| 知乎專欄 | 多維度架構 | 微信號 netkiller-ebook | QQ群:128659835 請註明“讀者” |
install.
$ sudo apt-get install dante-server
configure.
$ sudo vim /etc/danted.conf
$ cat /etc/danted.conf | sed s/^#.*//g | sed -r /^$/d
logoutput: /tmp/socks.log
internal: eth0 port = 1080
external: 172.16.0.1
method: username none #rfc931
clientmethod: none
user.privileged: proxy
user.notprivileged: nobody
user.libwrap: nobody
client pass {
from: 0.0.0.0/0 port 1-65535 to: 0.0.0.0/0
log: connect disconnect error
}
pass {
from: 0.0.0.0/0 to: 0.0.0.0/0
protocol: tcp udp
}
Once the config is complete. Start/Restart dante socks server:
$ sudo /etc/init.d/danted start
check to see if server is listening on 1080
$ netstat -n -a |grep 1080 tcp 0 0 172.16.0.1:1080 0.0.0.0:* LISTEN tcp 0 0 172.16.0.1:1080 10.8.0.6:1485 TIME_WAIT
Make sure the firewall is open.
$ grep socks /etc/services socks 1080/tcp # socks proxy server socks 1080/udp $ sudo ufw allow socks Rule added
SSH Tunnel
internal: 127.0.0.1 port = 1080 ssh -L 1080:localhost:1080 username@yourserver or ssh user@server.com -D 1080 # -D is for Dynamic Port Forwarding.
注意:hpsockd 不支持 socks5
$ sudo apt-get install hpsockd $ sudo cp /usr/share/doc/hpsockd/examples/hpsockd.conf /etc/hpsockd.conf $ sudo vim /etc/hpsockd.conf
@@MYNET@@/@@NETSIZE@@ 替換為 網絡與子網掩碼 如:172.16.0.0/24
$ cat /etc/hpsockd.conf
daemon {
name "sockd";
listen-address { 0.0.0.0; };
directory "/var/cache/hpsockd";
negotiate-file "negot_file"; # must be specified
# inetdsec-file "/var/adm/inetd.sec"; # default is no inetd.sec
# listen {1,252};
# client {1,200};
# pre-fork 1;
# service "socks";
port 1080;
# poll 1m;
# user -2;
user "nobody";
# dns-helper 1;
# flags { };
};
logging {
# facility "daemon";
# level 2;
dump-prefix "sockd.dump"; # if not specified, you get no dumps
usage-log "usage.log"; # if not specified, you get no logging
};
env {
PING="/bin/ping %z";
TRACEROUTE="/usr/sbin/traceroute %z";
};
default {
# timeout 2h;
# setup-timeout 15m;
# bufsize 32768;
};
route {
{ default host }; # must have at least one route
};
method-list {
{ number 0; name "noAuth"; internal; flags 0; };
{ number 2; name "userPass"; internal; flags 0; };
{ number 254; name "v4"; internal; flags 0; };
};
client-method {
{ src { 10.10.0.0/24; }; method { "userPass"; "v4"; "noAuth"; }; };
};
client {
permit traceroute { # Let net 10.10.0.0 traceroute even net 10.10.0.0.
