有无大手子锐评一下我这套 Xray-core 客户端配置 (Windows)

57315

楼主 2026-09-07编辑于 2026-09-08 13:31

服务端配置请参考我另一篇文章 单端口五合一VLESS部署

本文也同步发在我的博客了，点击我头像的 tag 可以跳转

还请大手子留情

由于三台机器每台机器都配置 5 个出站节点，使用 Jsonc 书写配置将重复大量内容，所以改为支持锚点的 YAML，配合锚点，旧可以在顶部统一定义模板并快速填写节点信息，在出站字段处直接引用，大幅减少重复代码

机器信息

机器	线路	月配额	定位
机器 A：HKG 移动快乐机	香港 CMI / 普通国际直连	1000G @ 500Mbps	常规网页 / Tg / GitHub / 国际小包 <br/> 移动回程快但晚高峰差，大包重传高
机器 B：LAX 三网优化小流量机	美西 CN2 GIA / 9929 / CMIN2	500G @ 200Mbps	AIGC / Google / 重要业务
机器 C：LAX 4837 大流量机	美西 AS4837 联通优化	1000G @ 500Mbps	AIGC 备用 / OpenList / 大流量下载

每台机器都构建 5 个节点：

*-vision：TCP + VLESS + Vision + REALITY 直连；
*-xhttp-reality：XHTTP + REALITY 直连；
*-cdn-up-reality-down：上行走 CDN 隐藏客户端 SNI，下行走 REALITY 直连；
*-cdn-all：纯 CDN 上下行 + ECH；
*-reality-up-cdn-down：上行直连 REALITY，下行走 CDN

踩坑

详情

ECH 纯 IP UDP 动态查询

如何配置 ECH 请参考文章 XHTTP + CDN + ECH配置教程

CDN 节点启用 TLS 1.3 ECH 加密，客户端在握手前需获取公钥

我尝试配置了：

阿里 https://dns.alidns.com/dns-query
- 报错 Post "https://dns.alidns.com/dns-query": context deadline exceeded；
Cloudflare https://cloudflare-dns.com/dns-query
- 报错Failed to query ECH DNS record for domain, An existing connection was forcibly closed by the remote host.

经过一番捣鼓，原因是：

拉取公钥在代理建立前发起（走直连），如果填写阿里云域名 DNS，则需先解析域名并完成 TLS 握手，非常容易触发 xray 硬编码的 5 秒超时……
```
// L269
dnsTimeoutCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()

// L288
conn.SetReadDeadline(time.Now().Add(5 * time.Second))
```
至于 CF，可能是我所在的地区无法直连或它的 DoH IP 已经被功夫网阻断

之后我翻阅了 Project X 的文档，这部分有提到：

基础格式为 "udp://1.1.1.1" 表示从 UDP DNS 1.1.1.1 查询，也可以使用 "https://1.1.1.1/dns-query"(或者 h2c://) 这样的格式，代表使用 DOH(h2c) 进行查询 (实际使用请替换成当地可用的服务器). 上述三种均支持修改端口号，如 udp://1.1.1.1:53，没写会按照协议默认 53/443.
特别地，可以使用指定的域名用于查询 ECHConfig, 格式为 "example.com+https://1.1.1.1/dns-query" 这样 Xray 会强制使用 example.com 的 DNS 记录中的 ECHConfig 用于连接，如果你想从 DNS 获取 ECHConfig 但又不想暴露自己在查询这个域名的 HTTPS 记录或者在这个域名下发布 HTTPS 记录时有一些用。

因此，使用纯 IP 的 UDP 53 查询成功解决了问题，单次 UDP 报文交互耗时约 10ms（echConfigList: 'yourdomain.com+udp://223.5.5.5:53'）

观测器

XHTTP 多路复用需要多重 TLS/H2/H3 握手，使用高频探测会引发 Client.Timeout exceeded while awaiting headers 假死

因此，我弄了两个观测器，分别是：

burstObservatory（高频探测），仅针对 3 个裸流 TCP 节点（*-vision）做测速；
observatory（标准探测），每 30 秒探测一次，负责全部节点

