Xray(M+F+H+K+G+B+A)+Nginx | 2025/2/08的最新更新, 发现无法使用XHTTP #237

1trapbox · 2025-02-10T19:45:32Z

1trapbox
Feb 10, 2025

Xray(M+F+H+K+G+B+A)+Nginx（由 Nginx 兼顾 SNI 分流的综合应用。）

这个配置这两天改动挺频繁的, 今晚试了下新配置发现XHTTP无法使用.

对比了一下之前的配置, 发现stream块中的server删除了listen 443 udp reuseport...

是否会是这个问题导致呢😲?

如果是只有我遇到这个问题... 我愿意分享配置以便各位指点 😧

这是xray的报错日志(debug)

PS: nginx倒是没看到错误日志

2025/02/11 03:33:37.224459 [Error] common/net: invalid IP format: []
2025/02/11 03:33:37.224472 [Info] [1898027052] proxy/vless/inbound: firstLen = 0
2025/02/11 03:33:37.224480 [Info] [1898027052] app/proxyman/inbound: connection ends > proxy/vless/encoding: failed to read request version > EOF
2025/02/11 03:33:38.235114 [Info] [2918207928] app/proxyman/inbound: connection ends > proxy/vless/inbound: fallback ends > context canceled
2025/02/11 03:33:38.235157 [Info] [2918207928] app/proxyman/inbound: failed to close connection > tls: failed to send closeNotify alert (but connection was closed anyway): write unix /dev/shm/proxy-xray.sock->@: write: broken pipe

Answered by lxhao61

Feb 12, 2025

使用通配符证书、合并后的正确配置如下：
1、Nginx

stream {
    map $ssl_preread_server_name $tcpsni_name {
        h3.xx.yy            vless;
        zt.xx.yy           trojan;
        zh.xx.yy            http3;
    }
    upstream vless {
        server unix:/dev/shm/uds5443.sock;
    }
    upstream trojan {
        server unix:/dev/shm/uds6443.sock;
    }
    upstream http3 {
        server unix:/dev/shm/uds8443.sock;
    }
    server {
        listen 443;
        #listen [::]:443;
        ssl_preread on;
        proxy_protocol on;
        proxy_pass $tcpsni_name;
    }
}

http {
    # 其他配置和日志这里省略掉

    server {
        listen 80;
        #listen [::]:80;
        return 301 https://$host$request_uri;
    }

 …

View full answer

1trapbox · 2025-02-12T14:19:37Z

1trapbox
Feb 12, 2025
Author

@lxhao61 麻烦大佬指点一下，看看哪里出问题。。。
XHTTP连不上 😞

配置如下

nginx

stream {
    map $ssl_preread_server_name $tcpsni_name {
        h3.xx.yy            vless;              # h3.xx.yy 为对应 VLESS+Vision+REALITY 的域名，修改为自己的。
        zt.xx.yy            trojan;             # zt.xx.yy 为对应 Trojan+RAW+TLS 的域名，修改为自己的。
        zh.xx.yy            fallback;           # zh.xx.yy 为对应 HTTP/2 server 的域名，修改为自己的。
    }
    upstream vless {
        server unix:/dev/shm/uds5443.sock; # 转给 VLESS+Vision+REALITY 监听进程
    }
    upstream trojan {
        server unix:/dev/shm/uds6443.sock; # 转给 Trojan+RAW+TLS 监听进程
    }
    upstream fallback {
        server unix:/dev/shm/uds8443.sock; # 转给 HTTP/2 server 监听进程
    }
    server {
        listen 443;
        #listen [::]:443;
        ssl_preread on;
        proxy_protocol on;
        proxy_pass $tcpsni_name;
    }
}


http {
    # 其他配置和日志这里省略掉，方便大佬指点。

# server 1
    server {
        listen 80;
        #listen [::]:80;
        return 301 https://$host$request_uri;            #H TTP 自动跳转 HTTPS，让网站看起来更真实。
    }

# server 2
    server {
        listen 443 quic reuseport;                       # 仅版本不小于 v1.25.0 且 SSL 库支持 QUIC（HTTP/3） 配置，否则必须删除。
        #listen [::]:443 quic reuseport;                 # 仅版本不小于 v1.25.0 且 SSL 库支持 QUIC（HTTP/3） 配置，否则必须删除。另无 IPv6，此项也可删除。
        listen unix:/dev/shm/uds8443 ssl proxy_protocol; # 仅版本不小于 v1.25.0 配置，否则必须删除。
        http2 on;                                        # 仅版本不小于 v1.25.1 配置，否则必须删除。
        set_real_ip_from unix:;
        real_ip_header proxy_protocol;

