Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

老是被阻断，每个小时都有那么几分钟不能用。请求大佬给个排查的方向。 #2247

Closed
lhbdhr opened this issue Jun 23, 2023 · 9 comments
Closed

老是被阻断，每个小时都有那么几分钟不能用。请求大佬给个排查的方向。 #2247

lhbdhr opened this issue Jun 23, 2023 · 9 comments

Comments

@lhbdhr
Copy link

lhbdhr commented Jun 23, 2023 •
edited
Loading

客户端：V2rayN，最新测试版本6.27，没有任何特殊配置 xray内核1.8.3

服务端配置：
用的最新的协议，vless+utls+vision+reality.

{
  "log": {
    "loglevel": "error",
    "access": "/etc/xray/logs/access.log",
    "error": "/etc/xray/logs/error.log",
    "dnsLog": true
  },
  "inbounds": [
    {
      "listen": null,
      "port": 8443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "xxxxxxxxxxxxxxxxxxx",
            "email": "[email protected]",
            "flow": "xtls-rprx-vision"
          }
        ],
        "decryption": "none",
        "fallbacks": []
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "dest": "www.microsoft.com:443",
          "xver": 0,
          "serverNames": [
            "www.microsoft.com",
            "wwwqa.microsoft.com",
            "staticview.microsoft.com",
            "privacy.microsoft.com"
          ],
          "privateKey": "XXXXXXXXXXXXXXXXXXXXX",
          "publicKey": "XXXXXXXXXXXXXXXXXXXXX",
          "minClient": "",
          "maxClient": "",
          "maxTimediff": 0,
          "shortIds": ["", "56", "7923", "d031bd", "a1d1030d"]
        },
        "tcpSettings": {
          "header": {
            "type": "none"
          },
          "acceptProxyProtocol": false
        }
      },
      "tag": "inbound-443",
      "sniffing": {
        "enabled": true,
        "destOverride": ["http", "tls"]
      }
    }
  ],
  "outbounds": [
    { "protocol": "freedom", "tag": "freedom" },
    {
      "protocol": "freedom",
      "tag": "IP6_out",
      "settings": {
        "domainStrategy": "UseIPv6"
      }
    },
    {
      "protocol": "wireguard",
      "settings": {
        "secretKey": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=",
        "address": ["172.16.0.2/32", "XXXXXXXXXXXXXXXXXXXXXXX/128"],
        "peers": [
          {
            "publicKey": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
            "allowedIPs": ["0.0.0.0/0", "::/0"],
            "endpoint": "engage.cloudflareclient.com:2408"
          }
        ],
        "reserved": [0, 0, 0],
        "mtu": 1280
      },
      "tag": "wgcf"
    }
  ],
  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      {
        "type": "field",
        "outboundTag": "IP6_out",
        "domain": ["geosite:netflix"]
      },
      {
        "type": "field",
        "domain": ["geosite:cn", "domain:ip.gs", "domain:whatismyip.com", "domain:googleapis.cn"],
        "outboundTag": "wgcf"
      },
      {
        "type": "field",
        "domain": ["domain:ip6only.me", "domain:api6.ipify.org"],
        "outboundTag": "wgcf"
      },
      {
        "type": "field",
        "domain": ["domain:api4.ipify.org", "geosite:openai"],
        "outboundTag": "wgcf"
      },
      {
        "type": "field",
        "ip": ["geoip:cn"],
        "outboundTag": "wgcf"
      }
    ]
  }
}

客户端配置：

"outbounds": [
    {
      "tag": "proxy",
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "XXXXXXXXXXXXXXXXXXXXXXXXX",
            "port": 8443,
            "users": [
              {
                "id": "XXXXXXXXXXXXXXXXXXXXXXXXXXX",
                "alterId": 0,
                "email": "[email protected]",
                "security": "auto",
                "encryption": "none",
                "flow": "xtls-rprx-vision"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "serverName": "www.microsoft.com",
          "fingerprint": "chrome",
          "show": false,
          "publicKey": "XXXXXXXXXXXXXXXXXXXXXXXXX",
          "shortId": "",
          "spiderX": ""
        }
      },
      "mux": {
        "enabled": false,
        "concurrency": -1
      }
    },
    {
      "tag": "direct",
      "protocol": "freedom",
      "settings": {
        "domainStrategy": "AsIs",
        "userLevel": 0
      }
    },
    {
      "tag": "block",
      "protocol": "blackhole",
      "settings": {
        "response": {
          "type": "http"
        }
      }
    }
  ],
@lhbdhr
Copy link
Author

lhbdhr commented Jun 23, 2023

使用TCPing工具，测试稳定性

PS C:\Users\Admin\Downloads\Compressed\PSTools> .\psping.exe -n 1000s xxxxxxxxx.com:8443

PsPing v2.12 - PsPing - ping, latency, bandwidth measurement utility
Copyright (C) 2012-2023 Mark Russinovich
Sysinternals - www.sysinternals.com

