Двойное
туннелирование:
OpenConnect
+ VLESS

{
  "inbounds": [
    {
      "tag": "socks-in",  // для тестирования через curl
      "port": 10808, "listen": "127.0.0.1",
      "protocol": "socks"
    },
    {
      "tag": "tproxy-in",  // прозрачный прокси для офисного трафика
      "port": 12345, "listen": "0.0.0.0",
      "protocol": "dokodemo-door",
      "settings": { "network": "tcp,udp", "followRedirect": true },
      "streamSettings": { "sockopt": { "tproxy": "tproxy" } }
    }
  ],
  "outbounds": [
    {
      "tag": "vless-out",
      "protocol": "vless",
      "settings": { "vnext": [{
        "address": "ВАШ_VLESS_ДОМЕН", "port": 443,
        "users": [{ "id": "ВАШ_UUID", "encryption": "none" }]
      }]},
      "streamSettings": {
        "network": "tcp", "security": "tls",
        "tlsSettings": {
          "serverName": "ВАШ_VLESS_ДОМЕН",
          "fingerprint": "chrome"  // маскировка под браузер
        }
      }
    }
  ]
}

systemctl enable --now xray

# Самоподписанный сертификат
mkdir -p /etc/ocserv/ssl && cd /etc/ocserv/ssl
openssl req -x509 -newkey rsa:2048 -keyout server-key.pem   -out server-cert.pem -days 3650 -nodes   -subj "/CN=ВАШ_IP_СЕРВЕРА"

# Создать пользователя
ocpasswd -c /etc/ocserv/ocpasswd itfresh

auth            = "plain[passwd=/etc/ocserv/ocpasswd]"
tcp-port        = 443
udp-port        = 443
server-cert     = /etc/ocserv/ssl/server-cert.pem
server-key      = /etc/ocserv/ssl/server-key.pem
device          = vpns
ipv4-network    = 192.168.8.0/24
dns             = 8.8.8.8
route           = default
# Критично: исключить IP шлюза и VLESS-сервера из туннеля
no-route        = 155.212.159.202/255.255.255.255
no-route        = 202.148.54.236/255.255.255.255
max-clients     = 50
keepalive       = 30
dpd             = 60

systemctl enable --now ocserv

[Unit]
Description=TPROXY IP routing rules for OpenConnect+VLESS
After=network.target netfilter-persistent.service xray.service
Requires=netfilter-persistent.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/bash -c "ip rule add fwmark 0x1 table 100 2>/dev/null || true;   ip route add local 0.0.0.0/0 dev lo table 100 2>/dev/null || true"
ExecStop=/bin/bash -c "ip rule del fwmark 0x1 table 100 2>/dev/null || true;   ip route del local 0.0.0.0/0 dev lo table 100 2>/dev/null || true"

[Install]
WantedBy=multi-user.target