        # ? 加载
        include "SSL_CA.conf"; # SSL配置 & CA证书路径

        location /VLSpdG9k { #与 VLESS+XHTTP 应用中 path 对应
            grpc_pass grpc://unix:/dev/shm/uds2023.sock; #转发给本机 VLESS+XHTTP 监听进程
            grpc_set_header Host $host;
            grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }

        location / {
            add_header Alt-Svc 'h3=":443"; ma=86400';    # 通告 HTTP/3 server 的可用性
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; #启用 HSTS
            root /opt/nginx/html;                        # 修改为自己存放的 WEB 文件路径
            index index.html index.htm;
        }
    }
}

xray服务端

"sockopt": {} 这是自己添加的, 不过删除了也是无法用XHTTP

{
  "log": {
    "loglevel": "debug",
    "error": "/var/log/xray/error.log",
    "access": "/var/log/xray/access.log"
  },
  "inbounds": [
    {
      "listen": "/dev/shm/uds5443.sock,0666",
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "edfd12f5-acc9-49dc-9d67-efec7a2f8ff4",
            "flow": "xtls-rprx-vision",
            "email": "5443@gmail.com"
          }
        ],
        "decryption": "none",
        "fallbacks": [
          {
            "dest": "/dev/shm/uds2023.sock"
          }
        ]
      },
      "streamSettings": {
        "network": "raw",
        "security": "reality",
        "realitySettings": {
          "target": "/dev/shm/uds8443.sock",
          "xver": 1,
          "serverNames": [
            "h3.xx.yy"
          ],
          "privateKey": "cMSsBFTdSkPNS6xmhSWgyITLK7FsWpfvTFv3CDV8j2w",
          "shortIds": [
            "c22196259f2c2712"
          ]
        },
        "rawSettings": {
          "acceptProxyProtocol": true
        }
      },
      "tag": "VISION+REALITY",
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ]
      }
    },

    {
      "listen": "/dev/shm/uds6443.sock,0666",
      "protocol": "trojan",
      "settings": {
        "clients": [
          {
            "password":"diy6443",
            "email": "6443@gmail.com"
          }
        ],
        "fallbacks": [
          {
            "alpn": "h2",
            "dest": "/dev/shm/uds8443.sock",
            "xver": 1
          }
        ]
      },
      "streamSettings": {
        "network": "raw",
        "security": "tls",
        "tlsSettings": {
          "certificates": [
            {
              "ocspStapling": 3600,
              "certificateFile": "/home/xxx/.acme.sh/xxx/fullchain.cer",
              "keyFile": "/home/xxx/.acme.sh/xxx/.app.key"
            }
          ],
          "minVersion": "1.2",
          "cipherSuites": "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305"
        },
        "rawSettings": {
          "acceptProxyProtocol": true
        }
      },
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ]
      }
    },

    {
      "listen": "/dev/shm/uds2023.sock,0666",
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "edfd12f5-acc9-49dc-9d67-efec7a2f8ff4",
            "email": "2023@gmail.com"
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "xhttp",
        "xhttpSettings": {
          "host": "",
          "path": "/VLSpdG9k",
          "mode": "auto"
        }
      },
      "sockopt": {
        "tcpFastOpen": true,
        "acceptProxyProtocol": false,
        "tcpcongestion": "bbr",
        "tcpMptcp": true,
        "tcpNoDelay": true
      },
      "tag": "XHTTP_IN",
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ]
      }
    }
  ],
  "routing": {
    "rules": [
      {
        "type": "field",
        "protocol": [
          "bittorrent"
        ],
        "outboundTag": "block"
      }
    ]
  },
  "outbounds": [
    {
      "protocol": "freedom",
      "settings": {}
    },
    {
      "tag": "block",
      "protocol": "blackhole",
      "settings": {}
    }
  ]
}

0 replies

lxhao61 · 2025-02-12T16:39:57Z

lxhao61
Feb 12, 2025
Maintainer

不好意思，原示例 Nginx 中的 uds8443.sock 错写成了 uds8443，现己修复。
另域名 h3.xx.yy（直连）与域名 zh.xx.yy（CDN 流量中转）使用的是同一个通配符证书（或 SAN 证书）？

2 replies

1trapbox Feb 12, 2025
Author

是的大佬，通配符证书。

1trapbox Feb 14, 2025
Author

不好意思，原示例 Nginx 中的 uds8443.sock 错写成了 uds8443，现己修复。另域名 h3.xx.yy（直连）与域名 zh.xx.yy（CDN 流量中转）使用的是同一个通配符证书（或 SAN 证书）？

感谢大佬的付出，之前演示的设置我自己后面也添加了.sock，忘记提醒大佬一下。
刚才测试了一下，一切ok，非常感谢。
对了，顺便提醒一下，有的时候得相信玄学，哈哈，找不到任何问题的时候真应该reboot试试。
这个配置，客户端使用XHTTP的时候记得关闭flow

lxhao61 · 2025-02-12T16:44:15Z

lxhao61
Feb 12, 2025
Maintainer

使用通配符证书、合并后的正确配置如下：
1、Nginx

stream {
    map $ssl_preread_server_name $tcpsni_name {
        h3.xx.yy            vless;
        zt.xx.yy           trojan;
        zh.xx.yy            http3;
    }
    upstream vless {
        server unix:/dev/shm/uds5443.sock;
    }
    upstream trojan {
        server unix:/dev/shm/uds6443.sock;
    }
    upstream http3 {
        server unix:/dev/shm/uds8443.sock;
    }
    server {
        listen 443;
        #listen [::]:443;
        ssl_preread on;
        proxy_protocol on;
        proxy_pass $tcpsni_name;
    }
}

