VPS Oracle Japan - Proxy Server

CI/CD last tested: 2026-02-18

Server Info

• IP: 158.101.140.85
• OS: Ubuntu 24.04 LTS
• SSH: ssh server2

VLESS + Reality (Xray)

• Protocol: VLESS
• Port: 443
• UUID: 7bb711be-47a2-4273-aa8e-45bcb6216f70
• Flow: xtls-rprx-vision
• Security: reality
• SNI: www.microsoft.com
• Public Key: 203MXpq2G45goHJB7gmdEorwORVeyBOvEISlcLCrWms
• Private Key: (stored on server only — see /usr/local/etc/xray/config.json)
• Short ID: abcd1234
• Fingerprint: safari

Client URI

vless://7bb711be-47a2-4273-aa8e-45bcb6216f70@158.101.140.85:443?encryption=none&flow=xtls-rprx-vision&security=reality&sni=www.microsoft.com&fp=safari&pbk=203MXpq2G45goHJB7gmdEorwORVeyBOvEISlcLCrWms&sid=abcd1234&type=tcp#Japan-VPS

Tailscale

• VPS: 100.70.115.1 (oracle-tokyo, exit node enabled)
• NAS: 100.78.131.124 (ds224plus)
• Phone: 100.83.55.44 (huawei-mate-70)
• iPhone: 100.111.7.83 (iphone181)
• Mac: 100.65.185.12 (macbook-air)

Files

• xray-config.json — Xray server config (deployed to /usr/local/etc/xray/config.json)
• clash-meta.yaml — Clash Meta client config for Android
• japan-vps-qr.png — Shadowrocket QR code
• clash-meta-qr.png — Clash Meta QR code

AdGuard Home

• Web UI: http://100.70.115.1:3000 (Tailscale only)
• DNS: 100.70.115.1:53
• Login: admin / (change default password!)
• Tailscale DNS: set 100.70.115.1 as nameserver at https://login.tailscale.com/admin/dns
• IMPORTANT: In Tailscale admin DNS settings, enable "Use with exit node" for this nameserver and "Override DNS servers" to bypass GFW DNS poisoning

Exit Node Setup Notes

• UFW forward policy must be ACCEPT (in /etc/default/ufw)
• NAT MASQUERADE rule for ens3 added to /etc/ufw/before.rules
• Without these, Tailscale exit node traffic is silently dropped

Services Running

• Xray (VLESS+Reality) on port 443
• Tailscale (exit node)
• WireGuard on port 51820
• AdGuard Home (DNS ad blocker)
• fail2ban (SSH protection)

Security

• SSH: key-only auth, root login disabled
• UFW: only 22/tcp, 443/tcp (iptables), 51820/udp open
• fail2ban: active
• Old Clash Meta proxy: stopped and disabled
• nginx: stopped and disabled
• rpcbind: disabled