Part 3, the noob guide on 3x-ui setup for Vless proxy services with CDN

Creating Vless Proxy Inbounds with Cloudflare CDN

---

To Use Cloudflare CDN, you must do the following:

1. You have to own a domain name, you don't have to buy from Cloudflare.
2. But Cloudflare must control domain name servers(DNS) for your domain name.
   • If Cloudflare is not the registrar for your domain name, you must create or already have an account at Cloudflare.
     1. From the Cloudflare Dashboard, click on the Domains menu on the left side.
     2. Click on the [Add Domain] button on top right.
     3. Select [Connect a domain], put your domain name, and click [Continue].
     4. Select Free Plan and it should try to import your existing DNS record.
     5. Select Continue Activation and just follow Cloudflare instructions on what to at the registrar that controls your domain name.
   • Go to the next step, if your domain is either registered or under control of Cloudflare.

Create Another Hostname Record for VPS.

1. Click on your domain name in theDomains menu of the Cloudflare Dashboard.
2. Click on DNS Records on the right side and will see a list of DNS records or might be empty, if you haven't created any.
3. Click on [+Add Record] button.
   • You should have already added an A record for your VPS. For example, lax1.example.com for 172.25.251.186 with the Proxy Status DNS Only.
   • Add another A record just for Cloudflare CDN. For example, lax1a.example.com for IPv4 172.25.251.186 with Proxy Status Proxied.
4. Click to expand SSL/TLS menu on the left panel and click on Overview sub-menu.
5. Click on the [Configure] button on the top of the right panel.
6. Select the Flexible for the SSL/TLS setting for the domain and click on the [Save] button.
7. Under the SSL/TLS menu on the left panel, select the Edge Certificates sub-menu.
8. Scroll down to the TLS 1.3 setting and disable it.
9. Have the Cloudflare Dash page open for now, will get back it after a new inbound has been created.

Create a Vless/XHTTP/RAW security Inbound

1. From the 3x-ui web control panel, select the Inbounds menu on the left panel and click on the [+Add Inbound] button in the main panel.
2. On the Basic tab, give a name for the inbound in the Remark field.
3. Leave the Protocol field from default vless.
4. Leave all the other fields the default, including the random Port number. Write down or copy the random port number to the clipboard. DO NOT change it to 443 nor 8443.
5. Leave the rest of fields default on their settings and click on the Stream tab and select XHTTP for the Transportsetting.
6. Click on the [Create] button on the bottom. Go back to Cloudflare Dash page

Finishing Cloudflare CDN Setting

1. Back to Cloudflare Dashboard, click on the Network menu for your domain name's DNS Record.
2. Enable the gRPC setting.
3. Click on the Rules menu and then the Overview sub-menu.
4. In the Origin Rules section, click on the [Create Rule] button .
5. For Rule Name, call it proxied hostname lax1a.example.com. As you need a different name rule for a different VPS.
6. Leave the default Custom filter expression and select Hostname for Field.
7. Select Equal for Operatorand enter you proxied hostname, ie lax1a.example.com, for Value.
8. For Destination, select Rewrite, and enter the port number from the above vless inbound setting.
9. Click on the [Deploy] button and we're done with the Cloudflare setup.

Create a Client and export to App for Vless Inbound

Follow the previous guide on client creation and import the client setting to a proxy client app/program

Change the Settings on Your Proxy Client App

After importing vless client config in the proxy client app, depending on the app, either right mouse click and select Edit or just left double clicking the vless config that was imported.

1. Change the address from lax1.example.com to lax1a.example.com of proxied hostname.
2. Change port number to 443.
3. The host field might empty, put in lax1.example.com.
4. The TLS might be empty or set to none or raw, change TLS
5. Again put in proxied hostname lax1a.example.com in the SNI field.
6. Save the changes and you should be able to connect to the proxy server with the client app.

Conclusion on 3x-ui Setup

My final thoughts on the three 3x-ui from using it while behind the GFW are the following:

• Hysteria2 is my primary proxy inbound I'm using in China, it has the fastest transfer that I used including NaïveProxy(3x-ui doesn't support it) and the multiple vless protocols. This is great for streaming video from YouTube, Netflix, HBO Max, Apple TV, and/or Amazon. If you're planning to use only Hysteria, set it use port 443. Else use 8443 and enable the port hopping feature. For comparison, I'm getting 5.22MiB/s download rate on one of my LAX VPS servers with ping latency ~180ms.

• Vless with XHTTP and Reality combo is the best, if you are not planning to watch streaming video outside of China. But it is a more secure proxy protocol for browsing non-video websites. I'm getting .22MiB/s on the same VPS with the same latency.

• Vless with XHTTP and Cloudflare CDN will be the least consistent for data transfer rate of the 3 for me. There are multiple reasons for this.

  • Data traffic from a website has to first go to your VPS/proxy server, then relay through a Cloudflare CDN server near your VPS, and then finally to you behind the GFW.
  • Unless you're paying for premium Cloudflare CDN, you won't get a CDN server in China. So you might get a CND server either close to China or might be close to the VPS.
  • While the free Cloudflare CDN will allow a burst of high bandwidth for a static website, it may not continuously allocate high bandwidth for streaming video and such.

Experiment with multiple proxy client apps/programs. Because of the proxy engine that they’re using, some protocols’ data transfer suffer when comparing one client to another one. I have my OpenWrt setup that automatically switches between multiple proxy servers, each with the above 3 proxy setups. I will write a guide for that setup sometime in the future.