自己搭建科学上网：VLESS + TCP + REALITY 完整教程

海外 Ubuntu 服务器 + Xray + VLESS + TCP + REALITY + Clash Verge Rev

target: www.bing.com:443
serverNames: [www.bing.com]
servername: www.bing.com

系统：Ubuntu 24.04 LTS
CPU：1 核或以上
内存：512MB 可运行，建议 1GB 或以上
硬盘：10GB 或以上
网络：独立公网 IPv4
流量：按自己的下载、视频和开发需求选择

镜像：Ubuntu 24.04 LTS
登录方式：SSH 密钥
公网地址：独立 IPv4
自动续费：先关闭，测试稳定后再决定

ssh -i ~/.ssh/id_ed25519 ubuntu@<SERVER_IP>

ssh-keygen -t ed25519 -a 64
ssh-copy-id ubuntu@<SERVER_IP>

sudo apt update
sudo apt full-upgrade -y
sudo apt install -y curl openssl ufw ca-certificates
sudo timedatectl set-timezone Asia/Shanghai
timedatectl status

timedatectl show -p NTPSynchronized

NTPSynchronized=yes

sudo nano /etc/ssh/sshd_config.d/99-hardening.conf

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

sudo sshd -t
sudo systemctl reload ssh

sudo ufw allow OpenSSH
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

sudo bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install

/usr/local/bin/xray version
systemctl cat xray

程序：/usr/local/bin/xray
配置：/usr/local/etc/xray/config.json
服务：/etc/systemd/system/xray.service

/usr/local/bin/xray uuid

/usr/local/bin/xray x25519

PrivateKey: <REALITY_PRIVATE_KEY>
Password: <REALITY_PUBLIC_KEY>

openssl rand -hex 8

6f1a2b3c4d5e7f80

<SERVER_IP>          服务器公网 IP
<UUID>               xray uuid 的输出
<REALITY_PRIVATE_KEY> xray x25519 的 PrivateKey
<REALITY_PUBLIC_KEY>  xray x25519 的 Password 或 PublicKey
<SHORT_ID>            openssl rand -hex 8 的输出

sudo cp /usr/local/etc/xray/config.json /usr/local/etc/xray/config.json.bak
sudo nano /usr/local/etc/xray/config.json

{
  "log": {
    "loglevel": "warning"
  },
  "inbounds": [
    {
      "tag": "vless-reality-in",
      "listen": "0.0.0.0",
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "<UUID>",
            "flow": "xtls-rprx-vision",
            "email": "my-device"
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "raw",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "target": "www.bing.com:443",
          "xver": 0,
          "serverNames": ["www.bing.com"],
          "privateKey": "<REALITY_PRIVATE_KEY>",
          "shortIds": ["<SHORT_ID>"]
        }
      },
      "sniffing": {
        "enabled": true,
        "destOverride": ["http", "tls"]
      }
    }
  ],
  "outbounds": [
    {
      "tag": "direct",
      "protocol": "freedom"
    },
    {
      "tag": "block",
      "protocol": "blackhole"
    }
  ],
  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      {
        "type": "field",
        "ip": ["geoip:private"],
        "outboundTag": "block"
      }
    ]
  }
}

服务端 target      = www.bing.com:443
服务端 serverNames = www.bing.com
客户端 servername  = www.bing.com

sudo /usr/local/bin/xray run -test -config /usr/local/etc/xray/config.json

Configuration OK.

sudo systemctl enable --now xray
sudo systemctl restart xray
sudo systemctl status xray --no-pager -l

sudo ss -lntp | grep ':443'

sudo journalctl -u xray -n 100 --no-pager

sudo /usr/local/bin/xray run -test -config /usr/local/etc/xray/config.json
sudo journalctl -u xray -n 200 --no-pager

mixed-port: 7897
allow-lan: false
mode: rule
log-level: info
ipv6: false

proxies:
  - name: '我的-REALITY'
    type: vless
    server: <SERVER_IP>
    port: 443
    uuid: <UUID>
    network: tcp
    tls: true
    udp: true
    flow: xtls-rprx-vision
    servername: www.bing.com
    client-fingerprint: chrome
    reality-opts:
      public-key: <REALITY_PUBLIC_KEY>
      short-id: <SHORT_ID>

