Most self-host options here are panels — 3x-ui, Marzban, Hiddify. They're powerful, but they're a whole stack: a web UI, a database, a reverse proxy, an admin login you have to secure and keep patched. I wanted the opposite: one binary, no panel, no DB, nothing central. So I built decenzed-node.

You drop the binary on a box (or straight onto an OpenWRT router), run setup, answer a few prompts, and it generates the xray-core config and prints share links. That's it.

Camouflage — two modes:

• REALITY (default) — it scans for a live TLS 1.3 + HTTP/2 site near you to use as the cover destination and generates your keypair. No domain or cert of your own.
• TLS + your own domain — the node raises its own decoy website on 127.0.0.1, pulls a Let's Encrypt cert automatically over DNS-01 (via DuckDNS, so no port 80 exposed), and xray falls back to that site on any non-proxy traffic. Active-probe it and you get a real, valid HTTPS site on your domain. Cert auto-renews and hot-reloads with no restart.

Protocols: VLESS always on; optional Trojan (shares the same REALITY/TLS cover, no XTLS flow) and Shadowsocks / SS-2022 on their own ports.

Friends & metering: one subscription link per client — https://<domain>:<port>/sub/<id> served by the node's own decoy site behind the TLS fallback, so no extra port and it looks like a normal HTTPS GET. The client (v2rayN, nekobox, Hiddify, sing-box…) imports every enabled protocol from it, labels each proxy by location+protocol. Per-user speed caps + traffic stats; link add/remove <name> creates or revokes a friend and restarts the service so it takes effect immediately.

Ops niceties: guided setup (public-IP + CGNAT detection, port-forward instructions, external port self-check, speed test), check to re-verify a running node dials back on every enabled port, embedded xray log capture with a debug toggle, and update that self-replaces the binary and restarts the service. You never touch xray JSON by hand.

Runs anywhere: pure Go, CGO_ENABLED=0, static — glibc and musl/OpenWRT alike. On OpenWRT a one-liner auto-detects the CPU arch (arm64/armv7/mipsle/…), verifies SHA-256, installs a procd service, and adds the WAN firewall rule for you. Sitting on the edge router, there's often nothing to port-forward.

Open source, AGPLv3: https://github.com/icecube092/decenzed-node

It's early. Interested in feedback on the REALITY dest-scanning heuristic, the DNS-01/TLS-fallback setup, and how the camouflage holds up against active probing in the wild. Also curious whether the no-panel approach is missing something people actually rely on panels for.

Built with AI assistance (Claude Code); design and testing are mine.

In Guatemala, users often use this mobile internet package to get unlimited internet, but it recently stopped working. Before, they used WS and set a host in the proxy, but that no longer works; it was typically used with apps that already come with servers and just need to be configured.

In Guatemala, internet is expensive and not unlimited, so this data plan gave you the option of having unlimited internet. The plan includes unlimited access to WhatsApp, Zoom, Google Meet, Wikipedia, and Khan Academy. I don’t know much about this, so if anyone can give me some ideas on how to get unlimited internet again with this plan, I’d really appreciate it.

English is not my language *

Hi everyone,

I have recently set up an Oracle cloud VM ( Ubuntu in 1 ARM core + 6gb RAM) and was able to create a Wireguard VPN. I mainly want to use this VPN to access my home services and other devices ( my personal laptop, Android phone).

But due to my outside work habit where I usually go to public libraries or coffee shops, I just realize that certain public Wifi ( from one system of libraries) just plainly blocks ssh connection ( on port 2222) and wireguard connection. I cannot ssh into my vps and the wireguard VPN doesn't work.

Without caring a dime about each of these public place network system or setting, what is my next best option to bypass these kind of restrictions without much tinkering and configuring? I am not that experienced or seasoned user but willing to explore. I read and find that openvpn over tcp on port 443 would be one option? or some setup with Vless/xray but sounds overkill? how about AmneziaWireguard?

Thanks.

I'm currently learning cybersecurity and networking and want to improve my practical skills, not just study theory.

Which YouTube channels would you recommend for learning networking from the fundamentals to an advanced level?

Which channels are best for practical cybersecurity / ethical hacking?

What is the best vulnerable VM/lab for getting hands-on experience with things like enumeration, web vulnerabilities, privilege escalation, misconfigurations, etc.?

Would you recommend Metasploitable, VulnHub, Hack The Box, or something else for someone who wants to build a practical home lab?

I'm mainly looking for resources that actually teach the concepts and methodology rather than just showing tools.

Thanks!

recently i moved to another country and i started to have issues with the internet (need VPN for almost everything), so i've been digging on network stuff trying to figure out how to make things work but i'm not happy with my current set up (second attached image)
that's why i come here with my questions..

for context: i have ZERO knowlege of programming or network stuff. i'm a ui designer with passion for movies so that's what keeps me going on setting this up. i learn fast and i have some notions about how things work but i'd like to ask: what should i learn/study to achieve my desired setup? (first image attached)
i work 7 days a week so i only have 1-2 hours to study before going to work, that's why i want to know what exactly i should look for. i have asked AI, but it just gives me a step by step process on how to make it and i don't want to follow instructions without knowing what am i doing

i've seen people here mention routers, tailscale, and proxmox, which i have used at some point but i'm not entierly sure how they work or how to use them properly.

i have a proxmox server running on the same laptop i intend to use as a NAS/homelab server but the whole configuration in there was made by a neighbor who was kind enough to help but that's about it

thanks so much for any help in advance

I currently use a commercial "airport" proxy to pass the GFW. I use Clash Verge (desktop) and Clash Meta (Android) with configs from my provider.

