xray-client --> domestic VPS <-- foreign VPS --> INTERNET

[miharoot]

In Russia, blocking of foreign internet connections has become increasingly strict and brutal. They block not only by SNI or protocol, but also by the number of connections to an address or their intensity. This forces the use of cascading proxies, using VPSs in Russia as intermediate ones, because blocking on VPS communication channels is more lenient.
But over time, blocking on VPS communication channels is also becoming more severe.
And here's an interesting point: the blocking is targeted at traffic going OUTSIDE.
Therefore, the following option would be interesting:
create a scheme in which the connection between a domestic VPS and a foreign VPS is initiated by an foreign VPS, but the traffic goes from the domestic to the foreign one.

xray-client --xhttp--> domestic VPS <--xhttp-- foreign VPS --> INTERNET

[yakimant]

I didnt read it (in my TODO), but there is an official guide:
https://xtls.github.io/en/document/level-2/vless_reverse.html

[miharoot]

official guide

thanks for the good manual.
I already use this to access my HOME network.

But here I’m talking about access not to one specific resource, but about access to an indefinite number of resources, that is, the Internet.
As far as I understand, VLESS Reverse Proxy will not work in this case, although it is of course very similar to the required functionality.

[yakimant]

I need to read it and try setting up. I think it's possible using this guide.
Would be nice to update the guide with your scenario it it is possible.

[DmitryPan]

Blocking is more severe on mobile networks. Try establishing a VLESS connection from your home router to a foreign node. Many ISPs allow such connections. VLESS/Reality setups are more easily detected. In that case, try configuring VLESS-Nginx with real certificates and a simple website. This approach should work from home internet.
As for mobile internet, set up a WireGuard tunnel to your home router (on Russian ISP), and route your traffic abroad from there. This was working quite recently.

[miharoot]

I already have all this and have tested it. and even more.
Now we are talking about a connection option when VLESS goes from a foreign VPS to a domestic VPS, but at the same time the proxied data on that VLESS goes in the opposite direction - from the home xray client through the domestic VPS and then to the foreign VPS and further to the free Internet.
do you understand the idea?

What I have done at the moment is that I have a cloak connection established from a foreign VPS to a Russian VPS, and inside this cloak there is a VLESS from the Russian to the foreign one so that proxied data can flow.
and I would like it to be the normal mode of xray operation

[DmitryPan]

Ok, so basically you want to initiate tunnel connection from foreign VPS but establish connections from home to the free Internet thru foreign VPS. Did you try to establish SSH tunnel (tun interface, not proxy)? If Russian TSPUs block direct SSH, you can connect SSH inside VLESS: foreign VPS connects VLESS to Russian VPS and then SSH tunnel inside VLESS from foreign VPS to russian VPS. You will get tun interfaces on server and client and you can route all the traffic in both directions. If you use VLESS as outer layer, inner SSH can be replaced by anything that fully supports L3, e.g. Wireguard or OpenVPN.

[miharoot]

Did you try to establish SSH

What are you even talking about?
Why do you need SSH and OpenVPN? It's very suspicious for DPI.
I already made with cloak (https://github.com/cbeuw/cloak) it disguises itself as https.
But I'd like to see similar functionality in Xray.

[DmitryPan]

I'll translate it for you.

Используйте VLESS как внешнее соединение, внутри которого любую VPN с поддержкой OSI Layer 3, например SSH в режиме tun, OpenVPN или Wireguard. Благодаря L3 вы сможете инициировать IP соедиения с любой стороны, а VLESS скроет VPN от ТСПУ. У меня, кстати, SSH без VLESS из РФ за бугор работает безотказно.

[miharoot]

У меня, кстати, SSH без VLESS из РФ за бугор работает безотказно.

Did I understand you correctly: “xray is not needed because ssh works well for you”?
I don’t understand why talk here about something that has nothing to do with xray?

[DmitryPan]

No, you misunderstood me.