mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-10-16 02:44:59 +03:00
MHSanaei
c5e1e54c75
xray-core opens an XDRIVE stream's storage only when the inbound starts listening, so a Google Drive inbound saved with the form's defaults (no folder, no secrets), a local one without a folder, or a template one whose template xray cannot use stopped xray and every other inbound with it. validateXDriveStorage applies the core's storage rules at save, on inbound add/update and on the xray template's inbounds and outbounds: the service must be local, Google Drive or template; local and Google Drive need a remoteFolder; Google Drive needs its three non-empty secrets; a template must pass newTemplateStorage's checks (put, get, list and delete urls, and a list namesRegex with one capture group). A VLESS client kept its xtls-rprx-vision flow when its inbound moved to a transport that cannot carry it, and GetXrayConfig only honoured DisableFlow, so the server demanded Vision there and refused every client. GetXrayConfig and the outbound form now apply the Vision gate, and that gate now follows the core in the backend, the subscription service and the frontend: TLS/REALITY on raw TCP, or VLESS encryption on any transport (xray runs Vision inside encryption.CommonConn whatever the transport, not only on XHTTP). The outbound modal passes the VLESS encryption into the gate and gates Mux on the effective flow.
231 lines
15 KiB
Plaintext
231 lines
15 KiB
Plaintext
---
|
||
title: Transports & Security
|
||
description: Every transport 3x-ui exposes — TCP, mKCP, WebSocket, gRPC, HTTPUpgrade, XHTTP, Hysteria, XDRIVE, MASQUE — with their settings, plus FinalMask obfuscation, sockopt, TLS/REALITY, XTLS-Vision, and VLESS encryption.
|
||
icon: Network
|
||
---
|
||
|
||
A **transport** decides how packets are carried between client and server, a
|
||
**security** layer decides how they're encrypted and disguised, and **FinalMask**
|
||
can obfuscate what's left. The panel only offers valid combinations; this page
|
||
lists every transport's settings and the rules the panel enforces.
|
||
|
||
## Transports
|
||
|
||
Pick the transport (the inbound's `network`) in the inbound/outbound form. Each
|
||
network writes its own settings key on the wire (`tcpSettings`, `kcpSettings`, …).
|
||
|
||
| Transport | Settings key | When to use it |
|
||
| --------------- | --------------------- | ---------------------------------------------------------------------- |
|
||
| **TCP (Raw)** | `tcpSettings` | Lowest overhead. The basis for REALITY + XTLS-Vision and fallbacks; optional HTTP/1.1 header camouflage. |
|
||
| **mKCP** | `kcpSettings` | Reliable protocol over **UDP** — trades bandwidth for lower latency on lossy links. Carries no TLS/REALITY. |
|
||
| **WebSocket** | `wsSettings` | Works through CDNs and HTTP reverse proxies; very compatible. |
|
||
| **gRPC** | `grpcSettings` | HTTP/2-based; multiplexes well and proxies cleanly through Nginx. |
|
||
| **HTTPUpgrade** | `httpupgradeSettings` | CDN-friendly HTTP/1.1 `Upgrade`; lighter than full WebSocket. |
|
||
| **XHTTP** | `xhttpSettings` | Modern stream-multiplexed HTTP transport; CDN-friendly and REALITY-capable. |
|
||
| **Hysteria** | `hysteriaSettings` | QUIC-based transport — only for the **Hysteria2** protocol. |
|
||
| **XDRIVE** | `xdriveSettings` | Tunnels the stream through files in shared cloud storage (Google Drive, a local folder or any HTTP storage API). |
|
||
| **MASQUE** | `masqueSettings` | CONNECT-IP over HTTP/3 or HTTP/2 — only for the **MASQUE** protocol. See [MASQUE](/docs/config/masque). |
|
||
|
||
<Callout type="info">
|
||
**WireGuard** and **Tunnel** (dokodemo-door) inbounds expose no transport
|
||
selector — their stream carries only security/sockopt. Earlier panels also
|
||
exposed a raw **HTTP/2 (`http`)** transport; it has been superseded by **XHTTP**
|
||
and is no longer selectable.