src { 10.10.0.0/24; };
};
deny { # block X traffic
port { 6000-6099; };
};
deny { # Nothing bound for net 10.10.0.0, or private
dest { 10.10.0.0/24; 127/8; 10/8; 172.16/12; 192.168/16; };
};
permit { # give ftp control sessions longer
src { 10.10.0.0/24; };
port { "ftp"; };
timeout 1d;
};
permit { # Let net 10.10.0.0 out
src { 10.10.0.0/24; };
timeout 1h;
};
deny { }; # nuke everyone else (default action)
};
yum install epel-release -y
yum install python2-pip
pip install shadowsocks
cat > /etc/sysctl.d/local.conf << EOF
# max open files
fs.file-max = 51200
# max read buffer
net.core.rmem_max = 67108864
# max write buffer
net.core.wmem_max = 67108864
# default read buffer
net.core.rmem_default = 65536
# default write buffer
net.core.wmem_default = 65536
# max processor input queue
net.core.netdev_max_backlog = 4096
# max backlog
net.core.somaxconn = 4096
# resist SYN flood attacks
net.ipv4.tcp_syncookies = 1
# reuse timewait sockets when safe
net.ipv4.tcp_tw_reuse = 1
# turn off fast timewait sockets recycling
net.ipv4.tcp_tw_recycle = 0
# short FIN timeout
net.ipv4.tcp_fin_timeout = 30
# short keepalive time
net.ipv4.tcp_keepalive_time = 1200
# outbound port range
net.ipv4.ip_local_port_range = 10000 65000
# max SYN backlog
net.ipv4.tcp_max_syn_backlog = 4096
# max timewait sockets held by system simultaneously
net.ipv4.tcp_max_tw_buckets = 5000
# turn on TCP Fast Open on both client and server side
net.ipv4.tcp_fastopen = 3
# TCP receive buffer
net.ipv4.tcp_rmem = 4096 87380 67108864
# TCP write buffer
net.ipv4.tcp_wmem = 4096 65536 67108864
# turn on path MTU discovery
net.ipv4.tcp_mtu_probing = 1
# for high-latency network
net.ipv4.tcp_congestion_control = hybla
# for low-latency network, use cubic instead
# net.ipv4.tcp_congestion_control = cubic
EOF
mkdir -p /etc/shadowsocks/
cat > /etc/shadowsocks/ssserver.json << EOF
{
"server": "0.0.0.0",
"server_port": 8399,
"local_address": "127.0.0.1",
"local_port": 1080,
"password": "netkiller",
"timeout": 300,
"method": "aes-256-cfb",
"fast_open": false
}
EOF
# 啟動
ssserver -c /etc/shadowsocks/ssserver.json -d start
wget -N --no-check-certificate https://raw.githubusercontent.com/wn789/serverspeeder/master/serverspeeder.sh
bash serverspeeder.sh
service serverSpeeder start
service serverSpeeder start #啟動 service serverSpeeder stop #停止 service serverSpeeder reload #重新加載配置 service serverSpeeder restart #重啟 service serverSpeeder status #狀態 service serverSpeeder stats #統計 service serverSpeeder renewLic #更新許可檔案 service serverSpeeder update #更新 chattr -i /serverspeeder/etc/apx* && /serverspeeder/bin/serverSpeeder.sh uninstall -f #卸載
[root@iZj6c39y62jl5b1wmfv6u8Z ~]# ssserver --help usage: ssserver [OPTION]... A fast tunnel proxy that helps you bypass firewalls. You can supply configurations via either config file or command line arguments. Proxy options: -c CONFIG path to config file -s SERVER_ADDR server address, default: 0.0.0.0 -p SERVER_PORT server port, default: 8388 -k PASSWORD password -m METHOD encryption method, default: aes-256-cfb -t TIMEOUT timeout in seconds, default: 300 --fast-open use TCP_FASTOPEN, requires Linux 3.7+ --workers WORKERS number of workers, available on Unix/Linux --forbidden-ip IPLIST comma seperated IP list forbidden to connect --manager-address ADDR optional server manager UDP address, see wiki General options: -h, --help show this help message and exit -d start/stop/restart daemon mode --pid-file PID_FILE pid file for daemon mode --log-file LOG_FILE log file for daemon mode --user USER username to run as -v, -vv verbose mode -q, -qq quiet mode, only show warnings/errors --version show version information Online help: <https://github.com/shadowsocks/shadowsocks>
不適用配置檔案,命令行啟動方法。
ssserver -s ::0 -p 448 -k passw0rd -m aes-256-cfb --user nobody --workers 2 -d start