ownexit

English | 简体中文

Turn a VPS you rent into your own fixed exit IP — connect directly, or through a relay — set up from your laptop with one command.

pipx install ownexit
ownexit direct --host 203.0.113.7   # asks for the VPS root password once

When it finishes, paste the printed subscription URL into Clash Verge or Shadowrocket. That's it.

_{The IPs in the demo are examples.}

• One command, from your laptop. No logging into the server to type commands.
• A fixed exit that is yours. Your traffic leaves from your own VPS; the IP is not shared with strangers.
• Still works when the IP gets blocked. Add a relay server in front; the exit IP and your client settings stay the same.
• Undoable. The relay setup rolls back both servers to how they were, and the relay never holds any keys.

How it works

Direct — your devices connect straight to your VPS:

phone / laptop ──VLESS-Reality──▶ your VPS (sing-box) ──▶ websites see your VPS's IP

Relay — for when the VPS IP is blocked from where you are. The relay only forwards TCP bytes; it cannot read your traffic and stores no keys:

phone / laptop ──VLESS-Reality──▶ relay (systemd-socket-proxyd) ──▶ exit VPS (sing-box) ──▶ websites see the exit's IP

Everything runs on your laptop and talks to the servers over SSH. Configuration, keys and state stay on your laptop, outside this repository.

Prerequisites

Servers. One VPS for direct, two for relay, running Debian 12 or Ubuntu 22.04 and reachable as root over SSH with a password (used once). Never bought a VPS? Follow the step-by-step guide: docs/manual/vps.en.md — choosing, ordering, installing the OS, firewalls.

Your computer.

Install what is missing:

# macOS (with Homebrew, https://brew.sh); ssh, curl and openssl come with macOS
brew install pipx expect
pipx ensurepath            # then open a new terminal

# Debian / Ubuntu / WSL
sudo apt update
sudo apt install -y pipx expect openssh-client curl openssl
pipx ensurepath            # then open a new terminal

Windows itself is not supported; use WSL. If your computer runs a proxy in TUN mode (Clash and similar), turn it off while deploying — see Supported platforms.

Install

pipx install ownexit        # or: pip install --user ownexit
ownexit --help

ownexit is a thin wrapper around the bundled bash scripts, so you can also run them straight from a clone — the commands map one to one:

# needs git
git clone https://github.com/jakoes-wu/ownexit && cd ownexit
./direct/setup_direct.sh --host 203.0.113.7

When run from a clone, the chain scripts additionally refuse configuration files that live inside the clone, so real IPs and keys cannot be committed by accident.

Quick start: direct

1. Deploy

   ownexit direct --host 203.0.113.7          # add --port 2222 if SSH is not on 22
   

   It sets up key login, checks the system, enables BBR, has the server download a pinned official sing-box release and check its SHA-256, generates the Reality keys on the server, renders subscriptions, uploads them and verifies every layer. No questions asked. Pass --sni <domain> or --proxy-port <port> to choose them yourself; run it again with new values to change them later (the UUID and keys stay the same).

2. Import on your devices — the script prints four URLs:

   URL	For
   …/clash.yaml	Clash Verge, mihomo, Clash Meta for Android
   …/shadowrocket.txt	Shadowrocket on iPhone, v2rayN / v2rayNG
   …/sing-box.json	sing-box apps (SFI / SFA / SFM, 1.12 or later)
   …/node.txt	the plain vless:// link, for anything else

3. Check and close up — open https://ipinfo.io on a device: it should show your VPS's IP. Then turn the subscription endpoint off until you need it again:

   ownexit subctl stop
   

The VPS is remembered, so later runs need no arguments: ownexit direct to redeploy, ownexit subctl status|start|stop|log|qr, ownexit direct --uninstall to remove it. ownexit direct --rotate-keys replaces the UUIDs, Reality key pair and short id on the server (every device must re-import the subscription). ownexit direct --add-device phone gives one device its own UUID and subscription URLs; --remove-device phone revokes it without touching the others; ownexit subctl devices lists them.

Set up with the 233boy script by an earlier version? Run ownexit direct --migrate once. It keeps the existing UUID, keys, port and SNI, switches to ownexit's own service and removes the 233boy files (backed up first) — your clients and subscription URLs keep working.

Step-by-step guide: docs/manual/direct.md (Chinese).

Quick start: relay

1. Give it two IPs

   ownexit chain init --relay 203.0.113.10 --exit 203.0.113.20
   

   It sets up key login on both servers (one password prompt each), detects the exit IP and asks you to confirm it, checks whether the relay already runs sing-box, and writes ~/.config/ownexit/chains/main.env. Nothing on the servers is changed yet. By default deploy will also add an nftables rule on the exit so that only the relay can reach its Reality port (--exit-source-filter managed); use provider if your provider's security group already does that, or none to skip it.

