There’re three parts(v2ray server, server and client) in this article.
Configuration
There’re three configurations when we try to use v2ray with tls.
V2ray Server Side
We need to add configurations in the inbounds part. The configurations is as follows:
1
2
3
4
5
6
| "streamSettings": {
"network": "ws", // Using websocket.
"wsSettings": {
"path": "/ray" // Url path
}
}
|
The example is as follows:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
| {
"inbounds": [
{
"port": 10000, //CHANGEME
"listen":"127.0.0.1",//只监听 127.0.0.1，避免除本机外的机器探测到开放了 10000 端口
"protocol": "vmess",
"settings": {
"clients": [
{
"id": "b831381d-6324-4d53-ad4f-8cd81121", //CHANGEME
"alterId": 64
}
]
},
//This is for tls
"streamSettings": {
"network": "ws",
"wsSettings": {
"path": "/path"
}
}
}
],
"outbounds": [
{
"protocol": "freedom",
"settings": {}
}
]
}
|
Server side
We need to expose a URI for v2ray client to access in the server side. The example is as follow:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
| server {
listen 443 ssl;
listen [::]:443 ssl;
ssl_certificate /etc/v2ray/v2ray.crt;
ssl_certificate_key /etc/v2ray/v2ray.key;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
server_name mydomain.me; # CHANGEME
location /ray { # 与 V2Ray 配置中的 path 保持一致
if ($http_upgrade != "websocket") { # WebSocket协商失败时返回404
return 404;
}
proxy_redirect off;
proxy_pass http://127.0.0.1:10000; # 假设WebSocket监听在环回地址的10000端口上 CHANGEME
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
# Show real IP in v2ray access.log
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
|
Client side
The change is in the outbounds . The example is as follow:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
| {
"inbounds": [
{
"port": 1080,
"listen": "127.0.0.1",
"protocol": "socks",
"sniffing": {
"enabled": true,
"destOverride": ["http", "tls"]
},
"settings": {
"auth": "noauth",
"udp": false
}
}
],
"outbounds": [
{
"protocol": "vmess",
"settings": {
"vnext": [
{
"address": "mydomain.me", //CHANGEME
"port": 443,
"users": [
{
"id": "b831381d-6324-4d53-ad4f-8cda48b30811", //CHANGEME
"alterId": 64
}
]
}
]
},
"streamSettings": {
"network": "ws",
"security": "tls",
"wsSettings": {
"path": "/path" //CHANGEME
}
}
}
]
}
|
Workflow
TBD(to lazy to do it)
This blog is under a CC BY-NC-SA 3.0 Unported License
Link to this article: https://younggod.netlify.app/2020/09/09/practice/V2ray+TLS/
