[Clash模板] XHTTP stream-up + Reality + 上下行v4/v6分离+ xmux + .....

[Chen017]

配置了一下xhttp，跑通了，不知道有什么可以改进的，发出来给大家看看
准确地说组合是 XHTTP stream-up + Reality + 上下行v4/v6分离+ xmux + BBR + TFO + MPTCP+ Header padding (Referer)
如果要照抄记得更新mihomo内核到最新

服务端

{
  "log": {
    "loglevel": "warning"
  },
  "dns": {
    "servers": ["localhost"]
  },
  "inbounds": [
    {
      "tag": "public_443_v6",
      "listen": "::",
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "用户UUID",
            "flow": "xtls-rprx-vision",
            "email": "vision-us-v6"
          }
        ],
        "decryption": "none",
        "fallbacks": [
          {
            "dest": "@xhttp_inner"
          }
        ]
      },
      "streamSettings": {
        "network": "raw",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "dest": "目标域名甲:443",
          "serverNames": [
            "目标域名甲"
          ],
          "privateKey": "服务端私钥",
          "shortIds": [
            "",
            "短ID甲"
          ]
        },
        "sockopt": {
          "tcpFastOpen": true,
          "tcpCongestion": "bbr"
        }
      },
      "sniffing": {
        "enabled": true,
        "destOverride": ["http", "tls", "quic"],
        "routeOnly": true
      }
    },
    {
      "tag": "public_443_v4",
      "listen": "0.0.0.0",
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "用户UUID",
            "flow": "xtls-rprx-vision",
            "email": "vision-us-v4"
          }
        ],
        "decryption": "none",
        "fallbacks": [
          {
            "dest": "@xhttp_inner"
          }
        ]
      },
      "streamSettings": {
        "network": "raw",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "dest": "目标域名乙:443",
          "serverNames": [
            "目标域名乙",
            "目标域名丙"
          ],
          "privateKey": "服务端私钥",
          "shortIds": [
            "",
            "短ID乙",
            "短ID丙",
            "短ID丁"
          ]
        },
        "sockopt": {
          "tcpFastOpen": true,
          "tcpCongestion": "bbr"
        }
      },
      "sniffing": {
        "enabled": true,
        "destOverride": ["http", "tls", "quic"],
        "routeOnly": true
      }
    },
    {
      "tag": "local_xhttp_stream_up",
      "listen": "@xhttp_inner",
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "用户UUID",
            "flow": "",
            "email": "xhttp-stream-up"
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "xhttp",
        "security": "none",
        "xhttpSettings": {
          "mode": "stream-up",
          "host": "",
          "path": "/api/v1/updates",
          "uplinkMethod": "PUT",
          "noSSEHeader": false,
          "xPaddingBytes": "100-1000",
          "xPaddingObfsMode": true,
          "xPaddingPlacement": "queryInHeader",
          "xPaddingMethod": "tokenish",
          "xPaddingKey": "x_padding",
          "xPaddingHeader": "Referer",
          "sessionPlacement": "path",
          "seqPlacement": "path",
          "scStreamUpServerSecs": "20-80",
          "xmux": {
            "maxConcurrency": "16-32",
            "cMaxReuseTimes": 0,
            "hMaxRequestTimes": "600-900",
            "hMaxReusableSecs": "1800-3000",
            "hKeepAlivePeriod": 0
          }
        }
      },
      "sniffing": {
        "enabled": true,
        "destOverride": ["http", "tls", "quic"],
        "routeOnly": true
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom",
      "tag": "direct"
    },
    {
      "protocol": "blackhole",
      "tag": "block"
    }
  ],
  "routing": {
    "domainStrategy": "UseIP",
    "rules": [
      {
        "type": "field",
        "ip": [
          "0.0.0.0/8",
          "10.0.0.0/8",
          "100.64.0.0/10",
          "127.0.0.0/8",
          "169.254.0.0/16",
          "172.16.0.0/12",
          "192.0.0.0/24",
          "192.168.0.0/16",
          "198.18.0.0/15",
          "198.51.100.0/24",
          "203.0.113.0/24",
          "::1/128",
          "fc00::/7",
          "fe80::/10"
        ],
        "outboundTag": "block"
      },
      {
        "type": "field",
        "protocol": ["bittorrent"],
        "outboundTag": "block"
      }
    ]
  }
}

