Xray 搭建与优化：VLESS + Reality 部署与性能调优实战

一、Xray-core 简介

• GitHub: https://github.com/XTLS/Xray-core （36k+ stars）
• V2Ray 的超集，支持 VLESS/VMess/Trojan/SS + XTLS/Reality
• 单二进制文件，Go 编写，跨平台

---

二、快速部署

2.1 一键安装 Xray

bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install

安装后：

• 二进制: /usr/local/bin/xray
• 配置: /usr/local/etc/xray/config.json
• 服务: systemctl start xray

2.2 方案一：VLESS + Reality（推荐，无需域名）

生成密钥对：

xray x25519
# 输出:
# Private key: xxxxxxxxxxxxxx
# Public key:  yyyyyyyyyyyyyy

生成短 ID：

openssl rand -hex 8

生成 UUID：

xray uuid

服务端配置 /usr/local/etc/xray/config.json：

{
  "log": { "loglevel": "warning" },
  "inbounds": [{
    "listen": "0.0.0.0",
    "port": 443,
    "protocol": "vless",
    "settings": {
      "clients": [{
        "id": "<生成的UUID>",
        "flow": "xtls-rprx-vision"
      }],
      "decryption": "none"
    },
    "streamSettings": {
      "network": "tcp",
      "security": "reality",
      "realitySettings": {
        "dest": "www.microsoft.com:443",
        "serverNames": ["www.microsoft.com"],
        "privateKey": "<生成的私钥>",
        "shortIds": ["<生成的短ID>"]
      }
    }
  }],
  "outbounds": [{
    "protocol": "freedom"
  }]
}

客户端配置关键参数：

协议: vless
地址: 服务器IP
端口: 443
UUID: <同上>
Flow: xtls-rprx-vision
传输: tcp
安全: reality
SNI: www.microsoft.com
公钥: <生成的公钥>
短ID: <同上>
指纹: chrome

2.3 方案二：VLESS + WS + TLS（支持 CDN）

需要：域名 + Cloudflare 或 Let’s Encrypt 证书

{
  "inbounds": [{
    "port": 443,
    "protocol": "vless",
    "settings": {
      "clients": [{ "id": "<UUID>" }],
      "decryption": "none"
    },
    "streamSettings": {
      "network": "ws",
      "security": "tls",
      "tlsSettings": {
        "certificates": [{
          "certificateFile": "/path/to/fullchain.pem",
          "keyFile": "/path/to/privkey.pem"
        }]
      },
      "wsSettings": {
        "path": "/随机路径"
      }
    }
  }],
  "outbounds": [{ "protocol": "freedom" }]
}

配合 Nginx 回落（非代理流量返回正常网页）：

server {
    listen 80;
    server_name your-domain.com;
    return 301 https://$host$request_uri;
}

2.4 方案三：Hysteria2（UDP 高速）

安装：

bash <(curl -fsSL https://get.hy2.sh/)

服务端配置 /etc/hysteria/config.yaml：

listen: :443

tls:
  cert: /path/to/cert.pem
  key: /path/to/key.pem

auth:
  type: password
  password: your-password

bandwidth:
  up: 1 gbps
  down: 1 gbps

自签证书（不需要域名）：

openssl req -x509 -nodes -newkey ec:<(openssl ecparam -name prime256v1) \
  -keyout /etc/hysteria/server.key -out /etc/hysteria/server.crt \
  -subj "/CN=bing.com" -days 36500

---

三、性能优化

3.1 系统层优化

cat >> /etc/sysctl.conf << 'EOF'
# TCP 优化
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
net.ipv4.tcp_fastopen = 3
net.ipv4.tcp_max_syn_backlog = 8192
net.core.somaxconn = 4096

# 缓冲区
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216

# 连接复用
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 15

# UDP 优化 (Hysteria2)
net.core.rmem_default = 26214400
net.core.wmem_default = 26214400
EOF

sysctl -p

3.2 BBR 拥塞控制

echo "net.core.default_qdisc=fq" >> /etc/sysctl.conf
echo "net.ipv4.tcp_congestion_control=bbr" >> /etc/sysctl.conf
sysctl -p

# 验证
sysctl net.ipv4.tcp_congestion_control
# 输出: net.ipv4.tcp_congestion_control = bbr

3.3 Xray 多用户 + 流量统计

{
  "stats": {},
  "policy": {
    "levels": { "0": { "statsUserUplink": true, "statsUserDownlink": true } },
    "system": { "statsInboundUplink": true, "statsInboundDownlink": true }
  },
  "inbounds": [{
    "tag": "vless-in",
    "settings": {
      "clients": [
        { "id": "uuid-user1", "email": "user1@example.com", "flow": "xtls-rprx-vision" },
        { "id": "uuid-user2", "email": "user2@example.com", "flow": "xtls-rprx-vision" }
      ]
    }
  }],
  "api": {
    "tag": "api",
    "services": ["StatsService"]
  }
}

查询流量：

xray api statsquery --server=127.0.0.1:10085 -pattern "user>>user1@example.com>>traffic>>downlink"

3.4 多协议共存（同端口）

Xray 支持 fallback，443 端口同时服务 VLESS + Trojan + 网页：

{
  "inbounds": [{
    "port": 443,
    "protocol": "vless",
    "settings": {
      "clients": [{ "id": "<UUID>", "flow": "xtls-rprx-vision" }],
      "decryption": "none",
      "fallbacks": [
        { "dest": 8001 },
        { "path": "/ws-path", "dest": 8002 },
        { "alpn": "h2", "dest": 8003 }
      ]
    }
  }]
}

---

四、安全加固

4.1 防探测

"realitySettings": {
  "dest": "www.microsoft.com:443",
  "serverNames": ["www.microsoft.com", "microsoft.com"],
  "shortIds": ["abcdef1234567890", "abcdef12"],
  "maxTimeDiff": 60000
}

• dest: 选择大站（microsoft/apple/amazon），且该站支持 TLS 1.3 和 H2
• shortIds: 可设多个，增加随机性
• maxTimeDiff: 客户端时间差容忍（毫秒）

4.2 伪装站点选择标准

1. 支持 TLS 1.3
2. 支持 HTTP/2
3. 位于同地区的 CDN 节点（降低延迟）
4. 访问量大（混入正常流量）

推荐伪装目标：

www.microsoft.com
www.apple.com  
www.amazon.com
addons.mozilla.org
www.lovelive-anime.jp  (日本节点)

4.3 防火墙配置

# 只开放需要的端口
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp     # SSH
ufw allow 443/tcp    # Xray
ufw allow 443/udp    # Hysteria2
ufw enable