How to setup VLESS mKCP over DNS

[kokoromagic]

Ever found yourself in a shopping mall, cafe, or airport connected to a public Wi-Fi network, only to be blocked by a captive portal requiring SMS verification, payment, or account sign-in?

Often, these networks block all standard traffic until you log in, but they frequently leave UDP Port 53 (DNS traffic) open or unmanaged to allow domain resolution. By tunneling VLESS and mKCP inside DNS queries using xDNS, you can disguise your traffic as normal DNS requests and bypass these captive portal restrictions.

In this guide, we will walk through setting up a VLESS + mKCP over xDNS server and generating the corresponding v2rayNG client configuration.

---

Technical Overview

To trick the captive portal firewall:

1. mKCP acts as the fast UDP transport layer.
2. xDNS finalmask wraps the UDP payload to mimic legitimate DNS queries (specifically TXT record queries).
3. Traffic is routed through Port 53 directly or relayed via public DNS servers.

Domain Prerequisites

You need a domain with custom DNS records set up on your DNS provider (e.g., Cloudflare, Namecheap):

• A / AAAA Record: vps.yourdomain.com $\rightarrow$ Points to your VPS IPv4/IPv6 address.
• NS Record: ns1.yourdomain.com $\rightarrow$ Delegated to vps.yourdomain.com.

(For the configuration below, replace huskydg.io.vn with your actual domain).

---

Server Configuration

Install Xray-core. Paste the following JSON configuration into your server config file (e.g., /usr/local/etc/xray/config.json).

Note: Make sure no other process (like systemd-resolved or dnsmasq) is using port 53 on your server. And let firewall to allow udp/tcp from outside goes into port 53

{
  "log": {
    "loglevel": "debug"
  },
  "inbounds": [
    {
      "port": 53,
      "listen": "0.0.0.0",
      "protocol": "vless",
      "sniffing": {
        "enabled": false
      },
      "settings": {
        "clients": [
          {
            "id": "<YOUR-UUID>",
            "level": 0
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "mkcp",
        "security": "none",
        "kcpSettings": {
          "mtu": 900,
          "tti": 20,
          "uplinkCapacity": 5,
          "downlinkCapacity": 20,
          "congestion": false,
          "readBufferSize": 2,
          "writeBufferSize": 2
        },
        "finalmask": {
          "udp": [
            {
              "type": "xdns",
              "settings": {
                "domains": ["ns1.huskydg.io.vn:txt"]
              }
            }
          ]
        }
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom",
      "settings": {
        "domainStrategy": "UseIPv4"
      }
    }
  ]
}

Replace <YOUR-UUID> with a newly generated UUID (you can generate one using xray uuid or uuidgen).

Client Link (v2rayNG / V2rayN)

To quickly import this setup into v2rayNG (Android) or v2rayN (Windows), copy the URI link below and import it via clipboard:

vless://<YOUR-UUID>@1.1.1.1:53?security=none&encryption=none&fm=%7B%22udp%22%3A%5B%7B%22type%22%3A%22xdns%22%2C%22settings%22%3A%7B%22resolvers%22%3A%5B%22ns1.huskydg.io.vn%2Budp%3A%2F%2F1.1.1.1%3A53%22%5D%7D%7D%5D%7D&headerType=none&type=kcp&mtu=130#vless-mkcp-xdns

URL Parameter Breakdown

• Host: 1.1.1.1:53 (Can be changed to the public DNS server or direct gateway DNS allowed by the local network).
• fm (finalmask JSON encoded):

{
  "udp": [
    {
      "type": "xdns",
      "settings": {
        "resolvers": [
          "ns1.huskydg.io.vn+udp://1.1.1.1:53"
        ]
      }
    }
  ]
}

• mtu=130: Keeps packet sizes small to avoid truncation or fragmentation over DNS.

How to Test

• Connect to the restricted Wi-Fi network without logging in through the portal page.
• Turn on your VPN app (v2rayNG) with the imported configuration.
• Check your connectivity by opening a browser or testing latency in the app.

Disclaimer: This guide is provided for educational and research purposes regarding network protocols and firewall mechanics.

[shakibamoshiri]

worked, thank you,
better to mention xray version compatibles