xray

Sun, 14 Dec 2025 00:00:00 +0000

 graph LR
 subgraph 443/tcp
 A[client] -- https 차단 --- B[firewall]
 A1[client] <-- vless+ws 우회 --> B
 end
 B <-- vless+ws 우회 --> G[nginx-proxy]
 G <--> I[xray]
 I <-- https 요청/응답 --> L[internet]

container 구성

docker-compose.yml

vi /opt/xray/docker-compose.yml

services:
 xray:
 image: teddysun/xray:1.7.5
 container_name: xray
 networks:
 - dev
 ports:
 - 9000/tcp
 user: 0:0
 environment:
 - TZ=Asia/Seoul
 volumes:
 - /opt/xray/config:/etc/xray:rw
 - /opt/.acme/*.$HOSTNAME.duckdns.org_ecc/fullchain.cer:/etc/ssl/*.$HOSTNAME.duckdns.org/fullchain.pem:ro
 - /opt/.acme/*.$HOSTNAME.duckdns.org_ecc/*.$HOSTNAME.duckdns.org.key:/etc/ssl/*.$HOSTNAME.duckdns.org/privkey.pem:ro
 restart: unless-stopped
networks:
 dev:
 external: true

vless-websocket-tls (서버)

vi /opt/xray/config/config.json

{
 "log":{
 "loglevel":"warning"
 },
 "inbounds":[
 {
 "port":9000,
 "protocol":"vless",
 "settings":{
 "clients":[
 {
 "id":"5*******-****-****-****-************",
 "flow":"xtls-rprx-direct"
 }
 ],
 "decryption":"none",
 "fallbacks":[]
 },
 "streamSettings":{
 "network":"ws",
 "security":"tls",
 "tlsSettings":{
 "serverName":"xr.gvp6nx1a.duckdns.org",
 "certificates":[
 {
 "certificateFile":"/etc/ssl/*.gvp6nx1a.duckdns.org/fullchain.pem",
 "keyFile":"/etc/ssl/*.gvp6nx1a.duckdns.org/privkey.pem"
 }
 ]
 },
 "wsSettings":{
 "path":"/w*******",
 "headers":{}
 }
 },
 "tag":"inbound",
 "sniffing":{
 "enabled":true,
 "destOverride":[
 "http",
 "tls"
 ]
 }
 }
 ],
 "outbounds":[
 {
 "protocol":"freedom"
 }
 ]
}

vless-websocket-tls (클라이언트)

vi $USERPROFILE/AppData/Local/qv2ray/connections/maellhfkxqke.qv2ray.json

{
 "outbounds": [
 {
 "protocol": "vless",
 "settings": {
 "vnext": [
 {
 "address": "xr.gvp6nx1a.duckdns.org",
 "port": 443,
 "users": [
 {
 "encryption": "none",
 "id": "5*******-****-****-****-************"
 }
 ]
 }
 ]
 },
 "streamSettings": {
 "network": "ws",
 "security": "tls",
 "tlsSettings": {
 "disableSystemRoot": false,
 "serverName": "xr.gvp6nx1a.duckdns.org"
 },
 "wsSettings": {
 "path": "/w*******"
 },
 "xtlsSettings": {
 "disableSystemRoot": false
 }
 }
 }
 ]
}

proxy 구성

vi /opt/nginx/config/sites-available/xray.conf

...
 location /w******* {
 if ($allowed_country = no) {
 return 403;
 }
 include /etc/nginx/conf.d/include/proxy.conf;
 proxy_pass https://xray:9000;

 keepalive_timeout 65;
 client_max_body_size 0;
 }
...

테스트

dns 누출 확인

wireguard

Mon, 08 Dec 2025 00:00:00 +0000

 graph LR
 subgraph iptables
 subgraph bridge-network
 A1[docker/wireguard] <--> B[docker]
 A2[apps] <--> B
 end
 subgraph host-network
 C[host] <--> C1[package/wireguard]
 end
 end
 A1 <-- udp --> D[client]
 C1 <-- udp --> D
 B <-- wireguard 라우팅 방법을 찾지 못함 --> C

host 구성

포트 개방

sudo firewall-cmd --permanent --add-port=6****/udp && \
sudo firewall-cmd --reload && \
sudo firewall-cmd --list-all

container 구성

docker-compose.yml

vi /opt/wireguard/docker-compose.yml

services:
 wireguard:
 image: linuxserver/wireguard:1.0.20210914
 container_name: wireguard
 networks:
 - dev
 ports:
 - 6****:6****/udp
 user: 0:0
 environment:
 - PUID=1000
 - PGID=1000
 - TZ=Asia/Seoul
 - PEERS=1
 - PEERDNS=auto
 - LOG_CONFS=false
 volumes:
 - /usr/src:/usr/src:ro
 - /lib/modules:/lib/modules:ro
 - /opt/wireguard/config/wg_confs/wg0.conf:/config/wg_confs/wg0.conf:ro
 - /opt/wireguard/config/coredns/Corefile:/config/coredns/Corefile:ro
 cap_add:
 - NET_ADMIN
 - SYS_MODULE
 sysctls:
 - net.ipv4.conf.all.src_valid_mark=1
 restart: unless-stopped
networks:
 dev:
 external: true

key 생성

docker exec -it wireguard /bin/sh && \
umask 077 && \
wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub && \
wg genkey | tee /etc/wireguard/client.key | wg pubkey > /etc/wireguard/client.pub && \
wg genpsk > /etc/wireguard/client.psk && \
cat /etc/wireguard/server.key && \
cat /etc/wireguard/server.pub && \
cat /etc/wireguard/client.key && \
cat /etc/wireguard/client.pub && \
cat /etc/wireguard/client.psk

wg0.conf

vi /opt/wireguard/config/wg_confs/wg0.conf

[Interface]
Address = 10.10.0.4/32
ListenPort = 6****
PrivateKey = +******************************************=
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth+ -j MASQUERADE

[Peer]
PublicKey = t******************************************=
PresharedKey = h******************************************=
AllowedIPs = 10.10.0.0/24
PersistentKeepalive = 25

Corefile

coredns healthcheck 비활성화

vpn on 대충어쩌고저쩌고샬라샬라

xray

container 구성

docker-compose.yml

vless-websocket-tls (서버)

vless-websocket-tls (클라이언트)

proxy 구성

테스트

wireguard

host 구성

포트 개방

container 구성

docker-compose.yml

key 생성

wg0.conf

Corefile