客户端配置

本配置适用于 xray-core v26.7.28 +

# =========================================================================
# 锚点定义
# =========================================================================
x-anchors:
  # -----------------------------------------------------------------------
  # 0. 用户变量
  # -----------------------------------------------------------------------
  # VPS 1: 香港 HKG 移动快乐
  hkg_ip: &hkg_ip "填入IPx.x.x.x"
  hkg_uuid_01: &hkg_uuid_01 "填入UUID 1"
  hkg_uuid_02: &hkg_uuid_02 "填入UUID 2"
  hkg_reality_sni: &hkg_reality_sni "填入REALITY伪装域名"
  hkg_reality_pubkey: &hkg_reality_pubkey "填入公钥"
  hkg_reality_shortid: &hkg_reality_shortid "填入shortID"
  hkg_cdn_domain: &hkg_cdn_domain "填入套CDN的域名"
  hkg_xhttp_path: &hkg_xhttp_path "填入xhttp path"
  hkg_prefer_cdn_domain: &hkg_prefer_cdn_domain "填入套CDN的域名或优选IP" 

  # VPS 2: 美西 LAX 三网优化
  lax_ip: &lax_ip "填入IPx.x.x.x"
  lax_uuid_01: &lax_uuid_01 "填入UUID 1"
  lax_uuid_02: &lax_uuid_02 "填入UUID 2"
  lax_reality_sni: &lax_reality_sni "填入REALITY伪装域名"
  lax_reality_pubkey: &lax_reality_pubkey "填入公钥"
  lax_reality_shortid: &lax_reality_shortid "填入shortID"
  lax_cdn_domain: &lax_cdn_domain "填入套CDN的域名"
  lax_xhttp_path: &lax_xhttp_path "填入xhttp path"
  lax_prefer_cdn_domain: &lax_prefer_cdn_domain "填入套CDN的域名或优选IP"

  # VPS 3: 美西 LAX 4837
  lax4837_ip: &lax4837_ip "填入IPx.x.x.x"
  lax4837_uuid_01: &lax4837_uuid_01 "填入UUID 1"
  lax4837_uuid_02: &lax4837_uuid_02 "填入UUID 2"
  lax4837_reality_sni: &lax4837_reality_sni "填入REALITY伪装域名"
  lax4837_reality_pubkey: &lax4837_reality_pubkey "填入公钥"
  lax4837_reality_shortid: &lax4837_reality_shortid "填入shortID"
  lax4837_cdn_domain: &lax4837_cdn_domain "填入套CDN的域名"
  lax4837_xhttp_path: &lax4837_xhttp_path "填入xhttp path"
  lax4837_prefer_cdn_domain: &lax4837_prefer_cdn_domain "填入套CDN的域名或优选IP"

  # -----------------------------------------------------------------------
  # 1. 协议、混淆模板
  # -----------------------------------------------------------------------
  sockopt: &default_sockopt
    tcpFastOpen: true
    tcpKeepAliveInterval: 15
    domainStrategy: UseIPv4

  xmux: &default_xmux
    maxConcurrency: 16-32
    cMaxReuseTimes: "0"
    hMaxReusableSecs: 1800-3000
    hKeepAlivePeriod: 0

  xhttp_obfs: &default_xhttp_obfs
    sessionIDTable: Alphabet
    sessionIDLength: 12-20
    xPaddingObfsMode: true
    xPaddingMethod: tokenish
    xPaddingPlacement: queryInHeader
    xPaddingKey: t
    xPaddingHeader: Referer
    scStreamUpServerSecs: 30-60
    xmux: *default_xmux

  # CDN TLS / ALPN / ECH 参数
  cdn_tls_hkg: &cdn_tls_hkg
    fingerprint: chrome
    alpn: [h3, h2]
    echConfigList: '填入套CDN的域名+udp://223.5.5.5:53'

  cdn_tls_lax: &cdn_tls_lax
    fingerprint: chrome
    alpn: [h3, h2]
    echConfigList: '填入套CDN的域名.com+udp://223.5.5.5:53'

  cdn_tls_lax4837: &cdn_tls_lax4837
    fingerprint: chrome
    alpn: [h3, h2]
    echConfigList: '填入套CDN的域名+udp://223.5.5.5:53'

# 日志输出
log:
  loglevel: warning
  access: D:\Programs\Proxy\Xray\logs\access.log
  error: D:\Programs\Proxy\Xray\logs\error.log
  dnsLog: false

