VPN / 代理工具技術總結

{
  "log": {
    "loglevel": "warning"
  },
  "inbounds": [
    {
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "<YOUR_UUID_1>",          // 用 uuidgen 或 3x-ui 介面產生
            "email": "user-self",              // 識別標籤，可自訂
            "flow": "xtls-rprx-vision"
          },
          {
            "id": "<YOUR_UUID_2>",
            "email": "user-mobile",
            "flow": "xtls-rprx-vision"
          },
          {
            "id": "<YOUR_UUID_3>",
            "email": "friend-pc",
            "flow": "xtls-rprx-vision"
          },
          {
            "id": "<YOUR_UUID_4>",
            "email": "friend-mobile",
            "flow": "xtls-rprx-vision"
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "raw",
        "security": "reality",
        "realitySettings": {
          "dest": "www.apple.com:443",         // 偽裝目標，需是真實可連的 TLS 網站
          "serverNames": ["www.apple.com"],
          "privateKey": "<YOUR_PRIVATE_KEY>", // 3x-ui 自動生成，或 xray x25519
          "shortIds": ["", "1", "2", "3", "4", "5", "6"]
        }
      }
    }
  ],
  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      {
        "type": "field",
        "ip": ["geoip:private"],               // 封鎖存取伺服器內網
        "outboundTag": "block"
      },
      {
        "type": "field",
        "protocol": ["bittorrent"],             // 封鎖 BT，防止 DMCA
        "outboundTag": "block"
      }
    ]
  },
  "outbounds": [
    {
      "protocol": "freedom",
      "settings": {
        "domainStrategy": "UseIPv4"             // 強制走 IPv4 出口
      },
      "tag": "direct"
    },
    {
      "protocol": "blackhole",
      "tag": "block"
    }
  ]
}

# ====================================================
# Hysteria2 伺服器設定 — 直播推流 + 多使用者強化版
# ====================================================

# 伺服器監聽埠口
listen: :443

# --- TLS 選項 A：手動憑證（自簽或 Let's Encrypt 手動下載）---
#tls:
#  cert: "/path/to/certs/server.crt"    # 憑證路徑
#  key:  "/path/to/certs/server.key"    # 私鑰路徑
#  sniGuard: strict                     # 防止掃描器探測

# --- TLS 選項 B：ACME 自動憑證（推薦，需要域名 + Cloudflare DNS）---
acme:
  domains:
    - "<YOUR_DOMAIN>"                   # 例：vpn.example.com
  email: "<YOUR_EMAIL>"               # 用於憑證到期提醒
  challengeSolver:
    dns:
      provider: cloudflare
      cloudflare:
        apiToken: "<YOUR_CF_API_TOKEN>" # Cloudflare DNS 編輯權限 Token

# 身份驗證：多使用者帳密模式
auth:
  type: userpass
  userpass:
    "<USERNAME_1>": "<PASSWORD_1>"      # 自己用
    "<USERNAME_2>": "<PASSWORD_2>"      # 分享給朋友

# ACL：封鎖 QUIC 放大攻擊向量
acl:
  inline:
    - reject(all, udp/443)

# 混淆（遇到 ISP 封鎖 QUIC 時才啟用，客戶端需同步設定）
#obfs:
#  type: salamander
#  salamander:
#    password: "<YOUR_OBFS_PASSWORD>"

# QUIC 效能調整（針對直播長連接）
quic:
  initStreamReceiveWindow: 4194304   # 4 MB — 減少推流初期卡頓
  maxStreamReceiveWindow:  8388608   # 8 MB
  initConnReceiveWindow:  10485760   # 10 MB — 同時有多條流時的總緩衝
  maxConnReceiveWindow:   20971520   # 20 MB
  maxIdleTimeout: 120s               # 長連接保持，避免短暫斷線重連
  maxIncomingStreams: 1024
  disablePathMTUDiscovery: true      # 跨境網路建議關閉自動 MTU 探測

# 頻寬上限（避免打爆路由器）
bandwidth:
  up:   100 mbps
  down: 100 mbps

# 流量嗅探（可選）
sniff:
  enable: false

# 偽裝網站：有人掃描 IP 時顯示 Bing 首頁
masquerade:
  type: proxy
  proxy:
    url: https://www.bing.com
    rewriteHost: true
  listenHTTP:  :80
  listenHTTPS: :443
  forceHTTPS: true

# 流量統計 API（本機監控）
trafficStats:
  listen: 127.0.0.1:9999
  secret: "<YOUR_STATS_SECRET>"

# 內建測速工具
speedTest: true