How I tested Xray REALITY

[computerscot]

Greetings. This is the procedure I used to successfully test Xray REALITY.

Beta builds of Xray-core

I used the build "THE NEXT FUTURE becomes THE REALITY NOW" from https://github.com/XTLS/Xray-core/actions/runs/4185805260.

Xray-linux-64.zip is at https://github.com/XTLS/Xray-core/suites/11000957785/artifacts/557837209

Unzip the .zip file, and set the execution bit on xray:

apt install unzip
unzip Xray-linux-64.zip
chmod +x xray

For the client I used Xray-windows-64.zip from https://github.com/XTLS/Xray-core/suites/11000957785/artifacts/557837230

Generate parameters

On the Linux server, generate a universally unique id with ./xray uuid. Example of output:

9f2b4b10-6818-492e-a157-d5131d450c7b

Plug the id into both the server and the client configuration files.

Generate a public-private key pair with ./xray x25519. Example of output:

Private key: M4cZLR81ErNfxnG1fAnNUIATs_UXqe6HR78wINhH7RA
Public key: ioE61VC3V30U7IdRmQ3bjhOq2ij9tPhVIgAD4JZ4YRY

Plug the private key into the server configuration file, and the public key into the client configuration file.

Choose a shortId of up to 16 hexadecimal characters. Example:

906f47df46efecc5

Plug this into the server and client configuration files.

Xray configuration on the server

From https://github.com/XTLS/REALITY#readme the possible properties of realitySettings on the server are as follows.

Property	Specification
show	Optional. If true, output debugging information.
dest	Required. The format is the same as the dest of VLESS fallbacks.
xver	Optional. The format is the same as xver of VLESS fallbacks.
serverNames	Required. The serverName list available to the client. Does not support * wildcards.
privateKey	Required. Execute ./xray x25519 to generate
minClientVer	Optional. The minimum version of client Xray. The format is x.y.z.
maxClientVer	Optional. The highest version of client Xray. The format is x.y.z.
maxTimeDiff	Optional. The maximum time difference allowed in milliseconds.
shortIds	Required. The shortId list available to the client, which can be used to distinguish different clients. If set to an empty string, the client shortId can be empty. If non-empty, should be a multiple of 2 hexadecimal digits, with a maximum of 16 hexadecimal digits.

I create a server configuration file config.json based on https://github.com/chika0801/Xray-examples/blob/main/VLESS-XTLS-uTLS-REALITY/config_server.json. In the template below, Xray listens on 0.0.0.0:443.

{
    "log": {
        "loglevel": "warning"
    },
    "routing": {
        "domainStrategy": "IPIfNonMatch",
        "rules": [
            {
                "type": "field",
                "domain": [
                    "geosite:category-ads-all"
                ],
                "outboundTag": "block"
            },
            {
                "type": "field",
                "ip": [
                    "geoip:cn"
                ],
                "outboundTag": "block"
            }
        ]
    },
    "inbounds": [
        {
            "listen": "0.0.0.0",
            "port": 443,
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "id": "9f2b4b10-6818-492e-a157-d5131d450c7b",
                        "flow": "xtls-rprx-vision"
                    }
                ],
                "decryption": "none"
            },
            "streamSettings": {
                "network": "tcp",
                "security": "reality",
                "realitySettings": {
                    "show": false,
                    "dest": "www.lovelive-anime.jp:443",
                    "xver": 0,
                    "serverNames": [
                        "www.lovelive-anime.jp"
                    ],
                    "privateKey": "M4cZLR81ErNfxnG1fAnNUIATs_UXqe6HR78wINhH7RA",
                    "minClientVer": "",
                    "maxClientVer": "",
                    "maxTimeDiff": 0,
                    "shortIds": [
                        "906f47df46efecc5"
                    ]
                }
            },
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls"
                ]
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "freedom",
            "tag": "direct"
        },
        {
            "protocol": "blackhole",
            "tag": "block"
        }
    ],
    "policy": {
        "levels": {
            "0": {
                "handshake": 3,
                "connIdle": 180
            }
        }
    }
}

Run Xray on the server

I ran the Xray server with the commands:

screen -S xray
./xray run -c config.json

Detach from the screen session with Ctrl+a followed by d.

Xray configuration on the client

Unzip Downloads\Xray-windows-64.zip.

From https://github.com/XTLS/REALITY#readme the possible properties of realitySettings on the client are as follows.

Property	Specification
show	Optional. If true, output debugging information.
fingerprint	Required. Use uTLS library to emulate client TLS fingerprint.
serverName	One of the server names.
publicKey	The public key corresponding to the private key of the server.
shortId	One of the server shortIds.
spiderX	The initial path and parameters of the crawler are recommended to be different for each client.