http {
    # 其他配置和日志这里省略掉

    server {
        listen 80;
        #listen [::]:80;
        return 301 https://$host$request_uri;
    }

    server {
        listen 443 quic reuseport;
        #listen [::]:443 quic reuseport;
        listen unix:/dev/shm/uds88.sock proxy_protocol;
        listen unix:/dev/shm/uds8443.sock ssl proxy_protocol;
        http2 on;
        set_real_ip_from unix:;
        real_ip_header proxy_protocol;

        include SSL_CA.conf;

        location /VLSpdG9k {
            grpc_pass grpc://unix:/dev/shm/uds2023.sock;
            grpc_set_header Host $host;
            grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }

        location / {
            add_header Alt-Svc 'h3=":443"; ma=86400';
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
            root /opt/nginx/html;
            index index.html index.htm;
        }
    }
}

2、Xray 服务端

{
  "log": {
    "loglevel": "debug",
    "error": "/var/log/xray/error.log",
    "access": "/var/log/xray/access.log"
  },
  "inbounds": [
    {
      "listen": "/dev/shm/uds5443.sock,0666",
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "edfd12f5-acc9-49dc-9d67-efec7a2f8ff4",
            "flow": "xtls-rprx-vision",
            "email": "5443@gmail.com"
          }
        ],
        "decryption": "none",
        "fallbacks": [
          {
            "dest": "/dev/shm/uds2023.sock"
          }
        ]
      },
      "streamSettings": {
        "network": "raw",
        "security": "reality",
        "realitySettings": {
          "target": "/dev/shm/uds8443.sock",
          "xver": 1,
          "serverNames": [
            "h3.xx.yy"
          ],
          "privateKey": "cMSsBFTdSkPNS6xmhSWgyITLK7FsWpfvTFv3CDV8j2w",
          "shortIds": [
            "c22196259f2c2712"
          ]
        },
        "rawSettings": {
          "acceptProxyProtocol": true
        }
      },
      "tag": "VISION+REALITY",
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ]
      }
    },
    {
      "listen": "/dev/shm/uds6443.sock,0666",
      "protocol": "trojan",
      "settings": {
        "clients": [
          {
            "password":"diy6443",
            "email": "6443@gmail.com"
          }
        ],
        "fallbacks": [
          {
            "dest": "/dev/shm/uds88.sock",
            "xver": 1
          }
        ]
      },
      "streamSettings": {
        "network": "raw",
        "security": "tls",
        "tlsSettings": {
          "certificates": [
            {
              "ocspStapling": 3600,
              "certificateFile": "/home/xxx/.acme.sh/xxx/fullchain.cer",
              "keyFile": "/home/xxx/.acme.sh/xxx/.app.key"
            }
          ],
          "minVersion": "1.2",
          "maxVersion": "1.2",
          "cipherSuites": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
        },
        "rawSettings": {
          "acceptProxyProtocol": true
        }
      },
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ]
      }
    },
    {
      "listen": "/dev/shm/uds2023.sock,0666",
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "edfd12f5-acc9-49dc-9d67-efec7a2f8ff4",
            "email": "2023@gmail.com"
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "xhttp",
        "xhttpSettings": {
          "path": "/VLSpdG9k"
        }
      },
      "tag": "XHTTP_IN",
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ]
      }
    }
  ],
  "routing": {
    "rules": [
      {
        "type": "field",
        "protocol": [
          "bittorrent"
        ],
        "outboundTag": "block"
      }
    ]
  },
  "outbounds": [
    {
      "protocol": "freedom",
      "settings": {}
    },
    {
      "tag": "block",
      "protocol": "blackhole",
      "settings": {}
    }
  ]
}

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Xray(M+F+H+K+G+B+A)+Nginx | 2025/2/08的最新更新, 发现无法使用XHTTP #237

{{title}}

Replies: 3 comments 2 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

Xray(M+F+H+K+G+B+A)+Nginx | 2025/2/08的最新更新, 发现无法使用XHTTP #237

1trapbox Feb 10, 2025

这是xray的报错日志(debug)

PS: nginx倒是没看到错误日志

Replies: 3 comments · 2 replies

1trapbox Feb 12, 2025 Author

配置如下

nginx

xray服务端

lxhao61 Feb 12, 2025 Maintainer

1trapbox Feb 12, 2025 Author

1trapbox Feb 14, 2025 Author

lxhao61 Feb 12, 2025 Maintainer

1trapbox
Feb 10, 2025

Replies: 3 comments 2 replies

1trapbox
Feb 12, 2025
Author

lxhao61
Feb 12, 2025
Maintainer

1trapbox Feb 12, 2025
Author

1trapbox Feb 14, 2025
Author

lxhao61
Feb 12, 2025
Maintainer