客户端mihomo

- name: test
  type: vless
  server: "服务器IPv6地址"
  port: 443
  uuid: 用户UUID
  network: xhttp
  tls: true
  udp: true
  tfo: true
  mptcp: true
  packet-encoding: xudp
  encryption: none
  servername: 目标域名甲
  client-fingerprint: chrome
  alpn:
    - h2
  reality-opts:
    public-key: 服务端公钥
    short-id: 短ID甲
  sockopt:
    tcp-fast-open: true
    tcp-no-delay: true
    tcp-mptcp: true
  xhttp-opts:
    mode: stream-up
    host: 目标域名甲
    path: /api/v1/updates
    no-grpc-header: false
    uplink-http-method: PUT
    x-padding-bytes: "100-1000"
    x-padding-obfs-mode: true
    x-padding-key: x_padding
    x-padding-header: Referer
    x-padding-placement: queryInHeader
    x-padding-method: tokenish
    session-placement: path
    seq-placement: path
    reuse-settings:
      max-concurrency: "16-32"
      c-max-reuse-times: 0
      h-max-request-times: "600-900"
      h-max-reusable-secs: "1800-3000"
      h-keep-alive-period: 0
    download-settings:
      server: 服务器IPv4地址
      port: 443
      tls: true
      alpn:
        - h2
      servername: 目标域名乙
      client-fingerprint: firefox
      no-grpc-header: false
      reality-opts:
        public-key: 服务端公钥
        short-id: 短ID乙
      host: 目标域名乙
      path: /api/v1/updates
      x-padding-bytes: "100-1000"
      x-padding-obfs-mode: true
      x-padding-key: x_padding
      x-padding-header: Referer
      x-padding-placement: queryInHeader
      x-padding-method: tokenish
      session-placement: path
      seq-placement: path
      sockopt:
        tcp-fast-open: true
        tcp-no-delay: true
        tcp-mptcp: true
      reuse-settings:
        max-concurrency: "8-16"
        c-max-reuse-times: 0
        h-max-request-times: "300-600"
        h-max-reusable-secs: "2400-3600"
        h-keep-alive-period: 0

[ksant0s]

Hi, thanks for sharing this template — really helpful!

I'm trying to replicate it on my own VPS. I've already generated my UUID, Reality keypair, and 4 short IDs. The part I'm unsure about is choosing the target domains (目标域名甲/乙/丙) for the Reality dest and serverNames fields.

A few questions:

1. How did you pick these domains? Any criteria (CDN, latency, TLS 1.3 + H2 support)?
2. Do 甲 and 乙/丙 need to be different domains, or is the split mainly for the v4/v6 inbounds?
3. Are there any other fields in either the server.json or mihomo.yaml that need to be filled in beyond the UUID, keypair, short IDs, target domains, and server IPv4/IPv6 addresses?

Thanks again!

[Chen017]

1. I use https://bgp.he.net. Enter your IPv4, find the /24 subnet, and check "Certs" for domains with long histories and many certificates. This avoids CDN-hosted domains and prevents "traffic theft." These domains typically support TLS 1.3 and H2 by default. So I don't care too much of TLS and h2.
2. Yes, use Domain 甲 for upstream and Domain 乙 for downstream. Separating SNI for upload and download traffic is a more secure practice.
3. That’s all. Do not enter your public IPv4/v6 address, as the config is already bound. I have marked all fields requiring your input in Chinese; if a field is only in English or number, leave it unchanged.

[Chen017]

For 3,I mean that in server.json, do not enter the public ip addresses,but in mihomo.yaml,you do need to enter the public addresses

[ksant0s]

Hey, when I enter my IPv4 it only shows a /23. Can I use domains from the /23 pool, or is a /24 required? Also, I noticed that 103.20.***.0/24 isn’t visible in the global routing table—does that matter for choosing domains?

[Chen017]

It's ok, as long as the ip address of that domain is near or adjacent to your ip address.
For example if your ip address is 109.212.212.122, any domain coming from 109.212.212.xxx is good. If there isn't suitable domain,you can try search the domain coming from 109.212.213.xxx or 109.212.211.xxx.
If you still can't find the suitable domain,then just try 109.212.210.xxx or 109.212.214.xxx
If not,keep doing...