Network Censorship Circumvention Guide

XTLS Proxy Guide

XTLS REALITY is the best and strongest proxy protocol for bypassing censorship at home (ISP blocking), school/work (e.g. Fortinet), China, Russia, Iran, etc. It makes all your traffic appear as though it is coming from the same unblocked SNI (site). This guide uses the 3X-UI web panel to make setup and editing easier. 3X-UI website has a lot of information if you want to look more in depth.

If the environment you are trying to bypass is home, school, or work, you should first try free VPNs such as WARP, Proton, Windscribe (OpenVPN TCP with port 443 is the strongest), or Psiphon.

Requirements: A VPS or home server with incoming port 443 open to the internet.

Free Oracle VPS guide. Recommended OS = Ubuntu Server.

Home Server Info

Use DigitalPlat for free domain, fake info works. Do NOT choose an obvious proxy domain name (e.g. xtls, proxy, bypass etc).

This guide may be difficult for beginners self hosting for the first time. It may be easier to buy from proxy sellers (aka ‘机场’ for China) online.

Server Side Method

0. Open Cloudflare dashboard and select Onboard a domain. Type in your domain, skip DNS related steps. Paste the two nameservers into your domain sites dashboard → Each of Name Server 1 and 2.
1. Terminal SSH into your server machine ssh ubuntu@publicip.
2. Run sudo su because most commands in this guide require root privileges.
3. Run apt update then apt upgrade.
4. Run ufw allow 443/tcp
5. Run bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh).

• Choose n for port settings.
• Choose 4 for SSL certificate to skip.
• Choose y for binding the panel to 127.0.0.1 only.

6. Scroll up until you see the green text Panel Installation Complete! Note down the login username, password, port and WebBasePath
7. This step turns the panel to https. In Cloudflare Dashboard home go to Tunnels then click Create Tunnel. Enter any name.
8. Select your OS (Debian for Ubuntu). Run the commands for Install cloudflared and Install as service. It will update the page and say its connected.
9. Click Add route then select Published Application

• Subdomain: <files> # Can be anything, this will be your panel domain prefix.
• Domain: Select your domain
• Service URL: http://127.0.0.1:<port from step 6> # e.g. http://127.0.0.1:38592

Click Save changes

10. Login to your web panel using your browser.

<subdomain from step 9><domain>/<webBasePath> # e.g. x.domain.qzz.io/0QFjKDGv47mpuw9zYK

11. Go to the inbounds tab on the left. Select Add Inbound.

Basics tab:

• Remark: XTLS REALITY
• Port: 443
• Protocol: vless

Security tab:

• Security: Reality
• Target: <An unblocked domain>:443 # e.g. learn.microsoft.com:443 , this is the domain you are spoofing your data as.

Find Targets button can help you find a suitable domain. Click the Scan button. Leave the rest as default then click create.

12. Go to Panel Settings -> Subscription on the left sidebar, disable Subscription Service then click Save.

13. Go to the clients tab on the left. Click Add client.

Basics tab:

• Email: <username>
• Attached inbounds: XTLS REALITY

Credentials tab:

• Flow: xtls-rprx-vision

Leave the rest as default then click create.

Feel free to add more accounts for other people. It automatically generates a unique password for each user. You have the power to remove auth.

14. Click the QR code icon next to the user you want. Clicking the small copy icon adds the client config text to clipboard.

Troubleshooting

If you have forgotten any of the info from step 6, run x-ui with sudo and press the respective number. E.g. Reset Username & Password or View Current Settings to see your port and webBasePath.

Client Side Method

Requirement: Proxy Client

1. Open your client and select scan the QR code or import client config text from clipboard (from step 14). This would be accessed from the + button on v2rayNG/V2Box and configuration button on v2rayN.
2. Edit the imported server client config and replace the address box (containing your domain) with your public server ip.

Home Server Info

• Minimum requirements to run the server is 1GB ram, 15GB storage, 1 CPU core. Therefore you could run the server on a virtual machine alongside your primary OS, dual boot and switch to the server when you leave home, or use a cheap Raspberry Pi.
• Enable boot computer when power is reconnected within BIOS settings. This ensures your pc is kept on even after a power outage.
• Within modem web panel, go to the DHCP tab. Set a static private IP for your server computer. This ensures port forwarding is kept pointed to your server working even after a modem restart. Home server can only be used if there is no censorship at home.

Dynamic DNS

IP usually changes when modem is restarted. Auto update domain DNS so it stays pointed at your home IP.

1. Run git clone https://github.com/K0p1-Git/cloudflare-ddns-updater.
2. Run nano cloudflare-ddns-updater/cloudflare-template.sh to edit the script. Fill in the lines required using record from step 9.
3. Run crontab -e.
4. Add this line 0 * * * * /bin/bash cloudflare-ddns-updater/cloudflare-template.sh. This is an hourly schedule to set IP within DNS.

Port Forwarding

Ports must be forwarded to be open to the internet.

1. Run ip addr in terminal. Note your device’s private IP address which is in the line inet.
2. Open your modem’s web panel.
3. Go to the Port Forwarding (aka Port Mapping) tab.
4. Create an allow TCP rule. Enter the private IP address, private and public port is 443.

Credits

Huge shoutout to Zenith Rifle for teaching me.