基础配置

初始化OS

fail2ban

1
2
3
4
5
6
7
8
sudo apt-get install -y fail2ban
sudo tee  /etc/fail2ban/jail.d/sshd.local << EOF
[sshd]
enabled = true
port = 22
EOF
sudo systemctl reload fail2ban
sudo fail2ban-client reload

安装docker和nginx

略

ssl泛域名证书和cloudflare

https://yanyong.cc/post/certbot/

BBR and TFO

https://wiki.crowncloud.net/?How_to_enable_BBR_on_Debian_11

https://www.geeksforgeeks.org/what-is-tcp-fast-open/

1
2
3
4
5
6
7
8
sudo tee /etc/sysctl.d/bbr.sysctl.conf << EOF
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr
EOF
sudo sysctl -p /etc/sysctl.d/bbr.sysctl.conf

echo 'net.ipv4.tcp_fastopen=3' | sudo tee /etc/sysctl.d/tfo.sysctl.conf
sudo sysctl -p /etc/sysctl.d/tfo.sysctl.conf

trojan

https://trojan-gfw.github.io/trojan/

https://github.com/trojan-gfw/trojan

https://hub.docker.com/r/trojangfw/trojan 此镜像配置文件在/config，不在/etc/trojan，且没装tzdata。fuck!

https://hub.docker.com/r/teddysun/trojan 些镜像配置文件在/etc/trojan

1
sudo docker run -d --name trojan --network=host --restart=always -v /etc/trojan:/config trojangfw/trojan

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
sudo tee /etc/trojan/config.json << EOF
{
    "run_type": "server",
    "local_addr": "0.0.0.0",
    "local_port": 8443,
    "remote_addr": "127.0.0.1",
    "remote_port": 80,
    "password": [
        "password1",
        "password2"
    ],
    "log_level": 3,
    "ssl": {
        "cert": "/config/ssl/fullchain.pem",
        "key": "/config/ssl/privkey.pem",
        "key_password": "",
        "cipher": "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384",
        "cipher_tls13": "TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384",
        "prefer_server_cipher": true,
        "alpn": [
            "http/1.1"
        ],
        "alpn_port_override": {
            "h2": 81
        },
        "reuse_session": true,
        "session_ticket": false,
        "session_timeout": 600,
        "plain_http_response": "",
        "curves": "",
        "dhparam": ""
    },
    "tcp": {
        "prefer_ipv4": false,
        "no_delay": true,
        "keep_alive": true,
        "reuse_port": false,
        "fast_open": true,
        "fast_open_qlen": 20
    },
    "mysql": {
        "enabled": false,
        "server_addr": "127.0.0.1",
        "server_port": 3306,
        "database": "trojan",
        "username": "trojan",
        "password": "",
        "key": "",
        "cert": "",
        "ca": ""
    }
}
EOF

sudo mkdir /etc/trojan/ssl

sudo tee /etc/letsencrypt/renewal-hooks/deploy/trojan.sslUpdate.sh << EOF
#!/bin/bash
cp /etc/letsencrypt/live/yanyong.cc/{privkey.pem,fullchain.pem} /etc/trojan/ssl/
chmod 400 /etc/trojan/ssl/*
docker restart trojan
EOF

sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/trojan.sslUpdate.sh
sudo /etc/letsencrypt/renewal-hooks/deploy/trojan.sslUpdate.sh

trojan-go

https://p4gefau1t.github.io/trojan-go/

https://github.com/p4gefau1t/trojan-go

https://hub.docker.com/r/p4gefau1t/trojan-go

https://hub.docker.com/r/teddysun/trojan-go

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
sudo docker run \
    --name trojan-go \
    -d \
    -v /etc/trojan-go/:/etc/trojan-go \
    --network=host \
    --restart=always \
    -e TZ=Asia/Shanghai \
    p4gefau1t/trojan-go

sudo tee /etc/trojan-go/config.json << EOF
{
    "run_type": "server",
    "local_addr": "0.0.0.0",
    "local_port": 8444,
    "remote_addr": "127.0.0.1",
    "remote_port": 80,
    "password": [
        "123456"
    ],
    "log_level": 3,
    "ssl": {
        "cert": "/etc/trojan-go/ssl/fullchain.pem",
        "key": "/etc/trojan-go/ssl/privkey.pem"
    },
    "websocket": {
        "enabled": true,
        "path": "/abcdefg"
    }

