Xray Examples

https://github.com/xtls/xray-examples
Admin
Xray Examples provides practical examples and use cases for Xray-core, a versatile proxy platform.
Tokens:10,635
Snippets:72
Trust Score:8.8
Update:3 weeks ago
Show doc for...
Tokens:
Raw
### Client JSON for Shadowsocks 2022 multi-user

Source: https://github.com/xtls/xray-examples/blob/main/Shadowsocks-2022/README.ENG.md

Client configuration for multi-user setups. The password combines the server pre-shared key and the user key with a colon separator.

```json
{
   "inbounds": [
     {
       "port": 10801,
       "protocol": "socks",
       "settings": {
         "udp": true
       }
     },
     {
       "port": 10802,
       "protocol": "http"
     }
   ],
   "outbounds": [
     {
       "protocol": "shadowsocks",
       "settings": {
         "servers": [
           {
             "address": "{{ host }}",
             "port": 1234,
             "method": "2022-blake3-aes-128-gcm",
             "password": "{{ server psk }}:{{ user psk }}"
           }
         ]
       }
     }
   ]
}
```

--------------------------------

### Client JSON for Shadowsocks 2022 transit

Source: https://github.com/xtls/xray-examples/blob/main/Shadowsocks-2022/README.ENG.md

Client configuration for transit setups. The password combines the relay pre-shared key and the user key with a colon separator.

```json
{
   "inbounds": [
     {
       "port": 10801,
       "protocol": "socks",
       "settings": {
         "udp": true
       }
     },
     {
       "port": 10802,
       "protocol": "http"
     }
   ],
   "outbounds": [
     {
       "protocol": "shadowsocks",
       "settings": {
         "servers": [
           {
             "address": "{{ host }}",
             "port": 1234,
             "method": "2022-blake3-aes-128-gcm",
             "password": "{{ relay psk }}:{{ user psk }}"
           }
         ]
       }
     }
   ]
}
```

--------------------------------

### Replace SSL certificate paths in server.json

Source: https://github.com/xtls/xray-examples/blob/main/All-in-One-fallbacks-Nginx/README.md

Replace placeholder SSL certificate and key paths in Xray server.json with your actual paths. Use for the main domain and the domain behind CDN. Adjust the paths to match your fullchain and key files.

```bash
sed -i 's/\/etc\/ssl\/example.com\/domain.pem/PATH_TO_YOUR_FULLCHAIN/g' *
```

```bash
sed -i 's/\/etc\/ssl\/example.com\/domain-key.pem/PATH_TO_THE_FULLCHAINS_CERT/g' *
```

```bash
sed -i 's/\/etc\/ssl\/behindcdn.com\/domain.pem/PATH_TO_YOUR_FULLCHAIN/g' *
```

```bash
sed -i 's/\/etc\/ssl\/behindcdn.com\/domain-key.pem/PATH_TO_THE_FULLCHAINS_CERT/g' *
```

--------------------------------

### Client JSON for Shadowsocks 2022

Source: https://github.com/xtls/xray-examples/blob/main/Shadowsocks-2022/README.ENG.md

Client configuration with SOCKS and HTTP inbound proxies, and a Shadowsocks 2022 outbound to a single server using a pre-shared key.

```json
{
   "inbounds": [
     {
       "port": 10801,
       "protocol": "socks",
       "settings": {
         "udp": true
       }
     },
     {
       "port": 10802,
       "protocol": "http"
     }
   ],
   "outbounds": [
     {
       "protocol": "shadowsocks",
       "settings": {
         "servers": [
           {
             "address": "{{ host }}",
             "port": 1234,
             "method": "2022-blake3-aes-128-gcm",
             "password": "{{ psk }}"
           }
         ]
       }
     }
   ]
}
```

--------------------------------

### Replace Trojan and ShadowSocks password

Source: https://github.com/xtls/xray-examples/blob/main/All-in-One-fallbacks-Nginx/README.md

