Локальный SNI-мост и DNS-сплиттер на базе Cloudflare Edge

import net from "node:net";

// Впиши сюда свой привязанный поддомен на .online (без https:// и слэшей)
const WORKER_HOST = "switcher.richcorp.online";

function extractSNI(buf) {
  try {
    if (buf.length < 43 || buf[0] !== 0x16 || buf[5] !== 0x01) return null;
    let pos = 43;
    if (pos >= buf.length) return null;
    pos += 1 + buf[pos];
    if (pos + 2 > buf.length) return null;
    pos += 2 + buf.readUInt16BE(pos);
    if (pos + 1 > buf.length) return null;
    pos += 1 + buf[pos];
    if (pos + 2 > buf.length) return null;
    const extTotalLen = buf.readUInt16BE(pos);
    pos += 2;

    const end = Math.min(buf.length, pos + extTotalLen);
    while (pos + 4 <= end) {
      const extType = buf.readUInt16BE(pos);
      const extLen = buf.readUInt16BE(pos + 2);
      pos += 4;
      if (extType === 0x0000 && pos + 5 <= end) {
        const nameLen = buf.readUInt16BE(pos + 3);
        if (pos + 5 + nameLen <= end) {
          return buf.toString("utf8", pos + 5, pos + 5 + nameLen);
        }
      }
      pos += extLen;
    }
  } catch (_) {}
  return null;
}

net.createServer((client) => {
  client.setNoDelay(true);
  const chunks = [];

  const onFirstData = (chunk) => {
    chunks.push(chunk);
    const fullBuf = Buffer.concat(chunks);

    if (fullBuf.length < 5) return;
    const recordLen = fullBuf.readUInt16BE(3);
    if (fullBuf.length < 5 + recordLen && fullBuf.length < 2048) return;

    client.removeListener("data", onFirstData);

    const sni = extractSNI(fullBuf);
    if (!sni || sni === WORKER_HOST) {
      client.destroy();
      return;
    }

    console.log(`[CONNECT] ${sni} -> wss://${WORKER_HOST}`);

    const ws = new WebSocket(`wss://${WORKER_HOST}/?host=${encodeURIComponent(sni)}&port=443`);
    ws.binaryType = "arraybuffer";

    const queue = [fullBuf];
    const onQueueData = (c) => queue.push(c);
    client.on("data", onQueueData);

    ws.onopen = () => {
      client.removeListener("data", onQueueData);
      for (const c of queue) ws.send(c);
      queue.length = 0;

      client.on("data", (c) => {
        if (ws.readyState === WebSocket.OPEN) ws.send(c);
      });
    };

    ws.onmessage = (e) => {
      if (!client.destroyed) client.write(new Uint8Array(e.data));
    };

    ws.onclose = (e) => {
      if (e.code !== 1000 && e.code !== 1005) {
        console.log(`[WS CLOSED] ${sni} | Code: ${e.code} | Reason: ${e.reason}`);
      }
      client.destroy();
    };

    ws.onerror = (err) => {
      console.error(`[WS ERROR] ${sni}:`, err.message || "Connection error");
      client.destroy();
    };

    client.on("close", () => { try { ws.close(); } catch (_) {} });
    client.on("error", () => { try { ws.close(); } catch (_) {} });
  };

  client.on("data", onFirstData);
  client.on("error", () => client.destroy());
}).listen(443, () => {
  console.log(`SNI Tunnel Bridge active -> wss://${WORKER_HOST}`);
});

no-resolv
server=1.1.1.1
server=8.8.8.8

# ChatGPT / OpenAI
address=/chatgpt.com/127.0.0.1
address=/openai.com/127.0.0.1
address=/oaistatic.com/127.0.0.1
address=/oaiusercontent.com/127.0.0.1

# Google Antigravity
address=/antigravity.google/127.0.0.1
address=/daily-cloudcode-pa.googleapis.com/127.0.0.1
address=/cloudcode-pa.googleapis.com/127.0.0.1
address=/cloudaicompanion.googleapis.com/127.0.0.1
address=/generativelanguage.googleapis.com/127.0.0.1
address=/aiplatform.googleapis.com/127.0.0.1
address=/businessaicode.googleapis.com/127.0.0.1
address=/gemini.google.com/127.0.0.1

# xAI Grok
address=/grok.com/127.0.0.1

events {
    worker_connections 1024;
}

http {
    resolver 1.1.1.1 8.8.8.8 ipv6=off;

    # Увеличиваем лимиты на размер заголовков и Cookie от браузера
    client_header_buffer_size 64k;
    large_client_header_buffers 8 64k;
    underscores_in_headers on;

    # Увеличиваем буферы для ответов от воркера
    proxy_buffer_size 128k;
    proxy_buffers 8 256k;
    proxy_busy_buffers_size 256k;

    server {
        listen 443 ssl;
        server_name _;

        ssl_certificate     /etc/nginx/certs/cert.pem;
        ssl_certificate_key /etc/nginx/certs/key.pem;
        ssl_protocols TLSv1.2 TLSv1.3;

        location / {
            set $worker_host "frisky-squid-8674.catvoodoo.deno.net"; # домен на deno.dev / workers.dev

            # Защита от случайной петли
            if ($host = $worker_host) {
                return 508 "Loop detected";
            }

            proxy_pass https://$worker_host;

            proxy_ssl_server_name on;
            proxy_ssl_name $worker_host;
            proxy_ssl_protocols TLSv1.2 TLSv1.3;

            proxy_set_header Host $worker_host;
            proxy_set_header X-Target-Host $host;
            proxy_set_header Accept-Encoding ""; # чтобы воркер не путался со сжатием

            proxy_buffering off;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            client_max_body_size 100M;
        }
    }
}