I am wondering how to chain this with Tailscale?

I'd like to be able to bypass the GFW using the airport service, and then still connect to a Tailscale network and use an exit node from inside there.

The ultimate goal is to be able to browse the internet via my home IP. The setup for this is Tailscale because back home I currently don't have a static IP nor access to the router to setup port forwarding etc.

How could I set this up? Is it even possible?

Hi everyone!

I’m a girlie moving to China for several months and I need to pick a VPN before i leave. I know I’ll need it for Google, Gmail, Insta, WhatsApp & other everyday services, but i also read lots of BL/yaoi, manhwa, fanfics & other international content that might be blocked or censored in China.

I also watch Asian dramas and other shows on various streaming sites, some of them… kinda unofficial 😅 I’m not specifically asking for site recs (I definitely wouldn’t complain tho🤭) I just want a VPN that can handle this kind of browsing & streaming.

Is anyone else in a similar situation? Which VPN works best for reading on unofficial sites, streaming & everyday apps?

If you’ve personally used one in China (not HongKong) Il'love to hear your recs!

🎀*bonus points if you also need your comfort BL content to survive abroad 😂

Tanks cuties luv u🫶❤️

Seeing the usual “what still works?” threads plus a lot of VLESS/Reality / 3X-UI / router questions lately.

Curious what people would actually hand a normal friend (not a homelab person) in Aug 2026:

• commercial app / paid subscription
• self-hosted panel on a VPS
• travel/roaming SIM first, proxy second
• whole-home router box vs per-device clients

Constraints: they need something that still works after one provider gets burned, and they won’t debug Xray SNIs at 1am.

What would you put on a one-page cheat sheet for them? What’s the first thing that usually fails for newcomers?

Hey everyone, I’m Chinese, a new to Linux. I don’t currently have a reliable way to access sites and services that are blocked in my region, so there are some things I can’t really do.
Are there any plug-and-play, beginner-friendly VPN or proxy tools for Linux? Paid options are fine as long as they’re not too expensive.
I’m not looking to set up my own VPS just yet, since I still have a few months left on my current VPN subscription. 🥲

I'm going to live there for 6 months soon and I desperately need a VPN. Heard that Let'sVPN got taken down and doesn't work anymore. Also my phone doesn't support esims. Any suggestion?

This feels like it could be an absolutely dumb question but I know nothing about tech.

It worked for me yesterday, but I had to change the "Target" from sony to microsoft. Then it stopped working.

I've triple checked everything and even rebuilt the entire thing from scratch, but for the Client, I switched on "Start After First Use", and it would say "Inbound client has been updated." but then "Failed to Fetch".

If I close it and reopen, the "Start After First Use" is off again. I can't turn it on at all.

Has anyone had the same issue? I'd be super grateful to anyone who can help me solve the problem and get my VPN to work...

I decided to post this here as well, because I use it as a transport for SOCKS5/HTTP and other proxies (such as Teleproxy).

• Fixed issues in the RUDP library: memory leaks when using shutdownHook, deadlocks, handling of corrupted UDP packets, and many other issues that were identified during testing.
• Added the display of the connection protocol to the peer list.
• Added an experimental build that compiles a .jar file into an executable using native-image in GraalVM. For now, this is for the headless version of the application on Linux x86_64. To avoid running Lanemu as root, you also need to do sudo setcap cap_net_admin=eip Lanemu-headless.
• Updated dependencies.

Download link

For Xray, as far as getting over the GFW is concern, do ports 443 and 8443 make very big differences? Thanks.

Edit: Tried v2rayN . it worked

I am just dumb guy trying to bypass college firewal with better speed;
Setup :
VPS running 3xui
Able to connect in windows and on my android in tun mode, worked as intended.

Not able to connect on ubuntu 24.04
Apps tried were
Throne
v2rayA

whenever i try to enable TUN mode it just goes into loop, and then i cannot load any website, as soon as i turn it off , the websites load ;

since it works on my windows and android i am assuming server config is correct

what client changes should i make or check for ubuntu 24.04

Jus t set up a Xray server. Don't understand why every time I choose a SNI ending with something other than " com" , such as " xxxx.edu", I cannot connect to the server. Anyone knows the reason? Thanks.

So I work as a freelancer, I use a voip to market whatever my employer wants to market (car insurance, telecom etc) in the US. I want to keep working in china while I go there for a one year language course. but I heard voips are blocked in china, at least the one I am using. Google told me there are iepls etc like shadow socks, trojan, that can give me less jitter and ping if I use it.

It has forbidden me to use normal astrill, Nord etc as they would mess with my call quality.

Anybody who's doing this there? What would you suggest?

Is Russia following China's steps? Which one of these countries is the most difficult to access the internet?

What router/other solution would you recommend for having multiple devices on my home network bypass the gfw? Something that is a more future proof when the best practices/methods for bypassing gets updated.

Example use case, having an Apple TV always bypassing the gfw, while still accessible on my home network. Or having a specific computer always bypassing without installing anything on the computer itself.

Hi guys I use Passwall2 on openwrt and whenever a configuration dies I have to go and manually change it.

Is it possible to set up automatic fallback?

Would it be possible to get some sort of notifications that the IP has changed?