fix: cyrillic fonts, dev certs, page head, and ru-text typography (#67)
🤖 PR generated for branch `fix/cyrillic-fonts-dev-certs-and-page-head`.
### Changes Summary
- **Fonts**: Add Cyrillic glyph subsets for Lato, EB Garamond, and Fira
Code.
- **Dev**: Support remote Root CA and encrypted dev CA key in
`.env.dev`.
- **UI & Kits**: Add size variant to `Breadcrumbs` component and enlarge
`PageHead` breadcrumbs with tuned collapse scroll threshold.
- **ESLint**: Add `no-hanging-particles` i18n & markdown typography rule
with auto-fixer.
- **Content & i18n**: Apply `ru-text` editorial and typography polish
(em dashes, number ranges, «ё» restoration, non-breaking spaces) across
`services/www` and `services/docs`.
This commit is contained in:
deytenit authored and 
GitHub committed
1 parent
c6487dc258
commit
b3638f4d63
111 files changed
+2350
-1512
No files matched your search
@@ -1,67 +1,67 @@
|
||||
---
|
||||
title: 'Xray Subnet Mimicry (10.0.0.0/8)'
|
||||
description: 'Building a distributed private network with Xray-core and reverse tunneling'
|
||||
description: 'Building a distributed private network with Xray-core and reverse tunneling'
|
||||
createdDate: 2026-03-20
|
||||
tags: ['networking', 'guides', 'xray']
|
||||
---
|
||||
|
||||
> **EDUCATIONAL PURPOSES ONLY**
|
||||
> This project is designed as a technical demonstration of Xray-core's routing capabilities and private subnet mimicry. It is NOT intended for restriction evasion or illegal activities. Use this knowledge responsibly and in compliance with your local laws.
|
||||
> This project is designed as a technical demonstration of Xray-core's routing capabilities and private subnet mimicry. It is NOT intended for restriction evasion or illegal activities. Use this knowledge responsibly and in compliance with your local laws.
|
||||
|
||||
This guide describes how to deploy a private, distributed communications infrastructure across distinct remote servers using a contiguous `10.0.0.0/8` private subnet mimicked via **Xray-core**, **TPROXY**, and **VLESS reverse tunneling**.
|
||||
This guide describes how to deploy a private, distributed communications infrastructure across distinct remote servers using a contiguous `10.0.0.0/8` private subnet mimicked via **Xray-core**, **TPROXY**, and **VLESS reverse tunneling**.
|
||||
|
||||
---
|
||||
|
||||
## Technical Deep-Dive & Architecture
|
||||
|
||||
### The Virtual Subnet Concept
|
||||
### The Virtual Subnet Concept
|
||||
|
||||
We are constructing a Layer 3 "Flat Network" over the public internet. Each server node acts as an authoritative gateway for its own `/16` segment within the `10.0.0.0/8` private address space:
|
||||
We are constructing a Layer 3 "Flat Network" over the public internet. Each server node acts as an authoritative gateway for its own `/16` segment within the `10.0.0.0/8` private address space:
|
||||
|
||||
- **Server A (Hub / Portal)**: Owns `10.1.0.0/16`
|
||||
- **Server A (Hub / Portal)**: Owns `10.1.0.0/16`
|
||||
- **Server B (Spoke / Bridge)**: Owns `10.2.0.0/16`
|
||||
- **Server C (Spoke / Bridge)**: Owns `10.3.0.0/16`
|
||||
|
||||
This setup enables seamless inter-node communication as if all servers and hosted containers resided on the same local physical network.
|
||||
This setup enables seamless inter-node communication as if all servers and hosted containers resided on the same local physical network.
|
||||
|
||||
### The Science of Interception (TPROXY)
|
||||
### The Science of Interception (TPROXY)
|
||||
|
||||
Unlike `REDIRECT`, which only supports TCP and modifies packet destination IP headers to match the proxy, **TPROXY** (Transparent Proxy) intercepts both TCP and UDP packets while preserving original source and destination IP headers.
|
||||
Unlike `REDIRECT`, which only supports TCP and modifies packet destination IP headers to match the proxy, **TPROXY** (Transparent Proxy) intercepts both TCP and UDP packets while preserving original source and destination IP headers.
