vps-tcp-tune: a Chinese one-shot BBR3 and XanMod tuning script for VPS hosts

What the script actually does to your kernel

The project is a single shell script, net-tcp-tune.sh, that installs the XanMod kernel and enables BBR v3 congestion control, plus an alias installer. Menu entry 1 is the kernel install, described in the README as the performance foundation of the system, and entry 2 uninstalls the XanMod kernel and restores the distribution default. The README is explicit that a reboot is mandatory after the kernel install before it takes effect, which tells you the scale of the change. This is not a sysctl tuning script that adjusts buffer sizes in a running kernel. It replaces the kernel of a remote machine, which means the script's value is that it automates a procedure that is tedious and error prone by hand, and its risk is that the procedure itself is irreversible if the machine does not come back. The stated target audience is visible in the details, since the whole document is written in Chinese and the menu groups the features around VPS hosting, proxy deployment and Chinese network routes.

The three install paths and why the alias is the recommended one

There are three ways to run it, and the differences matter for how you maintain the machine afterwards. Method one installs a shell alias so that the tool is invoked as bbr with three characters. Method two runs the script directly from the network with no install step. Method three downloads it to a local file with wget, makes it executable, and runs it. The alias method pulls the latest version on every run, which is convenient, and it supports both bash and zsh. The online method adds a timestamp query parameter to defeat caching, and the README recommends using the -q flag so a local curlrc cannot interfere. The download method is the one that goes stale, and the README says so plainly: a locally downloaded script does not update itself, so you re-run the wget command to get a new version. The recommended path is:

bash <(curl -q -fsSL "https://raw.githubusercontent.com/Eric86777/vps-tcp-tune/refs/heads/main/install-alias.sh?$(date +%s)")

After the alias is installed you reload your shell configuration and then invoke the tool by its short name, bbr, and the README notes that both bash and zsh are supported. If curl is not installed on a fresh machine, the README asks you to install it first with apt update -y && apt install curl -y. The download alternative is:

wget -O net-tcp-tune.sh "https://raw.githubusercontent.com/Eric86777/vps-tcp-tune/refs/heads/main/net-tcp-tune.sh?$(date +%s)"
chmod +x net-tcp-tune.sh
./net-tcp-tune.sh

The recommended path is a three-step sequence, not a single run

The best practice flow in the README is a sequence, and reading it in order explains how the menu is meant to be used. Step one is feature 1, the XanMod kernel plus BBR v3 install, followed by the mandatory reboot. Step two is feature 3, the BBR direct and landing optimization, and it asks you two things. The first is your bandwidth, and the choice depends on your own knowledge: the beginner option is 1, an automatic detection that runs Speedtest once and computes the parameters for you, while an advanced user who knows their line bandwidth picks a tier directly, with 500Mbps and 1Gbps given as examples. The second question is which region the server mainly serves, because the buffer choice differs. Asia-Pacific locations, meaning Hong Kong, Japan, Singapore and Korea, get a standard buffer, while the United States and Europe, which means crossing the Pacific or the Atlantic, get a large buffer to fix the throughput bottleneck on a high latency path. The author also notes in passing that they personally pick the 500M or 700M tier because it is the most stable. There is also a one-shot path described as the lazy option, feature 66, which performs all of these steps automatically, although the feature list elsewhere in the document counts 33 entries.

DNS purification ships with a transactional rollback

Feature 5 is the NS forum DNS purification, and it comes with the most explicit safety machinery described anywhere in the document. Two modes are offered. Mode 1 is a pure foreign mode using Google and Cloudflare with DoT encryption forced on, which the README recommends for resisting pollution. Mode 2 is a pure domestic mode using Alibaba Cloud and Tencent DNSPod with no encryption, because domestic DNS does not support DoT. The security note describes a complete transactional rollback mechanism built in: a full snapshot before execution, and automatic restoration of the original state if any step fails. It also says the reboot persistence has been fixed. The README still advises a first run with VNC or console access if you have concerns, which is a sensible instruction for a change that rewrites resolver behaviour. Two failure modes are described further up the document. Snell and Xray wait for DNS cold start readiness before starting, and a probe timeout is logged and handed to the proxy itself for target handling and retry, so an unreachable external probe does not become a hard block for all IP and internal domain traffic. DNS persistence recovery, in contrast, still fails strictly and retries.

