VPN 代理筆記

# 檢查目前演算法（Linux server 或 RPi5）
sysctl net.ipv4.tcp_congestion_control

# 啟用 BBR（核心需 >= 4.9）
echo "net.core.default_qdisc=fq" | sudo tee -a /etc/sysctl.conf
echo "net.ipv4.tcp_congestion_control=bbr" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

IF gRPC 健康：使用 gRPC（主線）
ELSE IF gRPC 不穩：切換 → Reality
IF Reality 也不穩或被封：切換 → Hysteria2
IF 全部失敗：每 10 秒重試 gRPC（backoff）

IF gRPC 穩定滿 60 秒：切回 gRPC（主線）

OBS / 手機 App
   → RTMP(TCP) 或 SRT(UDP)                     ← 第一層：直播內容協議
      → 包進 VPN 隧道（Reality/gRPC/Hysteria2） ← 第二層：科學上網隧道協議
         → 送到 VPS → 平台伺服器

bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)

# Debian / Ubuntu 安裝工具
apt update && apt install -y mtr-tiny traceroute iputils-ping curl

# 確認 VPS 的出口 IP 與地理位置
curl ip.sb
curl ip-api.com/json

# 分別測三大運營商方向（各跑 100 次取樣）
mtr -rwzbc 100 223.5.5.5        # 電信（阿里 DNS，AS4134）
mtr -rwzbc 100 114.114.114.114  # 聯通方向探測（114 DNS 為第三方公共 DNS，非聯通官方基礎設施，僅作經驗性替代）
mtr -rwzbc 100 180.76.76.76     # 移動路由測試（目標為百度 DNS，AS55967，僅作探測用途）


# 參數說明：
# -r 報告模式  -w 寬格式  -z 顯示 ASN (最關鍵)
# -b 顯示 IP/hostname  -c 取樣次數

$xrayPath = ".\xray.exe"   # 改成你的 xray.exe 實際路徑

$domains = @(
    "www.apple.com",
    "dl.google.com",
    "www.microsoft.com",
    "download-installer.cdn.mozilla.net",
    "addons.mozilla.org",
    "www.bing.com",
    "www.nvidia.com",
    "www.amd.com",
    "downloadmirror.intel.com",
    "www.adobe.com",
    "www.wto.org",
    "www.debian.org",
    "www.amazon.com",
    "www.ebay.com",
    "www.samsung.com",
    "www.ibm.com",
    "www.oracle.com",
    "www.cisco.com",
    "www.dell.com",
    "www.hp.com"
)

