Sharing port 443

Several nodes can share one public port 443. PSM has Nginx read the domain name (SNI) in the TLS handshake at the TCP level, without decrypting anything, and hand the connection to the node for that name.

client ──443/TCP──▶ Nginx (reads SNI, no decryption)
                     ├─ a.example.com  ──▶ REALITY node
                     ├─ b.example.com  ──▶ Vision node
                     ├─ c.example.com  ──▶ AnyTLS node
                     ├─ your domain    ──▶ HTTPS camouflage site
                     └─ anything else  ──▶ dropped

client ──443/UDP──▶ Hysteria2 / TUIC (separate listener, no collision)

Why it helps

• One open port: the firewall only allows 443, so there is less to scan.
• Unknown names are dropped: only domains you mounted get through. A scanner that makes up a name is cut off at once, so nobody can use your server as a free relay.
• One server, several identities: nodes and a camouflage website sit on 443 side by side, told apart by domain.
• UDP 443 does not collide: Hysteria2 and TUIC use UDP, a separate listener from TCP 443.

Which nodes can be mounted

Xray REALITY, Vision, XHTTP, Trojan and VMess, and REALITY, AnyTLS, Trojan, VMess and VLESS on sing-box and mihomo. All three cores share one routing table; the same domain used by two cores is detected and refused.

How

Choose "mount on shared 443" when creating a node in the menu, or on the command line:

psm node add xray reality --tag hk-443 --port 21001 \
  --server-name learn.microsoft.com --dest learn.microsoft.com:443 --mount-443

The node listens on a loopback port (21001 here); only 443 faces the internet. Nginx is installed if it is missing, and the routing table follows port, domain and deletion changes.

In the PSM panel, tick 挂到 443 端口复用 when creating a node and psm-agent does the same thing on the server — it is the same path as the command line. The tick box appears only for protocols that can be mounted, and with it on, the connect port is fixed at 443 and is not asked for.

Fixed once the node is made

Whether a node listens on its own port or sits behind the shared 443 decides the address clients use, so it is not something an update can change — PSM and the panel both refuse it. To switch, delete the node and make it again the other way.

"REALITY: Listening on non-443 ports" in the log

On a mounted node this warning can be ignored: the node listens on loopback, and the port the world sees is 443. It only matters for a node listening directly on a public port other than 443.

Port hopping

A Hysteria2 node can use port hopping: a whole UDP port range (say 20000-20999) is redirected to the node's port, and the client rotates through it, which gets around ISPs throttling a single UDP port.

psm node add sing-box hysteria2 --tag hk-hy2 --port 8443 \
  --sni hy2.example.com --cert-path /path/fullchain.pem --key-path /path/privkey.pem \
  --hop-ports 20000-20999

• The firewall only needs the node's own port.
• Share links carry the range (host:8443,20000-20999); clients that support it rotate automatically.
• The redirect rules come back after a reboot.