# API
api:
  tag: api
  listen: 127.0.0.1:10085
  services: [HandlerService, LoggerService, StatsService, RoutingService, ObservatoryService]

policy:
  levels:
    "0":
      statsUserUplink: true
      statsUserDownlink: true
  system:
    statsInboundUplink: true
    statsInboundDownlink: true
    statsOutboundUplink: true
    statsOutboundDownlink: true

stats: {}

# 节点观测器配置
observatory:
  # 1. 节点健康状态常规观测 (用于 Balancer 持续挑选延迟最低/健康的节点)
  subjectSelector: [HKG-, LAX-, Lax4837-]
  probeUrl: https://www.gstatic.com/generate_204
  probeInterval: 30s
  enableConcurrency: true

burstObservatory:
  # 2. 仅针对 Vision 极速直连节点做高频测速
  subjectSelector: [HKG-vision, LAX-vision, Lax4837-vision]
  pingConfig:
    destination: https://www.gstatic.com/generate_204
    interval: 30s
    timeout: 6s
    sampling: 3
    httpMethod: HEAD

# =========================================================================
# 入站配置
# =========================================================================
inbounds:
# Xray 原生 TUN。如果使用 SingTUN 转发到 Socks，把这里保持注释或删掉
# - tag: tun-in
#   protocol: tun
#   settings:
#     name: utun10
#     desc: Wintun
#     mtu: 1500
#     gateway: ["198.18.0.1/16", "fdfe:dcba:9876::1/64"]
#     dns: ["1.1.1.1", "8.8.8.8"]
#     autoSystemRoutingTable: ["0.0.0.0/0", "::/0"]
#     autoOutboundsInterface: auto
#   sniffing:
#     enabled: true
#     destOverride: [http, tls, quic]
#     metadataOnly: false
#     routeOnly: false

# Socks 入站
  - tag: socks-in
    port: 10808
    listen: "::"
    protocol: socks
    settings:
      auth: noauth
      udp: true
    sniffing:
      enabled: true
      destOverride: [http, tls, quic]
      metadataOnly: false
      routeOnly: false

# HTTP 入站
  - tag: http-in
    port: 10809
    listen: "::"
    protocol: http
    sniffing:
      enabled: true
      destOverride: [http, tls, quic]
      metadataOnly: false
      routeOnly: false

# =========================================================================
# 出站配置
# =========================================================================
outbounds:
# -----------------------------------------------------------------------
# VPS 1
# -----------------------------------------------------------------------
- tag: HKG-vision
  protocol: vless
  settings:
    vnext:
    - address: *hkg_ip
      port: 443
      users:
      - id: *hkg_uuid_01
        flow: xtls-rprx-vision
        encryption: none
  streamSettings:
    network: tcp
    security: reality
    realitySettings:
      serverName: *hkg_reality_sni
      fingerprint: chrome
      show: false
      publicKey: *hkg_reality_pubkey
      shortId: *hkg_reality_shortid
      spiderX: /
    sockopt: *default_sockopt

- tag: HKG-xhttp-reality
  protocol: vless
  settings:
    vnext:
    - address: *hkg_ip
      port: 443
      users:
      - id: *hkg_uuid_02
        encryption: none
  streamSettings:
    network: xhttp
    security: reality
    realitySettings:
      serverName: *hkg_reality_sni
      fingerprint: chrome
      show: false
      publicKey: *hkg_reality_pubkey
      shortId: *hkg_reality_shortid
      spiderX: /
    xhttpSettings:
      path: *hkg_xhttp_path
      mode: auto
      <<: *default_xhttp_obfs
    sockopt: *default_sockopt

- tag: HKG-cdn-up-reality-down
  protocol: vless
  settings:
    vnext:
    - address: *hkg_prefer_cdn_domain
      port: 443
      users:
      - id: *hkg_uuid_02
        encryption: none
  streamSettings:
    network: xhttp
    security: tls
    tlsSettings:
      serverName: *hkg_cdn_domain
      <<: *cdn_tls_hkg
    xhttpSettings:
      host: *hkg_cdn_domain
      path: *hkg_xhttp_path
      mode: auto
      <<: *default_xhttp_obfs
      downloadSettings:
        address: *hkg_ip
        port: 443
        network: xhttp
        security: reality
        realitySettings:
          serverName: *hkg_reality_sni
          fingerprint: chrome
          show: false
          publicKey: *hkg_reality_pubkey
          shortId: *hkg_reality_shortid
          spiderX: /
        xhttpSettings:
          path: *hkg_xhttp_path
          mode: auto
          <<: *default_xhttp_obfs
    sockopt: *default_sockopt

