mostm/openwrt-xray
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Rework into using nftables, along with proper Xray DNS configuration

Browse Source
This commit is contained in:
Levent Duivel
2025-04-13 13:41:16 +05:00
parent a5c8961d78
commit f9645b0ef6
17 changed files with 249 additions and 195 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
etc/xray/config/01_log.json
View File

@@ -1,9 +0,0 @@
{
"log":
{
"access": "/etc/xray/log/access.log",
"dnsLog": false,
"error": "/etc/xray/log/error.log",
"loglevel": "none"
}
}

24
etc/xray/config/02_transport.json
View File

@@ -1,24 +0,0 @@
{
"transport":
{
"domainStrategy": "IPIfNonMatch",
"grpcSettings":
{
"health_check_timeout": 20,
"idle_timeout": 60,
"initial_windows_size": 35536,
"permit_without_stream": true
},
"httpSettings":
{
"health_check_timeout": 15,
"read_idle_timeout": 10
},
"sockopt":
{
"tcpFastOpen": true,
"tcpMptcp": true,
"tcpNoDelay": true
}
}
}

13
etc/xray/config/06_policy.json
View File

@@ -1,13 +0,0 @@
{
"policy":
{
"levels":
{
"0":
{
// If you have issues with SSH connections, it's recommended to increase this value. See the docs
"connIdle": 30
}
}
}
}

19
etc/xray/config/dns.jsonc Normal file
View File

@@ -0,0 +1,19 @@
{
"dns": {
"tag": "dns-in",
"hosts": {
"dns.google": "8.8.8.8"
},
"servers": [
"https://dns.google/dns-query",
{
"address": "localhost",
"disableFallback": true,
"domains": [
"regexp:.*\\.lan"
]
}
],
"queryStrategy": "UseIPv4"
}
}

18
etc/xray/config/03_inbounds.json → etc/xray/config/inbounds.jsonc
View File

@@ -1,18 +1,14 @@
{
"inbounds":
[
"inbounds": [
{
"port": 61219,
"protocol": "dokodemo-door",
"settings":
{
"settings": {
"followRedirect": true,
"network": "tcp,udp"
},
"sniffing":
{
"destOverride":
[
"sniffing": {
"destOverride": [
"http",
"tls",
"quic"
@@ -20,10 +16,8 @@
"enabled": true,
"routeOnly": true
},
"streamSettings":
{
"sockopt":
{
"streamSettings": {
"sockopt": {
"tproxy": "tproxy"
}
},

8
etc/xray/config/log.jsonc Normal file
View File

@@ -0,0 +1,8 @@
{
"log": {
// "access": "/etc/xray/log/access.log",
// "error": "/etc/xray/log/error.log",
"loglevel": "none",
"dnsLog": true
}
}

62
etc/xray/config/04_outbounds.json → etc/xray/config/outbounds.jsonc
View File

@@ -1,17 +1,14 @@
{
"outbounds":
[
"outbounds": [
{
"tag": "vless-reality",
"protocol": "vless",
"settings":
{
"vnext":
[
"settings": {
"vnext": [
{
"address": "1.1.1.1",
"port": 443,
"users":
[
"users": [
{
"encryption": "none",
"flow": "xtls-rprx-vision",
@@ -22,39 +19,52 @@
}
]
},
"streamSettings":
{
"streamSettings": {
"network": "tcp",
"realitySettings":
{
"realitySettings": {
"fingerprint": "chrome",
"publicKey": "",
"serverName": "",
"shortId": "",
"spiderX": "/"
},
"security": "reality"
},
"tag": "vless-reality"
"security": "reality",
// Important: This is required for rules to work correctly!
"sockopt": {
"domainStrategy": "UseIP",
"mark": 2
}
}
},
{
"tag": "direct",
"protocol": "freedom",
"tag": "direct"
},
{
"protocol": "blackhole",
"settings":
{
"response":
{
"type": "http"
"streamSettings": {
"sockopt": {
"mark": 2
}
},
"tag": "block"
"settings": {
"domainStrategy": "UseIP"
}
},
{
"tag": "block",
"protocol": "blackhole",
"settings": {
"response": {
"type": "http"
}
}
},
{
"tag": "dns-out",
"protocol": "dns",
"tag": "dns"
"streamSettings": {
"sockopt": {
"mark": 2
}
}
}
]
}

10
etc/xray/config/policy.jsonc Normal file
View File

@@ -0,0 +1,10 @@
{
"policy": {
"levels": {
"0": {
// If you have issues with SSH connections, it's recommended to increase this value. See the docs
"connIdle": 30
}
}
}
}