}
EOF

sudo mkdir /etc/trojan-go/ssl

sudo tee /etc/letsencrypt/renewal-hooks/deploy/trojan-go.sh << EOF
#!/bin/bash
cp /etc/letsencrypt/live/yanyong.cc/{privkey.pem,fullchain.pem} /etc/trojan-go/ssl/
chmod 400 /etc/trojan-go/ssl/*
docker restart trojan-go
EOF

sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/trojan-go.sh
sudo /etc/letsencrypt/renewal-hooks/deploy/trojan-go.sh

v2ray

https://www.v2fly.org/

https://github.com/v2fly/v2ray-core

https://hub.docker.com/r/v2fly/v2fly-core

1
2
3
4
5
#查看默认文件
sudo docker run -d --name v2ray v2fly/v2fly-core
sudo docker cp v2ray:/etc/v2ray/config.json config.json
sudo docker stop v2ray
sudo docker rm -v v2ray

1
sudo docker run -d --name v2ray --network=host --restart=always -v /etc/v2ray/:/etc/v2ray/ -e TZ=Asia/Shanghai v2fly/v2fly-core

https://www.v2fly.org/config/overview.html

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
cat /proc/sys/kernel/random/uuid

sudo tee /etc/v2ray/config.json << EOF
{
  "log": {
    //"access": "/var/log/v2ray/access.log",
    //"error": "/var/log/v2ray/error.log",
    "loglevel": "error"
  },
  "api": {
    "tag": "api"
  },
  "inbounds": [{
    "port": 16801,
    "protocol": "vmess",
    "settings": {
      "clients": [
        {
          "alterId": 8,
          "id": "9cf6573b-12a5-47c4-bc48-8f1643252a5f",
          "level": 1
        }
      ]
    },
    "streamSettings": {
      "network": "ws",
      "security": "none",  // TLS已经交给nginx处理
      "wsSettings": {
        "path": "/abcdefg"  // 复杂点避免嗅探
      }
    },
    "sniffing": {
      "enabled": false
    },
    "allocate": {
      "strategy": "always"
    }
  }],
  "outbounds": [
    {
      "protocol": "freedom",
      "settings": {},
      "tag": "direct"
    },
    {
      "protocol": "blackhole",
      "settings": {},
      "tag": "blocked"
    }
  ],
  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules":[
      {
        "type": "field",
        "ip": [ "geoip:private" ],
        "outboundTag": "blocked"
      }
    ]
  },
  "dns": {
    "servers": [
      "https://1.1.1.1/dns-query",
      "https://8.8.8.8/dns-query",
      "localhost"
    ]
  },
  "policy": {},
  "other": {}
}
EOF

sudo docker restart v2ray

Xray

vless + tcp + xtls

https://xtls.github.io/

https://github.com/XTLS/Xray-core

https://hub.docker.com/r/teddysun/xray

https://github.com/XTLS/Xray-examples/blob/main/VLESS-TCP-XTLS-WHATEVER/config_server.json

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
sudo docker run -d --name xray --network=host --restart=always -v /etc/xray:/etc/xray -e TZ=Asia/Shanghai teddysun/xray

