vpn-foreign-exit

Foreign Exit Setup

Use this when the foreign node is not ready yet.

Inputs

Collect first:

• EXIT_IP (foreign VPS public IP)
• PANEL_URL (for example https://panel.example.com:54321/<path>/)
• PANEL_PASSWORD
• FOREIGN_SNI (for example www.microsoft.com)

SSH key should already exist at ~/.ssh/vpn_servers (see vpn-server-access).

Progress checklist

- [ ] Step 1: Server prep + firewall (22/80/443/54321)
- [ ] Step 2: Install 3x-ui + set panel password + optional HTTPS panel
- [ ] Step 3: Generate Reality key pair + Short ID
- [ ] Step 4: Create VLESS+Reality inbound on :443
- [ ] Step 5: Add relay user (exit-relay-1) and optional direct users
- [ ] Step 6: Verify and save bridge credentials

Step 1: Server prep

run("apt update && apt upgrade -y && apt install -y curl ufw sqlite3", timeout=120)
for cmd in ["ufw allow 22/tcp", "ufw allow 80/tcp", "ufw allow 443/tcp", "ufw allow 54321/tcp", "ufw --force enable"]:
    run(cmd)

Step 2: 3x-ui install

Use vpn-3xui-common for install, password, API login helper, and HTTPS panel.

Step 3: Reality keys

rc, out, err = run("/usr/local/x-ui/bin/xray-linux-amd64 x25519")
priv_key, pub_key = "", ""
for line in out.splitlines():
    if line.startswith("PrivateKey:"):
        priv_key = line.split(":", 1)[1].strip()
    elif line.startswith("Password (PublicKey):"):
        pub_key = line.split(":", 1)[1].strip()

import secrets
short_id = secrets.token_hex(4)

Step 4: Inbound on 443 (Reality)

inbound = {
    "remark": "exit-vless-reality",
    "enable": True,
    "listen": "",
    "port": 443,
    "protocol": "vless",
    "settings": json.dumps({"clients": [], "decryption": "none", "fallbacks": []}),
    "streamSettings": json.dumps({
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
            "show": False,
            "xver": 0,
            "dest": f"{FOREIGN_SNI}:443",
            "serverNames": [FOREIGN_SNI],
            "privateKey": priv_key,
            "shortIds": [short_id],
            "settings": {
                "publicKey": pub_key,
                "fingerprint": "chrome",
                "serverName": "",
                "spiderX": "/"
            }
        },
        "tcpSettings": {"acceptProxyProtocol": False, "header": {"type": "none"}}
    }),
    "sniffing": json.dumps({
        "enabled": True,
        "destOverride": ["http", "tls", "quic"],
        "metadataOnly": False,
        "routeOnly": False
    }),
    "tag": "inbound-443"
}

Create it via POST /panel/api/inbounds/add using vpn-3xui-common login helper.

Step 5: Users

Use vpn-users:

• Required: exit-relay-1 (UUID used by Russian relay outbound)
• Optional: direct users on foreign server

Step 6: Verify + save values

run("systemctl restart x-ui")
run("journalctl -u x-ui --no-pager -n 10")

Save these for russian-vpn-setup:

• EXIT_IP
• EXIT_UUID (exit-relay-1)
• EXIT_PUB_KEY
• EXIT_SHORT_ID
• FOREIGN_SNI