Xray(M+F+H+K+G+B+A)+Nginx 应用是否无法通过 XHTTP3 连接

[lyrnya]

首先感谢大佬的参考配置

由于我只需要vless vision reality以及vless xhttp
在参考配置基础上删除多余部分，并将nginx两个server进行合并 或许http2和http3合并我写错了
vision和xhttp2(cf和直连)都能正常工作
但是如果将xhttp alpn设置为h3 v2rayng会提示eof
ufw防火墙已放行443端口

还是说这一套配置本来就无法支持xhttp3

nginx配置

#user nobody nogroup; #表示以默认用户（root）运行 若取消注释，注意修改为相应权限的用户与组
worker_processes auto;

error_log /var/log/nginx/error.log; #错误日志的文件地址

pid /run/nginx.pid;

events {
    worker_connections 1024;
}

stream {
    map $ssl_preread_server_name $tcpsni_name {
        example-x.example.com vision; #对应 VLESS Vision REALITY 的域名
        example.example.com xhttp; #对应 VLESS XHTTP 的域名
    }
    upstream vision {
        server 127.0.0.1:5443; #转给 VLESS Vision REALITY 本地监听端口
    }
    upstream xhttp {
        server 127.0.0.1:7443; #转给 HTTP/2 server 本地监听端口
    }
    server {
        listen 443;
        listen [::]:443; #无 IPv6，此项可删除
        ssl_preread on;
        proxy_protocol on; #启用 PROXY protocol 发送（全局模式）
        proxy_pass $tcpsni_name;
    }
}

http {
    include mime.types;
    default_type application/octet-stream;

    #创建自定义变量 $client_ip 获取客户端真实 IP，其配置如下：
    map $http_x_forwarded_for $client_ip {
        "" $remote_addr;
        "~*(?P<firstAddr>([0-9a-f]{0,4}:){1,7}[0-9a-f]{1,4}|([0-9]{1,3}\.){3}[0-9]{1,3})$" $firstAddr;
    }

    #启用访问日志，其调整后的配置如下：（选配）
    log_format main '$client_ip - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main; #访问日志的文件地址（选配）

    sendfile on;

    keepalive_timeout 65;

    server {
        listen 80;
        listen [::]:80; #无 IPv6，此项可删除
        return 301 https://$host$request_uri; #HTTP 自动跳转 HTTPS，让网站看起来更真实
    }

    server {
        listen 443 quic reuseport; #仅版本不小于 v1.25.0 且 SSL 库支持 QUIC（HTTP/3） 配置，否则必须删除
        listen [::]:443 quic reuseport; #仅版本不小于 v1.25.0 且 SSL 库支持 QUIC（HTTP/3） 配置，否则必须删除 另无 IPv6，此项也可删除
        listen 127.0.0.1:7443 ssl proxy_protocol; #仅版本不小于 v1.25.1 配置，否则必须删除
        http2 on; #仅版本不小于 v1.25.1 配置，否则必须删除
        set_real_ip_from 127.0.0.1;
        real_ip_header proxy_protocol;

        ssl_certificate /home/user/tls/fullchain.crt; #换成自己的证书，绝对路径
        ssl_certificate_key /home/user/tls/cert.key; #换成自己的密钥，绝对路径

        ssl_protocols TLSv1.2 TLSv1.3; #若使用 OpenSSL 库，TLSv1.3 需要 OpenSSL 库的版本不小于 1.1.1 构建才支持
        ssl_prefer_server_ciphers on; #优先使用服务端的密码套件（对如下 TLSv1.2 协议的密码套件有效）
        ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305; #若证书为 RSA 证书，所有 ECDSA 改为 RSA
        ssl_ecdh_curve secp521r1:secp384r1:secp256r1:x25519; #若使用 OpenSSL 库，此项配置参数需要 OpenSSL 库的版本不小于 3.0.0 构建才支持

        location /path { #与 VLESS XHTTP 应用中 path 对应
            grpc_pass grpc://127.0.0.1:2023; #转发给本机 VLESS XHTTP 监听端口
            grpc_set_header Host $host;
            grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }   

        location / {
            add_header Alt-Svc 'h3=":443"; ma=86400'; #通告 HTTP/3 server 的可用性
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; #启用 HSTS
            root /var/www/html; #修改为自己存放的 WEB 文件路径
            index index.html index.htm;
        }
    }
}