80
etc/xray/config/05_routing.json → etc/xray/config/routing.jsonc
View File

@@ -1,25 +1,31 @@
{
"routing": {
"domainStrategy": "IPIfNonMatch",
"rules": [
// Capture DNS
{
"inboundTag": ["redirect", "tproxy"],
"outboundTag": "dns",
"type": "field",
"inboundTag": "tproxy",
"outboundTag": "dns-out",
"port": 53
},
// Block QUIC
{
"inboundTag": ["redirect", "tproxy"],
"inboundTag": "tproxy",
"outboundTag": "block",
"type": "field",
"protocol": ["quic"]
"protocol": [
"quic"
]
},
// Force DNS to go through direct
// If needed, you can force DNS to go through other outbound using tags for specific servers in dns.jsonc
{
"inboundTag": "dns-in",
"outboundTag": "direct"
},
// Force specific source IPs to go direct
{
"inboundTag": ["redirect", "tproxy"],
"inboundTag": "tproxy",
"outboundTag": "direct",
"type": "field",
"source": [
"192.168.2.255",
"192.168.2.254"
@@ -27,9 +33,8 @@
},
// Block common ads and other stuff
{
"inboundTag": ["redirect", "tproxy"],
"inboundTag": "tproxy",
"outboundTag": "block",
"type": "field",
"domain": [
"geosite:category-ads-all",
"google-analytics",
@@ -42,39 +47,36 @@
},
// Force BitTorrent to go through direct
{
"inboundTag": ["redirect", "tproxy"],
"inboundTag": "tproxy",
"outboundTag": "direct",
"type": "field",
"protocol": ["bittorrent"]
},
// Explicitly force direct
"protocol": "bittorrent"
},
// Explicitly force direct (domains)
{
"inboundTag": ["redirect", "tproxy"],
"inboundTag": "tproxy",
"outboundTag": "direct",
"type": "field",
"domain": [
"regexp:^([\\w\\-\\.]+\\.)ru$", // .ru
"regexp:^([\\w\\-\\.]+\\.)su$", // .su
"regexp:^([\\w\\-\\.]+\\.)xn--p1ai$", // .рф
"regexp:^([\\w\\-\\.]+\\.)xn--p1acf$", // .рус
"regexp:^([\\w\\-\\.]+\\.)xn--80asehdb$", // .онлайн
"regexp:^([\\w\\-\\.]+\\.)ru$", // .ru
// "regexp:^([\\w\\-\\.]+\\.)su$", // .su
"regexp:^([\\w\\-\\.]+\\.)xn--p1ai$", // .рф
"regexp:^([\\w\\-\\.]+\\.)xn--p1acf$", // .рус
"regexp:^([\\w\\-\\.]+\\.)xn--80asehdb$", // .онлайн
"regexp:^([\\w\\-\\.]+\\.)xn--c1avg$", // .орг
"regexp:^([\\w\\-\\.]+\\.)xn--80aswg$", // .сайт
"regexp:^([\\w\\-\\.]+\\.)xn--80adxhks$", // .москва
"regexp:^([\\w\\-\\.]+\\.)moscow$", // .moscow
"regexp:^([\\w\\-\\.]+\\.)xn--d1acj3b$", // .дети
"regexp:^([\\w\\-\\.]+\\.)yandex$", // .yandex
"regexp:^([\\w\\-\\.]+\\.)xn--80aswg$", // .сайт
"regexp:^([\\w\\-\\.]+\\.)xn--80adxhks$", // .москва
"regexp:^([\\w\\-\\.]+\\.)moscow$", // .moscow
"regexp:^([\\w\\-\\.]+\\.)xn--d1acj3b$", // .дети
"regexp:^([\\w\\-\\.]+\\.)yandex$", // .yandex
"geosite:category-ru",
"geosite:category-gov-ru",
"geosite:yandex",
"geosite:steam",
"geosite:vk",
"geosite:category-gov-ru",
"regexp:^assets(\\d*?)\\.xboxlive\\.com$",
// "regexp:^assets(\\d*?)\\.xboxlive\\.com$",
"domain:rt.ru",
"domain:ngenix.net",
"domain:plex.tv",
"geoip:ru",
"domain:kaspersky.com",
"domain:koronapay.com",
"domain:binance.com",
@@ -87,13 +89,23 @@
"domain:veesp.com"
]
},
// Explicitly force direct (IPs)
{
"inboundTag": "tproxy",
"outboundTag": "direct",
"ip": [
"geoip:ru",
"geoip:am"
]
},
// No rules found? Go vless-reality
{
"inboundTag": ["redirect", "tproxy"],
"outboundTag": "vless-reality",
"type": "field"
"inboundTag": [
"tproxy",
"dns-in"
],
"outboundTag": "vless-reality"
}
]
}
}
}