Based on https://github.com/chika0801/Xray-examples/blob/main/VLESS-XTLS-uTLS-REALITY/config_client.json I created a client configuration file Downloads\Xray-windows-64\config.json. Here is a template into which you can substitute your own values:

{
    "log": {
        "loglevel": "warning"
    },
    "routing": {
        "domainStrategy": "IPIfNonMatch",
        "rules": [
            {
                "type": "field",
                "domain": [
                    "geosite:category-ads-all"
                ],
                "outboundTag": "block"
            },
            {
                "type": "field",
                "domain": [
                    "geosite:category-games@cn"
                ],
                "outboundTag": "direct"
            },
            {
                "type": "field",
                "domain": [
                    "geosite:geolocation-!cn"
                ],
                "outboundTag": "proxy"
            },
            {
                "type": "field",
                "domain": [
                    "geosite:cn",
                    "geosite:private"
                ],
                "outboundTag": "direct"
            },
            {
                "type": "field",
                "ip": [
                    "geoip:cn",
                    "geoip:private"
                ],
                "outboundTag": "direct"
            }
        ]
    },
    "inbounds": [
        {
            "listen": "127.0.0.1",
            "port": 10808,
            "protocol": "socks",
            "settings": {
                "udp": true
            },
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls"
                ]
            }
        },
        {
            "listen": "127.0.0.1",
            "port": 10809,
            "protocol": "http",
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls"
                ]
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "vless",
            "settings": {
                "vnext": [
                    {
                        "address": "167.99.243.148",
                        "port": 443,
                        "users": [
                            {
                                "id": "9f2b4b10-6818-492e-a157-d5131d450c7b",
                                "flow": "xtls-rprx-vision",
                                "encryption": "none"
                            }
                        ]
                    }
                ]
            },
            "streamSettings": {
                "network": "tcp",
                "security": "reality",
                "realitySettings": {
                    "show": false,
                    "fingerprint": "chrome",
                    "serverName": "www.lovelive-anime.jp",
                    "publicKey": "ioE61VC3V30U7IdRmQ3bjhOq2ij9tPhVIgAD4JZ4YRY",
                    "shortId": "906f47df46efecc5",
                    "spiderX": "/"
                }
            },
            "tag": "proxy"
        },
        {
            "protocol": "freedom",
            "tag": "direct"
        },
        {
            "protocol": "blackhole",
            "tag": "block"
        }
    ]
}

If you use Windows Notepad as your editor, remember to save Downloads\Xray-windows-64\config.json without the usual .txt on the end of its name.

Run Xray on the client

Open Windows PowerShell and run the client:

cd Downloads\Xray-windows-64
.\xray.exe -c config.json

Configure your browser to use the SOCKS proxy on 127.0.0.1 port 10808.

[RPRX]

谢谢你写的详细步骤，Xray-core 第一个 REALITY 的 commit，服务端代码可能会陷入死循环，已经在第二个 commit 修复，建议用最新版本

（模板和代码很快会更新，你可以等它们更新后再修改文章）

[chika0801]

请问"spiderX": "/"

客户端写这个有不有什么建议或参考？

[chika0801]

"dest": "www.lovelive-anime.jp:443",

这个网址是个人的喜好，你可以替换成其它的 ^_^

[wuwentao]

咨询一下，根据example加了一个简单的配置试了一下，reality配置上面这个dest的url是第三方的网站，如果本地浏览器https访问服务器的域名或者服务器的ip，就会显示这个第三方dest的证书？那不论是域名或ip，好像都无法匹配证书？chrome就有一个tls的告警了，是不是具有比较明显的特征？
@RPRX @yuhan6665

[Arc-2023]

所以才说服务器ip和回落的ip相近是加分项？

[wuwentao]

是的，建议不要用 REALITY

大佬您好，就是讨论和咨询一下这个现象，您这个答复……
好吧，我不说了，请无视，抱歉！

[xcf13363175]

所以才说服务器ip和回落的ip相近是加分项？

所以偷自己是最优解

[GreatMichaelLee]

所以才说服务器ip和回落的ip相近是加分项？

所以偷自己是最优解

什么叫偷自己啊？是说nginx配置搭建server本地的443网站，然后把dest和serverName配为server自己的域名吗？这个和配置dest/serverName为外部网站在安全上有什么区别？不太懂这个原理。

[RPRX]

#1800 (comment)

[computerscot]

Tutorial has been updated with screenshot of v2rayN:

https://cscot.pages.dev/2023/03/02/Xray-REALITY-tutorial/

With thanks to @RPRX, @chika0801, @2dust, and all other contributors to this post.

[chika0801]

tahnks.

我们正在讨论 更新 README 的事情。#1796 (comment)

https://github.com/chika0801/Xray-core/blob/main/README.md

[houmie]

@computerscot Thank you for the example.

spiderX The initial path and parameters of the crawler are recommended to be different for each client.

1. Do you have any example what to set the spiderX to for different clients? You chose "/". But what if I have five clients, what do I do then?

2. For fingerprint, you chose chrome. There is also random and randomized. What is the difference and isn't random better than choosing always Chrome?

Thank you

[chika0801]

Do you have any example what to set the spiderX to for different clients? You chose "/". But what if I have five clients, what do I do then?

This parameter is briefly explained in the configuration notes though. We usually leave this parameter blank (no value written)

For fingerprint, you chose chrome. There is also random and randomized. What is the difference and isn't random better than choosing always Chrome?

random and randomized has been explained before. randomized is, as I recall, a randomly generated one.

I personally don't recommend using these 2. You choose the current one, such as chrome, and you're good to go.

[houmie]

Thank you @chika0801 for the explanation.