The Nginx Decoy Web Server: Completing the Camouflage

Introduction: The Final Layer of Stealth

Protocols like VLESS and Trojan, secured by TLS on Port 443, provide the necessary encryption and structure to hide the V2Ray tunnel. However, the camouflage is only complete if the server always responds like a normal, functioning web host to anyone who doesn’t possess the secret proxy key. This is where the Decoy Web Server comes in.

A decoy server—typically powered by Nginx or Caddy (Article 29)—is configured to run alongside V2Ray. It performs two crucial functions:

1. Passive Decoy: It hosts a legitimate, harmless website (e.g., a simple blog or a static company page) that a human user or a censor can browse, confirming the server is benign.
2. Active Decoy (Fallback): Through V2Ray’s Fallback mechanism (Article 26), any connection that fails to authenticate as VLESS/Trojan is instantly and silently handed off to the Nginx decoy. The probe receives a perfect, legitimate HTTP response (e.g., a “404 Not Found” or a fully rendered web page), eliminating the suspicion that the server hosts a proxy.

The Nginx decoy is the final, non-negotiable step in defeating Active Probing and statistical traffic analysis.

Section 1: The Role of the Reverse Proxy in Decoy Management

The decoy server’s functionality is seamlessly integrated using the Reverse Proxy pattern (Article 29). The reverse proxy acts as the gatekeeper on Port 443, making the initial decision about the nature of the incoming traffic.

1. Handling Legitimate Web Traffic

If a regular user types your domain name into their browser, the traffic hits the Nginx server on Port 443. Nginx sees the request is for the root path (/) or a standard file, recognizes it as a legitimate HTTP request, and serves the decoy website content stored in the web root directory (e.g., /var/www/html/decoy).

2. Handling V2Ray Tunnel Traffic

If a V2Ray client connects to the specific, secret path (e.g., /my-ws-path) configured in Nginx, the reverse proxy performs a targeted forwarding:

• The traffic is diverted from the public Port 443 to V2Ray’s private local port (e.g., 127.0.0.1:10000).
• Nginx ensures that the connection is correctly upgraded to a WebSocket tunnel and hands off the control to the V2Ray core.

3. Handling Probes (The Fallback)

This is the most critical function. If a probe connects on Port 443 but doesn’t request the secret path, or if a VLESS connection fails the initial handshake, V2Ray or Nginx ensures the connection is redirected to the decoy server. This eliminates the chance of the probe seeing a suspicious connection reset or a blank page.

Section 2: Implementing the Nginx Decoy (Configuration)

The decoy setup requires preparing a simple website and configuring Nginx’s virtual host blocks.

1. Preparing the Decoy Content

The decoy website should be simple, static, and preferably relate to a plausible use case (e.g., “Under Construction,” a family photo gallery, or a basic company homepage). It must be served over HTTPS and located in the Nginx web root directory.

• Plausibility: Avoid hosting anything controversial or political. The goal is to be boring and look like a typical, low-traffic site that censors would have no reason to inspect manually.
• SSL/TLS: The decoy website configuration must use the same valid, renewed TLS certificate as the V2Ray tunnel (Article 46).

2. Nginx Decoy Configuration Block

The main Nginx configuration for your domain must include two distinct location blocks within the server block listening on Port 443.

• Location 1 (/): The default root location, serving the static decoy site.
• Location 2 (/secret-path): The targeted location, reverse-proxying traffic to V2Ray’s internal port.

server {
    listen 443 ssl http2;
    server_name your-domain.com;
    
    # SSL/TLS certificate handling here (MUST be valid)

    # 1. Decoy Website Location (The general public face)
    location / {
        root /var/www/html/decoy; # Directory containing the static HTML/CSS files
        index index.html index.htm;
        # Standard HTTP response headers for camouflage
        add_header X-Content-Type-Options nosniff;
    }

    # 2. V2Ray Tunnel Location (The hidden tunnel)
    location /ws-secret-path {
        proxy_pass [http://127.0.0.1:10000](http://127.0.0.1:10000); 
        # Mandatory headers for WebSocket upgrade and forwarding...
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        # ... and so on
    }
}

Section 3: V2Ray Fallbacks (Advanced Decoy Activation)

For protocols like Trojan and VLESS, the Nginx decoy works best when integrated with V2Ray’s internal Fallback system (Article 26).

1. The Trojan Protocol Fallback

Trojan is designed to use its internal fallbacks array to handle non-Trojan traffic. If a connection hits the Trojan listener on Port 443 but fails the secret password check, V2Ray silently forwards that traffic to the Nginx decoy running on a separate local port.

• V2Ray Fallback Configuration:"fallbacks": [ { "dest": 8080, // Nginx is listening locally on a private port 8080 "xver": 1 } ]
• Nginx Listener: Nginx must have a second server block configured to listen only on Port 8080 on 127.0.0.1 to catch these redirected decoy requests.

2. Preventing Suspicious Timeouts

The beauty of the fallback is that it provides an instant, legitimate HTTP response (the decoy page) to the censor, rather than a suspicious TCP timeout. A connection that times out on Port 443 suggests a blocked service; a connection that returns a valid webpage is instantly verified as “just a website,” making the probe harmless.

Section 4: Maintenance and Stealth Integrity

Maintaining the integrity of the decoy is vital for long-term stealth. A broken decoy is a security flaw.

1. Decoy Plausibility and Updates

The decoy site should appear up-to-date and functional. A website that displays “Under Construction” for three years is suspicious. Ideally, the decoy should be a live, simple, and updated blog or informational page.

2. Error Log Monitoring

Monitor the Nginx access logs for unusual activity.

• Normal: The logs should show occasional human-like browsing activity (requests for .html, .css, .jpg).
• Suspicious: Repeated, automated requests to the root path (/) from the same few external IP addresses, followed by immediate connection resets, often indicates an automated censorship probe that is failing the V2Ray handshake and being redirected to the decoy.

3. Consistency Across Ports

If you host other services (like SSH on a high port or a web control panel), ensure that those ports are strictly firewalled. A successful decoy on Port 443 is meaningless if an open, exposed Port 20000 reveals an unknown, unencrypted service. Zero Trust principles (Article 45) must be enforced across the entire server perimeter.

Conclusion: Defeating the Censor’s Eye

The Nginx Decoy Web Server is the final, essential component in V2Ray’s defense architecture. It defeats both passive detection (by looking like a normal web host) and active probing (by providing a legitimate, harmless HTTP response to suspicious connection attempts). By configuring the decoy seamlessly using reverse proxy techniques and V2Ray fallbacks, administrators ensure their proxy tunnel is perfectly disguised, resilient against analysis, and capable of long-term stealth operation.