers": [
              {
                  "address": "1.1.1.1",
                  "domains": [
                      "geosite:geolocation-!cn"
                  ]
              },
              {
                  "address": "223.5.5.5",
                  "domains": [
                      "geosite:cn"
                  ],
                  "expectIPs": [
                      "geoip:cn"
                  ]
              },
              {
                  "address": "114.114.114.114",
                  "domains": [
                      "geosite:cn"
                  ]
              },
              "localhost"
          ]
      },
      "routing": {
          "domainStrategy": "IPIfNonMatch",
          "rules": [
              {
                  "type": "field",
                  "domain": [
                      "geosite:category-ads-all"
                  ],
                  "outboundTag": "block"
              },
              {
                  "type": "field",
                  "domain": [
                      "geosite:cn"
                  ],
                  "outboundTag": "direct"
              },
              {
                  "type": "field",
                  "ip": [
                      "geoip:cn",
                      "geoip:private"
                  ],
                  "outboundTag": "direct"
              },
              {
                  "type": "field",
                  "domain": [
                      "geosite:geolocation-!cn"
                  ],
                  "outboundTag": "proxy"
              },
              {
                  "type": "field",
                  "ip": [
                      "223.5.5.5"
                  ],
                  "outboundTag": "direct"
              }
          ]
      },
      "inbounds": [
          {
              "tag": "socks-in",
              "protocol": "socks",   #socks代理
              "listen": "127.0.0.1",
              "port": 1080,
              "settings": {
                  "udp": true
              }
          },
          {
              "tag": "http-in",
              "protocol": "http",    #http代理
              "listen": "127.0.0.1",
              "port": 1081
          }
      ],
      "outbounds": [
          {
              "tag": "proxy",
              "protocol": "vless",
              "settings": {
                  "vnext": [
                      {
                          "address": "mephisto.cc", # 改成你的域名
                          "port": 444,  # 服务端端口
                          "users": [
                              {
                                  "id": "your_uuid",  # 你的uuid
                                  "flow": "xtls-rprx-direct",
                                  "encryption": "none",
                                  "level": 0
                              }
                          ]
                      }
                  ]
              },
              "streamSettings": {
                  "network": "tcp",
                  "security": "xtls",
                  "xtlsSettings": {
                      "serverName": "mephisto.cc", # 你的域名
                      "allowInsecure": true
                  }
              }
          },
          {
              "tag": "direct",
              "protocol": "freedom"
          },
          {
              "tag": "block",
              "protocol": "blackhole"
          }
      ]
  }

routing 和 dns部分看起来复杂，请查看xray的文档，普通用户都不需要怎么改动，翻墙够用了

验证是否符合预期

命令行http代理测试，it works!

  ➜  ~ curl -I -x http://127.0.0.1:1081 https://google.com   
  HTTP/1.1 200 Connection established

  HTTP/2 301 
  location: https://www.google.com/
  content-type: text/html; charset=UTF-8
  date: Fri, 03 Jun 2022 12:55:40 GMT
  expires: Sun, 03 Jul 2022 12:55:40 GMT
  cache-control: public, max-age=2592000
  server: gws
  content-length: 220
  x-xss-protection: 0
  x-frame-options: SAMEORIGIN
  alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

socks5代理测试，也是能工作的

  ➜  ~ curl -I -x socks5h://127.0.0.1:1080 https://www.google.com/
  HTTP/2 200 
  content-type: text/html; charset=ISO-8859-1
  p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
  date: Fri, 03 Jun 2022 13:00:58 GMT
  server: gws
  x-xss-protection: 0
  x-frame-options: SAMEORIGIN
  expires: Fri, 03 Jun 2022 13:00:58 GMT
  cache-control: private
  set-cookie: 1P_JAR=2022-06-03-13; expires=Sun, 03-Jul-2022 13:00:58 GMT; path=/; domain=.google.com; Secure
  set-cookie: AEC=AakniGOSbutZGFxTDab9J5w5YK8ZVJWqiR-zynVkDi-b8Rof7f_LvLyFVJo; expires=Wed, 30-Nov-2022 13:00:58 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
  set-cookie: NID=511=idF0g6ZS2sbWz6Du7vKmvJj7pje-MC8xe0Fd8z3bCbGYAGKGiFVWBUflmIStvdfWPAKgsGd0q0jPD_pDbd-Er2XQpr-6-D7YhCi5RdauYLIRQiWR_9R1DXuqxhfcxiCmROOhv9OP3nkNkEQJmMjJmMEYKUdY0MyoIUi3rYChzGA; expires=Sat, 03-Dec-2022 13:00:58 GMT; path=/; domain=.google.com; HttpOnly
  alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

有人可能要问了，接下来怎么使用呢，操作很简单，我平时用两个浏览器，chrome主力，firefox配置上面的上述两种代理即可 setting/General/Network Settings/Settings/Manual proxy configration 下图所示

另外，Gnome等桌面也有全局网络代理设置，chrome和firefox有相关代理插件可用，终端里面也可以配置环境变量的方式使用，不一一列举。

最后，特别说明手机端ios去美区下载Shadowrocket也可以配置使用

Xray科学上网简要

1. 购买海外主机

2. 服务端配置

3. 客户端配置，linux命令行客户端配置, 和服务端相差不大，只是配置文件config.json 内容不同

验证是否符合预期

相关文章:

翻译: