你的朋友收到的页面 — 查看演示
两条命令，得到可用的代理
你需要一台 Debian 或 Ubuntu 的 VPS（每月 $5 的就够用）和电脑上的终端。其余由 Meridian 完成。
curl -sSf https://getmeridian.org/install.sh | bashmeridian deploy向导会询问服务器 IP 并处理其余事项。或直接传递参数 — 查看 CLI 参考。
幕后发生了什么
构建你的命令
选择选项并复制完整命令。涵盖部署、中继、检查、SNI 扫描、诊断和卸载。
Deploy Reality, XHTTP, and Hysteria2 on one server. Sets up Docker, the Remnawave panel, nginx, the firewall, and TLS.
meridian scan to find a same-network target.meridian deploy
meridian deploy — the interactive wizard guides you through everything.它如何避免被检测
OpenVPN 和 WireGuard 有可识别的流量特征。VLESS+Reality 连接与访问真实网站的普通 HTTPS 很难区分。
深度包检测 (DPI)
DPI analyzes traffic patterns to identify proxy protocols. OpenVPN and WireGuard have handshakes that are easy to recognize and block.
VLESS+Reality runs inside a standard TLS 1.3 connection on port 443, so DPI sees what looks like ordinary HTTPS to the camouflage site. Every server also offers XHTTP and Hysteria2, so a block on one method leaves the others working.
主动探测
Censors connect to suspicious servers and try to fingerprint them. If a server responds differently than the website it claims to be, it gets blocked.
Reality borrows the TLS identity of a real website: by default a site hosted near your server, or www.google.com. A probe without your key is passed through to that site and sees its genuine certificate. Only clients with your key get the proxy tunnel.
TLS 指纹识别
Every TLS client sends a unique "Client Hello" fingerprint. Censors flag connections where the fingerprint doesn't match the claimed application.
Client apps use uTLS to send the same Client Hello as Chrome. Meridian also publishes a Firefox copy of each Reality and XHTTP entry, so if censors flag one fingerprint, the other keeps working.
扫描即连
部署后，你会得到一个带二维码的连接页面。发送给需要的人——一键连接。
连接页面会优先列出这些应用，并为每个平台链接其他应用。查看演示。
工作原理
独立模式（无域名）
nginx owns TCP port 443 and routes connections by TLS SNI with its stream module. Reality connections go to Xray. Everything else reaches nginx's http module, which serves the connection pages, subscriptions, and XHTTP over HTTPS with a short-lived Let's Encrypt certificate for the server's IP (issued by acme.sh). Hysteria2 listens on UDP 443 with salamander obfuscation.
The Remnawave admin panel is reverse-proxied by nginx on a secret path — accessible via HTTPS, no SSH tunnel needed.
域名模式（CDN 回退）
With --domain, nginx gets a Let's Encrypt certificate for your domain and routes that SNI to the domain's paths. XHTTP moves to the domain andVLESS+WSS is added. With Cloudflare proxying the domain, both travel through the CDN and keep working if your server's IP is blocked. The panel and connection pages stay on the IP certificate.
中继模式（境内入口）
A Realm TCP forwarder on a server inside your country passes connections to your exit abroad. Relays carry Reality only; XHTTP, WSS, and Hysteria2 still connect to the exit directly. Encryption runs end to end between the app and the exit, so the relay never sees plaintext.
Add one with meridian relay add RELAY_IP --exit EXIT. Subscriptions and connection pages pick up the relay entries automatically.