Replace the placeholder password for Trojan and ShadowSocks configs with your own password.

```bash
sed -i 's/desdemona99/YOUR_PASSWORD/g' *
```

--------------------------------

### VLESS-XTLS-uTLS-REALITY server and client configuration

Source: https://github.com/xtls/xray-examples/blob/main/VLESS-TCP-XTLS-Vision-REALITY/REALITY.ENG.md

Server and client configurations for VLESS-XTLS-uTLS-REALITY. The server block defines the inbound with required fields like dest, serverNames, privateKey, and shortIds; the client block defines the outbound with required fields like fingerprint, serverName, publicKey, shortId, and spiderX. Both must match on id, flow, and shortId.

```json5
{
    "inbounds": [ // Server-side inbound configuration
        {
            "listen": "0.0.0.0",
            "port": 443,
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "id": "", // Required, generated with ./xray uuid or a 1-30 character string
                        "flow": "xtls-rprx-vision" // Optional, if specified, clients must enable XTLS
                    }
                ],
                "decryption": "none"
            },
            "streamSettings": {
                "network": "tcp",
                "security": "reality",
                "realitySettings": {
                    "show": false, // Optional, if true, outputs debug information
                    "dest": "example.com:443", // Required, format similar to VLESS fallbacks' dest
                    "xver": 0, // Optional, format similar to VLESS fallbacks' xver
                    "serverNames": [ // Required, list of serverNames available to clients, * wildcard is not supported yet
                        "example.com",
                        "www.example.com"
                    ],
                    "privateKey": "", // Required, generated with ./xray x25519
                    "minClientVer": "", // Optional, minimum client Xray version, format x.y.z
                    "maxClientVer": "", // Optional, maximum client Xray version, format x.y.z
                    "maxTimeDiff": 0, // Optional, maximum allowed time difference in milliseconds
                    "shortIds": [ // Required, list of shortIds available to clients, can be used to distinguish different clients
                        "", // If this item exists, client shortId can be empty
                        "0123456789abcdef" // 0 to f, length is a multiple of 2, maximum length is 16
                    ]
                }
            }
        }
    ]
}
```

```json5
{
    "outbounds": [ // Client-side outbound configuration
        {
            "protocol": "vless",
            "settings": {
                "address": "", // Server's domain or IP
                "port": 443,
                "id": "", // Matching the server-side
                "flow": "xtls-rprx-vision", // Matching the server-side
                "encryption": "none"
            },
            "streamSettings": {
                "network": "tcp",
                "security": "reality",
                "realitySettings": {
                    "show": false, // Optional, outputs debug information if true
                    "fingerprint": "chrome", // Required, simulates the client TLS fingerprint using the uTLS library
                    "serverName": "", // One of the server's serverNames
                    "publicKey": "", // The public key corresponding to the server's private key
                    "shortId": "", // One of the server's shortIds
                    "spiderX": "" // Initial path and parameters for web crawlers, recommended to be different for each client
                }
            }
        }
    ]
}
```

--------------------------------

### Nginx server block for VLESS-gRPC with TLS termination

Source: https://github.com/xtls/xray-examples/blob/main/VLESS-GRPC/README.ENG.md

Nginx configuration for terminating TLS and proxying gRPC to the Xray server via a Unix socket. Requires the service name to be appended to the location path and the gRPC content type check to return 404 for non-gRPC requests.

```conf
server {
listen 443 ssl http2 so_keepalive=on;
listen [::]:443 ssl http2 so_keepalive=on;
server_name example.com;

index index.html;
root /var/www/html;

ssl_certificate /path/to/example.cer;
ssl_certificate_key /path/to/example.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE -RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

client_header_timeout 52w;
         keepalive_timeout 52w;
# Fill in /your ServiceName after location
location /your ServiceName {
if ($content_type !~ "application/grpc") {
return 404;
}
client_max_body_size 0;
client_body_buffer_size 512k;
grpc_set_header X-Real-IP $remote_addr;
client_body_timeout 52w;
grpc_read_timeout 52w;
grpc_pass unix:/dev/shm/Xray-VLESS-gRPC.socket;
}
}
```

