{"id":51475954,"url":"https://github.com/superchaospc/xray-xhttp-wireguard-relay","last_synced_at":"2026-07-06T21:00:54.232Z","repository":{"id":363484403,"uuid":"1263555705","full_name":"superchaospc/xray-xhttp-wireguard-relay","owner":"superchaospc","description":"Multi-route Xray VLESS XHTTP REALITY relay over isolated WireGuard VPS tunnels","archived":false,"fork":false,"pushed_at":"2026-06-09T04:28:37.000Z","size":100,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-09T06:22:41.642Z","etag":null,"topics":["bash","reality","relay","vless","vps","wireguard","xhttp","xray"],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/superchaospc.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-09T04:05:55.000Z","updated_at":"2026-06-09T04:28:23.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/superchaospc/xray-xhttp-wireguard-relay","commit_stats":null,"previous_names":["superchaospc/xray-xhttp-wireguard-relay"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/superchaospc/xray-xhttp-wireguard-relay","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/superchaospc%2Fxray-xhttp-wireguard-relay","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/superchaospc%2Fxray-xhttp-wireguard-relay/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/superchaospc%2Fxray-xhttp-wireguard-relay/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/superchaospc%2Fxray-xhttp-wireguard-relay/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/superchaospc","download_url":"https://codeload.github.com/superchaospc/xray-xhttp-wireguard-relay/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/superchaospc%2Fxray-xhttp-wireguard-relay/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35205739,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-06T02:00:07.184Z","response_time":106,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bash","reality","relay","vless","vps","wireguard","xhttp","xray"],"created_at":"2026-07-06T21:00:53.360Z","updated_at":"2026-07-06T21:00:54.218Z","avatar_url":"https://github.com/superchaospc.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# xray-xhttp-wireguard-relay\n\n[![Release](https://img.shields.io/github/v/release/superchaospc/xray-xhttp-wireguard-relay?style=flat-square)](https://github.com/superchaospc/xray-xhttp-wireguard-relay/releases)\n[![Release date](https://img.shields.io/github/release-date/superchaospc/xray-xhttp-wireguard-relay?style=flat-square)](https://github.com/superchaospc/xray-xhttp-wireguard-relay/releases)\n[![Downloads](https://img.shields.io/github/downloads/superchaospc/xray-xhttp-wireguard-relay/total?style=flat-square)](https://github.com/superchaospc/xray-xhttp-wireguard-relay/releases)\n[![Last commit](https://img.shields.io/github/last-commit/superchaospc/xray-xhttp-wireguard-relay?style=flat-square)](https://github.com/superchaospc/xray-xhttp-wireguard-relay/commits/main)\n[![Issues](https://img.shields.io/github/issues/superchaospc/xray-xhttp-wireguard-relay?style=flat-square)](https://github.com/superchaospc/xray-xhttp-wireguard-relay/issues)\n[![Stars](https://img.shields.io/github/stars/superchaospc/xray-xhttp-wireguard-relay?style=flat-square)](https://github.com/superchaospc/xray-xhttp-wireguard-relay/stargazers)\n[![Forks](https://img.shields.io/github/forks/superchaospc/xray-xhttp-wireguard-relay?style=flat-square)](https://github.com/superchaospc/xray-xhttp-wireguard-relay/network/members)\n[![Repo