Youtube视频

一键安装脚本

安装指定版本

bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install --version 1.8.6

安装最新稳定版

# 通过root用户安装，会覆盖已有安装文件
bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install -u root

卸载

bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ remove --purge

服务端配置文件（带注释）

{
    // 日志模块
    "log": {
        "loglevel": "info",
        "access": "/var/log/xray/access.log",
        "error": "/var/log/xray/error.log"
    },
    // api模块
    "api": {
        "tag": "api",
        // HandlerService 用于出入站代理的新增和删除。添加入站代理用户的新增和删除
        // LoggerService 支持对内置logger的重启，可以配置logrotate进行日志文件的操作
        // StatsService 数据统计服务，可以获取用户的流量数据以及全局的流量数据
        "services": [
            "HandlerService",
            "LoggerService",
            "StatsService"
        ]
    },
    // 流量统计模块,开启后只需要在policy中启动对应的统计项,用户需要设置email
    "stats": {},
    // 本地策略模块
    "policy": {
        // 开启用户级别为0的用户的流量上下行统计
        "levels": {
            "0": {
                "statsUserUplink": true,
                "statsUserDownlink": true
            }
        },
        // 开启xray进入站代理的上下行流量统计
        "system": {
            "statsInboundUplink": true,
            "statsInboundDownlink": true,
            "statsOutboundUplink": true,
            "statsOutboundDownlink": true
        }
    },
    // dns模块
    "dns": {
        "servers": [
            // 自定义dns服务器，可以解锁流媒体，不需要请删除
            {
                "address": "1.2.3.4",
                "port": 5353,
                // 包含的域名优先使用该dns服务器查询
                "domains": [
                    "domain:netflix.com"
                ]
            },
            "https+local://cloudflare-dns.com/dns-query",
            "1.1.1.1",
            "1.0.0.1",
            "8.8.8.8",
            "8.8.4.4",
            "localhost"
        ]
    },
    // 入站模块
    "inbounds": [
        // 定义名称为“api”的入站代理
        {
            "listen": "127.0.0.1",
            "port": 10086,
            "protocol": "dokodemo-door",
            "settings": {
                "address": "127.0.0.1"
            },
            "tag": "api",
            "sniffing": null
        },
        // 定义vless入站分流代理
        {
            "tag": "vless-tcp-xtls",
            "listen": "0.0.0.0",
            // 监听443端口，TLS的入口点
            "port": 443,
            // 协议使用vless才会做后续的回落处理
            "protocol": "vless",
            "settings": {
                // 用户配置
                "clients": [
                    {
                        "id": "123456",
                        "email": "123456@qq.com",
                        // 指定分流模式,后面“,none”代表兼容普通的tls代理，不需要可删掉
                        "flow": "xtls-rprx-vision",
                        "level": 0
                    }
                ],
                // 填none ，不能留空
                "decryption": "none",
                // 回落分流配置,目前 XTLS 仅支持 TCP、mKCP、DomainSocket 这三种传输方式
                "fallbacks": [
                    // 回落到web服务的http/1.1伪装服务
                    {
                        "dest": "172.17.0.2:80",
                        "alpn": "http/1.1",
                        "xver": 1
                    },
                    // 回落到web服务的http2伪装服务
                    {
                        "dest": "172.17.0.2:81",
                        "alpn": "h2",
                        "xver": 1
                    }
                ]
            },
            // 底层传输方式设置
            "streamSettings": {
                "network": "tcp",
                // XTLS Vision 分流模式, 必须是 "tls"
                "security": "tls",
                "tlsSettings": {
                    "certificates": [
                        {
                            // ocspStapling更新间隔，支持证书热更新，提升https性能
                            "ocspStapling": 3600,
                            // 换成自己的证书，绝对路径
                            "certificateFile": "/data/cert/latata.me/latata.me.cer",
                            "keyFile": "/data/cert/latata.me/latata.me.key"
                        }
                    ],
                    // 可接受最低的的SSL/TLS版本
                    "minVersion": "1.2",
                    // 支持的密码套件
                    "cipherSuites": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
                    // 如果fallback有h2回落，需要在这添加h2。以下是默认值
                    "alpn": [
                        "http/1.1",
                        "h2"
                    ]
                }
            },
            // 启用流量探测
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls"
                ]
            }
        }
    ],
    // 出站模块
    "outbounds": [
        // 定义自由出站
        {
            "protocol": "freedom",
            "tag": "direct"
        },
        // 定义黑洞出站，禁止访问
        {
            "protocol": "blackhole",
            "tag": "blocked"
        }
    ],
    // 路由模块
    "routing": {
        // 域名解析策略，默认是AsIs，也就是只使用域名进行路由选择
        // IPIfNonMatch 表示域名没有匹配的时候，解析域名为IP再次匹配（一般我会使用该域名解析策略）
        // IPOnDemand 如果匹配到基于IP的规则，将域名解析为IP进行匹配，最精确，但是很慢
        "domainStrategy": "IPIfNonMatch",
        // 路由规则，从上到下判断。当没有匹配任何规则，流量默认从第一个outbound发出
        "rules": [
            // 这个是流量进站出站都经过api服务，用来统计流量
            {
                "inboundTag": [
                    "api"
                ],
                "outboundTag": "api",
                "type": "field"
            },
            // 自定义域名路由到"blocked"，用于禁止某些网站的访问
            {
                "domain": [
                    "domain:iqiyi.com",
                    "domain:video.qq.com",
                    "domain:youku.com"
                ],
                "type": "field",
                "outboundTag": "blocked"
            },
            // 匹配到私有ip以及中国ip则路由到名称为"blocked"的outbound
            {
                "type": "field",
                "ip": [
                    "geoip:cn",
                    "geoip:private"
                ],
                "outboundTag": "blocked"
            },
            // 将bt协议的流量路由到"blocked" outbound
            {
                "protocol": [
                    "bittorrent"
                ],
                "type": "field",
                "outboundTag": "blocked"
            }
        ]
    }
}