- tag: HKG-cdn-all
  protocol: vless
  settings:
    vnext:
    - address: *hkg_prefer_cdn_domain
      port: 443
      users:
      - id: *hkg_uuid_02
        encryption: none
  streamSettings:
    network: xhttp
    security: tls
    tlsSettings:
      serverName: *hkg_cdn_domain
      <<: *cdn_tls_hkg
    xhttpSettings:
      host: *hkg_cdn_domain
      path: *hkg_xhttp_path
      mode: auto
      <<: *default_xhttp_obfs
    sockopt: *default_sockopt

- tag: HKG-reality-up-cdn-down
  protocol: vless
  settings:
    vnext:
    - address: *hkg_ip
      port: 443
      users:
      - id: *hkg_uuid_02
        encryption: none
  streamSettings:
    network: xhttp
    security: reality
    realitySettings:
      serverName: *hkg_reality_sni
      fingerprint: chrome
      show: false
      publicKey: *hkg_reality_pubkey
      shortId: *hkg_reality_shortid
      spiderX: /
    xhttpSettings:
      path: *hkg_xhttp_path
      mode: auto
      <<: *default_xhttp_obfs
      downloadSettings:
        address: *hkg_prefer_cdn_domain
        port: 443
        network: xhttp
        security: tls
        tlsSettings:
          serverName: *hkg_cdn_domain
          <<: *cdn_tls_hkg
        xhttpSettings:
          host: *hkg_cdn_domain
          path: *hkg_xhttp_path
          mode: auto
          <<: *default_xhttp_obfs
    sockopt: *default_sockopt


# VPS 2、VPS 3 出站节点内容是相似的，把锚点换了就行。论坛有长文限制，所以我把VPS2和3都删除了，完整版还请移步我的博客
# https://blog.rokutosei.com/posts/proxy/xray-client-config/

# 基础出站
- tag: direct
  protocol: freedom
  # v26.9.8 起废弃 freedom.settings.domainStrategy 
  # 推荐统一移入 freedom.streamSettings.sockopt
  # 显式配置 sockopt 可继承 TCP Fast Open 0-RTT 握手加速与 NAT 防老化
  # streamSettings:
  #   sockopt: 
  #     tcpFastOpen: true
  #     tcpKeepAliveInterval: 15
  #     domainStrategy: UseIPv4
- tag: block
  protocol: blackhole
  # v26.9.8 新增响应模式，显式配置 type: http 可在拦截广告时即时回送 HTTP 403，加速网页渲染
  # settings:
  #   response:2
  #     type: http
- tag: dns-out
  protocol: dns

# =========================================================================
# DNS 配置
# =========================================================================
dns:
  tag: dns-proxy
  hosts:
    # 防止 DoH 域名自身递归解析死锁
    dns.alidns.com: [223.5.5.5, 223.6.6.6]
    doh.pub: [1.12.12.12, 120.53.53.53]
    dns.google: [8.8.8.8, 8.8.4.4]
    cloudflare-dns.com: [1.1.1.1, 1.0.0.1]
    www.gstatic.com: [142.250.73.142, 142.251.46.65, 172.253.117.188]
  servers:
  # 1. 国外域名
  - address: 1.1.1.1
    skipFallback: true
    domains: ["geosite:google", "geosite:category-scholar-!cn", "geosite:google-scholar", "geosite:github"]

  # 2. 国内域名
  - tag: dns-direct
    address: https://dns.alidns.com/dns-query
    skipFallback: false
    domains: ["geosite:cn"]
    expectIPs: ["geoip:cn"]

  # 3. 节点自身域名查询
  - tag: dns-self
    address: https://dns.alidns.com/dns-query
    skipFallback: false
    domains: ["domain:填入VPS1domain.com", "domain:填入VPS2domain.com", "domain:填入VPS3domain.com"]
    # domain 只写一级域名即可
    expectIPs: [] # 解析出的可能是 Cloudflare 海外 IP，这里不建议强制 expectIPs: ["geoip:cn"]