size](https://img.shields.io/github/repo-size/superchaospc/xray-xhttp-wireguard-relay?style=flat-square)](https://github.com/superchaospc/xray-xhttp-wireguard-relay)\n[![Code size](https://img.shields.io/github/languages/code-size/superchaospc/xray-xhttp-wireguard-relay?style=flat-square)](https://github.com/superchaospc/xray-xhttp-wireguard-relay)\n[![License](https://img.shields.io/github/license/superchaospc/xray-xhttp-wireguard-relay?style=flat-square)](LICENSE)\n![Tests](https://img.shields.io/badge/tests-bash%20%2B%20shellcheck-brightgreen?style=flat-square)\n![Bash](https://img.shields.io/badge/language-Bash-4EAA25?style=flat-square)\n![Linux](https://img.shields.io/badge/platform-Linux%20systemd-blue?style=flat-square)\n![Xray](https://img.shields.io/badge/core-Xray-2F6FED?style=flat-square)\n![XHTTP](https://img.shields.io/badge/transport-XHTTP-0EA5E9?style=flat-square)\n![REALITY](https://img.shields.io/badge/security-REALITY-7C3AED?style=flat-square)\n![WireGuard](https://img.shields.io/badge/relay-WireGuard-88171A?style=flat-square)\n![Debian](https://img.shields.io/badge/Debian-supported-A81D33?style=flat-square)\n![Ubuntu](https://img.shields.io/badge/Ubuntu-supported-E95420?style=flat-square)\n![RHEL](https://img.shields.io/badge/RHEL--compatible-supported-EE0000?style=flat-square)\n\n单文件部署工具：\n\n```text\n客户端\n  -\u003e 中转 VPS：VLESS + XHTTP + REALITY\n  -\u003e 独立 WireGuard 隧道\n  -\u003e 落地 VPS：转发 + NAT\n  -\u003e Internet\n```\n\n同一台 Relay 可以管理多条 Exit 线路。每条线路拥有独立客户端 TCP\n端口、XHTTP 路径、REALITY 凭据、WireGuard 接口、UDP 端口、密钥和\n`/30` 子网。修改客户端端口不会改变 WireGuard 身份。\n\n脚本使用独立的 `xray-xhttp-wireguard-relay.service`、配置目录和 Stats\nAPI 端口，不替换系统已有的 `xray.service` 或其配置，适合与现有节点并存。\n\n\u003e **秘密参数包警告：** Exit 输出的 `WG_BUNDLE` 包含 Relay WireGuard\n\u003e 私钥。只通过可信的加密渠道传输，不要发到聊天群、工单或公开日志。\n\u003e 参数包内的 SHA-256 仅检测意外损坏，不提供加密、签名或身份认证。\n\n## 要求\n\n- Linux、root、systemd。\n- 优先支持 Debian/Ubuntu，兼容使用 `dnf` 的 RHEL 系发行版。\n- 客户端与 Xray core 必须支持 XHTTP + REALITY。\n- Relay 对外开放每条线路的 TCP 入口端口。\n- Exit 对外开放每条线路的 WireGuard UDP 端口。\n- 云厂商安全组也必须同步放行；脚本无法修改云控制台规则。\n\n## 安装\n\n### 1. 先在 Exit 运行\n\n```bash\ncurl -fsSL https://raw.githubusercontent.com/superchaospc/xray-xhttp-wireguard-relay/main/xray_xhttp_wireguard_relay.sh \\\n  -o /root/xray_xhttp_wireguard_relay.sh\nchmod +x /root/xray_xhttp_wireguard_relay.sh\n/root/xray_xhttp_wireguard_relay.sh --exit\n```\n\nExit 会安装 WireGuard、自动分配 `/30` 子网和 UDP 端口、启用精确范围的\n转发/NAT，并输出一条包含 `WG_BUNDLE` 的 Relay 命令。\n\n### 2. 在 Relay 粘贴 Exit 输出的命令\n\n示意：\n\n```bash\nWG_BUNDLE='SECRET_BUNDLE' \\\nRELAY_PORT='443' \\\nRELAY_PUBLIC_HOST='RELAY_IP_OR_DOMAIN' \\\nROUTE_NAME='US Exit' \\\nAUTO_YES=1 \\\nbash /root/xray_xhttp_wireguard_relay.sh --relay\n```\n\n成功后会输出 `vless://` 客户端链接并刷新：\n\n```text\n/root/xray_xhttp_wireguard_subscription.txt\n```\n\n若 Relay 同时有 IPv4/IPv6，或某一地址未在上游防火墙开放入口端口，请用\n`RELAY_PUBLIC_HOST` 明确指定客户端可达的 IPv4、IPv6 或域名。该值会保存到\n线路状态，后续 `--list`、`--qr` 和 `--sub` 会继续使用。\n\n### 3. 添加更多线路\n\n在新 Exit 重复第一步，然后在同一 Relay 导入新参数包，使用另一个客户端\n端口：\n\n```bash\nWG_BUNDLE='SECOND_SECRET_BUNDLE' RELAY_PORT='8443' ROUTE_NAME='DE Exit' \\\n  AUTO_YES=1 bash /root/xray_xhttp_wireguard_relay.sh --relay\n```\n\n默认从 `10.77.0.0/16` 分配 `/30`，UDP 从 `51821` 开始。