|
||||
|
||||
- **Marking**: When a packet destined for `10.x.x.x` enters the `PREROUTING` or `OUTPUT` iptables chain, the Mangle table marks it with `0x1`.
|
||||
- **Preservation**: Xray's `tunnel` inbound listens with `"sockopt": { "tproxy": "tproxy" }`, allowing it to read the original destination IP from socket metadata and route packets transparently.
|
||||
- **Marking**: When a packet destined for `10.x.x.x` enters the `PREROUTING` or `OUTPUT` iptables chain, the Mangle table marks it with `0x1`.
|
||||
- **Preservation**: Xray's `tunnel` inbound listens with `"sockopt": { "tproxy": "tproxy" }`, allowing it to read the original destination IP from socket metadata and route packets transparently.
|
||||
|
||||
### Policy Routing (Table 100)
|
||||
|
||||
Firewall marks alone do not alter routing paths; standard Linux routing tables ignore firewall marks unless directed by **Policy Routing**:
|
||||
Firewall marks alone do not alter routing paths; standard Linux routing tables ignore firewall marks unless directed by **Policy Routing**:
|
||||
|
||||
1. **The Rule (`ip rule`)**: `ip rule add fwmark 0x1 lookup 100 priority 100` tells the kernel to route any packet marked with `0x1` using custom routing table 100.
|
||||
2. **The Table (`ip route`)**: Table 100 contains `ip route add local 0.0.0.0/0 dev lo table 100`, forcing marked packets onto the local loopback interface.
|
||||
3. **The Handoff**: Xray listens on `127.0.0.1:12345` with TPROXY enabled, grabbing the packet from loopback.
|
||||
4. **Loop Prevention**: Xray outbounds append `"sockopt": { "mark": 255 }` (`0xff`) to bypass TPROXY interception rules for its own generated traffic, preventing infinite routing loops.
|
||||
1. **The Rule (`ip rule`)**: `ip rule add fwmark 0x1 lookup 100 priority 100` tells the kernel to route any packet marked with `0x1` using custom routing table 100.
|
||||
2. **The Table (`ip route`)**: Table 100 contains `ip route add local 0.0.0.0/0 dev lo table 100`, forcing marked packets onto the local loopback interface.
|
||||
3. **The Handoff**: Xray listens on `127.0.0.1:12345` with TPROXY enabled, grabbing the packet from loopback.
|
||||
4. **Loop Prevention**: Xray outbounds append `"sockopt": { "mark": 255 }` (`0xff`) to bypass TPROXY interception rules for its own generated traffic, preventing infinite routing loops.
|
||||
|
||||
---
|
||||
|
||||
## 1. Setup Phase and Key Generation
|
||||
## 1. Setup Phase and Key Generation
|
||||
|
||||
Generate four unique UUIDs to secure the VLESS tunnel connections between the Hub and Spokes:
|
||||
Generate four unique UUIDs to secure the VLESS tunnel connections between the Hub and Spokes:
|
||||
|
||||
- `UUID_B_REVERSE`: Tunnel control for Server B (Bridge)
|
||||
- `UUID_B_DIRECT`: Data traffic for Server B
|
||||
- `UUID_C_REVERSE`: Tunnel control for Server C (Bridge)
|
||||
- `UUID_C_DIRECT`: Data traffic for Server C
|
||||
- `UUID_B_REVERSE`: Tunnel control for Server B (Bridge)
|
||||
- `UUID_B_DIRECT`: Data traffic for Server B
|
||||
- `UUID_C_REVERSE`: Tunnel control for Server C (Bridge)
|
||||
- `UUID_C_DIRECT`: Data traffic for Server C
|
||||
|
||||
---
|
||||
|
||||
## 2. Host Networking and TPROXY (routing.sh and before.rules)
|
||||
## 2. Host Networking and TPROXY (routing.sh and before.rules)
|
||||
|
||||
Before launching Xray containers, each server node requires kernel routing policy rules and UFW `mangle` firewall chains.
|
||||
Before launching Xray containers, each server node requires kernel routing policy rules and UFW `mangle` firewall chains.