--------------------------------

### Replace Vless and VMESS UUID

Source: https://github.com/xtls/xray-examples/blob/main/All-in-One-fallbacks-Nginx/README.md

Replace the placeholder UUID for Vless and VMESS configs with your own UUID.

```bash
sed -i 's/90e4903e-66a4-45f7-abda-fd5d5ed7f797/YOUR_UUID/g' *
```

--------------------------------

### Replace domain names in configs

Source: https://github.com/xtls/xray-examples/blob/main/All-in-One-fallbacks-Nginx/README.md

Replace placeholder domain names in both server and client configs. If you don't have a CDN domain, remove the CDN config from server.json and leave YOUR_CDN_DOMAIN blank in Nginx.

```bash
sed -i 's/example.com/YOUR_DOMAIN/g' *
```

```bash
sed -i 's/behindcdn.com/YOUR_CDN_DOMAIN/g' *
```

--------------------------------

### Client JSON for Shadowsocks 2022 UDP over TCP

Source: https://github.com/xtls/xray-examples/blob/main/Shadowsocks-2022/README.ENG.md

Client configuration with UDP over TCP enabled via the "uot": true option on the Shadowsocks server entry.

```json
{
   "inbounds": [
     {
       "port": 10801,
       "protocol": "socks",
       "settings": {
         "udp": true
       }
     },
     {
       "port": 10802,
       "protocol": "http"
     }
   ],
   "outbounds": [
     {
       "protocol": "shadowsocks",
       "settings": {
         "servers": [
           {
             "address": "{{ host }}",
             "port": 1234,
             "method": "2022-blake3-aes-128-gcm",
             "password": "{{ psk }}",
             "uot": true
           }
         ]
       }
     }
   ]
}
```

--------------------------------

### Client-side JSON configuration for Shadowsocks AEAD

Source: https://github.com/xtls/xray-examples/blob/main/Shadowsocks-AEAD/README.ENG.md

Client-side configuration for Shadowsocks AEAD. It sets up a SOCKS inbound on port 10801 with UDP enabled and an HTTP inbound on port 10802. The outbound connects to the server at port 12345 using the password and method of the first client.

```json
{
     "inbounds": [
         {
             "port": 10801,
             "protocol": "socks",
             "settings": {
                 "udp": true
             }
         },
         {
             "port": 10802,
             "protocol": "http"
         }
     ],
     "outbounds": [
         {
             "protocol": "shadowsocks",
             "settings": {
                 "servers": [
                     {
                         "address": "",
                         "port": 12345,
                         "password": "example_user_1",
                         "method": "aes-128-gcm"
                     }
                 ]
             }
         }
     ]
}
```

--------------------------------

### Server-side JSON for Shadowsocks 2022 multi-user

Source: https://github.com/xtls/xray-examples/blob/main/Shadowsocks-2022/README.ENG.md

Server-side configuration for multiple users. Each client has its own password and an email identifier, while the server uses a separate pre-shared key.

```json
{
   "inbounds": [
     {
       "port": 1234,
       "protocol": "shadowsocks",
       "settings": {
         "method": "2022-blake3-aes-128-gcm",
         "password": "{{ server psk }}",
         "clients": [
           {
             "password": "{{ user psk }}",
             "email": "my user"
           }
         ],
         "network": "tcp,udp"
       }
     }
   ],
   "outbounds": [
     {
       "protocol": "freedom"
     }
   ]
}
```

--------------------------------

### Server-side JSON for Shadowsocks 2022

Source: https://github.com/xtls/xray-examples/blob/main/Shadowsocks-2022/README.ENG.md