TCP connect to x.x.x.x:8443:
1000 seconds (1 warmup pings) connecting test:
Connecting to x.x.x.x:8443 (warmup): from 0.0.0.0:13082:
由于超时时间已过，该操作返回。
Connecting to x.x.x.x:8443: from 0.0.0.0:13157:
由于超时时间已过，该操作返回。
Connecting to x.x.x.x:8443: from 0.0.0.0:13239:
由于超时时间已过，该操作返回。
Connecting to x.x.x.x:8443: from 0.0.0.0:13335:
由于超时时间已过，该操作返回。
Connecting to x.x.x.x:8443: from 0.0.0.0:13421:
由于超时时间已过，该操作返回。
Connecting to x.x.x.x:8443: from 0.0.0.0:13506:
由于超时时间已过，该操作返回。
Connecting to x.x.x.x:8443: from 192.168.1.3:13585: 1334.37ms
Connecting to x.x.x.x:8443: from 192.168.1.3:13603: 183.66ms
Connecting to x.x.x.x:8443: from 192.168.1.3:13622: 181.01ms
Connecting to x.x.x.x:8443: from 192.168.1.3:13630: 177.80ms
Connecting to x.x.x.x:8443: from 192.168.1.3:13644: 1334.72ms
Connecting to x.x.x.x:8443: from 192.168.1.3:13682: 336.81ms

ping 则没问题，ping了几百秒，0丢包。tcping不行，判断是阻断端口。

@lhbdhr
Copy link
Author

lhbdhr commented Jun 23, 2023

问题貌似解决了，更换reality的域名，不偷微软的，偷自己用Caddy搭建的网站，tcping测试不再丢包了。

@chika0801
Copy link
Contributor

如果你不是这种中断3分钟 net4people/bbs#257 (comment) ，就是换Dest网站或偷自己 就这2可能性

@lhbdhr
Copy link
Author

lhbdhr commented Jun 23, 2023

如果你不是这种中断3分钟 net4people/bbs#257 (comment) ，就是换Dest网站或偷自己 就这2可能性

我也是甲骨文，新加坡甲骨文，用个半小时左右就被阻断几分钟，偷自己后好像好了，我用个两天再关issue

@chika0801
Copy link
Contributor

大部分遇到选dest大厂网址，莫名时通时不通，都是甲骨文，你又是1个，不是第1也不会是最后1个

@RPRX
Copy link
Member

RPRX commented Jun 25, 2023 •
edited
Loading

根据长期收集的反馈，目前 REALITY 遇到问题的，不是 IP 太黑（如甲骨文），就是 dest 没选对（如微软、苹果并不适合所有人）

之前我看到你这个 issue，还写了个排查指南，但为了避免信息进一步碎片化，以后我不会单独放出大段内容，尽量出文章/QA汇总

@RPRX RPRX closed this as not planned Won't fix, can't repro, duplicate, stale Jun 25, 2023
@lhbdhr
Copy link
Author

lhbdhr commented Jun 27, 2023

@RPRX
非常感谢大佬的回复，甲骨文新加坡，换了dest之后好了。

非常需要集中的文档和QA！！！
非常需要集中的文档和QA！！！
非常需要集中的文档和QA！！！

比如dest和serverNames在实际的数据传送过程中，都起到了什么作用。

我搜了大量的issue，零碎的看到了你的一些解答。学到了很多东西，但还是很困惑。
比如知道了 tls1.3 加了 server hello的加密。这就是必须选1.3的原因。还有dest偷的不是证书，偷的是server hello等等。
reality的原理应该是 sni伪造+ 中间人欺骗吧？假装自己是dest的服务器。在握手阶段偷server hello。

这只是我的理解，我们小白真的很需要大佬讲讲原理，到底数据是怎么流动的。每个参数都起到了什么作用。这样我们才能知道每个参数最好怎么填写。

@chika0801
Copy link
Contributor

大佬太忙，等明年再来发。不发怕不知道代码的精妙之处 😊

或者小白（我）需要能看不懂，但是不能不看的心理了

@C-Harlin C-Harlin mentioned this issue Jul 21, 2023
Closed
@kingwilliam kingwilliam mentioned this issue Oct 28, 2023
Closed
@toyo2333
Copy link

根据长期收集的反馈，目前 REALITY 遇到问题的，不是 IP 太黑（如甲骨文），就是 dest 没选对（如微软、苹果并不适合所有人）

之前我看到你这个 issue，还写了个排查指南，但为了避免信息进一步碎片化，以后我不会单独放出大段内容，尽量出文章/QA汇总

如果你不是这种中断3分钟 net4people/bbs#257 (comment) ，就是换Dest网站或偷自己 就这2可能性

我也是甲骨文，新加坡甲骨文，用个半小时左右就被阻断几分钟，偷自己后好像好了，我用个两天再关issue

同样问题，同样的方法解决了。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@toyo2333 @lhbdhr @RPRX @chika0801