چطور در روسیه روی لینوکس کلاینت VPN/VLESS نصب و استفاده کنیم: توضیح صادقانه (لینوکس کممحدودترین پلتفرم از نظر فروشگاه است — به App Store قفل نیست، باینری/AppImage/.deb را مستقیم از گیتهاب رسمی میگیرید و اجرا میکنید؛ اما تفاوت اصلی با ویندوز/مک این است که کلاینتهای لینوکس بیشتر خطفرمانی/دستیاند — یا فایل JSON را ویرایش میکنید و sing-box/xray را اجرا میکنید، یا از یک GUI/رابط وب مثل v2rayA/nekoray استفاده میکنید؛ TUN روی کل ماشین به root یا CAP_NET_ADMIN نیاز دارد، وگرنه باید هر برنامه را جداگانه از طریق SOCKS پروکسی کنید و هر برنامهای پروکسی را رعایت نمیکند؛ میدان نبرد واقعی این است که آیا پروتکل شما از TSPUِ RKN جان سالم به در میبرد) و روشی پایدارتر (VLESS+Reality با سرویس systemd)
بهروزرسانی
Bottom line first: Linux isn't store-locked, but the clients are more command-line
Getting out on Linux has a natural advantage: it's the least app-store-restricted platform — there's no App Store-style lock, and you run the binary, AppImage or .deb/.rpm straight from official GitHub, so Apple/Google pulling VPN apps from the Russian store simply isn't a problem on Linux. The cost: Linux clients are more command-line/manual — there's no polished one-click GUI like on Windows/Mac. The two most universal paths are: (1) run the sing-box or xray-core CLI and edit a JSON config yourself; (2) use a GUI/web wrapper (the Linux builds of nekoray, v2rayA, Hiddify, or the mihomo family). Below: choosing a client, the TUN vs per-app-proxy trade-off, and how to run it as a systemd service.
Which clients exist on Linux: sing-box / xray CLI, or v2rayA / nekoray
The main ways to land VLESS+Reality on Linux: (1) sing-box (CLI) — one binary, one JSON config, the most complete and the best to run as an always-on service; the top pick for servers/advanced users; (2) xray-core (CLI) — also CLI+JSON, the reference implementation of VLESS+Reality; (3) v2rayA — a daemon with a web UI, popular among Linux desktop users; you import the subscription and pick nodes in the browser, with xray/sing-box underneath; (4) nekoray/nekobox — a Qt GUI client, cross-platform with a Linux build; (5) Hiddify and the clash family (mihomo / clash-verge-rev AppImage) also have Linux builds. Want it easy — use v2rayA/nekoray; want the most stable always-on setup — use the sing-box CLI directly. They use the same subscription as your phone/Windows client.
The key trade-off: whole-machine TUN (needs root) or per-app SOCKS proxy
There are two levels of sending traffic through the tunnel on Linux — be clear on the difference: (1) whole-machine TUN takeover — sing-box has a built-in
tun inbound (or use tun2socks) that creates a virtual interface capturing the whole machine's traffic, closest to the 'global mode' of Windows/Mac; but it needs root or CAP_NET_ADMIN to create the interface and change routes. (2) per-app SOCKS proxy — the client just opens a local SOCKS/HTTP port and you point a browser, or use proxychains / env vars (http_proxy/https_proxy), at a specific program; the catch is that not every program honors the proxy (especially CLI tools and UDP programs), so leaked traffic still goes direct. Want 'the whole machine stable' — use TUN; want only the browser/specific programs tunneled — the SOCKS proxy is lighter.Want it always-on / at boot: write a systemd service
If you want it to start at boot, auto-reconnect on drop, and stay resident on a headless server (e.g. on a little home box or a VPS acting as a gateway for the whole LAN), the most stable approach is to run sing-box/xray as a systemd service: a
.service unit pointing at the binary and config, systemctl enable --now to make it resident, and journalctl for logs. Many distros' official packages already ship a service file. Note that in TUN mode the service needs the right privileges (run as root, or grant the binary CAP_NET_ADMIN), and make sure your split-routing rules keep local/banking domestic traffic direct and send only foreign traffic through the tunnel.Configuration steps: install a client → import the subscription → pick TUN or SOCKS → verify
- Install a client: advanced/server — sing-box or xray-core (grab the binary from official GitHub, or use your distro's package manager); want a UI — v2rayA (install the daemon + open the browser) or nekoray (download the AppImage).
