01 — THE PROBLEM
A VPN on an odd port is easy to spot
I run an Xray VPN using VLESS with Reality, which makes the handshake look like a real visit to an ordinary website. The weak point was the port. Listening on a non-standard port draws attention, and I wanted it on 443 like everything else.
But 443 was already taken by Nginx Proxy Manager, which serves my sites.
02 — THE FIX
An SNI router in front of both
I put HAProxy in front on port 443. It reads only the server name in the TLS handshake, without decrypting anything. One name goes to Xray, and every other name goes to Nginx Proxy Manager, which I moved to an internal port.
The gotcha: the client has to dial 443 as well. After the change my first connection attempts still went to the old port and failed, which looked like the server being down.
The full rollback is written down: stop HAProxy, move the proxy back to 443. I am deliberately not publishing the ports, names or keys.