sudo tee /etc/xray/config.json << EOF
{
    "log": {
        "loglevel": "error"
    },
    "api": {
        "tag": "api"
    },
    "inbounds": [
        {
            "port": 8446,
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "id": "4dbb3422-14e9-4ab6-a3ab-18edafaf5172",
                        "flow": "xtls-rprx-direct",
                        "level": 1,
                        "email": "[email protected]"
                    }
                ],
                "decryption": "none",
                "fallbacks": [
                    {
                        "dest": 80
                    }
                ]
            },
            "streamSettings": {
                "network": "tcp",
                "security": "xtls",
                "xtlsSettings": {
                    "alpn": [
                        "http/1.1"
                    ],
                    "certificates": [
                        {
                            "certificateFile": "/etc/xray/ssl/fullchain.pem",
                            "keyFile": "/etc/xray/ssl/privkey.pem"
                        }
                    ]
                }
            },
            "sniffing": {
                "enabled": false
            },
            "allocate": {
                "strategy": "always"
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "freedom"
        },
        {
            "protocol": "blackhole",
            "tag": "blocked"
        }
    ],
    "routing": {
        "domainStrategy": "IPIfNonMatch",
        "rules": [
            {
                "type": "field",
                "ip": [ "geoip:private" ],
                "outboundTag": "blocked"
            }
        ]
    },
    "dns": {
        "servers": [
            "https://1.1.1.1/dns-query",
            "https://8.8.8.8/dns-query",
            "localhost"
        ]
    }
}
EOF

sudo mkdir /etc/xray/ssl

sudo tee /etc/letsencrypt/renewal-hooks/deploy/xray.sh << EOF
#!/bin/bash
cp /etc/letsencrypt/live/yanyong.cc/{privkey.pem,fullchain.pem} /etc/xray/ssl/
chmod 400 /etc/xray/ssl/*
docker restart xray
EOF

sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/xray.sh
sudo /etc/letsencrypt/renewal-hooks/deploy/xray.sh

nginx配置

http://nginx.org/en/docs/stream/ngx_stream_ssl_preread_module.html

http://nginx.org/en/docs/http/ngx_http_core_module.html#listen

https://www.chengxiaobai.com/trouble-maker/trojan-shared-443-port-scheme#more

1
2
sudo mkdir /etc/nginx/stream.d
echo 'include /etc/nginx/stream.d/*.conf;' | sudo tee -a /etc/nginx/nginx.conf

编辑文件/etc/nginx/sites-enabled/v.yanyong.cc，内容如下：

server {
    listen                  8445 ssl http2; 
    server_name             v.yanyong.cc;

    # SSL
    ssl_certificate         /etc/letsencrypt/live/yanyong.cc/fullchain.pem;
    ssl_certificate_key     /etc/letsencrypt/live/yanyong.cc/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/yanyong.cc/chain.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    # logging
    access_log              /var/log/nginx/v.yanyong.cc.access.log;
    error_log               /var/log/nginx/v.yanyong.cc.error.log warn;

    # WebSocket proxy
    location /abcdefg {
        proxy_pass http://127.0.0.1:16801;
        proxy_redirect off;
        proxy_http_version                 1.1;
        proxy_cache_bypass                 $http_upgrade;

        # Proxy headers
        proxy_set_header Upgrade           $http_upgrade;
        proxy_set_header Connection        "upgrade";
        proxy_set_header Host              $host;
    }

    # reverse proxy
    location / {
        #return 301 https://yanyong.cc$request_uri;
        proxy_pass http://127.0.0.1;
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
sudo tee /etc/nginx/stream.d/sni.conf << EOF
stream{
    #SNI，将域名映射到一个配置名
    map \$ssl_preread_server_name \$backend_name {
        t.yanyong.cc trojan;
        tg.yanyong.cc trojan-go;
        v.yanyong.cc v2ray;
        x.yanyong.cc xray;
        default web;
    }

    upstream trojan {
        server 127.0.0.1:8443;
    }

    upstream trojan-go {
        server 127.0.0.1:8444;
    }

    upstream v2ray {
        server 127.0.0.1:8445;
    }

    upstream xray {
        server 127.0.0.1:8446;
    }

    upstream web {
        server 127.0.0.1:80;
    }

    server {
        listen 443 reuseport;
        proxy_pass \$backend_name;
        ssl_preread on;
    }
}
EOF

sudo nginx -t && sudo nginx -s reload

梯子，懂的都懂不解释

Contents

基础配置

初始化OS

fail2ban

安装docker和nginx

ssl泛域名证书和cloudflare

BBR and TFO

trojan

trojan-go

v2ray

Xray

nginx配置