v2ray-tutorial

v2ray-client-android.md

V2RayNG is probably one of the easier client to use, it requires sideloading.

Endpoint Setup

On the main interface, click the + icon, and Import from QRcode On your 3x-UI inbounds, click the + icon on your newly created endpoint to expand it, the click the QR Code icon. Use your camera to scan it.

If you skipped the external proxy step in 3X-UI

• click the triple circle icon next to your imported endpoint then Edit
• the address is probably your private IP, change it to your domain and change the port to 443
• add ws host as your domain
• scroll down to TLS, select tls from the dropdown
• set the SNI as your domain

Routing Setup

Click the hamburger menu to expand it and select Routing settings

By default, there are already many rules populated and these are in Chinese. Click the edit icon, then the recycle bin icon to delete all of these. There are many ways you can configure routing and it gets deeps, I'll show you a Tailscale like experience.

\

• Set default routing to direct, so it does not go through VPN
  • click the plus icon, add a remark
  • leave everything the same and for port, enter 0-65535, set outboundTag to direct
• Proxy LAN traffic
  • ip: enter your LAN subnet range, e.g. 192.168.0.1/24
  • outboundTag: proxy
• Unlike L3 VPN, since V2Ray is a proxy, the split tunneling can be based on domains
  • under domain, you can enter list of domains, or even geosite:category-ddns, this will proxy all dynamic DNS websites, for other categories here Rules on the bottom of the screen will be evaluated last, so your proxy rules must be above the final direct rule to overwrite it.
• Optional: I like to have a rule that proxy everything that's on top of all direct all, but have it disable, and only enable it when a site is blocked, this is similar to Tailscale Exit Node
  • same as direct, but set outboundTag to proxy

When completed, simply click the start icon and it should work.

Normally, every website traffic do not go through the VPN, so the speed should be fast, only traffic with destination to your LAN subnet goes through it encrypted, just like how Tailscale/Wireguard default configuration works. If you toggle the all proxy, everything will go through VPN, similar to turning on Tailscale Exit Node. The flexibility of V2Ray goes beyond split tunneling because you can add any domain or domain list to routing rules to tailor the public WiFi experience.

v2ray-client-ios.md

Shadowrocket is one of the few V2Ray VPN app and also easy to use for beginners. However, the app is paid $3 USD. Alternative apps exists, such as V2Box, Sing-box etc...

The process of importing and using follows similar principle to Android.

• on the top-left corner, click the scan icon to import your config
• you can click the info icon to edit it

Shadowrocket require additional setup for route LAN traffic

• on the bottom bar, click Config, then default.conf, Edit Config

• Under General
  • Skip Proxy: remove the part where it's your subnet e.g. 192,172,10
  • do the same for Tun Excluded Routes

• Under Rule, this is where you declare routing
  • click the add button on the top right
    • Type: IP-CIDR, enter your LAN subnet range
    • Policy: Proxy

In ShadowRocket, by default, everything foreign website is proxied while Chinese website do not get proxied. For a Tailscale-like experience, additional setup is needed. The final rule is proxy, so it may be better to use a whitelist mode where popular sites like Google, YouTube, Amazon to have direct policy.

Unfortunately, unlike V2Ray, ShadowRocket do not support geosite domains, so you'll need to track down and add domains manually. For detailed setup, you can refer to the translated community manual

v2ray-server.md

For setup, I will use Nginx Proxy Manager, but as long as your reverse proxy support WebSocket, it will work. For the VLESS+WS part, I will use 3X-UI, a simple click GUI; but if you prefer copy paste, I have ChatGPT based config which do not require any GUI or clicking, just copy/paste commands.

3x-UI

Official documentation. The panel will warn you it's insecure, but that's fine since we only access it in our local network. Here is the Docker Compose for setting up 3X-UI.

Important Important: You must change Xray Configs > Basics > Basic Routing > Blocked IPs and uncheck LAN . As we are specifically configuring V2Ray to access LAN resources.

Inbound

• Remark: easy to remember name
• Protocol: VLESS
• Port: anything you want, just remember it later
• Transmission: WebSocket
• Path: choose anything you want
• External Proxy: enable (this is only for convenience, you can edit this later)
  • The host is the domain you plan on using and port should be 443
• Leave everything default

Nginx Proxy Manager

The setup in NPM should be applicable to other services such as Traefik or Caddy, as long as you can reverse proxy a websocket endpoint. Some helpful YouTube tutorial on NPM.

• you must add Websockets Support
• Forward Hostname/IP and Port: you can set this to any existing services (e.g. Jellyfin) you want, this will serve as a fronting page against active probing
• Custom Location > Add Location
  • put the location and the forward port to what you defined in 3x-UI

By now, your server will run on port 80, plain HTTP, and it already capable of most public Wi-Fi. If you don't want to use HTTPS/TLS, I suggest changing V2Ray protocol to VMess or SS, since both VLESS and HTTP/WS are plaintext. Now onto TLS.

• under SSL, choose a certificate you already have (e.g. a wildcard one through DNS challenge) or request a new one from LetsEncrypt

ChatGPT V2Ray Setup

If you want to have a single configuration generated by AI, just copy and paste and start Xray (the V2Ray server), you can find the configuration here. However, you'll also need to follow Nginx Proxy Manager above to make it into TLS.

Example configuration (just copy/paste into your server): https://github.com/vttc08/insta-v2ray/blob/main/xray.json

You can find the instructions for setting up Xray server and how to run with configuration here. https://github.com/vttc08/insta-v2ray?tab=readme-ov-file#very-quick-start

To use it for clients, since there's no QR Code, use the URL below and replace with your domain accordingly

vless://aa59b127-2b94-4dde-b918-50c8872392ba@{REPLACE_WITH_YOUR_DOMAIN}:443?type=ws&path=%vless&host={REPLACE_WITH_YOUR_DOMAIN}&security=none&sni={REPLACE_WITH_YOUR_DOMAIN}&security=tls#myvless

• when following the instruction for Nginx Proxy Manager, you need to set port as 8080, the same as xray.json
• the UUID is hardcoded in the config file, you should generate your own

Architecture