使用Caddy前置的 Xray(M+F+H+K+A)+Caddy(N) 配置，使用出现一些问题。

[crosspacific]

作者你好。

我首先使用了Xray前置的 Xray(M+H+K+A)+Caddy(N+T) 的配置，删除了一些用不到的配置。配置如下：

Xray前置

{
  "log": {
    "loglevel": "warning",
    "error": "/var/log/xray/error.log",
    "access": "/var/log/xray/access.log"
  },
  "inbounds": [
    {
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "1512a10a-0705-4ee4-99d6-04508fb82140",
            "flow": "xtls-rprx-vision"
          }
        ],
        "decryption": "none",
        "fallbacks": [
          {
            "dest": 2023
          }
        ]
      },
      "streamSettings": {
        "network": "raw",
        "security": "reality",
        "realitySettings": {
          "target": 8443,
          "xver": 2,
          "serverNames": [
            "123.abc.xyz"
          ],
          "privateKey": "asdasdasdasdasdasdasdasdasds",
          "shortIds": [
            "12",
            "1234",
            "123456"
          ]
        }
      },
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ]
      }
    },
    {
      "listen": "127.0.0.1",
      "port": 2023,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "1512a10a-0705-4ee4-99d6-04508fb82140"
          },
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "xhttp",
        "xhttpSettings": {
          "path": "/x123"
        }
      },
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ]
      }
    }
  ],
  "routing": {
    "rules": [
      {
        "type": "field",
        "protocol": [
          "bittorrent"
        ],
        "outboundTag": "blocked"
      },
      {
        "ip": [
          "geoip:private",
          "geoip:cn"
        ],
        "outboundTag": "blocked",
        "type": "field"
      }
    ]
  },
  "outbounds": [
    {
      "protocol": "freedom",
      "settings": {
        "domainStrategy": "UseIPv4"
      }
    },
    {
      "tag": "blocked",
      "protocol": "blackhole",
      "settings": {}
    }
  ]
}

Caddy配置

{
  "admin": {
    "disabled": true,
    "config": {
      "persist": false
    }
  },
  "logging": {
    "logs": {
      "default": {
        "writer": {
          "output": "file",
          "filename": "/var/log/caddy/error.log"
        },
        "encoder": {
          "format": "console"
        },
        "level": "ERROR",
        "exclude": ["http.log.access.log0"]
      },
      "log0": {
        "writer": {
          "output": "file",
          "filename": "/var/log/caddy/access.log"
        },
        "encoder": {
          "format": "console"
        },
        "include": ["http.log.access.log0"]
      }
    }
  },
  "storage": {
    "module": "file_system",
    "root": "/home/tls"
  },
  "apps": {
    "layer4": {
      "servers": {
        "udppy": {
          "listen": ["udp/:443"],
          "routes": [{
            "handle": [{
              "handler": "proxy",
              "upstreams": [{
                "dial": ["udp/127.0.0.1:8443"]
              }]
            }]
          }]
        }
      }
    },
    "http": {
      "servers": {
        "srvh1": {
          "listen": [":80"],
          "routes": [{
            "handle": [{
              "handler": "static_response",
              "headers": {
                "Location": ["https://{http.request.host}{http.request.uri}"]
              },
              "status_code": 301
            }]
          }],
          "protocols": ["h1"]
        },
        "srvh3": {
          "listen": ["127.0.0.1:8443"],
          "listener_wrappers": [{
            "wrapper": "proxy_protocol",
            "allow": ["127.0.0.1/32"]
          },
          {
            "wrapper": "tls"
          }],
          "routes": [{
            "match": [{
              "path": ["/x123/*"]
            }],
            "handle": [{
              "handler": "reverse_proxy",
              "transport": {
                "protocol": "http",
                "versions": ["h2c","2"]
              },
              "upstreams": [{
                "dial": "127.0.0.1:2023"
              }]
            }]
          },
          {
            "handle": [{
              "handler": "headers",
              "response": {
                "set": {
                  "Alt-Svc": ["h3=\":443\"; ma=2592000"],
                  "Strict-Transport-Security": ["max-age=31536000; includeSubDomains; preload"]
                }
              }
            },
            {
              "handler": "file_server",
              "root": "/home/html"
            }]
          }],
          "tls_connection_policies": [{
            "match": {
              "sni": ["123.abc.xyz","456.abc.xyz"]
            },
            "cipher_suites": ["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"],
            "alpn": ["h3","h2","http/1.1"]
          }],
          "trusted_proxies": {
            "source": "cloudflare",
            "interval": "12h",
            "timeout": "15s"
          },
          "logs": {
            "default_logger_name": "log0"
          },
          "protocols": ["h1","h2","h3"]
        }
      }
    },
    "tls": {
      "certificates": {
        "automate": ["*.abc.xyz"]
      },
      "automation": {
        "policies": [{
          "issuers": [{
            "module": "acme",
            "email": "12345@gmail.com",
            "challenges": {
              "dns": {
                "provider": {
                  "name": "cloudflare",
                  "api_token": "qweqweqweqweqweqweqweqwe"
                }
              }
            }
          }]
        }]
      }
    }
  }
}

