skills.rest
sukbearai
sukbearaiCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

dual-vps-reality-residential

Chains a VLESS Reality line VPS to a WireGuard landing VPS with fail-closed policy routing.

4|Updated Jun 2, 2026
Search Tags:#reality#vps#wireguard#xray#vless#policy routing#proxy egress
One-click install
npx skills add https://github.com/sukbearai/king-ai --skill dual-vps-reality-residential-sukbearai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dual-vps-reality-residential
Source: https://github.com/sukbearai/king-ai/tree/main/packages/skills/skills/dual-vps-reality-residential
Command: npx skills add https://github.com/sukbearai/king-ai --skill dual-vps-reality-residential-sukbearai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? Setting up a two-hop proxy chain where a China-optimized VPS terminates VLESS Reality traffic and a second VPS provides the final public egress is error-prone: default routes get stolen by WireGuard, existing Reality nodes get destroyed, marked traffic leaks to the wrong IP, and datacenter IPs get mislabeled as residential. ## Core Features & Use Cases - Preserve Existing Reality Inbounds: Detects and keeps live Xray Reality configurations on the line machine while adding WireGuard egress around them. - Fail-Closed Policy Routing: Uses fwmark 102 and routing table 166 with an unreachable fallback so proxy traffic never falls back to the line machine's datacenter IP when the tunnel drops. - Honest IP-Type Verification: Checks the landing VPS against ipinfo.io, ip-api.com, and proxycheck.io before calling an exit IP residential. - Use Case: A user has a ByteVirt CN2 GIA VPS and a second US host, and wants clients to connect via Reality on port 443 while websites see the second host's IP, with proof that marked egress exits via B and fails closed when WireGuard is down. ## Quick Start Ask the assistant to chain your line VPS A running VLESS Reality to landing VPS B over WireGuard with fail-closed marked routing and verified exit IP.

Frequently Asked Questions about dual-vps-reality-residential

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I route Xray traffic through WireGuard to a second VPS?▼

Add a freedom outbound with sockopt mark 102 in the Xray config, route the Reality inbound tag to it, then use an ip rule sending fwmark 102 to a separate routing table whose default route is the WireGuard interface. Keep Table = off in the WireGuard config so the default route is not stolen.

How to set up VLESS Reality on one VPS with egress on another?▼

Terminate VLESS Reality Vision on TCP 443 of the line machine A, establish a WireGuard tunnel to landing machine B, and policy-route only marked Xray traffic through the tunnel. B enables IPv4 forwarding and NATs the tunnel subnet out its public interface.

How do I check if a VPS IP is residential or datacenter?▼

Query at least two sources such as ipinfo.io, ip-api.com, and proxycheck.io for the IP. Hosting flags, business type labels, cloud ASNs, or transit ASNs like Cogent AS174 indicate datacenter, while consumer ISP names with no hosting marks suggest residential.

Why does WireGuard steal my VPS default route and break SSH?▼

This happens when AllowedIPs is 0.0.0.0/0 without Table = off in the WireGuard config, causing wg-quick to install a default route through the tunnel. Set Table = off and use policy routing with fwmarks so only marked proxy traffic uses the tunnel.

What happens to proxy traffic when the WireGuard tunnel goes down?▼

With the fail-closed guard, the policy routing table falls back to an unreachable default route, so marked proxy traffic fails instead of leaking out the line machine's datacenter IP. SSH and direct host traffic on A continue working normally.

Can I keep my existing 3x-ui Reality node when adding a second hop?▼

Yes, the existing Reality inbound is preserved by backing up the live config and only adding a marked freedom outbound plus a routing rule. Prefer native Xray installation over Docker for this routing model, and do not rotate UUIDs or keys unless requested.

Related Skills

Explore More Software Engineering Skills→
Nerfherder16Nerfherder16

homelab-deploy

Publishes homelab services via VPS nginx reverse proxy and CasaOS tunnel.

Community
Advanced
pyworkloadpyworkload
5

cdn-fallback

Configure 3x-ui inbounds behind a CDN or share port 443 using Xray fallbacks.

Community
Intermediate
wgpsecwgpsec
1.6k

multi-layer-network

Coordinate multi-hop SSH, FRP, and Chisel tunnels with SOCKS proxies to pivot from a DMZ to internal networks.

Official
Advanced
TitoPrauseeTitoPrausee

titocloud-microservice-proxy

Configures reverse proxy routing for new microservices behind TitoCloud.

Community
Advanced