2020-09-12 更新：V2ray config fallback -> fallbacks2020-11-04 更新：感谢 @John 的建议，修改 Haproxy 和 V2ray 配置，增加 Trojan 方式和获取真实 ip我使用的是 Haproxy+Nginx/OpenResty+V2ray，和 GitHub 仓库示例不同，我没用 V2ray 处理 TLS, 用的是 Haproxy，Tcp 和 WebSocket 方式都有，仅贴出关键配置文件作为参考，客户端连接域名都为 www.example.com，端口 443怎么安装 xxx 、怎么我没有 xxx 文件、怎么申请域名和证书、怎么配置证书，自行 googleHaproxy:自行替换域名、证书路径，如有需要自行替换 /ray 路径global log /dev/log local0 log /dev/log local1 notice chroot /var/lib/haproxy stats socket /run/haproxy-stat.sock mode 660 level admin expose-fd listeners pidfile /run/haproxy.pid stats timeout 30s user haproxy group haproxy daemon ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets ssl-dh-param-file /etc/ssl/dhparam.pem defaults log global mode tcp option dontlognull timeout connect 15s timeout client 300s timeout server 300s frontend http mode tcp bind *:80 bind [::]:80 tcp-request inspect-delay 5s tcp-request content accept if HTTP use_backend openresty_http if HTTP frontend tls mode tcp bind *:443 ssl crt /etc/ssl/ecc.pem crt /etc/ssl/xx.pem alpn h2,http/1.1 bind [::]:443 ssl crt /etc/ssl/ecc.pem crt /etc/ssl/xx.pem alpn h2,http/1.1 tcp-request inspect-delay 5s tcp-request content accept if HTTP # V2ray 域名 acl v2ray_host hdr(host) -i www.example.com # V2ray Websocket acl hdr_connection_upgrade hdr(Connection) -i upgrade acl hdr_upgrade_websocket hdr(Upgrade) -i websocket acl websocket_path path -i /ray use_backend v2ray_vless-ws if v2ray_host websocket_path hdr_connection_upgrade hdr_upgrade_websocket # 将 HTTP 流量发给 web 后端 use_backend openresty_tls_http2 if HTTP { ssl_fc_alpn -i h2 } use_backend openresty_tls_http1_1 if HTTP # 将其他流量发给 v2ray 后端 default_backend v2ray_trojan-tcp backend openresty_http mode tcp server server1 127.0.0.1:8080 send-proxy backend openresty_tls_http1_1 mode tcp server server1 127.0.0.1:8081 send-proxy backend openresty_tls_http2 mode tcp server server1 127.0.0.1:8082 send-proxy backend v2ray_vless-tcp mode tcp server server1 127.0.0.1:56667 send-proxy backend v2ray_vless-ws mode tcp server server1 127.0.0.1:56666 send-proxy backend v2ray_trojan-tcp mode tcp server server1 127.0.0.1:56665 send-proxyNginx:主配置就不贴了，贴一个虚拟机配置，自行替换域名，如有需要自行替换 /ray 路径、放置网站和添加 php-fpm 支持等server { server_name www.example.com; access_log /var/log/nginx/www.example.com.log combined; listen 127.0.0.1:8080 proxy_protocol; set_real_ip_from 127.0.0.1; real_ip_header proxy_protocol; error_page 497 https://$host; if ($scheme = http) { return 301 https://$host; } } server { server_name www.example.com; access_log /var/log/nginx/www.example.com.log combined; root /srv/www/wwwroot/www.example.com; index index.html index.htm index.php; listen 127.0.0.1:8081 proxy_protocol; listen 127.0.0.1:8082 http2 proxy_protocol; set_real_ip_from 127.0.0.1; real_ip_header proxy_protocol; add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"; add_header X-Frame-Options SAMEORIGIN; add_header X-Content-Type-Options nosniff; add_header X-Xss-Protection "1; mode=block"; add_header Content-Security-Policy "upgrade-insecure-requests block-all-mixed-content"; }V2ray:自行替换 uuid 和域名以及 Trojan 密码，如有需要自行替换 /ray 路径{ "outbounds": [{ "protocol": "freedom", "settings": {}, "tag": "direct" }, { "protocol": "blackhole", "settings": {}, "tag": "block" } ], "inbounds": [{ "port": 56667, "listen": "127.0.0.1", "protocol": "vless", "settings": { "clients": [{ "id": "uuid" }], "decryption": "none", "fallbacks": [{ "alpn": "", "dest": 8081, "xver": 1 }, { "alpn": "h2", "dest": 8082, "xver": 1 } ] }, "streamSettings": { "tlsSettings": { "alpn": [ "h2", "http/1.1" ] }, "tcpSettings": { "acceptProxyProtocol": true } } }, { "port": 56666, "listen": "127.0.0.1", "protocol": "vless", "settings": { "clients": [{ "id": "uuid" }], "decryption": "none" }, "streamSettings": { "network": "ws", "wsSettings": { "acceptProxyProtocol": true, "path": "/ray", "host": ["www.example.com"] } } }， { "port": "56665", "listen": "127.0.0.1", "protocol": "trojan", "settings": { "clients": [{ "password": "password" }], "fallbacks": [{ "alpn": "", "dest": 56667, "xver": 1 }] }, "streamSettings": { "network": "tcp", "security": "none", "tcpSettings": { "acceptProxyProtocol": true } } } ] }
就这样吧，虽然以前的文章都有存档，但大部分都是发牢骚，选了些正经的发出来，至于评论那是永久性丢失