Xray

Following the White Rabbit: Developer Builds Custom Rust VPN PAYPHONE Using QUIC and Obfuscation to Evade Detection

A Russian developer has released PAYPHONE, an experimental IPv4 VPN written entirely in Rust that uses QUIC datagrams and optional TLS-over-TCP transport with custom obfuscation. The project aims to provide an alternative to AmneziaWG and Xray/VLESS+REALITY stacks that are commonly used to bypass Russian internet filtering. The article details the full packet path from TUN interface through a 16-byte PAYPHONE header, session management with Ed25519 tokens, and multiple post-launch bugs including MTU miscalculations, self-routing loops on macOS, and timer lifetime issues in Tokio. Key technical choices include RFC 9221 datagram support to avoid head-of-line blocking for multiplexed TCP flows and token-bucket rate limiting tied to subscription tokens. The author also describes route monitoring every 400 ms and interface-bound sockets to prevent the tunnel from swallowing its own control traffic.

Part 2: How Third-Party Developers Closed the tun0 Leak in AmneziaVPN on Android

Third-party contributors to AmneziaVPN have detailed their fix for a VPN tunnel bypass affecting excluded applications on Android. The vulnerability allows any app, even those disallowed from the VPN, to bind sockets directly to the tun0 interface using SO_BINDTODEVICE and thereby discover the VPN server address. The team implemented a packet filter inside the client that queries Android via ConnectivityManager.getConnectionOwnerUid to determine packet ownership and drops traffic from unknown UIDs. The solution was integrated into both the Xray and AmneziaWG traffic paths, with the AmneziaWG hook placed inside amneziawg-go after packet parsing. Testing with leak_probe.py showed zero successful bypass attempts out of six methods when the filter was active, compared to six out of six without it. The developers submitted three pull requests and released a side-loaded test build, while noting remaining limitations such as raw sockets and tethering scenarios.

Hydrat Project Builds Automated WireGuard Gateway for Resilient VLESS and Tor Routing

A developer has released Hydrat, a self-hosted gateway that connects devices via WireGuard while automatically managing VLESS and Tor backends to survive server blocks and quality degradation. The system maintains a pool of tested proxies, performs continuous health checks, and switches routes without requiring client-side profile changes. Two Go processes handle control logic and network enforcement separately, using SQLite for state and nftables plus Xray for traffic routing. TCP and UDP can be assigned independent exits, with geoip.dat support and custom rules to keep marketplace apps functional. The project emphasizes stability over direct connections and is designed for deployment on servers in Russian jurisdiction.

Review of GL.iNet Mudi 7 and Xray Configuration for Flexible Traffic Routing

The article provides a hands-on review of the GL.iNet Mudi 7 portable router combined with detailed instructions for deploying Xray. The author explains moving away from managing multiple separate VPN clients by installing Xray directly on the router. This setup allows all connected devices to route traffic intelligently without manual configuration on each endpoint. Local and Russian services connect directly to avoid latency, while international traffic is forwarded through a personal server. The guide covers practical scenarios for home use and emphasizes maintaining speed for permitted connections while ensuring selective proxying for the rest of the traffic.

From HAProxy to VLESS+Reality: Overcoming DPI Blocks for MTProto Telegram Proxies

A detailed case study describes the challenges of running an MTProto proxy for Telegram on Russian servers facing ISP-level DPI. Initial attempts using HAProxy TCP relays and SOCKS5 tunnels failed because modern DPI systems detect MTProto and fake-TLS signatures regardless of transparent forwarding. The author eventually succeeded by layering mtg with an Xray VLESS+Reality tunnel that performs genuine TLS 1.3 handshakes to legitimate domains. Key configuration pitfalls included the xtls-rprx-vision flow breaking non-TLS payloads, missing mux causing handshake timeouts on short-lived connections, and provider-specific network policies. Final architecture places mtg and an Xray client on the Russian entry server while the foreign exit server runs Xray in VLESS+Reality inbound mode. The guide supplies complete docker-compose examples, key generation commands, and a checklist of common misconfigurations to avoid.

Simple Bridge Panel Offers Self-Hosted Management for Xray and AmneziaWG Connections

A developer frustrated with shared-IP VPN services and growing configuration management overhead has released Simple Bridge Panel (SBP), a lightweight self-hosted interface for administering Xray and AmneziaWG on personal VPS instances. The panel installs on fresh Ubuntu 24.04 servers via a single command and provides one-click deployment of Xray TCP with REALITY, Xray XHTTP, and AmneziaWG, along with group-based access expiration and traffic accounting. It separates the web UI from a privileged local agent that communicates over a Unix socket, allowing controlled management of Docker containers, systemd services, and network routes without granting the interface full root access. Fixed versions of Xray 26.3.27, v2rayN 7.20.4, and v2rayNG 2.2.6 are bundled to avoid compatibility issues encountered with newer releases. Additional features include Whitelist Bypass routes, monthly traffic tracking stored only in SQLite, automatic rollback on failed updates, and QR-code or subscription link generation for clients. The project is published under Apache 2.0 and deliberately targets clean servers to minimize risk of interfering with existing configurations.

sing-box Fork Expands from Desktop VPN Launcher to Android and Router Deployments

The sing-box-lx fork has grown from a desktop-focused VPN engine into a cross-platform solution supporting Android and headless router deployments. Over 1,700 commits since June produced 24 stable 1.14 releases and dozens of specialized builds. New protocol support includes a full MASQUE CONNECT-IP outbound for Cloudflare WARP and a rigorously verified AmneziaWG 2.0 implementation matching 16 obfuscation parameters across three reference sources. Android adaptations introduced aggressive endpoint state management that reduced RSS by 31 percent and CPU load by 80 percent while fixing long-standing TCP dial timeouts inherited from gVisor. The new lxd headless daemon exposes gRPC observability and admin REST endpoints with mTLS, config validation, automatic rollback, and device-name mapping for OpenWrt deployments. All changes follow strict upstream discipline: minimal patches, regular rebases, reproducible builds, and real-device testing before stable tags.