Proxy deployment is bundled in, and that changes the risk profile

A networking tuning script that also installs proxies is a different category of tool from one that only tunes the kernel, and this is where the audit questions live. The menu includes Snell protocol deployment, described as v5.0.1 kernel with support for multiple instances and multiple ports, and a one-click Xray multi-protocol option offering VLESS with Reality, SS2022 and chained SOCKS5 proxy. It also includes Sub-Store multi-instance management, a one-click reverse proxy using Cloudflare Tunnel, a one-click SOCKS5 proxy deployment, a rule blocking direct connections from mainland China to certain ports as a scan protection measure, and port traffic billing with quota, rate limiting and automatic shutdown on expiry. The uninstall path is described in detail too, and it supports the VLESS, Shadowsocks and dual-protocol deployments produced by this menu, along with subscriptions and the official copytruncate log rotation, while still checking fixed directories, service hooks and Snell protection. The README is careful to say that unknown custom deployments may need separate handling. The version notes in the README mention fixes for Xray multi-instance updates and for uninstalling SS and dual-protocol setups.

The diagnostics menu is where this project is most useful on its own

Nine of the menu entries are measurements rather than changes, and they are the cheapest reason to run this script. The testing section covers IP quality detection for both IPv4 and IPv6 with a composite fraud score, a recommended IPv4-only variant for speed, server bandwidth testing through Speedtest, a single thread iperf3 test for precise network throughput, an international interconnect speed test across global nodes, a network latency quality check for packet loss and jitter, a three-network return route test that detects line quality across CN2, 9929 and CMIN2, IP media and AI unlock detection for services such as Netflix, Disney+ and ChatGPT, and a one-click NQ check that gathers comprehensive system information. Separate entries cover system status, with CPU, memory, disk, network and kernel information, and a smart swap calculation that adds swap to prevent out of memory errors. Because these are read-only checks, they let you establish a baseline before touching anything, which is the opposite of what the kernel install does. The IPv4 and IPv6 priority setting is also in the menu, described as a fix for Google captcha challenges.

IPv6 handling refuses to guess, and boot recovery is idempotent

Two details in the version notes show how the author handles irreversible operations. On IPv6, the script checks whether ifupdown still has an inet6 configuration before permanently disabling IPv6, and refuses to produce a conflict if it does. The README says the network configuration needs to be coordinated in an environment where you have console access and a rollback plan, and that the proxy installation will not modify the network interface configuration for you. The second detail is boot recovery. The script sets up an automatic recovery mechanism so that services come back after a reboot, and there is a dedicated entry point, bbr --repair-boot-recovery, plus the equivalent on a downloaded file, bash net-tcp-tune.sh --repair-boot-recovery, which can install the recovery components explicitly before any service is deployed. The migration checks actual files, so a missing helper, missing boot protection or a missing new instance gets filled in, and repeating the operation keeps the same file content and silently reloads systemd to retry a load that previously failed. The auto migration does not download or upgrade service programs, does not swap the kernel, does not reboot the machine or the network interface, and does not enable or start services the user stopped by hand. That restraint is documented rather than implied.

MIT licensed, no tagged releases, and a Chinese-first document

The licence is MIT, with the LICENSE file at the repository root, and the repository is not archived. The last push was on 2026-10-20, so the script is being worked on daily, and the version in the README title is v5.4.17. There are no GitHub releases, so there is no tag to pin and no changelog attached to a version; the version history lives in the README prose itself, where each release line describes what changed. The repository is small: install-alias.sh, net-tcp-tune.sh, snell-upgrade-patch.sh, a tests directory, the README and the LICENSE. The description of the repository notes that the documentation was written by Claude 4.6 opus, which is worth knowing because it explains the tone, the exhaustive change notes and the fact that the prose is Chinese. For a non-Chinese reader this is the main barrier, not the shell code itself. The features are described in Chinese throughout the menu, the error conditions are described in Chinese, and the guidance on which region needs which buffer assumes knowledge of Chinese hosting routes.

Editorial conclusion

Adopt vps-tcp-tune if you run a Linux VPS that you administer yourself, you read Chinese, and you want the XanMod kernel plus BBR v3 installed and tuned in one command rather than by hand. Do not adopt it on a host you cannot rebuild, on a machine whose kernel you are not allowed to change, or if you need a script whose documentation you can read in English, since the README and menu are Chinese first. Before you commit, read the rollback notes around DNS purification, confirm you have console access as the README advises, and check that the maintenance window you have is long enough for the kernel install and the reboot it requires.

Frequently asked questions

Official sources

1. Eric86777/vps-tcp-tune on GitHub
2. Issues
3. License: MIT
4. README