以上配置正常使用。

然后，我又重新修改了Caddy前置的 Xray(M+F+H+K+A)+Caddy(N) 配置，配置如下：

Caddy前置

{
  "admin": {
    "disabled": true,
    "config": {
      "persist": false
    }
  },
  "logging": {
    "logs": {
      "default": {
        "writer": {
          "output": "file",
          "filename": "/var/log/caddy/error.log"
        },
        "encoder": {
          "format": "console"
        },
        "level": "ERROR",
        "exclude": ["http.log.access.log0"]
      },
      "log0": {
        "writer": {
          "output": "file",
          "filename": "/var/log/caddy/access.log"
        },
        "encoder": {
          "format": "console"
        },
        "include": ["http.log.access.log0"]
      }
    }
  },
  "storage": {
    "module": "file_system",
    "root": "/home/tls"
  },
  "apps": {
    "layer4": {
      "servers": {
        "tcpsni": {
          "listen": [":443"],
          "routes": [{
            "match": [{
              "tls": {
                "sni": ["123.abc.xyz"]
              }
            }],
            "handle": [{
              "handler": "proxy",
              "proxy_protocol": "v1",
              "upstreams": [{
                "dial": ["127.0.0.1:5443"]
              }]
            }]
          },
          {
            "match": [{
              "tls": {}
            }],
            "handle": [{
              "handler": "proxy",
              "proxy_protocol": "v2",
              "upstreams": [{
                "dial": ["127.0.0.1:8443"]
              }]
            }]
          }]
        },
        "udppy": {
          "listen": ["udp/:443"],
          "routes": [{
            "handle": [{
              "handler": "proxy",
              "upstreams": [{
                "dial": ["udp/127.0.0.1:8443"]
              }]
            }]
          }]
        }
      }
    },
    "http": {
      "servers": {
        "srvh1": {
          "listen": [":80"],
          "routes": [{
            "handle": [{
              "handler": "static_response",
              "headers": {
                "Location": ["https://{http.request.host}{http.request.uri}"]
              },
              "status_code": 301
            }]
          }],
          "protocols": ["h1"]
        },
        "srvh3": {
          "listen": ["127.0.0.1:8443"],
          "listener_wrappers": [{
            "wrapper": "proxy_protocol",
            "allow": ["127.0.0.1/32"]
          },
          {
            "wrapper": "tls"
          }],
          "routes": [{
            "match": [{
              "path": ["/x123/*"]
            }],
            "handle": [{
              "handler": "reverse_proxy",
              "transport": {
                "protocol": "http",
                "versions": ["h2c","2"]
              },
              "upstreams": [{
                "dial": "127.0.0.1:2023"
              }]
            }]
          },
          {
            "handle": [{
              "handler": "headers",
              "response": {
                "set": {
                  "Alt-Svc": ["h3=\":443\"; ma=2592000"],
                  "Strict-Transport-Security": ["max-age=31536000; includeSubDomains; preload"]
                }
              }
            },
            {
              "handler": "file_server",
              "root": "/home/html"
            }]
          }],
          "tls_connection_policies": [{
            "match": {
              "sni": ["123.abc.xyz","456.abc.xyz"]
            },
            "cipher_suites": ["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"],
            "alpn": ["h3","h2","http/1.1"]
          }],
          "trusted_proxies": {
            "source": "cloudflare",
            "interval": "12h",
            "timeout": "15s"
          },
          "logs": {
            "default_logger_name": "log0"
          },
          "protocols": ["h1","h2","h3"]
        }
      }
    },
    "tls": {
      "certificates": {
        "automate": ["*.abc.xyz"]
      },
      "automation": {
        "policies": [{
          "issuers": [{
            "module": "acme",
            "email": "asdaw123@gmail.com",
            "challenges": {
              "dns": {
                "provider": {
                  "name": "cloudflare",
                  "api_token": "12asdasdawdqw"
                }
              }
            }
          }]
        }]
      }
    }
  }
}