|
||||
|
||||
### A. Kernel Routing Initialization (routing.sh)
|
||||
|
||||
The shell script [`routing.sh`](https://github.com/deytenit/xray-core-subnet-mimicry/blob/main/routing.sh) enables IPv4 forwarding, registers firewall mark `0x1` to lookup table 100, and routes all table 100 traffic to loopback (`dev lo`).
|
||||
The shell script [`routing.sh`](https://github.com/deytenit/xray-core-subnet-mimicry/blob/main/routing.sh) enables IPv4 forwarding, registers firewall mark `0x1` to lookup table 100, and routes all table 100 traffic to loopback (`dev lo`).
|
||||
|
||||
Run this script on **all** server nodes:
|
||||
Run this script on **all** server nodes:
|
||||
|
||||
```bash
|
||||
#!/usr/bin/env bash
|
||||
@@ -93,13 +93,13 @@ echo "Routing configuration applied successfully."
|
||||
|
||||
### B. Hub Firewall Configuration (a/before.rules)
|
||||
|
||||
On **Server A (Hub)**, append the TPROXY rules to `/etc/ufw/before.rules` (after the initial `COMMIT` line).
|
||||
On **Server A (Hub)**, append the TPROXY rules to `/etc/ufw/before.rules` (after the initial `COMMIT` line).
|
||||
|
||||
The rule logic performs the following steps:
|
||||
1. **Excludes Local Subnet**: Packets targeting Server A's local subnet (`10.1.0.0/16`) are returned to standard processing.
|
||||
The rule logic performs the following steps:
|
||||
1. **Excludes Local Subnet**: Packets targeting Server A's local subnet (`10.1.0.0/16`) are returned to standard processing.
|
||||
2. **Excludes External Traffic**: Packets outside `10.0.0.0/8` pass through unaffected.
|
||||
3. **Excludes Xray Mark (`0xff`)**: Traffic generated by Xray itself is ignored to prevent routing loops.
|
||||
4. **TPROXY Redirection**: Intercepts TCP and UDP traffic targeting `10.0.0.0/8` and redirects it to Xray on `127.0.0.1:12345` with mark `1`.
|
||||
3. **Excludes Xray Mark (`0xff`)**: Traffic generated by Xray itself is ignored to prevent routing loops.
|
||||
4. **TPROXY Redirection**: Intercepts TCP and UDP traffic targeting `10.0.0.0/8` and redirects it to Xray on `127.0.0.1:12345` with mark `1`.
|
||||
|
||||
Exact repository file: [`a/before.rules`](https://github.com/deytenit/xray-core-subnet-mimicry/blob/main/a/before.rules)
|
||||
|
||||
@@ -139,13 +139,13 @@ COMMIT
|
||||
-A ufw-before-input -s 10.1.0.0/16 -d 10.0.0.0/8 -m mark --mark 0x1 -j ACCEPT
|
||||
```
|
||||
|
||||
### C. Spoke Firewall Configuration (b/before.rules and c/before.rules)
|
||||
### C. Spoke Firewall Configuration (b/before.rules and c/before.rules)
|
||||
|
||||
On **Server B (Spoke)** and **Server C (Spoke)**, apply the node-specific `/etc/ufw/before.rules`.
|
||||
On **Server B (Spoke)** and **Server C (Spoke)**, apply the node-specific `/etc/ufw/before.rules`.
|
||||
|
||||
For Server B (`10.2.0.0/16`), local traffic within `10.2.0.0/16` is exempted (`-d 10.2.0.0/16 -j RETURN`), while any packet destined for the rest of `10.0.0.0/8` (such as `10.1.x.x` or `10.3.x.x`) is intercepted via TPROXY and routed through the VLESS reverse tunnel back to Server A.
|
||||
For Server B (`10.2.0.0/16`), local traffic within `10.2.0.0/16` is exempted (`-d 10.2.0.0/16 -j RETURN`), while any packet destined for the rest of `10.0.0.0/8` (such as `10.1.x.x` or `10.3.x.x`) is intercepted via TPROXY and routed through the VLESS reverse tunnel back to Server A.