proxy-groups:
  - name: '节点选择'
    type: select
    proxies:
      - '我的-REALITY'
      - DIRECT

rules:
  - GEOIP,CN,DIRECT
  - MATCH,节点选择

nc -vz <SERVER_IP> 443

curl -x http://127.0.0.1:7897 https://api.ipify.org
echo

curl -I -x http://127.0.0.1:7897 https://www.google.com

sudo journalctl -u xray -f

sudo systemctl is-active xray
sudo systemctl status xray --no-pager -l
sudo /usr/local/bin/xray run -test -config /usr/local/etc/xray/config.json

sudo ss -lntp | grep ':443'

sudo ss -lntp '( sport = :443 )'

sudo ufw status verbose

服务器 IP
端口
UUID
REALITY 公钥
shortId
servername = www.bing.com

target: www.microsoft.com:443
serverNames: [www.microsoft.com]
servername: www.microsoft.com

服务端 target      → www.bing.com:443
服务端 serverNames → [www.bing.com]
客户端 servername  → www.bing.com

sudo apt update
sudo apt full-upgrade -y

sudo cp /usr/local/etc/xray/config.json /usr/local/etc/xray/config.json.$(date +%F).bak
sudo bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install
sudo /usr/local/bin/xray run -test -config /usr/local/etc/xray/config.json
sudo systemctl restart xray

/usr/local/bin/xray version
sudo systemctl status xray --no-pager -l
sudo journalctl -u xray -n 100 --no-pager

curl -sI https://claude.ai | grep -iE "cf-mitigated|^HTTP"

Clash Verge Rev → 服务器 Xray ─┬─ 普通流量 → direct（原出口）
                             └─ claude.ai / anthropic.com 等 → WARP → 目标站

cd ~
curl -fsSL -o wgcf "$(curl -fsSL https://api.github.com/repos/ViRb3/wgcf/releases/latest | grep browser_download_url | grep linux_amd64 | cut -d'"' -f4)"
chmod +x wgcf
./wgcf register --accept-tos
./wgcf generate
cat wgcf-profile.conf

PrivateKey  → 服务端 secretKey，后文记为 <WARP_PRIVATE_KEY>
Address     → 两行地址，v4 固定是 172.16.0.2/32，v6 记为 <WARP_IPV6>
PublicKey   → 固定为 bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=

TOKEN=$(grep access_token wgcf-account.toml | cut -d"'" -f2)
DEVICE=$(grep device_id wgcf-account.toml | cut -d"'" -f2)
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.cloudflareclient.com/v0a2158/reg/$DEVICE" \
  | grep -o '"client_id":"[^"]*"' | cut -d'"' -f4 | base64 -d | od -An -tu1

  "outbounds": [
    {
      "tag": "direct",
      "protocol": "freedom"
    },
    {
      "tag": "warp",
      "protocol": "wireguard",
      "settings": {
        "secretKey": "<WARP_PRIVATE_KEY>",
        "address": ["172.16.0.2/32", "<WARP_IPV6>/128"],
        "peers": [
          {
            "publicKey": "bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=",
            "endpoint": "engage.cloudflareclient.com:2408"
          }
        ],
        "reserved": [<RESERVED>],
        "mtu": 1280
      }
    },
    {
      "tag": "block",
      "protocol": "blackhole"
    }
  ],
  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      {
        "type": "field",
        "domain": [
          "domain:claude.ai",
          "domain:claude.com",
          "domain:anthropic.com",
          "domain:cloudflare.com"
        ],
        "outboundTag": "warp"
      },
      {
        "type": "field",
        "ip": ["geoip:private"],
        "outboundTag": "block"
      }
    ]
  }

sudo /usr/local/bin/xray run -test -config /usr/local/etc/xray/config.json
sudo systemctl restart xray
sudo systemctl status xray --no-pager -l

sudo journalctl -u xray -n 30 --no-pager

accepted tcp:claude.ai:443 [vless-reality-in -> warp]
accepted tcp:www.github.com:443 [vless-reality-in >> direct]

curl -x http://127.0.0.1:7897 -sI https://claude.ai | grep -iE "^HTTP|cf-mitigated"

curl -x http://127.0.0.1:7897 -s https://www.cloudflare.com/cdn-cgi/trace | grep -E "^(warp|ip)="