Xray配置

{
  "log": {
    "loglevel": "warning",
    "error": "/var/log/xray/error.log",
    "access": "/var/log/xray/access.log" 
  },
  "inbounds": [
    {
      "listen": "127.0.0.1",
      "port": 5443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "1512a10a-0705-4ee4-99d6-04508fb82140",
            "flow": "xtls-rprx-vision"
          }
        ],
        "decryption": "none",
        "fallbacks": [
          {
            "dest": 2023
          }
        ]
      },
      "streamSettings": {
        "network": "raw",
        "security": "reality",
        "realitySettings": {
          "target": 8443,
          "xver": 2,
          "serverNames": [
            "123.abc.xyz"
          ],
          "privateKey": "asdadwadawdaw",
          "shortIds": [
            "12",
            "1234",
            "123456"
          ]
        },
        "rawSettings": {
          "acceptProxyProtocol": true
        }
      },
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ]
      }
    },
    {
      "listen": "127.0.0.1",
      "port": 2023,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "1512a10a-0705-4ee4-99d6-04508fb82140"
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "xhttp",
        "xhttpSettings": {
          "path": "/x123"
        }
      },
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ]
      }
    }
  ],
  "routing": {
    "rules": [
      {
        "type": "field",
        "protocol": [
          "bittorrent"
        ],
        "outboundTag": "blocked"
      },
      {
        "ip": [
          "geoip:private",
          "geoip:cn"
        ],
        "outboundTag": "blocked",
        "type": "field"
      }
    ]
  },
  "outbounds": [
    {
      "protocol": "freedom",
      "settings": {
        "domainStrategy": "UseIPv4"
      }
    },
    {
      "tag": "block",
      "protocol": "blackhole",
      "settings": {}
    }
  ]
}

在v2rayN上使用出现如下问题：

1. vless+xhttp+tls+cdn (456.abc.xyz)，正常使用。
2. vless+vision+reality和vless+xhttp+reality，测试真连接、测速有数值，但是选中节点以后右下角延迟为-1，也不能正常上网。

我找了很久也没找到原因。

[lxhao61]

检查一下域名 123.abc.xyz 网站是否可访问，推测可能 SNI 被阻断了。

[crosspacific]

Caddy前置时两个网站都可以访问。Xray前置时，也可以正常访问。 😂

[lxhao61]

检查 Caddy 前置分流时 Xray 中 privateKey 值，是否与 Xray 前置分流时一样？

[crosspacific]

是一致的。我的配置都是同一套，相互复制。

[lxhao61]

无道理，你最好把正常可连那部分配置直接复制过去。
另外把 "domainStrategy": "UseIPv4" 删除试试。

[crosspacific]

我暂时放弃了。先用xray分流吧，等过段时间在试试。

[taxtigerno1]

xray前置比nginx前置速度快几倍

[crosspacific]

我今天又测试了一下，还是出现如下问题

在v2rayN上使用出现如下问题：

1. vless+xhttp+tls+cdn，正常使用。
2. vless+vision+reality和vless+xhttp+reality，测试真连接、测速有数值，但是选中节点以后右下角延迟为-1，也不能正常上网。

v2rayN日志显示流量走了代理 [socks >> proxy]，但是查看服务器xray日志，发现连接没有发送到xray，只有测速的连接。

2025/02/15 06:01:55.132199 from 14.145.50.18:12184 accepted tcp:speed.cloudflare.com:443
2025/02/15 06:01:56.904287 from 14.145.50.18:12185 accepted tcp:speed.cloudflare.com:443
2025/02/15 06:05:35.441995 from 14.145.50.18:12217 accepted tcp:www.google.com:443

但是，我将vless+vision+reality复制到手机小火箭，节点在手机上是可以正常使用的；复制到GUI for Singbox，也是可以使用。最后检查v2rayN，将分片关掉就能用了。😂

[lxhao61]

就是说直连（Xray 前置）支持分片，通过 SNI 分流后（Caddy 前置）不支持分片?

[crosspacific]

你是说直连（Xray 前置）支持分片，通过 SNI 分流（Caddy 前置）后不支持分片？

是的。
使用 Xray(M+F+H+K+A)+Caddy(N) 配置，vless+xhttp+tls+cdn 分片开启或关闭都能使用；vless+vision+reality 和vless+xhttp+reality，v2rayN 开启分片，测试真连接、测速均有数值，但是选中节点以后右下角延迟为-1，也不能正常上网；关闭分片后，正常使用。

[lxhao61]

xhttp 应用本不支持分片。测试 vless+vision+reality 分片即可。你参考测试的示例是配置 1，还是配置 2？

[crosspacific]

用的是配置1。我也用不到分片功能，可能是以前无意中点开了分片，导致这种情况。
Xray前置的时候，分片也是（无意）开着的，节点都能使用。

[lxhao61]

你可调整 SNI 分流，默认调整为 vless+vision+reality 试试。