$results = @()
foreach ($d in $domains) {
    Write-Host "`n========== $d ==========" -ForegroundColor Cyan
    $row = [ordered]@{ Domain=$d; TLS13="-"; ALPNh2="-"; ECH="-"; Redirect="-"; OCSP="-"; PingMs="-" }
    Write-Host "--- OpenSSL 篩選 ---" -ForegroundColor Yellow
    $result = "" | openssl s_client -connect "${d}:443" -tls1_3 -alpn h2 -servername $d -status 2>&1
    $tls13 = $result | Select-String "TLSv1.3"
    $alpn  = $result | Select-String "ALPN protocol: h2"
    $group = $result | Select-String "Negotiated TLS1.3 group"
    $ocsp  = $result | Select-String "OCSP Response Status: successful"
    if ($tls13) { Write-Host "  TLS1.3: OK" -ForegroundColor Green; $row.TLS13="OK" } else { Write-Host "  TLS1.3: FAIL" -ForegroundColor Red; $row.TLS13="FAIL" }
    if ($alpn)  { Write-Host "  ALPN h2: OK" -ForegroundColor Green; $row.ALPNh2="OK" } else { Write-Host "  ALPN h2: FAIL" -ForegroundColor Red; $row.ALPNh2="FAIL" }
    if ($group) { Write-Host "  金鑰群組: $group" }
    if ($ocsp)  { Write-Host "  OCSP Stapling: 有 (加分項)" -ForegroundColor Green; $row.OCSP="有" } else { Write-Host "  OCSP Stapling: 無"; $row.OCSP="無" }
    if (-not $alpn) { Write-Host "  --> ALPN 不合格，略過後續測試" -ForegroundColor DarkGray; $results += [PSCustomObject]$row; continue }
    Write-Host "--- ECH (DNS HTTPS 記錄) ---" -ForegroundColor Yellow
    try {
        $httpsRecord = Resolve-DnsName -Name $d -Type HTTPS -ErrorAction Stop
        $echFound = $httpsRecord | Where-Object { $_.Strings -match "ech" -or $_.NameExchange -match "ech" }
        if ($echFound) { Write-Host "  ECH: 有部署，不建議作為 Reality 目標" -ForegroundColor Red; $row.ECH="有(不建議)" } else { Write-Host "  ECH: 未發布 ECH 設定" -ForegroundColor Green; $row.ECH="無" }
    } catch { Write-Host "  ECH: 查無 HTTPS 記錄 (視為未部署 ECH)" -ForegroundColor Green; $row.ECH="無記錄" }
    Write-Host "--- 跳轉檢查 ---" -ForegroundColor Yellow
    try {
        $resp = Invoke-WebRequest -Uri "https://$d" -MaximumRedirection 0 -ErrorAction Stop -UseBasicParsing -TimeoutSec 8
        $code = [int]$resp.StatusCode
        if ($code -ge 300 -and $code -lt 400) { Write-Host "  偵測到跳轉 (狀態碼: $code)，扣分" -ForegroundColor Red; $row.Redirect="有跳轉" }
        else { Write-Host "  無跳轉 (狀態碼: $code)" -ForegroundColor Green; $row.Redirect="無" }
    } catch {
        $code = $_.Exception.Response.StatusCode.value__
        if ($code -ge 300 -and $code -lt 400) { Write-Host "  偵測到跳轉 (狀態碼: $code)，扣分" -ForegroundColor Red; $row.Redirect="有跳轉" }
        elseif ($_.Exception.Message -match "timed out|timeout") { Write-Host "  跳轉檢查逾時，略過" -ForegroundColor DarkGray; $row.Redirect="逾時" }
        else { Write-Host "  無法判斷 (狀態碼: $code)" -ForegroundColor DarkGray; $row.Redirect="未知" }
    }
    Write-Host "--- Xray TLS Ping ---" -ForegroundColor Yellow
    if (Test-Path $xrayPath) { & $xrayPath tls ping $d } else { Write-Host "  找不到 xray.exe，略過此步驟" -ForegroundColor DarkGray }
    Write-Host "--- Ping 延遲 ---" -ForegroundColor Yellow
    $pingResult = Test-Connection -ComputerName $d -Count 4 -ErrorAction SilentlyContinue
    if ($pingResult) { $avg = ($pingResult | Measure-Object -Property ResponseTime -Average).Average; Write-Host "  平均延遲: $([math]::Round($avg,1)) ms"; $row.PingMs=[math]::Round($avg,1) } else { Write-Host "  Ping 無回應 (可能封鎖 ICMP)" -ForegroundColor DarkGray; $row.PingMs="無回應" }
    $results += [PSCustomObject]$row
}
Write-Host "`n`n================ 總結 ================" -ForegroundColor Magenta
$results | Format-Table -AutoSize

$domains = @(
    "www.apple.com",
    "dl.google.com",
    "www.microsoft.com",
    "download-installer.cdn.mozilla.net",
    "addons.mozilla.org",
    "www.bing.com",
    "www.nvidia.com",
    "www.amd.com",
    "downloadmirror.intel.com",
    "www.adobe.com",
    "www.wto.org",
    "www.debian.org",
    "www.amazon.com",
    "www.ebay.com",
    "www.samsung.com",
    "www.ibm.com",
    "www.oracle.com",
    "www.cisco.com",
    "www.dell.com",
    "www.hp.com"
)

foreach ($d in $domains) {
    Write-Host "`n=== 測試: $d ===" -ForegroundColor Cyan

    $result = echo "" | openssl s_client -connect "${d}:443" -tls1_3 -alpn h2 -servername $d -status 2>&1

    $tls13 = $result | Select-String "TLSv1.3"
    $alpn  = $result | Select-String "ALPN protocol: h2"
    $group = $result | Select-String "Negotiated TLS1.3 group"
    $ocsp  = $result | Select-String "OCSP Response Status: successful"

    if ($tls13) { Write-Host "  TLS1.3: OK" -ForegroundColor Green } else { Write-Host "  TLS1.3: FAIL" -ForegroundColor Red }
    if ($alpn)  { Write-Host "  ALPN h2: OK" -ForegroundColor Green } else { Write-Host "  ALPN h2: FAIL" -ForegroundColor Red }
    if ($group) { Write-Host "  金鑰群組: $group" }
    if ($ocsp)  { Write-Host "  OCSP Stapling: 有 (加分項)" -ForegroundColor Green } else { Write-Host "  OCSP Stapling: 無" }