  # 4. 国内备用查询
  - tag: dns-direct-fallback
    address: https://doh.pub/dns-query
    skipFallback: true
    domains: ["geosite:cn"]

  # 5. 未知域名兜底查询
  - address: 8.8.8.8
    clientIp: x.x.x.x # 客户端 ECS，填入你常驻宽带的 IP 即可 ；如果切换到手机流量，公共 DoH 会依据出口智能识别
    skipFallback: false

# =========================================================================
# 路由规则
# =========================================================================
routing:
  domainStrategy: IPIfNonMatch
  domainMatcher: mph
  balancers:
  # 负载均衡策略组
  # 1. 常规代理组用前缀自适应，leastPing 自动选择延迟最低节点
  - tag: balancer-default
    selector: [HKG-, LAX-, Lax4837-]
    fallbackTag: HKG-cdn-all
    strategy:
      type: leastPing

  # 2. AIGC 组选择美西优化节点中抖动最小的节点
  - tag: balancer-aigc
    selector: [LAX-, Lax4837-]
    fallbackTag: LAX-cdn-all
    strategy:
      type: leastLoad

  # 3. Download 组选择 Lax4837 线路
  # 不选 HKG 是因为我这台机大包重传太高
  - tag: balancer-download
    selector: [Lax4837-]
    fallbackTag: Lax4837-cdn-all
    strategy:
      type: leastPing

  rules:
  # ---------------------------------------------------------------------
  # [0-DNS 内部路由]
  # ---------------------------------------------------------------------
  - inboundTag: [dns-direct, dns-direct-fallback, dns-self]
    outboundTag: direct

  - inboundTag: [dns-proxy]
    balancerTag: balancer-default

  # ---------------------------------------------------------------------
  # [1-block]
  # ---------------------------------------------------------------------
  - domain:
    - ext:awavenue.dat:ads
    - geosite:category-ads-all
    - geosite:category-stun
    outboundTag: block

  - port: 3478,3479,5348,5349,5350,5351,19302
    outboundTag: block

  # 阻止海外 UDP 443 QUIC
  - network: udp
    port: 443
    domain: ["geosite:cn"]
    outboundTag: direct

  - network: udp
    port: 443
    ip: ["geoip:cn"]
    outboundTag: direct

  - network: udp
    port: 443
    outboundTag: block

  # ---------------------------------------------------------------------
  # [2-direct]
  # ---------------------------------------------------------------------
  - process:
  # 如果你用 SingTUN，这里可以不写，在 Singbox 那边写进程直连就行
    - Weixin.exe
    - QQ.exe
    - QQMusic.exe
    - StarRail.exe
    - YuanShen.exe
    - ZenlessZoneZero.exe
    outboundTag: direct
  
  - domain:
    - domain:quark.cn
    - keyword:hoyoverse
    - regexp:\w{10}\.(adobe|adobestats)\.io
    - geosite:category-ai-cn
    - geosite:jetbrains
    - geosite:bing@cn
    - geosite:microsoft@cn
    - geosite:category-bank-cn
    - geosite:category-games-cn
    - geosite:category-cdn-cn
    - geosite:category-httpdns-cn
    - geosite:category-ntp-cn
    outboundTag: direct

  # ---------------------------------------------------------------------
  # [3-proxy]
  # ---------------------------------------------------------------------
  - domain: ["geosite:google"]
    outboundTag: LAX-xhttp-reality

  - process: [ChatGPT.exe, Obsidian.exe, codex.exe, Antigravity.exe]
    balancerTag: balancer-aigc

  - process: [AyuGram.exe]
    balancerTag: balancer-default
  
  - domain:
    - geosite:category-ai-!cn
    - geosite:category-ai-chat-!cn
    - geosite:openai
    - geosite:anthropic
    - geosite:github
    - geosite:gitlab
    - geosite:aws
    - geosite:azure
    - geosite:category-scholar-!cn
    - geosite:google-scholar
    balancerTag: balancer-aigc

  - domain:
    - domain:afdian.com
    - domain:mikanani.me
    - domain:kox.moe
    - domain:annas-archive.org
    - domain:docs.rs
    - full:dict.eudic.net
    balancerTag: balancer-default
  
