Chain Laboratory
Build chained proxy routes step-by-step. Test each hop live. Troubleshoot failures. Get free, uncensored internet access.
Step 1 Diagnose & Choose Your Base Proxy
First, let's understand what your network can reach. Then choose or paste a proxy to build your chain.
Network Diagnosis (click to run)
We'll test what your network can access. This determines the best chain strategy for your situation.
I already have a local proxy (Layer 1)
If you have Psiphon, Lantern, V2RayN, or any SOCKS/HTTP proxy running locally, enter it here. It becomes Layer 1 of your chain.
Step 2 Discover Clean IPs
Cloudflare WARP endpoints require "clean" IPs that are not blocked by your ISP. We'll scan for working Cloudflare IPs from your location. This is the critical step that determines if WARP chaining will work for you.
lab-scanner.py tool to find IPs that work from your specific network.Step 3 Build Your Chain
Choose a chain strategy based on what works on your network. WARP is not the only option — you can cascade proxies, use a LAN relay, apply TLS fragmentation, or route through a CDN Worker.
--auto-chain to find out.Advanced Evasion Options
Step 4 Test Your Chain
Test the chain end-to-end. We'll verify that traffic flows through WARP and your proxy successfully reaches the open internet. If the test fails, check the troubleshooting guide below.
sing-box run -c chain.json, then visit ip.gs through the proxy to verify your exit IP changes.Troubleshooting Guide
The clean IP may be blocked by your ISP. Go back to Step 2 and try different IPs. Best ports to try: 854, 859, 864, 878, 880, 890, 891, 894, 903, 908, 928, 2408, 4500. Use lab-scanner.py --scan-ips to find working IP:port combos automatically.
Your ISP is likely doing deep packet inspection (DPI). Solutions: 1) Enable TLS Fragment in Step 3. 2) Try the "Randomized" uTLS fingerprint. 3) Switch to ALPN "h2" only. 4) Try Double WARP strategy.
The inner proxy might be down or misconfigured. Try: 1) A different base proxy from Step 1. 2) Check if the proxy requires WebSocket or gRPC transport. 3) Verify the UUID/password is correct. 4) Test the proxy directly (without WARP) first.
Try a clean IP with lower latency. Use a WARP+ key for better routing. Enable multiplex (h2mux or yamux) in Advanced Evasion. Consider switching to a geographically closer proxy exit node.
Your ISP may be detecting and blocking the connection after a period. Try: 1) Switch to a different clean IP. 2) Enable multiplex with padding. 3) Use the Double WARP strategy. 4) Rotate clean IPs periodically.
Your ISP may be hijacking DNS. In your VPN client settings, force DNS to use DoH (DNS-over-HTTPS): https://1.1.1.1/dns-query or https://dns.google/dns-query. Also try setting the remote DNS in sing-box config.
Some ISPs block by SNI (Server Name Indication). Use TLS Fragment strategy or ECH (Encrypted Client Hello) if supported. Reality protocol is also effective against SNI-based filtering.
Step 5 Export & Use
Your chain is ready! Export the configuration in your preferred format and import it into your VPN client.
Quick Import Guide
Copy the JSON config. In Hiddify, go to Profiles → New Profile → Manual → paste the JSON content.
Copy the YAML config. In Clash Verge, go to Profiles → Import from clipboard or save as .yaml file.
Copy the raw URI. In V2RayN, click Server → Import from clipboard. For chains, use the Sing-Box JSON export.
Offline Tools & Scripts
Download these tools to run locally when you have no web access. They work offline with zero dependencies.
Full network diagnostic: find clean IPs, discover local proxies, test DNS, build multi-layer chains interactively. Works on Windows/Linux/Mac with Python 3.7+.
Download lab-scanner.pyRun and test chain configs, scan clean IPs, test individual layers. Auto-downloads sing-box. For Linux/Mac.
Download lab-runner.shA self-contained HTML file with the full chain builder. No server needed - just open in any browser.
Download lab-offline.htmlQuick Start Commands (Current)
# Full network diagnostic (all phases)
python lab-scanner.py
# Quick connectivity check (ICMP, TCP, DNS, TLS, HTTPS)
python lab-scanner.py --quick
# Scan for clean Cloudflare IPs
python lab-scanner.py --scan-ips --top-n 20
# Include your own IPs in the scan
python lab-scanner.py --scan-ips --custom-ips "1.2.3.4:2408,5.6.7.8"
# Find working DNS servers (UDP, DoH, DoT)
python lab-scanner.py --scan-dns
# Detect SNI-based domain blocking (25 domains)
python lab-scanner.py --scan-sni
# TCP port reachability matrix (includes alt CDN IPs)
python lab-scanner.py --scan-ports
# Find local SOCKS/HTTP proxies
python lab-scanner.py --scan-proxies
# Find intranet/LAN relays with internet access
python lab-scanner.py --scan-lan
# Auto-detect best chain path (6 strategies, not just WARP)
python lab-scanner.py --auto-chain
# Auto-chain with your own proxy as Layer 1
python lab-scanner.py --auto-chain --custom-proxy socks5://127.0.0.1:1080
# Interactive multi-layer chain builder
# (paste URIs, import IPs, remove layers, mid-build testing)
python lab-scanner.py --interactive
# Test through existing proxy (HTTP + HTTPS + speed test)
python lab-scanner.py --test-proxy socks5://127.0.0.1:1080
# Export results as JSON
python lab-scanner.py --scan-ips --json > clean-ips.json