vless fallback to trojan then fallback to nginx, how to configure alpn h2?

[qiangxinglin]

xray config:

{
    "log": {
        "access": "none",
        "error": "none",
        "loglevel": "warning"
    },
    "inbounds": [
        {
            "port": 443,
            "protocol": "vless",
            "settings": {
                "clients": [],
                "decryption": "none",
                "fallbacks": [
                    {
                        "dest": 1310,
                        "xver": 1
                    }
                ]
            },
            "streamSettings": {
                "security": "tls",
                "tlsSettings": {
                    "rejectUnknownSni": true,
                    "alpn": [
                        "http/1.1"
                    ],
                    "certificates": [
                        {
                            "certificateFile": "/etc/cert/fullchain.cer",
                            "keyFile": "/etc/cert/private.key"
                        }
                    ]
                }
            },
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls",
                    "quic"
                ]
            }
        },
        {
            "port": 1310,
            "listen": "127.0.0.1",
            "protocol": "trojan",
            "settings": {
                "clients": [],
                "fallbacks": [
                    {
                        "dest": 5001,
                        "xver": 1
                    },
                    {
                        "alpn": "h2",
                        "dest": 5002,
                        "xver": 1
                    }
                ]
            },
            "streamSettings": {
                "network": "tcp",
                "security": "none",
                "tcpSettings": {
                    "acceptProxyProtocol": true
                }
            }
        }
    ],
    "routing": {
        "domainStrategy": "IPIfNonMatch",
        "rules": [
            {
                "type": "field",
                "domain": [
                    "geosite:category-ads-all"
                ],
                "ip": [
                    "geoip:cn"
                ],
                "outboundTag": "block"
            },
            {
                "type": "field",
                "outboundTag": "direct",
                "network": "udp,tcp"
            }
        ]
    },
    "outbounds": [
        {
            "tag": "direct",
            "protocol": "freedom"
        },
        {
            "tag": "block",
            "protocol": "blackhole"
        }
    ]
}

nginx config:

user  nginx;
worker_processes    auto;

pid   /var/run/nginx.pid;

events {
    use     epoll;
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
 
    log_format main '[$time_local] $proxy_protocol_addr "$http_referer" "$http_user_agent"';
   
    # 强制https
    server {
        listen 80;
        return 301 https://$host$request_uri;
    }

    set_real_ip_from 127.0.0.1;
    real_ip_header proxy_protocol;

    map $http_upgrade $connection_upgrade {
        default      keep-alive;
        'websocket'  upgrade;
        ''           close;
    }

    map $proxy_protocol_addr $proxy_forwarded_elem {
        ~^[0-9.]+$        "for=$proxy_protocol_addr";
        ~^[0-9A-Fa-f:.]+$ "for=\"[$proxy_protocol_addr]\"";
        default           "for=unknown";
    }
    
    map $http_forwarded $proxy_add_forwarded {
        "~^(,[ \\t]*)*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*([ \\t]*,([ \\t]*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*)?)*$" "$http_forwarded, $proxy_forwarded_elem";
        default "$proxy_forwarded_elem";
    }
}

    server {
        listen 127.0.0.1:5001 proxy_protocol;
        listen 127.0.0.1:5002 proxy_protocol;
        http2  on;
    
        server_name XXXXXX;
    
        location / {
            proxy_pass http://[::1]:8953;
    
            sub_filter                            $proxy_host $host;
            sub_filter_once                       off;
            proxy_set_header Host                 $proxy_host;
            proxy_http_version                    1.1;
            proxy_cache_bypass                    $http_upgrade;
            proxy_ssl_server_name                 on;
            proxy_set_header Upgrade              $http_upgrade;
            proxy_set_header Connection           $connection_upgrade;
            proxy_set_header X-Real-IP            $proxy_protocol_addr;
            proxy_set_header Forwarded            $proxy_add_forwarded;
            proxy_set_header X-Forwarded-For      $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto    $scheme;
            proxy_set_header X-Forwarded-Host     $host;
            proxy_set_header X-Forwarded-Port     $server_port;
    
            add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
        }
    }

Currently, it works. But if I change the alpn for vless inbound to h2, the nginx fallback won't work. Any help?

[lxhao61]

Your configuration is outdated and has the risk of TLS in TLS, so it is no longer recommended. Currently, the VLESS fallback configuration is only recommended to refer to the Xray(VLESS+Vision+TLS)+Nginx example, and the Trojan fallback configuration is only recommended to refer to the Xray(Trojan+RAW+TLS)+Nginx example. If you want the two to coexist, please refer to the Xray(E+F+H+G+B+A)+Nginx example.

[qiangxinglin]

After inspecting the TLS in TLS caveats, I decide to use Xray(Trojan+TCP+TLS)+Nginx as my server configuration.
One more question: the examples you provided are very helpful, any plan on traefik examples?

[lxhao61]

No. Traefik is similar to Caddy. We recommend using the Caddy examples in the repository or configuring Traefik yourself by referring to the Caddy examples.

[Sparklingx]

@lxhao61 [Xray(Trojan+TCP+TLS)+Nginx] this link is not found. I am looking for something like this .. so I can use youtube.com as SNI or websocket option to use youtube.com as websocket host.

[lxhao61]

The official TCP transfer has been changed to RAW transfer. Therefore, Xray(Trojan+TCP+TLS)+Nginx has been updated to Xray(Trojan+RAW+TLS)+Nginx. Please refer to the Xray(Trojan+RAW+TLS)+Nginx example now.