x-tunnel

WebSocket proxy tunnel with CDN-traversal and multi-path bandwidth bonding. A single binary runs in either client or server mode; installation flow differs, runtime binary does not.

WebSocket / smux Bandwidth Bonding REALITY / uTLS ECH SOCKS5 · HTTP · mixed · TCP Linux · macOS · Windows

How to Install

⬡ Detecting platform…
curl -fsSL https://x-tunnel.itlinkin.com/install-client.sh | bash
Detects Intel vs Apple Silicon automatically. Installs to /usr/local/bin/xtunnel. Requires curl.
curl -fsSL https://x-tunnel.itlinkin.com/install-client.sh | bash
Detects x86_64 vs aarch64 automatically. Installs to /usr/local/bin/xtunnel.

Transparent proxy (optional)

Route all outbound traffic from this machine — including Docker containers and any process — through the tunnel transparently. No per-app proxy config needed.

# Step 1 — download the script (requires root)
sudo curl -fsSL https://x-tunnel.itlinkin.com/install/xtunnel-transparent.sh   -o /usr/local/sbin/xtunnel-transparent
sudo chmod +x /usr/local/sbin/xtunnel-transparent

# Step 2 — install (interactive: prompts for server, token, and connection mode)
sudo xtunnel-transparent install

# Step 3 — start
sudo xtunnel-transparent start
The installer prompts for server address, token, and connection mode:
  1) REALITY — fully obfuscated, looks like Apple CDN traffic (recommended)
  2) Cloudflare / ECH — server is behind Cloudflare, ECH auto-negotiated
  3) Direct VPS + skip cert — self-signed cert, adds -insecure
  4) Direct VPS + valid cert — valid TLS cert, adds -fallback

Uses chinadns-ng for split DNS: CN domains go via your original DNS directly; all others resolve via tcp://1.1.1.1 through the tunnel. Docker bridge traffic is intercepted automatically. iptables rules are cleanly removed on stop. 
sudo xtunnel-transparent start      # start + set DNS → 127.0.0.1
sudo xtunnel-transparent stop       # stop + restore original DNS
sudo xtunnel-transparent status     # service status / exit IP / DNS test
sudo xtunnel-transparent restart
sudo xtunnel-transparent update     # refresh CN domain lists
sudo xtunnel-transparent uninstall
irm https://x-tunnel.itlinkin.com/install-client.ps1 | iex
Downloads to %LOCALAPPDATA%\xtunnel\xtunnel.exe and adds to PATH. Run PowerShell as a normal user — no admin needed.

How to Run

Config file (recommended)

xtunnel -c ~/client.json

Create ~/client.json from the sample dropped next to the binary during install. Set forward to your server and token to the shared secret. Run with xtunnel -c ~/client.json.

SOCKS5 proxy (flags)

xtunnel \
  -mode client \
  -l socks5://127.0.0.1:1080 \
  -f reality://your.server.com:8118/api \
  -token YOUR_TOKEN \
  -bond 4

Starts a local SOCKS5 proxy on 127.0.0.1:1080. Point your browser or system proxy there. -bond 4 allows up to 4 parallel streams per connection, added automatically when throughput plateaus.

Mixed proxy (SOCKS5 + HTTP on one port)

xtunnel \
  -mode client \
  -l mixed://127.0.0.1:1080 \
  -f reality://your.server.com:8118/api \
  -token YOUR_TOKEN \
  -bond 4

Auto-detects the protocol on the same port: SOCKS5 clients (first byte 0x05) and HTTP CONNECT clients both work on 127.0.0.1:1080.

HTTP CONNECT proxy

xtunnel \
  -mode client \
  -l http://127.0.0.1:8080 \
  -f reality://your.server.com:8118/api \
  -token YOUR_TOKEN \
  -bond 4

All flags

-f reality://host:8118/api  # server address (REALITY transport, recommended)
-f wss://host:8118/api      # server address (TLS, for Cloudflare-fronted servers)
-l socks5://127.0.0.1:1080  # local listener (socks5, http, or mixed)
-token TOKEN                # must match server token
-bond N                     # max parallel streams per connection (default 8)
-max-spare N                # spare idle channels (default 2)
-ip IP[,IP2,...]            # force server IP(s), comma-separated (bypass DNS)
-c path/to/client.json      # load all flags from a JSON config file
License required. The server enters pending state on first start. Contact your admin to approve it before clients can connect.

How to Install

curl -fsSL https://x-tunnel.itlinkin.com/install-server.sh | bash
Installs the shared binary to /usr/local/bin/xtunnel, writes /etc/xtunnel/server.json, downloads domain rules to /etc/xtunnel/ip.txt, and creates a systemd service. Requires root. The installer prompts for token and transport (REALITY recommended). If an existing service is found, the installer lets you choose upgrade or uninstall.

Install options

INSTALL_SERVICE=0           # set to skip systemd setup (manual start only)

Service management

systemctl status  xtunnel
systemctl restart xtunnel
journalctl -fu    xtunnel
tail -f /var/log/xtunnel.log

How to Run

Start / stop (systemd)

systemctl start   xtunnel
systemctl stop    xtunnel
systemctl restart xtunnel
systemctl status  xtunnel

Config file (recommended)

xtunnel -c /etc/xtunnel/server.json

The installer writes /etc/xtunnel/server.json and a systemd unit that runs xtunnel -c /etc/xtunnel/server.json automatically. Edit the file and restart the service to change settings.

# /etc/xtunnel/server.json — edit then: systemctl restart xtunnel
{
  "mode": "server",
  "listen": ["reality://0.0.0.0:8118/api"],
  "token": "your_secret",
  "reality_dest": "www.apple.com:443",
  "sni": "www.apple.com",
  "forward": "socks5://user:pass@proxy:1080"
}
REALITY is the recommended transport. Passive observers see a connection to www.apple.com — the server forwards unauthenticated probes to Apple's real CDN. forward is optional; domains matching rules in /etc/xtunnel/ip.txt are forwarded through the upstream SOCKS5.

Manual start

xtunnel -c /etc/xtunnel/server.json

Directory layout

/usr/local/bin/xtunnel          # shared binary
/etc/xtunnel/server.json        # token, listen address, upstream proxy
/etc/xtunnel/ip.txt             # domain routing rules (Clash format)
/var/log/xtunnel.log            # service log

Activation

On first connection the server records the client fingerprint and returns pending_approval. If clients cannot connect, check the log:

journalctl -fu xtunnel
# or
tail -f /var/log/xtunnel.log

If the log shows pending_approval, ask the admin to approve the machine.

All downloads use the same binary. Only the latest version is kept online; installers compare the local version with the remote latest version before upgrading.
PlatformArchitectureArtifactUsage