存在内网冲突时：\n\n```bash\nWG_SUBNET_POOL='10.199.0.0/16' WG_PORT_START='52000' \\\n  bash /root/xray_xhttp_wireguard_relay.sh --exit\n```\n\n## 管理\n\n```bash\n# 查看线路和链接\nbash /root/xray_xhttp_wireguard_relay.sh --list\n\n# 刷新并显示 base64 订阅\nbash /root/xray_xhttp_wireguard_relay.sh --sub\n\n# 终端二维码与当前流量\nbash /root/xray_xhttp_wireguard_relay.sh --qr\nbash /root/xray_xhttp_wireguard_relay.sh --stats\n\n# 状态与诊断\nbash /root/xray_xhttp_wireguard_relay.sh --status\nbash /root/xray_xhttp_wireguard_relay.sh --doctor\n\n# 改名\nRELAY_PORT=443 ROUTE_NAME='Main Exit' bash /root/xray_xhttp_wireguard_relay.sh --rename\n\n# 修改客户端入口端口\nRELAY_PORT=443 NEW_RELAY_PORT=9443 bash /root/xray_xhttp_wireguard_relay.sh --port\n\n# 删除单条线路\nRELAY_PORT=9443 bash /root/xray_xhttp_wireguard_relay.sh --delete\n\n# 重启和更新 Xray\nbash /root/xray_xhttp_wireguard_relay.sh --restart\nbash /root/xray_xhttp_wireguard_relay.sh --update\n\n# 删除本项目管理的资源\nbash /root/xray_xhttp_wireguard_relay.sh --uninstall\n```\n\n直接运行脚本会进入交互菜单。线路状态以版本化 JSON 保存，敏感文件权限为 `600`。脚本使用稳定的\n`route_id` 生成不超过 15 字符的 WireGuard 接口名，例如\n`xwg-a1b2c3d4`。项目 firewall 规则带\n`xray-xhttp-wireguard-relay:\u003croute_id\u003e` 标记，删除时不会按模糊端口匹配\n清理无关规则。\n\n## XHTTP\n\n默认 `XHTTP_MODE=auto`，还支持：\n\n```text\nstream-one\nstream-up\npacket-up\n```\n\n每条线路生成独立随机路径。客户端 URI 包含 `type=xhttp`、`path`、\n`mode`、`security=reality`、`pbk`、`sid`、`sni` 和 `fp`。\n\n## IPv6 与 MTU\n\nRelay 或 Exit 的公网 endpoint 可以是 IPv4 或 IPv6；IPv6 WireGuard\nendpoint 会自动格式化为 `[2001:db8::1]:51821`。\n\n默认 `WG_MTU=1380`。若出现网页部分加载、TLS 卡顿或大包丢失，可尝试：\n\n```bash\nWG_MTU=1280 bash /root/xray_xhttp_wireguard_relay.sh --relay\n```\n\n同时检查云安全组、宿主机 UDP 限制和路径 MTU。\n\n## 排错\n\n```bash\nxray run -test -config /usr/local/etc/xray-xhttp-wireguard-relay/config.json\nwg show\nip rule show\nip route show table all\nsystemctl status xray-xhttp-wireguard-relay\nsystemctl status wg-quick@xwg-ROUTEID\n```\n\n`--doctor` 会显示 Xray 配置、监听端口、策略路由、WireGuard latest\nhandshake 和流量计数。它不会输出 WireGuard 私钥或预共享密钥，即使\n`XRAY_REDACT=0`。\n\n没有握手时依次检查：\n\n1. Exit UDP 端口及云安全组。\n2. Exit endpoint 是否正确，IPv6 是否可达。\n3. 两端系统时间和 WireGuard 服务。\n4. NAT/forward 规则及 `net.ipv4.ip_forward=1`。\n5. 地址池是否和 Docker、Tailscale、内网或其他 VPN 冲突。\n\n## 测试\n\n```bash\nbash run_all_tests.sh\n```\n\n测试包含 Bash 语法、ShellCheck、项目身份、XHTTP 配置、IPv6 endpoint、\n稳定接口名、多线路生命周期、策略路由、firewall 所有权和诊断入口。\n\n自动化测试不等同于真实公网验证。正式使用前应在可丢弃 VPS 上确认：\n\n- WireGuard 完成握手并有双向计数。\n- 代理后的公网 IP 是 Exit 地址。\n- 重启后 Xray 和所有 `wg-quick@...` 服务恢复。\n- 删除一条线路不影响其他线路和 SSH。\n\n## v1.0.0\n\n- 客户端入口改为 VLESS XHTTP REALITY。\n- VPS 间传输改为每线路独立 WireGuard。\n- 保留多线路、链接、订阅、改名、改端口、删除、状态、诊断、更新和卸载。\n- 增加秘密 route bundle、稳定接口名、源地址策略路由和带归属标记的 NAT。\n- 支持 IPv4/IPv6 WireGuard endpoint。\n\n## v1.0.1 实机验证\n\n已在 Ubuntu 24.04 双 VPS 完成真实部署：\n\n- 香港 Relay：VLESS XHTTP REALITY，IPv6 TCP 9443。\n- ZLIDC Exit：WireGuard UDP 51822，独立 `10.79.0.0/30`。\n- 本地 Xray 客户端通过生成的 VLESS URI 连接，公网出口确认是 Exit IPv4。\n- Cloudflare trace 返回 HTTP/2，Xray Stats API 记录双向流量。\n- 两端 WireGuard 与独立 Xray 服务重启后，握手和代理链路恢复。\n- 原有主 Xray、`wg-hz`、`wg-mly` 和 443/8443 监听均保持 active。\n\n本次实测同时修复：独立 Xray 服务隔离、JSON 临时配置识别、服务目录权限与\n启动确认、客户端入口地址持久化，以及 Relay WireGuard 固定监听端口。\n\n## 来源与许可\n\n本项目派生自\n[superchaospc/xray-vps2vps-relay](https://github.com/superchaospc/xray-vps2vps-relay)\nv1.4.3，保留 MIT License。感谢 Xray-core、WireGuard 及上游项目。\n\n本项目仅用于合法的网络运维、隐私保护与协议研究。使用者需遵守所在地法律\n及服务商条款，并自行承担部署和使用风险。\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsuperchaospc%2Fxray-xhttp-wireguard-relay","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsuperchaospc%2Fxray-xhttp-wireguard-relay","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsuperchaospc%2Fxray-xhttp-wireguard-relay/lists"}