- Import your VLESS+Reality subscription: with the CLI, put the node into the JSON config; with v2rayA/nekoray, paste the subscription link and pick nodes (the same subscription as your phone/Windows).
- Pick the takeover mode: for whole-machine, enable TUN (sing-box tun inbound or tun2socks, needs root/CAP_NET_ADMIN); for just the browser/specific programs, use the local SOCKS port + proxychains/browser proxy settings.
- Set split-routing: route Russian domestic sites, online banking and Gosuslugi direct, and send only blocked/throttled foreign sites through the tunnel — saves resources and avoids local services rejecting a foreign IP.
- Want it resident — write a systemd service: a .service unit + systemctl enable --now, journalctl for logs.
- Verify: open a blocked site to confirm it works; confirm local online banking still goes direct; use curl --interface or journalctl on the CLI to troubleshoot.
Honest limits and checklist
- Linux clients are more command-line — sing-box/xray means editing JSON; for a GUI use v2rayA/nekoray.
- Whole-machine TUN needs root or CAP_NET_ADMIN; without TUN you proxy per-app over SOCKS, and not every program honors it.
- Pick the right protocol: on Linux too you must use a well-configured VLESS+Reality — RKN's TSPU probes/cuts suspicious encrypted traffic.
- No guarantees: a poorly configured VLESS gets cut too; during sovereign-internet drills / wide shutdowns any foreign tunnel can go down.
- Always split-route: local sites / banking / Gosuslugi direct, only foreign traffic through the tunnel.
- Don't grab binaries from unofficial sources — use the official GitHub releases or your distro's official repos to avoid a planted backdoor; verify checksums.
In summary: Linux's advantage is that it's unaffected by store removals — you run the client straight from the official source, and can even make it a systemd service resident on a server; the cost is that it's more command-line/manual, whole-machine TUN needs root, and per-app proxying isn't honored by every program. Want it easy — use the v2rayA/nekoray GUI; want the most stable always-on setup — sing-box CLI + systemd. Whether you actually connect still comes down to the protocol fight: use a well-configured VLESS+Reality, and for the desktop approach see the Windows guide.
سؤالات متداول
- Do I have to know the command line to install a VPN/VLESS on Linux?
- Not necessarily, but the command line is the most universal path. If you'd rather not touch it, use a client with a GUI/web UI: v2rayA (a daemon you operate from the browser, popular on Linux desktops), nekoray/nekobox (a Qt GUI client, just download the AppImage), or the Linux builds of Hiddify or the clash family (mihomo / clash-verge-rev) — you import the subscription and pick nodes in the interface. If you're a server/advanced user, running the sing-box or xray-core CLI and editing a single JSON config is actually the most stable and best suited to an always-on service. Both paths use the same VLESS+Reality subscription.
- How do I make the 'whole machine' use the VPN on Linux, not just the browser?
- Use TUN mode. sing-box has a built-in tun inbound (or use tun2socks) that creates a virtual interface capturing the whole machine's traffic, closest to the global mode on Windows/Mac. The cost is that it needs root or CAP_NET_ADMIN to create the interface and change the routing table. If you only opened a local SOCKS/HTTP proxy port, then only the programs you explicitly point at it (a browser set to the proxy, or programs launched via proxychains) go through the tunnel, while everything else stays direct — and not every program honors a SOCKS proxy (many CLI tools and UDP programs leak). Want the whole machine stable — use TUN; want only the browser tunneled — the SOCKS proxy is lighter. Don't forget split-routing so domestic traffic goes direct.
- How do I make the VPN start at boot and stay running on a Linux server?
- Run it as a systemd service. Make a .service unit pointing at the sing-box/xray binary and config, then systemctl enable --now for start-at-boot and auto-reconnect, with journalctl for logs. Many distros' official packages already ship a service file — install, edit the config, enable. This is ideal for a little always-on home box or a VPS acting as a gateway for the whole LAN. Note: in TUN mode the service needs the right privileges (run as root or grant the binary CAP_NET_ADMIN), and configure split-routing so local/banking traffic goes direct and only foreign traffic is tunneled — it saves resources and avoids local services rejecting a foreign IP.
- Does using VLESS on Linux mean it definitely won't be blocked?