服务端配置文件

{
    "log": {
        "loglevel": "info",
        "access": "/var/log/xray/access.log",
        "error": "/var/log/xray/error.log"
    },
    "api": {
        "tag": "api",
        "services": [
            "HandlerService",
            "LoggerService",
            "StatsService"
        ]
    },
    "stats": {},
    "policy": {
        "levels": {
            "0": {
                "statsUserUplink": true,
                "statsUserDownlink": true
            }
        },
        "system": {
            "statsInboundUplink": true,
            "statsInboundDownlink": true,
            "statsOutboundUplink": true,
            "statsOutboundDownlink": true
        }
    },
    "dns": {
        "servers": [
            "https+local://cloudflare-dns.com/dns-query",
            "1.1.1.1",
            "1.0.0.1",
            "8.8.8.8",
            "8.8.4.4",
            "localhost"
        ]
    },
    "inbounds": [
        {
            "listen": "127.0.0.1",
            "port": 10086,
            "protocol": "dokodemo-door",
            "settings": {
                "address": "127.0.0.1"
            },
            "tag": "api",
            "sniffing": null
        },
        {
            "tag": "vless-tcp-xtls",
            "listen": "0.0.0.0",
            "port": 443,
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "id": "填自己的UUID",
                        "email": "填自己的邮箱",
                        "flow": "xtls-rprx-vision",
                        "level": 0
                    }
                ],
                "decryption": "none",
                "fallbacks": [
                    {
                        "dest": "填自己回落到http的web服务地址",
                        "alpn": "http/1.1",
                        "xver": 1
                    },
                    {
                        "dest": "填自己回落到http2的web服务地址",
                        "alpn": "h2",
                        "xver": 1
                    }
                ]
            },
            "streamSettings": {
                "network": "tcp",
                "security": "tls",
                "tlsSettings": {
                    "certificates": [
                        {
                            "ocspStapling": 3600,
                            "certificateFile": "填自己的证书文件绝对路径",
                            "keyFile": "填自己的密钥文件的绝对路径"
                        }
                    ],
                    "minVersion": "1.2",
                    "cipherSuites": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
                }
            },
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls"
                ]
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "freedom",
            "tag": "direct"
        },
        {
            "protocol": "blackhole",
            "tag": "blocked"
        }
    ],
    "routing": {
        "domainStrategy": "IPIfNonMatch",
        "rules": [
            {
                "inboundTag": [
                    "api"
                ],
                "outboundTag": "api",
                "type": "field"
            },
            {
                "domain": [
                    "domain:iqiyi.com",
                    "domain:video.qq.com",
                    "domain:youku.com"
                ],
                "type": "field",
                "outboundTag": "blocked"
            },
            {
                "type": "field",
                "ip": [
                    "geoip:cn",
                    "geoip:private"
                ],
                "outboundTag": "blocked"
            },
            {
                "protocol": [
                    "bittorrent"
                ],
                "type": "field",
                "outboundTag": "blocked"
            }
        ]
    }
}

