Custom Xray Privacy Tunnel
A personal network engineering project: route ordinary Internet traffic through an Xray privacy path while keeping private homelab traffic on NetBird. My contribution is architecture, deployment, integration and troubleshooting.
02 / Problem
Problem
A global privacy tunnel can capture traffic intended for a separate private overlay. Turning on a TUN client can therefore change access to the very infrastructure used to administer the network.
03 / Objectives
Objectives
Send ordinary Internet traffic through the privacy path, keep homelab traffic on NetBird, support Windows and Android clients, avoid routing loops and keep the policy understandable when troubleshooting.
04 / ARCHITECTURE
Two destinations. Two routes.
Client → TUN policy → Xray / REALITY → VPS → Internet
Client → routing exception → NetBird → private services
These are separate paths. The private overlay is not downstream of the privacy tunnel.
05 / Implementation
Implementation
The personal setup combines Xray and REALITY on a VPS with v2rayN on Windows and v2rayNG on Android. Windows TUN mode brings ordinary application traffic into the client routing policy. Route exclusions preserve the separate private overlay path. I integrated these components; I did not develop Xray or the REALITY protocol.
06 / SECURITY
Security boundaries
- This is a personal privacy and routing project, not a commercial VPN product or a promise of anonymity.
- Endpoint addresses, protocol keys, identifiers and target configuration are intentionally excluded.
- The diagram separates the two routes instead of implying that NetBird traffic passes through Xray.
07 / Testing
Testing
The project involved checking public egress, routes, latency, throughput and NetBird reachability while investigating tunnel conflicts. No benchmark figures are published here. In the current inspection, the VPS overlay peer was connected and its private SSH endpoint responded; a fresh end-to-end Xray client test remains outstanding.
08 / Challenges
Challenges
Routing precedence, DNS resolution and the interaction between TUN and overlay interfaces have to be considered together. A working public connection does not demonstrate that private traffic is taking the intended route, and a successful name lookup does not prove the subsequent connection path.
09 / Lessons
Lessons
Start with the destination and intended path, then inspect which routing rule actually wins. Explicit boundaries make the system easier to debug than an assumption that all encrypted tunnels will coexist automatically.