Server-side configuration for a single-user Shadowsocks 2022 inbound. Uses the 2022-blake3-aes-128-gcm method with a pre-shared key placeholder and enables both TCP and UDP.

```json
{
   "inbounds": [
     {
       "port": 1234,
       "protocol": "shadowsocks",
       "settings": {
         "method": "2022-blake3-aes-128-gcm",
         "password": "{{ psk }}",
         "network": "tcp,udp"
       }
     }
   ],
   "outbounds": [
     {
       "protocol": "freedom"
     }
   ]
}
```

--------------------------------

### Server-side JSON configuration for Shadowsocks AEAD

Source: https://github.com/xtls/xray-examples/blob/main/Shadowsocks-AEAD/README.ENG.md

Server-side configuration for Shadowsocks AEAD. It defines a single inbound on port 12345 with three clients, each using a different encryption method (aes-128-gcm, aes-256-gcm, chacha20-poly1305). The network is set to "tcp,udp" and the outbound is freedom.

```json
{
     "inbounds": [
         {
             "port": 12345,
             "protocol": "shadowsocks",
             "settings": {
                 "clients": [
                     {
                         "password": "example_user_1",
                         "method": "aes-128-gcm"
                     },
                     {
                         "password": "example_user_2",
                         "method": "aes-256-gcm"
                     },
                     {
                         "password": "example_user_3",
                         "method": "chacha20-poly1305"
                     }
                 ],
                 "network": "tcp,udp"
             }
         }
     ],
     "outbounds": [
         {
             "protocol": "freedom"
         }
     ]
}
```

--------------------------------

### Nginx server block for Trojan-gRPC

Source: https://github.com/xtls/xray-examples/blob/main/Trojan-gRPC-Caddy2／Nginx/README.ENG.md

Nginx configuration to reverse proxy gRPC traffic to a Unix socket. It listens on 443 with SSL, requires the client to send application/grpc content type, and passes requests to unix:/dev/shm/Xray-Trojan-gRPC.socket. The location path must be replaced with your ServiceName.

```conf
server {
listen 443 ssl http2;
         listen [::]:443 ssl http2;
server_name example.com;

index index.html;
root /var/www/html;

ssl_certificate /path/to/example.cer;
ssl_certificate_key /path/to/example.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE -RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

client_header_timeout 1w;
keepalive_timeout 30m;
# Fill in /your ServiceName after location
location /your ServiceName {
if ($content_type !~ "application/grpc") {
return 404;
}
client_max_body_size 0;
client_body_buffer_size 512k;
grpc_set_header X-Real-IP $remote_addr;
client_body_timeout 1w;
grpc_read_timeout 1w;
grpc_send_timeout 1w;
grpc_pass unix:/dev/shm/Xray-Trojan-gRPC.socket;
}
}
```

--------------------------------

### Routing split: uncomment geoip:private route

Source: https://github.com/xtls/xray-examples/blob/main/ReverseProxy/VLESS-TCP-XTLS-WS/README.ENG.md

In the Portal configuration, uncomment the first route to enable routing split. When traffic matches the 'external' or 'externalws' label and the target IP is a private IP address, it will be forwarded to the bridge; other traffic goes direct.

```json
// "ip": [
// "geoip:private"
// ],
```

--------------------------------

### Server-side JSON for Shadowsocks 2022 transit

Source: https://github.com/xtls/xray-examples/blob/main/Shadowsocks-2022/README.ENG.md

Server-side configuration for a transit (relay) node. The client entry specifies the upstream server address and port, using a relay pre-shared key and a server/user key.

```json
{
   "inbounds": [
     {
       "port": 1234,
       "protocol": "shadowsocks",
       "settings": {
         "method": "2022-blake3-aes-128-gcm",
         "password": "{{ relay psk }}",
         "clients": [
           {
             "address": "server",
             "port": 1234,
             "password": "{{ server/user psk }}",
             "email": "my server"
           }
         ],
         "network": "tcp,udp"
       }
     }
   ],
   "outbounds": [
     {
       "protocol": "freedom"
     }
   ]
}
```
Tokens:
Raw