Gan, Jimmy
66 lines
2.2 KiB
Markdown
66 lines
2.2 KiB
Markdown
# VPS Oracle Japan - Proxy Server
|
|
> CI/CD last tested: 2026-02-18
|
|
|
|
## Server Info
|
|
- IP: 158.101.140.85
|
|
- OS: Ubuntu 24.04 LTS
|
|
- SSH: `ssh server2`
|
|
|
|
## VLESS + Reality (Xray)
|
|
- Protocol: VLESS
|
|
- Port: 443
|
|
- UUID: 7bb711be-47a2-4273-aa8e-45bcb6216f70
|
|
- Flow: xtls-rprx-vision
|
|
- Security: reality
|
|
- SNI: www.microsoft.com
|
|
- Public Key: 203MXpq2G45goHJB7gmdEorwORVeyBOvEISlcLCrWms
|
|
- Private Key: *(stored on server only — see `/usr/local/etc/xray/config.json`)*
|
|
- Short ID: abcd1234
|
|
- Fingerprint: safari
|
|
|
|
### Client URI
|
|
```
|
|
vless://7bb711be-47a2-4273-aa8e-45bcb6216f70@158.101.140.85:443?encryption=none&flow=xtls-rprx-vision&security=reality&sni=www.microsoft.com&fp=safari&pbk=203MXpq2G45goHJB7gmdEorwORVeyBOvEISlcLCrWms&sid=abcd1234&type=tcp#Japan-VPS
|
|
```
|
|
|
|
## Tailscale
|
|
- VPS: 100.70.115.1 (oracle-tokyo, exit node enabled)
|
|
- NAS: 100.78.131.124 (ds224plus)
|
|
- Phone: 100.83.55.44 (huawei-mate-70)
|
|
- iPhone: 100.111.7.83 (iphone181)
|
|
- Mac: 100.65.185.12 (macbook-air)
|
|
|
|
## Files
|
|
- `xray-config.json` — Xray server config (deployed to `/usr/local/etc/xray/config.json`)
|
|
- `clash-meta.yaml` — Clash Meta client config for Android
|
|
- `japan-vps-qr.png` — Shadowrocket QR code
|
|
- `clash-meta-qr.png` — Clash Meta QR code
|
|
|
|
## AdGuard Home
|
|
- Web UI: http://100.70.115.1:3000 (Tailscale only)
|
|
- DNS: 100.70.115.1:53
|
|
- Login: admin / *(change default password!)*
|
|
- Tailscale DNS: set 100.70.115.1 as nameserver at https://login.tailscale.com/admin/dns
|
|
- **IMPORTANT**: In Tailscale admin DNS settings, enable "Use with exit node" for this nameserver
|
|
and "Override DNS servers" to bypass GFW DNS poisoning
|
|
|
|
## Exit Node Setup Notes
|
|
- UFW forward policy must be `ACCEPT` (in `/etc/default/ufw`)
|
|
- NAT MASQUERADE rule for `ens3` added to `/etc/ufw/before.rules`
|
|
- Without these, Tailscale exit node traffic is silently dropped
|
|
|
|
## Services Running
|
|
- Xray (VLESS+Reality) on port 443
|
|
- Tailscale (exit node)
|
|
- WireGuard on port 51820
|
|
- AdGuard Home (DNS ad blocker)
|
|
- fail2ban (SSH protection)
|
|
|
|
## Security
|
|
- SSH: key-only auth, root login disabled
|
|
- UFW: only 22/tcp, 443/tcp (iptables), 51820/udp open
|
|
- fail2ban: active
|
|
- Old Clash Meta proxy: stopped and disabled
|
|
- nginx: stopped and disabled
|
|
- rpcbind: disabled
|