|
||
</Callout>
|
||
|
||
### TCP (Raw) — `tcpSettings`
|
||
|
||
| Field | Default | Meaning |
|
||
| ------------------------------ | ------- | ----------------------------------------------------------------------- |
|
||
| `acceptProxyProtocol` | `false` | Accept the PROXY protocol from an upstream proxy so the real client IP is preserved. |
|
||
| `header.type` | `none` | `none`, or `http` for HTTP/1.1 camouflage. |
|
||
| `header.request` / `response` | — | When `type: http`: method, path, version and a header map that mimic a normal HTTP exchange. |
|
||
|
||
### mKCP — `kcpSettings`
|
||
|
||
| Field | Default | Meaning |
|
||
| ------------------ | ----------- | ---------------------------------------------------------------- |
|
||
| `mtu` | `1350` | Maximum transmission unit, in bytes (576–1460). |
|
||
| `tti` | `20` | Transmission time interval, in ms (10–100). Lower = more responsive, more overhead. |
|
||
| `uplinkCapacity` | `5` | Upload bandwidth budget, in **MB/s**. |
|
||
| `downlinkCapacity` | `20` | Download bandwidth budget, in **MB/s**. |
|
||
| `cwndMultiplier` | `1` | Congestion-window multiplier; raise to push harder on good links. |
|
||
| `maxSendingWindow` | `2097152` | Upper bound on in-flight packets. |
|
||
|
||
<Callout type="info">
|
||
mKCP can't carry TLS or REALITY. To disguise it, add a **FinalMask** UDP mask —
|
||
the `mkcp-legacy` mask reproduces the classic header obfuscation that older Xray
|
||
stored in `kcpSettings.header`/`seed` (those fields no longer exist here).
|
||
</Callout>
|
||
|
||
### WebSocket — `wsSettings`
|
||
|
||
| Field | Default | Meaning |
|
||
| --------------------- | ------- | ---------------------------------------------------------------- |
|
||
| `path` | `/` | Request path — route on it when several services share one host. |
|
||
| `host` | _(none)_| `Host` header override (useful behind a CDN). |
|
||
| `headers` | `{}` | Extra request headers. |
|
||
| `heartbeatPeriod` | `0` | Seconds between keepalive pings; `0` disables them. |
|
||
| `acceptProxyProtocol` | `false` | Accept the PROXY protocol from an upstream. |
|
||
|
||
### gRPC — `grpcSettings`
|
||
|
||
| Field | Default | Meaning |
|
||
| ------------- | ------- | --------------------------------------------------------- |
|
||
| `serviceName` | _(none)_| gRPC service path; acts like a secret route. |
|
||
| `authority` | _(none)_| `:authority` pseudo-header override. |
|
||
| `multiMode` | `false` | Multiplex several streams over one connection. |
|
||
|
||
### HTTPUpgrade — `httpupgradeSettings`
|
||
|
||
| Field | Default | Meaning |
|
||
| --------------------- | ------- | --------------------------------------------- |
|
||
| `path` | `/` | Request path. |
|
||
| `host` | _(none)_| `Host` header override. |
|
||
| `headers` | `{}` | Extra request headers. |
|
||
| `acceptProxyProtocol` | `false` | Accept the PROXY protocol from an upstream. |
|
||
|
||
HTTPUpgrade is a one-shot HTTP/1.1 `Upgrade` with no WebSocket framing — there's
|
||
no heartbeat field.
|
||
|
||
### XHTTP — `xhttpSettings`
|
||
|
||
XHTTP (SplitHTTP) has a large field set; the panel fills sensible defaults. The
|
||
ones you'll usually touch:
|
||
|
||
| Field | Default | Meaning |
|
||
| ---------------------- | ----------- | ---------------------------------------------------------------------- |
|
||
| `path` | `/` | Request path. |
|
||
| `host` | _(none)_ | `Host` header override. |
|
||
| `mode` | `auto` | `auto`, `packet-up`, `stream-up`, or `stream-one`. `packet-up` is the most CDN-compatible; `stream-*` are lower latency. |
|
||
| `xPaddingBytes` | `100-1000` | Random padding range that blurs packet sizes. |
|
||
| `scMaxBufferedPosts` | `30` | Server-side buffer for uploaded POSTs. |
|
||
| `scStreamUpServerSecs` | `20-80` | Stream-up server window (dash range). |
|
||
| `xmux` (`enableXmux`) | _(off)_ | Connection multiplexing — `maxConcurrency` `16-32`, `maxConnections` `6`, … Turn on for high concurrency. |
|
||
|
||
Session-ID fields (`sessionIDPlacement`, `sessionIDKey`, `sessionIDTable`,
|
||
`sessionIDLength`) and the `scMin/MaxEachPostBytes` knobs are advanced; leave them
|
||
empty unless you're matching a specific upstream.
