Initial import of Hugo site to Forgejo

2026-07-28 12:47:20 +00:00 · 2026-07-28 12:47:20 +00:00 · cb1ba0317f
commit cb1ba0317f
1259 changed files with 236349 additions and 0 deletions
--- a/public-onion/sources/posts/vpn.md
+++ b/public-onion/sources/posts/vpn.md
@ -0,0 +1,177 @@
+---
+title: "Stealth Trojan VPN Behind Cloudflare Guide"
+date: 2025-09-09T11:05:00+02:00
+draft: false
+tags: ["VPN", "Trojan", "Cloudflare", "Xray", "3x-ui", "Bypass", "Privacy", "Debugging"]
+categories: ["Guides"]
+---
+
+## Introduction
+So you want a VPN that **doesn't scream "I am a VPN"** to every censor and firewall out there?  
+Welcome to the world of **Trojan over WebSocket + TLS behind Cloudflare**.  
+
+This guide not only shows you how to set it up but also sprinkles in some **debugging magic** so you can figure out why things break (and they *will* break, trust me).  
+
+We’ll anonymise domains and secrets, so substitute with your own:
+- VPN domain: `web.example.com`
+- Panel domain: `panel.example.com`
+- Secret WS path: `/stealth-path_abcd1234`
+- Password: `<PASSWORD>`
+
+---
+
+## Architecture at a Glance
+Think of it as a disguise party:
+
+- **Trojan** = the shy guest (your VPN protocol)  
+- **Nginx** = the bouncer checking IDs (reverse proxy)  
+- **Cloudflare** = the doorman who makes sure nobody sees who's inside (CDN & proxy)  
+- **Your fake website** = the mask (camouflage page)  
+
+Traffic flow:
+```
+Client → Cloudflare (443) → Nginx (443) → Trojan (localhost:54321)
+```
+
+---
+
+## Step 1: Panel Setup (`panel.example.com`)
+- Bind the 3x-ui panel to localhost (e.g., `127.0.0.1:46309`).
+- Choose a funky **web base path** like `/panel-bananas_42/`.
+- Proxy it through Nginx with HTTPS + Basic Auth.
+- Test it at `https://panel.example.com/panel-bananas_42/`.  
+
+**Pro tip:** If you see a blank page → your base path is mismatched or Nginx is eating it. Check logs!
+
+---
+
+## Step 2: Trojan Inbound
+In 3x-ui, create a Trojan inbound:
+- Local port: `54321`
+- Transport: WebSocket
+- Path: `/stealth-path_abcd1234`
+- Security: none
+- Password: `<PASSWORD>`
+
+---
+
+## Step 3: Nginx for VPN Domain (`web.example.com`)
+Your Nginx is the gatekeeper. Sample config:
+
+```nginx
+server {
+    listen 443 ssl http2;
+    server_name web.example.com;
+
+    ssl_certificate     /etc/letsencrypt/live/web.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/web.example.com/privkey.pem;
+
+    # Fake website at root
+    location / {
+        root /var/www/html;
+        index index.html;
+    }
+
+    # Real VPN under secret WS path
+    location /stealth-path_abcd1234 {
+        proxy_pass http://127.0.0.1:54321;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+    }
+}
+```
+
+---
+
+## Step 4: Firewall Rules
+Lock things down! Only Cloudflare should reach you:
+```bash
+ufw allow 22/tcp
+ufw allow 80/tcp
+ufw allow 443/tcp
+ufw deny 54321/tcp
+```
+
+---
+
+## Step 5: Client Config
+Trojan URI:
+```
+trojan://<PASSWORD>@web.example.com:443?type=ws&security=tls&host=web.example.com&path=%2Fstealth-path_abcd1234&sni=web.example.com#MyStealthVPN
+```
+
+iOS clients: Shadowrocket, Stash, FoXray  
+Android clients: v2rayNG, Clash Meta, NekoBox  
+
+---
+
+## Debugging Time (a.k.a. “Why the heck doesn’t it work?!”)
+
+### Symptom: **520 Unknown Error (Cloudflare)**
+- Likely cause: Nginx couldn’t talk to Trojan.
+- Check Nginx error log:
+  ```bash
+  tail -n 50 /var/log/nginx/error.log
+  ```
+- If you see `upstream sent no valid HTTP/1.0 header` → you’re mixing HTTPS/HTTP between Nginx and Trojan.
+
+---
+
+### Symptom: **526 Invalid SSL certificate**
+- Cloudflare → Nginx cert mismatch.
+- Run:
+  ```bash
+  openssl s_client -connect web.example.com:443 -servername web.example.com -showcerts
+  ```
+- Make sure CN = `web.example.com`. If not, fix your cert.
+
+---
+
+### Symptom: **Blank page on panel**
+- Check if the base path matches exactly (case-sensitive, slash-sensitive).
+- Watch for sneaky trailing spaces!
+- Test locally:
+  ```bash
+  curl -s -D- http://127.0.0.1:46309/panel-bananas_42/
+  ```
+
+---
+
+### Symptom: **Client won’t connect**
+- Run a WebSocket test:
+  ```bash
+  curl -i -k -H "Connection: Upgrade" -H "Upgrade: websocket" https://web.example.com/stealth-path_abcd1234
+  ```
+  Expect `101 Switching Protocols`. If not, check Nginx config.
+
+---
+
+### Symptom: **Censor still blocks you**
+- Did you expose another service (like SSH, Matrix, or Minecraft) on the same IP?  
+  → They’ll find your origin IP. Use a second VPS or lock those ports down.  
+- Did you use an obvious path like `/ws`?  
+  → Use a random-looking one like `/cdn-assets-329df/`.
+
+---
+
+## Pro Tips & Fun Tricks
+- Serve a fake blog or portfolio at root so your domain looks legit.
+- Rotate WebSocket paths occasionally.
+- Use Cloudflare **Page Rules** to disable Rocket Loader & Minify for your VPN domain.
+- Make friends with your Nginx error.log — it will roast you but it tells the truth.
+
+---
+
+## Conclusion
+By putting Trojan behind Cloudflare, you’ve given your VPN a shiny new disguise:
+- Looks like normal HTTPS.
+- Hides your origin IP.
+- Forces censors into a tough choice: block Cloudflare (and half the web) or let you pass.
+
+Congrats — you’ve built a VPN with both **style** and **stealth**. 🥷
+
+---
+
+{{< sigdl >}}