nginx伪装配置

# 只是简单的案例，实现http和http2的回落。根据自己实际情况修改
server {
    listen      80 proxy_protocol;
    listen      81 http2 proxy_protocol;
    server_name xtls.latata.me;
    set_real_ip_from 172.17.0.0/16;
    real_ip_header proxy_protocol;
    location / {
        proxy_pass https://github.com;
        proxy_ssl_server_name on;
    }
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }
}

客户端配置

{
    "log": {
        "loglevel": "info"
    },
    "routing": {
        "domainStrategy": "IPIfNonMatch",
        "rules": [
            {
                "type": "field",
                "domain": [
                    "domain:my-proxy.com"
                ],
                "outboundTag": "proxy"
            },
            {
                "type": "field",
                "domain": [ 
                    "domain:my-direct.com"
                ],
                "outboundTag": "direct"
            },
            {
                "type": "field",
                "domain": [
                    "geosite:cn",
                    "geosite:private"
                ],
                "outboundTag": "direct"
            },
            {
                "type": "field",
                "ip": [
                    "geoip:cn",
                    "geoip:private"
                ],
                "outboundTag": "direct"
            }
        ]
    },
    "inbounds": [
        {
            "listen": "127.0.0.1",
            "port": 1080,
            "protocol": "http",
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls"
                ]
            }
        },
        {
            "listen": "127.0.0.1",
            "port": 1081,
            "protocol": "socks",
            "settings": {
                "udp": true
            },
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls"
                ]
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "vless",
            "settings": {
                "vnext": [
                    {
                        "address": "填自己的域名",
                        "port": 443,
                        "users": [
                            {
                                "id": "填自己的uuid",
                                "encryption": "none",
                                "flow": "xtls-rprx-vision"
                            }
                        ]
                    }
                ]
            },
            "streamSettings": {
                "network": "tcp",
                "security": "tls",
                "tlsSettings": {
                    "allowInsecure": false,
                    "fingerprint": "random"
                }
            },
            "tag": "proxy"
        },
        {
            "protocol": "freedom",
            "tag": "direct"
        }
    ]
}

流量统计API使用

# 获取用户的下行流量
xray api stats --server=127.0.0.1:10086 --name "user>>>123456@qq.com>>>traffic>>>downlink"
# 获取用户的上行流量
xray api stats --server=127.0.0.1:10086 --name "user>>>123456@qq.com>>>traffic>>>uplink"

# 查看并重置
xray api stats --server=127.0.0.1:10086 --name "user>>>123456@qq.com>>>traffic>>>uplink" --reset


# 获取指定inbound|outbound流量
xray api stats --server=127.0.0.1:10086 --name "inbound>>>vless-tcp-xtls>>>traffic>>>uplink"
xray api stats --server=127.0.0.1:10086 --name "inbound>>>vless-tcp-xtls>>>traffic>>>downlink"

相关链接

一键安装脚本
Xray-Core仓库
官方文档