mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-10-14 01:45:00 +03:00
MHSanaei
04cccef311
xray-core's masque transport reaches Cloudflare WARP with an enrolled ECDSA P-256 key, the endpoint's public key and the assigned tunnel addresses, which only a WARP enrollment hands out. A new regMasque action on /panel/api/xray/warp/:action registers a separate WARP device and enrolls a secp256r1 key for the masque tunnel (the API revision and client version the WARP apps enroll MASQUE keys with). Enrolling replaces a device's WireGuard key, so it never touches the stored WireGuard registration. It returns the PEM key pair, the addresses and the endpoint, and the WARP modal turns them into a warp-masque outbound (HTTP/3, Cloudflare's MASQUE SNI), or refreshes the one already there.
60 lines
3.3 KiB
Plaintext
60 lines
3.3 KiB
Plaintext
---
|
||
title: MASQUE
|
||
description: Serve MASQUE (CONNECT-IP) inbounds in 3x-ui, connect outbounds to MASQUE servers, and reach Cloudflare WARP over MASQUE.
|
||
icon: Waypoints
|
||
---
|
||
|
||
**MASQUE** carries IP packets over HTTP/3 (or HTTP/2) with the CONNECT-IP method, so a
|
||
client gets a full layer-3 tunnel that looks like ordinary HTTPS traffic. xray-core
|
||
serves it natively; 3x-ui offers it as an inbound protocol, an outbound protocol, and the
|
||
matching `masque` transport they both ride on.
|
||
|
||
## Inbound
|
||
|
||
| Field | Description |
|
||
| ---------------- | ----------- |
|
||
| **Clients** | Each client logs in with its **email** and **password** (HTTP Basic auth). Traffic, quotas, IP limits and expiry work like any other multi-user protocol. |
|
||
| **Address pool** | Prefixes the tunnel addresses are leased from — at most one IPv4 and one IPv6 (default `10.14.0.1/24`, `fd14::1/64`). The pool size caps how many clients can be connected at once. |
|
||
| **MTU** | Tunnel MTU, 1280–65535; leave empty for the core default. |
|
||
| **Path** | Request path the server answers on (default `/.well-known/masque/ip/*/*/`). |
|
||
| **Security** | Always TLS. The ALPN picks the listeners: `h3` serves HTTP/3 on UDP, `h2` serves HTTP/2 on TCP, and both together serve both. |
|
||
|
||
<Callout type="info">
|
||
MASQUE has no share-link format, so MASQUE inbounds get no link, QR code or Clash
|
||
entry. Clients get a ready-to-import config from the **JSON subscription**: a `masque`
|
||
outbound that authenticates with the client's email and password.
|
||
</Callout>
|
||
|
||
## Outbound
|
||
|
||
Pick **masque** as the outbound protocol, then set:
|
||
|
||
| Field | Description |
|
||
| ----------------------- | ----------- |
|
||
| **Address / Port** | The MASQUE server. |
|
||
| **Remote DNS** | Optional DNS server IPs queried inside the tunnel. |
|
||
| **Host / Path** | Authority and path of the CONNECT-IP request; the path must match the server's. |
|
||
| **Username / Password** | HTTP Basic credentials — on a 3x-ui server, the client's email and password. |
|
||
| **Headers** | Extra request headers. |
|
||
| **TLS** | Required. An ALPN of `h2` alone switches to HTTP/2 over TCP; otherwise HTTP/3 is used. |
|
||
|
||
## WARP over MASQUE
|
||
|
||
The quickest way is **Xray → Outbounds → WARP → Add WARP over MASQUE outbound**: the panel
|
||
registers a separate WARP device, enrolls a MASQUE key for it and adds a ready `warp-masque`
|
||
outbound (or refreshes the existing one). Your WireGuard WARP registration is not touched.
|
||
To set it up by hand instead:
|
||
|
||
Turn on **WARP** in the masque transport to reach Cloudflare WARP through its MASQUE
|
||
endpoint instead of WireGuard. It takes a WARP registration enrolled for MASQUE:
|
||
|
||
| Field | Description |
|
||
| ----------------------- | ----------- |
|
||
| **Private key** | The enrolled ECDSA P-256 private key (PEM, or base64 DER). |
|
||
| **Endpoint public key** | Cloudflare's endpoint public key returned by the enrollment. |
|
||
| **Tunnel addresses** | The IPv4 and IPv6 addresses Cloudflare assigned to the registration. |
|
||
|
||
Host and path then default to Cloudflare's endpoint, and WARP can't be combined with a
|
||
username or password. Point the outbound at the endpoint address from your enrollment and
|
||
set the TLS server name to `consumer-masque.cloudflareclient.com`.
|