xray服务端配置

{
    "log": {
        "loglevel": "warning"
    },
    "dns": {
        "servers": [
            "https+local://1.1.1.1/dns-query",
            "localhost"
        ]
    },
    "routing": {
        "domainStrategy": "IPIfNonMatch",
        "rules": [
            {
                "type": "field",
                "ip": [
                    "geoip:private"
                ],
                "outboundTag": "block"
            },
            {
                "type": "field",
                "domain": [
                    "geosite:category-ads-all"
                ],
                "outboundTag": "block"
            },
            {
                "type": "field",
                "protocol": [
                    "bittorrent"
                ],
                "outboundTag": "block"
            },
            {
                "type": "field",
                "domain": [
                    "geosite:cn"
                ],
                "outboundTag": "warp"
            },
            {
                "type": "field",
                "ip": [
                    "geoip:cn"
                ],
                "outboundTag": "warp"
            }
        ]
    },
    "inbounds": [
        {
            "listen": "127.0.0.1", //只监听本机
            "port": 5443, //VLESS Vision REALITY 监听端口
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "id": "uuid",
                        "flow": "xtls-rprx-vision"
                    }
                ],
                "decryption": "none",
                "fallbacks": [
                    {
                        "dest": 2023 //回落给 VLESS XHTTP 监听端口
                    }
                ]
            },
            "streamSettings": {
                "network": "raw",
                "security": "reality",
                "realitySettings": {
                    "target": 7443,
                    "xver": 1, //开启 PROXY protocol 发送，发送真实来源IP和端口给自己的网站
                    "serverNames": [
                        "example-x.example.com"
                    ],
                    "privateKey": "privateKey",
                    "shortIds": [
                        ""
                    ]
                },
                "rawSettings": {
                    "acceptProxyProtocol": true //开启 PROXY protocol 接收，接收 Caddy SNI 分流前真实来源 IP 和端口
                }
            },
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls",
                    "quic"
                ]
            }
        },
        {
            "listen": "127.0.0.1", //只监听本机
            "port": 2023, //VLESS XHTTP 监听端口
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "id": "uuid"
                    }
                ],
                "decryption": "none"
            },
            "streamSettings": {
                "network": "xhttp",
                "xhttpSettings": {
                    "path": "/path" //修改路径
                }
            },
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls",
                    "quic"
                ]
            }
        }
    ],
    "outbounds": [
        {
            "tag": "direct",
            "protocol": "freedom"
        },
        {
            "tag": "block",
            "protocol": "blackhole"
        },
        {
            "tag": "warp",
            "protocol": "wireguard" //此处省略
        }
    ]
}

[lyrnya]

系统是debain12 nginx通过nginx仓库安装

nginx -V
nginx version: nginx/1.26.3
built by gcc 12.2.0 (Debian 12.2.0-14) 
built with OpenSSL 3.0.11 19 Sep 2023 (running with OpenSSL 3.0.15 3 Sep 2024)
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-http_v3_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-g -O2 -ffile-prefix-map=/data/builder/debuild/nginx-1.26.3/debian/debuild-base/nginx-1.26.3=. -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie'

[lxhao61]

OpenSSL 3.0.11 不支持 QUIC!
最新 OpenSSL 3.4.0 才完全支持 QUIC。

[lyrnya]

好的，感谢解答

[chazikai24]

参考 https://u.sb/debian-nginx-quic 这个帖子换 Nginx，支持 H3。
另外我这边运营商或者 GFW 干扰 XHTTP H3 CDN，可参考讨论帖 235

[lxhao61]

不必一定要使用 Nginx，它的最大优势是作为中大型网站使用性能优异，其它与 Caddy 相比无优势。
若使用 Nginx 推荐自已定制编译。根据需要选择模块，静态关联所需文件（可灵活选择支持 QUIC 的 SSL 库）编译，这个不复杂。

[lyrnya]

更新：疑似手机系统问题 android10 h3无法连通，另一台android15 h3可以连通 我再看看 GPT说a11开始支持quic
根据测试确定为上述原因 电脑以及A15可以正常进行H3连接