  - domain: ["geosite:telegram"]
    ip: ["geoip:telegram"]
    balancerTag: balancer-default

  - domain: ["geosite:cloudflare"]
    ip: ["geoip:cloudflare"]
    balancerTag: balancer-default

  - domain:
    - geosite:netflix
    - geosite:youtube
    - geosite:bahamut
    ip: ["geoip:netflix"]
    balancerTag: balancer-download
  
  - domain:
    - geosite:microsoft
    - geosite:bing
    - geosite:onedrive
    - geosite:nvidia
    - geosite:ubuntu
    - geosite:rust
    - geosite:category-cdn-!cn
    balancerTag: balancer-download

  # ---------------------------------------------------------------------
  # [4-default]
  # ---------------------------------------------------------------------
  - ip: ["geoip:private", "geoip:cn"]
    outboundTag: direct

  - domain: ["geosite:cn"]
    outboundTag: direct

  # 相当于 mihomo 的 `MATCH, Proxy`
  - network: tcp,udp
    balancerTag: balancer-default

15 条回复

XsbUID 2323Lv.40
5980帖子 21.9K财富 10.3K成长值

2026-09-07
#1
开启 ech 是必须要使用 tun 模式吗？浏览器开 http 代理行不行
个性签名
全球烧饼交流论坛
火星人：
ECH 是出站节点里的传输层协议，从 TUN、HTTP、SOCKS、TProxy 入站都行（~~说白了就是和入站没关系~~）然后它是负责加密 Xray 到 CDN 之间的连接，让防火墙只能看到你在访问 cf 的公共大域名cloudflare-ech.com，看不到实际连的是哪个自建域名，以此防止域名 SNI 被阻断
2026-09-07#2
共 1 条回复
火星人
2026-09-07
#3
刚才发现论坛有长文限制，后面的文字被截断，所以我把 VPS2 和 3 出战节点部分都删除了
VPS 2、VPS 3 出站节点写法几乎一样，把锚点换了就行，完整版还请移步我的博客
豹哥UID 76Lv.19
1447帖子 6476财富 2522成长值

IKUN
2026-09-07
#4
@grok 评价一下楼主的配置
个性签名
烧饼论坛新人记得领取新人大礼包，领完就可以买域名和邮箱啦！
998UID 3405Lv.8
12帖子 6218财富 486成长值

咕嘎
2026-09-07
#5
1.reality
2.xhttp3
3.cdn
只要这三种就行了
火星人：
2026-09-08#7
共 1 条回复
NBAUID 113Lv.13
737帖子 6559财富 1248成长值

哆啦 A 梦
2026-09-07
#6
https://github.com/XTLS/Xray-core/discussions/4118
五合一早用上了，根据 github 上大佬给的用 AI 继续优化
火星人：
我也是看的这个教程，在服务端那篇文章开头我有提到，只不过客户端示例写的是 mihomo，现在我转到 xray 了。大佬他是用的 Nginx，我改成 Caddy 并更新添加了部分字段
2026-09-08#8
NBA：
我用的还是 NG 没改 Caddy , 添加了 ENC。不过说实话五个节点，用得最多的还是 VL-RLT，上下行都很少用到，
2026-09-08#13
火星人回复 NBA：
我让核心自动选择了，确实也是非 cdn 节点用的更多
2026-09-08#14
共 3 条回复
XsbUID 2323Lv.40
5980帖子 21.9K财富 10.3K成长值

2026-09-08
#9
能弄个五合一一键脚本就好了
个性签名
全球烧饼交流论坛
火星人：
我记得 GitHub/Linuxdo 论坛有人做过，我小鸡少不用脚本，就一直手搓
2026-09-08#10
共 1 条回复
fiatUID 2382Lv.10
285帖子 3372财富 796成长值

2026-09-08
#11
学习
飘云UID 2633Lv.5 小有收获
32帖子 3502财富 222成长值
2026-09-08
#12
学习了。谢谢
BSDUID 755Lv.11
453帖子 2675财富 874成长值

2026-09-09编辑于 2026-09-09 23:09
#15
看着还行

有无大手子锐评一下我这套 Xray-core 客户端配置 (Windows)

机器信息

踩坑

ECH 纯 IP UDP 动态查询

观测器

客户端配置

15 条回复

发表回复