2. Deploy

   ownexit chain --id main deploy
   

   Both servers download the pinned sing-box release from GitHub themselves (falling back to an upload from your computer). It deploys the exit first, then the relay, as one transaction, and verifies the exit IP three different ways. If anything fails, it cleans up; if your network drops halfway, run deploy or rollback again and it converges.

3. Import the node from ~/.local/state/ownexit/chains/main/client/node.txt, or run ownexit multi --chains main render for QR codes and a Clash snippet.

Day to day: ownexit chain --id main status | verify | conns | rollback. ownexit chain --id main rotate-keys replaces the exit's UUIDs, Reality key pair and short id in place (relay, ports and deployment stay; re-import afterwards). add-device <name> / remove-device <name> / list-devices manage per-device UUIDs. If the relay also runs a direct exit and you migrate, reconfigure or uninstall that direct exit, run ownexit chain --id main rebaseline afterwards so the chain re-records what it protects (the direct script reminds you). Relay blocked? Deploy a second relay with init --id backup … and combine both with multi_chain_client.sh — clients switch automatically. Full reference: chain/README.md; guide: docs/manual/chain.md (both in Chinese).

Supported platforms

If your computer runs a proxy in TUN mode (Clash and similar), SSH to the servers may be cut off halfway through a deploy. Turn TUN off, or route the relay and exit IPs directly, while running chain commands.

Stability

From 1.0.0 the command-line interface, configuration keys and on-disk formats are frozen for the whole 1.x series: releases only add things, nothing is renamed or removed, and existing deployments keep working after an upgrade without redeploying or re-importing clients. Breaking changes are reserved for 2.0 and will come with a migration. The frozen surface is listed in docs/reference/commands.md and docs/reference/files.md; the rules are in docs/reference/compatibility.md (all in Chinese).

Security notes

• No real IP, password or key ever goes into this repository. There is no "edit the IP at the top of the script" step and no --password option. Passwords are typed interactively (or passed via OWNEXIT_SSH_PASSWORD for non-interactive use), submitted once per try, and never written to disk.
• A wrong password is retried at most 3 times, and each try is submitted to the server only once, so you are unlikely to trip fail2ban. Failures end with reason=bad-password, reason=password-disabled or reason=unreachable.
• The direct subscription endpoint is plain HTTP protected by a random path. Keep it stopped (ownexit subctl stop) except while importing, and use ownexit direct --rotate-token if a URL leaks, --rotate-keys if the node credentials leak.
• The relay only runs systemd-socket-proxyd; the Reality private key lives only on the exit server, in a mode-600 file. By default the exit's Reality port only accepts connections from the relay (an nftables table that starts and stops with the exit service).
• Both setups download a pinned official sing-box release on each server and check the SHA-256 of both the archive and the binary; if a server cannot reach GitHub, your computer downloads and uploads it instead. Reality private keys are generated on the server and never leave it.

See SECURITY.md for how to report a vulnerability.

FAQ

Something isn't working. Where do I start? Run ownexit doctor. It checks this computer (required commands, proxy variables, directory permissions, whether a proxy TUN captures the route to your servers), every remembered direct VPS and every chain, and prints a fix for each problem. ownexit doctor --scan-sni tests which Reality camouflage domains actually work from your exit server (a real Reality handshake on the server's loopback, not just a TLS 1.3 check). ownexit doctor --ip-check also tests the exit IP from the server itself: owner and type, ChatGPT / Claude / Gemini, Netflix / YouTube Premium / Disney+, and common sites (indicative only). Chain checks run status, which holds that chain's lock for a few seconds.

Can I change the SSH port or user? Direct: --port, --user. Relay: --relay-port, --exit-port; the relay setup requires root.

I manage several VPSes. Pass --host to pick one. Without it, ownexit direct and ownexit subctl list the remembered servers and exit.

How do I undo it? Relay: ownexit chain --id main rollback. Direct: ownexit direct --uninstall (keeps your SSH key login and any migration backup).

Where are my files? Keys: ~/.ssh/ownexit/. Configuration: ~/.config/ownexit/. State and subscriptions: ~/.local/state/ownexit/.

Contributing

Issues and pull requests are welcome; please read CONTRIBUTING.md first. The project follows the Contributor Covenant.

License

MIT. Use this software in accordance with the laws where you live and the terms of your server provider.