|
||
|
||
### Hysteria — `hysteriaSettings`
|
||
|
||
Only valid when the protocol is **Hysteria2**.
|
||
|
||
| Field | Default | Meaning |
|
||
| ---------------- | ------- | ----------------------------------------------------------------------- |
|
||
| `version` | `2` | Hysteria protocol version. |
|
||
| `auth` | _(none)_| Shared authentication string. |
|
||
| `udpIdleTimeout` | `60` | Seconds (2–600) before idle UDP sessions are dropped. |
|
||
| `masquerade` | — | Disguise as an HTTP/3 server: `type` `proxy`/`file`/`string` with `url`/`dir`/`content`, plus `headers` and `statusCode`. |
|
||
|
||
### XDRIVE — `xdriveSettings`
|
||
|
||
XDRIVE carries the stream as files in a folder both ends can reach: the server polls
|
||
that folder instead of accepting connections on its port. Both sides must use the
|
||
**same** service, folder and secrets, so the JSON subscription ships them to every
|
||
client; XDRIVE inbounds get no share link or Clash entry.
|
||
|
||
| Field | Default | Meaning |
|
||
| -------------- | -------------- | ----------------------------------------------------------------------- |
|
||
| `service` | `Google Drive` | `Google Drive`, `local` (a folder on disk) or `template` (any HTTP storage API). |
|
||
| `remoteFolder` | — | Folder that holds the session files. |
|
||
| `secrets` | — | Google Drive: ClientID, ClientSecret, RefreshToken — exactly three, in that order. Template: values read as `{secret0}`, `{secret1}`, …. |
|
||
| `template` | — | Template service only: the storage API's `auth`, `put`, `get`, `list` and `delete` operations. |
|
||
| tuning | core defaults | `segmentBytes` (512 KiB), `flushIntervalMs` (20), `pollIntervalMs`/`maxPollIntervalMs` (50/500), `eagerWindowMs` (2000), `holeTimeoutMs` (30000), `sessionTtlSeconds` (300), `concurrency` (8). |
|
||
|
||
The optional **Front address/port** (the stream-level `address`/`port`) is a domain
|
||
front the storage API is dialed through; TLS still names the API host. XDRIVE has
|
||
no TLS/REALITY layer of its own — its traffic is the storage API's HTTPS. On an
|
||
outbound, **TLS** security shapes that HTTPS connection: its SNI, uTLS fingerprint
|
||
and ALPN are what the storage API sees.
|
||
|
||
## FinalMask — late-layer obfuscation
|
||
|
||
**FinalMask** wraps traffic **after** the transport and security layers, so it can
|
||
disguise transports that don't carry TLS (like mKCP) or add a second skin on top of
|
||
TLS. Masks are configured per direction:
|
||
|
||
- **TCP masks** — `fragment`, `sudoku`, `header-custom`, `xmc` (disguises the
|
||
stream as Minecraft protocol traffic; requires a password, with optional
|
||
hostname and player usernames).
|
||
- **UDP masks** — `salamander`, `mkcp-legacy`, `header-custom`, `xdns`, `xicmp`,
|
||
`noise`, `sudoku`, `realm`, plus the client-only `udphop`. (`mkcp-legacy`
|
||
reproduces the old mKCP header obfuscation; `udphop` rotates the remote port —
|
||
and optionally the remote IP — on an interval or per connection to dodge port
|
||
blocking.)
|
||
- **QUIC params** — congestion control (`reno`, `bbr`, `brutal`, `force-brutal`),
|
||
Brutal up/down rates, and receive-window tuning. On an inbound, **UDP Hop** sets
|
||
the port range advertised to clients (the share link's `mport` and the JSON
|
||
subscription's `udphop` mask); the server still listens on its own port. Since
|
||
Xray 26.9.9 a client hops only through the `udphop` mask, so the panel converts
|
||
an older client `quicParams.udpHop` to it.