你好，根据建议现在更改为caddy前置 使用Xray(M+F+H+K+G+B+A)+Caddy(N)应用 仅保留vision和xhttp 服务端xray配置仅将xver更改为2

v2rayng h3连接仍然为eof，同时服务端xray无任何连接信息

清空caddy日志后重启xray与caddy，v2rayng发起h3连接，caddy无任何日志

麻烦帮忙看看出了什么问题，是不是我把caddy某些必要配置删除了

caddy配置

{
    "admin": {
      "disabled": true,
      "config": {
        "persist": false
      }
    },
    "logging": {
      "logs": {
        "default": {
          "writer": {
            "output": "file",
            "filename": "/var/log/caddy/error.log"
          },
          "encoder": {
            "format": "console"
          },
          "level": "ERROR",
          "exclude": ["http.log.access.log0"]
        },
        "log0": {
          "writer": {
            "output": "file",
            "filename": "/var/log/caddy/access.log"
          },
          "encoder": {
            "format": "console"
          },
          "include": ["http.log.access.log0"]
        }
      }
    },
    "storage": {
      "module": "file_system",
      "root": "/home/tls"
    },
    "apps": {
      "layer4": {
        "servers": {
          "tcpsni": {
            "listen": [":443"],
            "routes": [{
              "match": [{
                "tls": {
                  "sni": ["example-x.example.com"]
                }
              }],
              "handle": [{
                "handler": "proxy",
                "proxy_protocol": "v1",
                "upstreams": [{
                  "dial": ["127.0.0.1:5443"]
                }]
              }]
            },
            {
              "match": [{
                "tls": {}
              }],
              "handle": [{
                "handler": "proxy",
                "proxy_protocol": "v2",
                "upstreams": [{
                  "dial": ["127.0.0.1:7443"]
                }]
              }]
            }]
          },
          "udppy": {
            "listen": ["udp/:443"],
            "routes": [{
              "handle": [{
                "handler": "proxy",
                "upstreams": [{
                  "dial": ["udp/127.0.0.1:7443"]
                }]
              }]
            }]
          }
        }
      },
      "http": {
        "servers": {
          "srvh1": {
            "listen": [":80"],
            "routes": [{
              "handle": [{
                "handler": "static_response",
                "headers": {
                  "Location": ["https://{http.request.host}{http.request.uri}"]
                },
                "status_code": 301
              }]
            }],
            "protocols": ["h1"]
          },
          "srvh3": {
            "listen": ["127.0.0.1:7443"],
            "listener_wrappers": [{
              "wrapper": "proxy_protocol",
              "allow": ["127.0.0.1/32"]
            },
            {
              "wrapper": "tls"
            }],
            "routes": [{
              "match": [{
                "path": ["/path/*"]
              }],
              "handle": [{
                "handler": "reverse_proxy",
                "transport": {
                  "protocol": "http",
                  "versions": ["h2c","2"]
                },
                "upstreams": [{
                  "dial": "127.0.0.1:2023"
                }]
              }]
            },
            {
              "handle": [{
                "handler": "headers",
                "response": {
                  "set": {
                    "Alt-Svc": ["h3=\":443\"; ma=2592000"],
                    "Strict-Transport-Security": ["max-age=31536000; includeSubDomains; preload"]
                  }
                }
              },
              {
                "handler": "file_server",
                "root": "/var/www/html"
              }]
            }],
            "tls_connection_policies": [{
              "match": {
                "sni": ["example-x.example.com","example.example.com"]
              },
              "cipher_suites": ["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"],
              "curves": ["x25519","secp521r1","secp384r1","secp256r1"],
              "alpn": ["h3","h2","http/1.1"]
            }],
            "trusted_proxies": {
              "source": "cloudflare",
              "interval": "12h",
              "timeout": "15s"
            },
            "logs": {
              "default_logger_name": "log0"
            },
            "protocols": ["h1","h2","h3"]
          }
        }
      },
      "tls": {
        "certificates": {
          "automate": ["*.example.com"]
        },
        "automation": {
          "policies": [{
            "issuers": [{
              "module": "acme",
              "ca": "https://acme-v02.api.letsencrypt.org/directory",
              "email": "example@com",
              "challenges": {
                "dns": {
                  "provider": {
                    "name": "cloudflare",
                    "api_token": "****"
                  }
                }
              }
            }]
          }]
        }
      }
    }
}

[lxhao61]

@lyrnya 配置无问题。

[lyrnya]

@lyrnya 配置无问题。

应该就是手机系统的原因了

[lxhao61]

@lyrnya 你可换 v2rayNG 不同版本试试。

[lxhao61]

只需要 vision reality 以及 xhttp，优先选择非 SNI 分流共用 TCP 443 端口的示例、简单且少一次转发。

[uestcNaldo]

要是还需要自己的网站呢

[lxhao61]

要是还需要自己的网站呢

推荐选择 SNI 分流共用 TCP 443 端口的示例，不会因 Xray 出问题从而网站受影响。