|
||||
|
||||
Exact repository files: [`b/before.rules`](https://github.com/deytenit/xray-core-subnet-mimicry/blob/main/b/before.rules) and [`c/before.rules`](https://github.com/deytenit/xray-core-subnet-mimicry/blob/main/c/before.rules)
|
||||
Exact repository files: [`b/before.rules`](https://github.com/deytenit/xray-core-subnet-mimicry/blob/main/b/before.rules) and [`c/before.rules`](https://github.com/deytenit/xray-core-subnet-mimicry/blob/main/c/before.rules)
|
||||
|
||||
```ini
|
||||
*mangle
|
||||
@@ -180,7 +180,7 @@ COMMIT
|
||||
-A ufw-before-input -s 10.2.0.0/16 -d 10.0.0.0/8 -m mark --mark 0x1 -j ACCEPT
|
||||
```
|
||||
|
||||
Apply the changes on each node with `sudo ufw reload`.
|
||||
Apply the changes on each node with `sudo ufw reload`.
|
||||
|
||||
---
|
||||
|
||||
@@ -188,7 +188,7 @@ Apply the changes on each node with `sudo ufw reload`.
|
||||
|
||||
### A. Hub Configuration (a/xray.jsonc)
|
||||
|
||||
The Hub listens on public port 443 with VLESS and XTLS-Vision. It maps reverse tunnel incoming connections (`reverse-b`, `reverse-c`) to their respective subnet destination rules.
|
||||
The Hub listens on public port 443 with VLESS and XTLS-Vision. It maps reverse tunnel incoming connections (`reverse-b`, `reverse-c`) to their respective subnet destination rules.
|
||||
|
||||
Exact repository file: [`a/xray.jsonc`](https://github.com/deytenit/xray-core-subnet-mimicry/blob/main/a/xray.jsonc)
|
||||
|
||||
@@ -232,9 +232,9 @@ Exact repository file: [`a/xray.jsonc`](https://github.com/deytenit/xray-core-su
|
||||
|
||||
### B. Spoke Configuration (b/xray.jsonc)
|
||||
|
||||
The Spoke establishes VLESS client connections back to Server A (`A-EXTERNAL-IP`), maintaining a persistent reverse tunnel for incoming requests and forwarding outbound `10.0.0.0/8` traffic.
|
||||
The Spoke establishes VLESS client connections back to Server A (`A-EXTERNAL-IP`), maintaining a persistent reverse tunnel for incoming requests and forwarding outbound `10.0.0.0/8` traffic.
|
||||
|
||||
Exact repository files: [`b/xray.jsonc`](https://github.com/deytenit/xray-core-subnet-mimicry/blob/main/b/xray.jsonc) and [`c/xray.jsonc`](https://github.com/deytenit/xray-core-subnet-mimicry/blob/main/c/xray.jsonc)
|
||||
Exact repository files: [`b/xray.jsonc`](https://github.com/deytenit/xray-core-subnet-mimicry/blob/main/b/xray.jsonc) and [`c/xray.jsonc`](https://github.com/deytenit/xray-core-subnet-mimicry/blob/main/c/xray.jsonc)
|
||||
|
||||
```jsonc
|
||||
{
|
||||
@@ -272,9 +272,9 @@ Exact repository files: [`b/xray.jsonc`](https://github.com/deytenit/xray-core-s
|
||||
|
||||
## Resources & Reference
|
||||
|
||||
For the complete, runnable repository containing Docker Compose files ([`a/docker-compose.yaml`](https://github.com/deytenit/xray-core-subnet-mimicry/blob/main/a/docker-compose.yaml) and [`b/docker-compose.yaml`](https://github.com/deytenit/xray-core-subnet-mimicry/blob/main/b/docker-compose.yaml)), visit:
|
||||
For the complete, runnable repository containing Docker Compose files ([`a/docker-compose.yaml`](https://github.com/deytenit/xray-core-subnet-mimicry/blob/main/a/docker-compose.yaml) and [`b/docker-compose.yaml`](https://github.com/deytenit/xray-core-subnet-mimicry/blob/main/b/docker-compose.yaml)), visit:
|
||||
|
||||
- [xray-core-subnet-mimicry Repository on GitHub](https://github.com/deytenit/xray-core-subnet-mimicry/tree/main)
|
||||
- [xray-core-subnet-mimicry Repository on GitHub](https://github.com/deytenit/xray-core-subnet-mimicry/tree/main)
|
||||
|
||||
Technical Documentation & Guides:
|
||||
|
||||
|
||||
Reference in new issue
Block a user