|
||
|
||
FinalMask replaces the per-transport `header`/`seed` obfuscation that older Xray
|
||
builds exposed.
|
||
|
||
## sockopt — low-level socket options
|
||
|
||
`sockopt` rides alongside any transport and tunes the underlying socket. The most
|
||
useful fields:
|
||
|
||
| Field | Default | Meaning |
|
||
| --------------------- | ------- | ---------------------------------------------------------------- |
|
||
| `tcpFastOpen` | `false` | Enable TCP Fast Open. |
|
||
| `tcpcongestion` | `bbr` | Congestion control: `bbr`, `cubic`, or `reno`. |
|
||
| `tproxy` | `off` | Transparent proxy mode: `off`, `redirect`, or `tproxy`. |
|
||
| `domainStrategy` | `AsIs` | How addresses resolve (`UseIP`, `ForceIPv4`, …). |
|
||
| `dialerProxy` | _(none)_| Chain this outbound's dialing through another outbound tag. |
|
||
| `interface` | _(none)_| Bind to a specific network interface. |
|
||
| `mark` | `0` | SO_MARK for policy routing (`0` = unset). |
|
||
|
||
Numeric fields left at `0` are omitted on the wire so Xray keeps OS defaults.
|
||
Advanced entries (`happyEyeballs`, `customSockopt[]`, keepalive timers) are
|
||
available for special cases.
|
||
|
||
## Security
|
||
|
||
The security layer is one of **`none`**, **`tls`**, or **`reality`**, with these
|
||
eligibility rules:
|
||
|
||
| Security | Eligible transports | Eligible protocols |
|
||
| ----------- | -------------------------------------------- | --------------------------------------------------- |
|
||
| **TLS** | `tcp`, `ws`, `grpc`, `httpupgrade`, `xhttp` | VLESS, VMess, Trojan, Shadowsocks (Hysteria2 is always TLS) |
|
||
| **REALITY** | `tcp`, `grpc`, `xhttp` | VLESS, Trojan |
|
||
|
||
mKCP and Hysteria don't take a separate TLS/REALITY layer — mKCP runs plaintext
|
||
(obfuscate with FinalMask), and Hysteria is QUIC/TLS by design. REALITY disguises
|
||
your server as a real TLS site and needs no certificate — see
|
||
[REALITY](/docs/config/reality).
|
||
|
||
## XTLS-Vision flow
|
||
|
||
The `xtls-rprx-vision` flow is fast and DPI-resistant. It's available for
|
||
**VLESS** when either:
|
||
|
||
- the transport is raw **TCP** with **TLS** or **REALITY** security (classic
|
||
XTLS-Vision), or
|
||
- VLESS encryption is enabled, on any transport (see below).
|
||
|
||
Set the flow on the VLESS **client**, not the inbound. With classic Vision on
|
||
TCP, the panel can also offer a **Vision seed** once a client uses the flow.
|
||
|
||
## VLESS encryption (ML-KEM)
|
||
|
||
VLESS supports post-quantum **encryption** (ML-KEM / `mlkem768x25519`), stored in
|
||
the inbound's `decryption` (server) and clients' `encryption` (for link
|
||
generation). When enabled, it unlocks the Vision flow on any transport. Generate the
|
||
keys from the panel's VLESS settings.
|
||
|
||
## Shadowsocks ciphers
|
||
|
||
Shadowsocks inbounds support both classic ciphers and **Shadowsocks-2022**
|
||
(method names starting with `2022-blake3-`). `2022-blake3-chacha20-poly1305` is not
|
||
offered for inbounds: Xray-core supports it only without users, and every panel
|
||
inbound has clients. Outbounds can still use it.
|
||
|
||
<Callout type="info">
|
||
Transports and security must match on both ends. The client's share link
|
||
encodes them (`type=ws`, `security=reality`, `flow=xtls-rprx-vision`, …) —
|
||
decode any link with the [share-link inspector](/docs/config/share-links).
|
||
</Callout>
|