    # ECH 改查 DNS HTTPS 記錄，才是準確的判斷方式
    try {
        $httpsRecord = Resolve-DnsName -Name $d -Type HTTPS -ErrorAction Stop
        $echFound = $httpsRecord | Where-Object { $_.Strings -match "ech" }
        if ($echFound) { Write-Host "  ECH: 有部署，不建議使用" -ForegroundColor Red } else { Write-Host "  ECH: 未發布 ECH 設定" -ForegroundColor Green }
    } catch {
        Write-Host "  ECH: 查無 HTTPS 記錄 (視為未部署)" -ForegroundColor Green
    }

    # 跳轉檢查
    try {
        $resp = Invoke-WebRequest -Uri "https://$d" -MaximumRedirection 0 -ErrorAction Stop -UseBasicParsing
        Write-Host "  跳轉: 無 (狀態碼 $($resp.StatusCode))" -ForegroundColor Green
    } catch {
        $code = $_.Exception.Response.StatusCode.value__
        if ($code -ge 300 -and $code -lt 400) { Write-Host "  跳轉: 有 (狀態碼 $code)，扣分" -ForegroundColor Red } else { Write-Host "  跳轉: 無法判斷 (狀態碼 $code)" -ForegroundColor DarkGray }
    }
}

$xrayPath = ".\xray.exe"   # 改成你的 xray.exe 實際路徑

$domains = @(
    "www.apple.com",
    "dl.google.com",
    "www.microsoft.com",
    "download-installer.cdn.mozilla.net",
    "addons.mozilla.org",
    "www.bing.com",
    "www.nvidia.com",
    "www.amd.com",
    "downloadmirror.intel.com",
    "www.adobe.com",
    "www.wto.org",
    "www.debian.org",
    "www.amazon.com",
    "www.ebay.com",
    "www.samsung.com",
    "www.ibm.com",
    "www.oracle.com",
    "www.cisco.com",
    "www.dell.com",
    "www.hp.com"
)

if (-not (Test-Path $xrayPath)) {
    Write-Host "找不到 xray.exe，請確認 `$xrayPath 路徑" -ForegroundColor Red
    return
}

foreach ($d in $domains) {
    Write-Host "`n=== 測試: $d ===" -ForegroundColor Cyan
    & $xrayPath tls ping $d
}

@echo off
setlocal enabledelayedexpansion

set domains=www.apple.com dl.google.com www.microsoft.com download-installer.cdn.mozilla.net addons.mozilla.org www.bing.com www.nvidia.com www.amd.com downloadmirror.intel.com www.adobe.com www.wto.org www.debian.org www.amazon.com www.ebay.com www.samsung.com www.ibm.com www.oracle.com www.cisco.com www.dell.com www.hp.com

for %%d in (%domains%) do (
    echo === %%d ===
    echo. | openssl s_client -connect %%d:443 -tls1_3 -alpn h2 -servername %%d -status 2>&1 | findstr /C:"TLSv1.3" /C:"ALPN protocol" /C:"Negotiated TLS1.3 group" /C:"OCSP Response Status: successful"

    rem ECH 改查 DNS HTTPS 記錄 (type=65)，openssl 本身測不出 ECH
    nslookup -type=65 %%d 2>&1 | findstr /I "ech" >nul
    if !errorlevel! == 0 (
        echo   ECH: 可能有部署，不建議使用
    ) else (
        echo   ECH: 未偵測到
    )
    echo.
)
pause

#!/bin/bash

domains=(
    www.apple.com
    dl.google.com
    www.microsoft.com
    download-installer.cdn.mozilla.net
    addons.mozilla.org
    www.bing.com
    www.nvidia.com
    www.amd.com
    downloadmirror.intel.com
    www.adobe.com
    www.wto.org
    www.debian.org
    www.amazon.com
    www.ebay.com
    www.samsung.com
    www.ibm.com
    www.oracle.com
    www.cisco.com
    www.dell.com
    www.hp.com
)

for d in "${domains[@]}"; do
    echo "=== $d ==="
    result=$(echo | openssl s_client -connect "$d:443" -tls1_3 -alpn h2 -servername "$d" -status 2>&1)

    echo "$result" | grep -q "TLSv1.3" && echo "  TLS1.3: OK" || echo "  TLS1.3: FAIL"
    echo "$result" | grep -q "ALPN protocol: h2" && echo "  ALPN h2: OK" || echo "  ALPN h2: FAIL"
    echo "$result" | grep "Negotiated TLS1.3 group"
    echo "$result" | grep -q "OCSP Response Status: successful" && echo "  OCSP Stapling: 有 (加分項)" || echo "  OCSP Stapling: 無"

