Доброго времени суток, уважаемые специалисты. Никак не могу заставить работать проксирование через CloudFlare по протоколу websocket.
Вот конфиг клиента (Nekobox)
{
"dns": {
"independent_cache": true,
"rules": [
{
"outbound": "any",
"server": "dns-direct"
},
{
"domain": [
"xxx.ru"
],
"domain_keyword": [
],
"domain_regex": [
],
"domain_suffix": [
],
"geosite": [
],
"server": "dns-direct"
},
{
"query_type": [
32,
33
],
"server": "dns-block"
},
{
"domain_suffix": ".lan",
"server": "dns-block"
}
],
"servers": [
{
"address": "https://dns.google/dns-query",
"address_resolver": "dns-local",
"detour": "proxy",
"strategy": "",
"tag": "dns-remote"
},
{
"address": "https://doh.pub/dns-query",
"address_resolver": "dns-local",
"detour": "direct",
"strategy": "",
"tag": "dns-direct"
},
{
"address": "rcode://success",
"tag": "dns-block"
},
{
"address": "local",
"detour": "direct",
"tag": "dns-local"
}
]
},
"inbounds": [
{
"domain_strategy": "",
"listen": "127.0.0.1",
"listen_port": 2080,
"sniff": true,
"sniff_override_destination": false,
"tag": "mixed-in",
"type": "mixed"
}
],
"log": {
"level": "info"
},
"outbounds": [
{
"domain_strategy": "",
"flow": "",
"packet_encoding": "xudp",
"server": "xxx.ru",
"server_port": 443,
"tag": "proxy",
"tls": {
"enabled": true,
"server_name": "xxx.ru"
},
"transport": {
"early_data_header_name": "Sec-WebSocket-Protocol",
"headers": {
"Host": "xxx.ru"
},
"max_early_data": 2560,
"path": "/123zz34",
"type": "ws"
},
"type": "vless",
"uuid": "e1...22"
},
{
"tag": "direct",
"type": "direct"
},
{
"tag": "bypass",
"type": "direct"
},
{
"tag": "block",
"type": "block"
},
{
"tag": "dns-out",
"type": "dns"
}
],
"route": {
"final": "proxy",
"rules": [
{
"outbound": "dns-out",
"protocol": "dns"
},
{
"network": "udp",
"outbound": "block",
"port": [
135,
137,
138,
139,
5353
]
},
{
"ip_cidr": [
"224.0.0.0/3",
"ff00::/8"
],
"outbound": "block"
},
{
"outbound": "block",
"source_ip_cidr": [
"224.0.0.0/3",
"ff00::/8"
]
}
]
}
}
Вот конфиг сервера Xray
"inbounds": [
{
"listen": "127.0.0.1",
"port": 8188,
"protocol": "vless",
"tag": "ws",
"settings": {
"clients": [
{
"id": "e1...22",
"email": "user1@myserver"
}
],
"decryption": "none"
},
"streamSettings": {
"network": "ws",
"security": "none",
"wsSettings": {
"path": "/123zz34"
}
}
}
],
"outbounds": [...
И конфиг Nginx
В Stream блоке
map $ssl_preread_server_name $sni_name {
hostnames;
www.google.com xray;
xxx.ru www2;
*.xxx.ru www2;
default xray;
}
upstream xray {
server 127.0.0.1:8050;
}
upstream www2 {
server 127.0.0.1:7543;
}
server {
listen 443;
proxy_pass $sni_name;
proxy_protocol on;
ssl_preread on;
}
...
В Server блоке:
server {
server_name xxx.ru;
listen 127.0.0.1:7543 ssl proxy_protocol so_keepalive=on;
listen [::1]:7543 ssl proxy_protocol so_keepalive=on;
http2 on;
index index.html;
root /etc/nginx/html/;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:AES256-GCM-SHA384:AES128-GCM-SHA256;
ssl_prefer_server_ciphers on;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
ssl_certificate /etc/ssl/cloudflare/origin.crt;
ssl_certificate_key /etc/ssl/cloudflare/origin.key;
# SSH-specific settings
ssl_early_data on;
...
location /123zz34 {
if ($http_upgrade != "websocket") {
return 404;
}
proxy_pass http://127.0.0.1:8188;
proxy_redirect off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_read_timeout 52w;
}
...
Сайт за CloudFlare, при проверке VPN соединения выдает 520 ошибку. Я уже весь мозг сломал. Сам сайт открывается и работает.
Также есть конфиг для reality, он работает (на другом домене), но по понятным причинам не проксируется через CloudFlare. И цель именно в реализации проксирования через CloudFlare.