- No such guarantee. Russia's blocking is at the protocol layer: since December 2025 RKN escalated from blocking specific services to blocking the protocols themselves, and TSPU deep packet inspection probes and cuts suspicious encrypted traffic, VLESS included. VLESS+Reality survives better because it disguises traffic as ordinary HTTPS to a real major site with almost no unique fingerprint — but the resilience comes from Reality's disguise configuration, not the protocol name; a poorly configured VLESS gets cut too, with no guarantee. And during sovereign-internet drills or wide shutdowns, any foreign tunnel can go down together, regardless of whether you're on Linux or another OS. Switching OS doesn't change the protocol fight.
کانال تلگرام Univista
آخرین کانفیگهای سالم، وضعیت سرورها و آموزش رفع اشکال در کانال ما.
ورود به کانالسرویسی که میخواهید باز کنید فیلتر شده؟ دسترسیتان را رایگان برگردانید.
حدود ۲ دقیقه تا اتصال دوباره، بدون نیاز به کارت بانکی. یک مسیر پایدار و امن مبتنی بر VLESS + Reality روی iOS، اندروید، ویندوز و مک.
- روزانه ۱ گیگابایت رایگان
- ثبتنام بدون کارت بانکی
- کانفیگ VLESS+Reality آماده در ۶۰ ثانیه
وقتی دوستتان شروع به استفاده کند، شما و دوستتان هرکدام +30 روز اعتبار و ترافیک پاداش میگیرید.
برگرداندن دسترسی — رایگانراهنماهای مرتبط
کدام VPN در سال ۲۰۲۶ هنوز در روسیه کار میکند: چرا OpenVPN/WireGuard مسدود میشوند و VLESS+Reality دوام میآورد
VLESS Reality چیست — کاربرد و تفاوت با VPN
چطور در روسیه روی ویندوز کلاینت VPN/VLESS نصب و استفاده کنیم: توضیح صادقانه (ویندوز منعطفترین پلتفرم است — نه مثل آیفون به App Store قفل است و نه مثل اندروید اصطکاک سایدلود دارد، هر کلاینتی مستقیم دانلود و اجرا میشود؛ اما RKN به مسدودسازی در سطح پروتکل رسیده و حالا حتی VLESS را زیر نظر دارد) و روشی پایدارتر (VLESS+Reality با v2rayN + حالت TUN)
چطور در روسیه روی مک (macOS) کلاینت VPN/VLESS نصب و استفاده کنیم: توضیح صادقانه (تفاوت اصلی با آیفون: مک به App Store قفل نیست — اپل اپهای VPN را از App Store روسیه حذف کرد، اما روی مک لازم نیست از App Store نصب کنید و میتوانید کلاینت را مستقیم از گیتهاب رسمی اجرا کنید و این حذف را دور بزنید؛ همان نبرد در سطح پروتکل — از دسامبر ۲۰۲۵ RKN از مسدودسازی سرویسها به مسدودسازی پروتکلها رسیده و TSPU حتی VLESS را زیر نظر دارد) و روشی پایدارتر (VLESS+Reality با Hiddify/sing-box/v2rayU + حالت TUN)
چطور در روسیه روی اندروید کلاینت VPN/VLESS نصب و استفاده کنیم: توضیح صادقانه (گوگل در برابر حذفها مقاومت میکند و بیشتر کلاینتها هنوز در پلیاستور هستند، اما راه پایدار سایدلود کردن APK sing-box است؛ RKN به مسدودسازی در سطح پروتکل رسیده و حالا حتی VLESS را هدف گرفته) و روشی پایدارتر (VLESS+Reality)
چطور در ایران روی اندروید کلاینت VPN/VLESS نصب و استفاده کنیم — توضیح صادقانه (اندروید از آیفون منعطفتر است: میتوانید APK را مستقیم سایدلود کنید و از دور باطلِ آیفون [برای رسیدن به App Store به VPN و برای گرفتن VPN به App Store] فرار کنید؛ اما میدان اصلی نبرد این است که پروتکل شما در برابر DPIِ ایران دوام میآورد یا نه) و روشی پایدارتر (VLESS+Reality)
این راهنما را به اشتراک بگذارید
مشترک شدید؟ کمک کنید مراحل وارد کردن و رفع اشکال را ببینید.
آماده دسترسی پایدار به اینترنت بینالملل؟
مشاهده تعرفههااین مطلب صرفاً آموزش فنی است. از ابزارهای شبکه مطابق قوانین محل خود استفاده کنید. Univista مسئول استفاده شما نیست.