    # ECH 改用 dig 查 HTTPS 記錄，比 openssl 準確
    if command -v dig &> /dev/null; then
        echDetect=$(dig +short HTTPS "$d" | grep -i "ech=")
        if [ -n "$echDetect" ]; then
            echo "  ECH: 有部署，不建議使用"
        else
            echo "  ECH: 未發布 ECH 設定"
        fi
    else
        echo "  ECH: 未安裝 dig，略過檢查"
    fi

    # 跳轉檢查
    redirectCode=$(curl -s -o /dev/null -w "%{http_code}" -I "https://$d" --max-redirs 0)
    if [[ "$redirectCode" =~ ^3 ]]; then
        echo "  跳轉: 有 (狀態碼 $redirectCode)，扣分"
    else
        echo "  跳轉: 無 (狀態碼 $redirectCode)"
    fi

    ping -c 3 -q "$d" | tail -1
    echo ""
done

#!/bin/bash

domains=(
    www.apple.com
    dl.google.com
    www.microsoft.com
    download-installer.cdn.mozilla.net
    addons.mozilla.org
    www.bing.com
    www.nvidia.com
    www.amd.com
    downloadmirror.intel.com
    www.adobe.com
    www.wto.org
    www.debian.org
    www.amazon.com
    www.ebay.com
    www.samsung.com
    www.ibm.com
    www.oracle.com
    www.cisco.com
    www.dell.com
    www.hp.com
)

if ! command -v xray &> /dev/null; then
    echo "找不到 xray 指令，請確認已安裝並在 PATH 中"
    exit 1
fi

for d in "${domains[@]}"; do
    echo "=== $d ==="
    xray tls ping "$d"
    echo ""
done

bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)

{
  "log": { "loglevel": "warning" },
  "inbounds": [
    {
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "<YOUR_UUID_1>",
            "email": "user-self",
            "flow": "xtls-rprx-vision"
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "dest": "www.cloudflare.com:443",
          "serverNames": ["www.cloudflare.com"],
          "privateKey": "<YOUR_PRIVATE_KEY>",
          "shortIds": ["", "0123456789abcdef"]
        }
      }
    }
  ],
  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      { "type": "field", "ip": ["geoip:private"], "outboundTag": "block" },
      { "type": "field", "protocol": ["bittorrent"], "outboundTag": "block" }
    ]
  },
  "outbounds": [
    { "protocol": "freedom", "tag": "direct" },
    { "protocol": "blackhole", "tag": "block" }
  ]
}

listen: :443

# TLS 憑證 (使用 ACME 自動簽發)
acme:
  domains:
    - "<YOUR_DOMAIN>"
  email: "<YOUR_EMAIL>"

# 身份驗證
auth:
  type: userpass
  userpass:
    "user1": "<STRONG_PASSWORD_1>"
    "user2": "<STRONG_PASSWORD_2>"

# 封鎖 QUIC 放大攻擊向量
acl:
  inline:
    - reject(all, udp/443)

# QUIC 效能調整 (針對直播長連接優化)
quic:
  initStreamReceiveWindow: 4194304
  maxStreamReceiveWindow: 8388608
  initConnReceiveWindow: 10485760
  maxConnReceiveWindow: 20971520
  maxIdleTimeout: 120s

# 頻寬上限 (依 VPS 實際頻寬調整)
bandwidth:
  up: 100 mbps
  down: 100 mbps

# 偽裝網站 (有人掃描 IP 時顯示)
masquerade:
  type: proxy
  proxy:
    url: https://www.bing.com
    rewriteHost: true

# Linux 伺服器確認時間同步狀態
timedatectl status

# 若未同步，啟用 NTP
sudo timedatectl set-ntp true

// 在 config.json 的 log 區塊加入：
"log": {
  "loglevel": "warning",
  "access": "access.log",
  "error": "error.log"
}

# 產生新 UUID 的指令
xray uuid
# 或
uuidgen

powershell -ExecutionPolicy Bypass -File .\hysteria2-masquerade-test.ps1 -Domains "www.bing.com","www.cloudflare.com","dl.google.com" -Samples 8