Network Censorship Circumvention

XTLS Proxy Guide

XTLS REALITY is the best and strongest proxy protocol for bypassing censorship at home (ISP blocking), school/work (e.g. Fortinet), China, Russia, Iran, etc. It makes all your traffic appear as though it is coming from the same unblocked SNI (site). This guide uses the 3X-UI web panel to make setup and editing easier. 3X-UI website has a lot of information if you want to look more in depth.

If the environment you are trying to bypass is home, school, or work, you should first try free VPNs such as WARP, Proton, Windscribe (OpenVPN TCP with port 443 is the strongest), or Psiphon.

Requirements: A VPS or home server with ports 443 and 2053 open to the internet.

Free Oracle VPS guide. Recommended OS = Ubuntu Server.

Home Server Info

Use DigitalPlat for free domain, fake info works. Do NOT choose an obvious proxy domain name (e.g. xtls, proxy, bypass etc).

This guide may be difficult for beginners self hosting for the first time. It may be easier to buy from proxy sellers (aka ‘机场’ for China) online.

Server Side Method

1. Terminal SSH into your server machine ssh ubuntu@publicip.
2. Run sudo su.
3. Run apt update then apt upgrade.
4. Run ufw allow 443/tcp and ufw allow 2053/tcp
5. Run curl https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh | bash. Note the green text containing login username and password towards the end of the install logs.
6. Run x-ui and select Change Port (10) and enter port 2053.
7. Bind the domain with certificate to harden the panel to https. Select Cloudflare SSL Certificate (21).
8. Open Cloudflare dashboard and select Onboard a domain. Type in your domain, skip DNS related steps. Paste the two nameservers into DigitalPlat dashboard → My domains → Each of Name Server 1 and 2. Global API Key is found here and registered email is the Cloudflare account email.
9. Go to DNS → Records Tab. Click Add Record.

• Run curl https://ipinfo.io/ip to find public ip of server machine

Type: A
Name: <files> # Can be anything, this will be your domain prefix. 
Content: <Public IP of server machine>

Disable Proxied, leave TTL as default then click save. This will be the domain used for the 3X-UI panel.

10. Go to DNS → Records Tab. Click Add Record.

Type: CNAME
Name: @
Content: <files>.<yourdomain> # (e.g files.domain.qzz.io)

Enable Proxied, leave TTL as default then click save. This will be the domain you connect to for the proxy.

11. Select View Current Settings (11) for the web panel address and open the link.
12. Login to the panel using info from step 5 or reset using Reset Username & Password (7).
13. Go to the inbounds tab on the left. Select Add Inbound.

Basics:

Remark: XTLS REALITY
Port: 443
Protocol: vless

Security: Reality

Target: <An unblocked domain>:443 # (e.g. learn.microsoft.com:443)
Min Client Ver: 1.0.0

Click the Scan button. Leave the rest as default then click create.

14. Go to the clients tab on the left. Click Add client.

Basics:

Email: <username> 
Attached inbounds: XTLS REALITY

Credentials:

Flow: xtls-rprx-vision

Leave the rest as default then click create.

Feel free to add more accounts for other people. It automatically generates a unique password for each user. You have the power to remove auth.

15. Click the QR code icon next to the user you want. Click the XTLS Reality toggle under the QR code for the actual config. Click the QR code itself to add the client config text to clipboard.

Client Side Method

Requirement: Proxy Client

1. Open your client and select scan the QR code or import client config text from clipboard (from step 15). This would be accessed from the + button on Nekobox/V2Box and configuration button on v2rayN.
2. Edit the imported server client config and add the prefix (from step 9) to the Server Address (e.g files.domain.qzz.io).

Home Server Info

• Minimum requirements to run the server is 1GB ram, 15GB storage, 1 CPU core. Therefore you could run the server on a virtual machine alongside your primary OS, dual boot and switch to the server when you leave home, or use a cheap Raspberry Pi.
• Enable boot computer when power is reconnected within BIOS settings. This ensures your pc is kept on even after a power outage.
• Within modem web panel, go to the DHCP tab. Set a static private IP for your server computer. This ensures port forwarding is kept pointed to your server working even after a modem restart. Home server can only be used if there is no censorship at home.

Dynamic DNS

IP usually changes when modem is restarted. Auto update domain DNS so it stays pointed at your home IP.

1. Run git clone https://github.com/K0p1-Git/cloudflare-ddns-updater.
2. Run nano cloudflare-ddns-updater/cloudflare-template.sh to edit the script. Fill in the lines required using record from step 9.
3. Run crontab -e.
4. Add this line 0 * * * * /bin/bash cloudflare-ddns-updater/cloudflare-template.sh. This is an hourly schedule to set IP within DNS.

Port Forwarding

Ports must be forwarded to be open to the internet.

1. Run ip addr in terminal. Note your device’s private IP address which is in the line inet.
2. Open your modem’s web panel.
3. Go to the Port Forwarding (aka Port Mapping) tab.
4. Create two rules: one for UDP and one for TCP. For each rule, enter the private IP address, the private and public port, all 443.
5. Repeat for the panel port, 2053.

Credits

Huge shoutout to Zenith Rifle for teaching me.