透明代理

本文是参考 V2RAY 官方文档进行编写的，详见： https://toutyrater.github.io/app/tproxy.html

再此做个记录，仅包含使用 TPROXY 的方式。

依赖

• [X] v2ray: 到 Release 页面下载最新版本，然后安装
• [X] wget
• [X] bind9-dnsutils: 安装 nslookup
• [X] jp
• [X] iptables
• [X] procps: 安装 sysctl
• [ ] net-tools: 可选，安装 netstat
• [ ] clash 到 Release 页面进行下载

  安装到 /usr/local/bin

• [ ] clash country db 到 Release 页面进行下载

  安装到 /usr/local/etc/clash

安装

# 拷贝配置文件
sudo mkdir -p /etc/transparent-v2ray
sudo cp ./simple/etc-transparent-v2ray/config.json /etc/transparent-v2ray/
# 拷贝 v2ray 配置文件
sudo mkdir -p /etc/v2ray
sudo cp ./simple/etc-2ray.client/v2ray.json /etc/v2ray/

# 拷贝 service 文件
sudo cp ./simple/systemd-service/[email protected] /lib/systemd/system/
sudo cp ./simple/systemd-service/transparent_v2ray.service /lib/systemd/system/
sudo systemctl daemon-reload

# 拷贝主脚本
sudo cp ./transparent_v2ray.sh /usr/local/bin/transparent_v2ray
sudo chmod +x /usr/local/bin/transparent_v2ray

完成上述文件安装后，根据实际配置修改 /etc/v2ray/v2ray.json 和 /etc/transparent-v2ray/config.json 文件。 然后执行 sudo systemctl start transparent_v2ray.service 进行测试，如果一切正常则执行 sudo systemctl enable transparent_v2ray.service 设置开机自启。如果运行结果异常，请自行检查配置。

使用

• sudo transparent_v2ray start: 启动服务
• sudo transparent_v2ray stop: 停止服务
• sudo transparent_v2ray restart: 重启服务
• sudo transparent_v2ray update-v2ray-geoip: 更新 v2ray 的 geoip.dat 和 geosite.dat

配置说明

Tranparent Proxy Config

透明代理的配置文件比较简单，这里介绍下：

• server: 代理服务器域名或地址
• proxy_start: 透明代理启动命令
• proxy_stop: 透明代理关闭命令
• local_port: 透明代理本地监听端口

V2ray Proxy Config

inbounds

在流量来源 inbounds 里，主要需要添加 protocol 为 dokodemo-door 段，这段设置了透明代理的端口、代理方式、网络协议等内容。

特别需要注意的是 followRedirect 必须为 true ， tpoxy 的值必须为 tproxy ，另外建议开启 sniffing 的设置，路由无法匹配域名。

示例配置如下：

{
    "port": 1083,
    "tag": "transparent",
    "protocol": "dokodemo-door",
    "settings": {
        "network": "tcp,udp",
        "followRedirect": true
    },
    "sniffing": {
        "enabled": true,
        "destOverride": ["http", "tls"]
    },
    "streamSettings": {
        "sockopt": {
            "tproxy": "tproxy"
        }
    }
}

outbounds

outbounds 主要配置流量出口方式，这里配置了四种，分别是：

• vmess: 填写代理服务器的配置信息， v2ray.json 中是 ws 的示例配置
• freedom: 直连的配置，通过 ip 进行区分
• blackhole: 屏蔽广告的配置，针对 http 类型的流量
• dns: dns 出口配置

dns

dns 主要配置 dns 查询规则，这里国内使用 225.5.5.5 和 114.114.114.114 查询，国外使用 8.8.8.8 和 1.1.1.1 进行查询。

另外对 223.5.5.5 进行了特殊配置， geosite:cn 和 ntp.org 会优先使用

routing

routing 配置了路由规则，主要是国内、国外流量的设置，如下：

• domainStrategy

  域名策略，可用值为：

  • AsIs

    只使用域名进行路由选择，默认值。其分流速度快，但不够精确。

  • IPIfNonMatch

    当域名没有匹配到任何规则时，将域名解析成 IP 后再次进行匹配。

    • 当一个域名有多个 A 记录时，会尝试匹配所有的 A 记录，直到其中一个与某个规则匹配为止；
    • 解析后的 IP 仅在路由选择时起作用，转发的数据包中依然使用原始域名;

    牺牲了部分速度，但提升了分流的精确度，推荐使用。

  • IPOnDemand

    匹配时碰到任何基于 IP 的规则，立即将域名解析成 IP 后进行匹配。 最为准确，但速度慢，并且精准度相对于 IPIfNonMatch 提升不明显，不推荐使用。

• port: 53

  这是 dns 端口，转发到 dns-out

• port: 123

  这是 ntp 端口，直接访问，不做代理。这是为了保证 ntp 服务能够正常，避免因时间误差大导致服务端拒绝连接

• ip

  两个 ip 段的配置，分别指定了域名解析服务的访问方式，国内的直连，国外的代理

• category-ads-all

  设置了广告的访问方式，转发到 block

• bittorrent

  设置了 bt 链接的访问方式，直连

• geoip

  private 和 cn 的 ip 走直连

• geosite

  cn 国内域名走直连

clash 配置

参考：Clash Configuration ，这里给出两个例子：

自定义节点

tproxy-port: 7893

# Set to true to allow connections to the local-end server from
# other LAN IP addresses
allow-lan: false

# This is only applicable when `allow-lan` is `true`
# '*': bind all IP addresses
# 192.168.122.11: bind a single IPv4 address
# "[aaaa::a8aa:ff:fe09:57d8]": bind a single IPv6 address
bind-address: '*'

# Clash router working mode
# rule: rule-based packet routing
# global: all packets will be forwarded to a single endpoint
# direct: directly forward the packets to the Internet
mode: rule

# Clash by default prints logs to STDOUT
# info / warning / error / debug / silent
log-level: error

# When set to false, resolver won't translate hostnames to IPv6 addresses
ipv6: false

# fwmark on Linux only
routing-mark: 255

profile:
  # Store the `select` results in $HOME/.config/clash/.cache
  # set false If you don't want this behavior
  # when two different configurations have groups with the same name, the selected values are shared
  store-selected: false

  # persistence fakeip
  store-fake-ip: true

# DNS server settings
# This section is optional. When not present, the DNS server will be disabled.
dns:
  enable: false
  listen: 0.0.0.0:53
  # ipv6: false # when the false, response to AAAA questions will be empty

  # These nameservers are used to resolve the DNS nameserver hostnames below.
  # Specify IP addresses only
  default-nameserver:
    - 114.114.114.114
    - 8.8.8.8
  enhanced-mode: fake-ip # or redir-host (not recommended)
  fake-ip-range: 198.18.0.1/16 # Fake IP addresses pool CIDR
  # use-hosts: true # lookup hosts and return IP record

  # Hostnames in this list will not be resolved with fake IPs
  # i.e. questions to these domain names will always be answered with their
  # real IP addresses
  # fake-ip-filter:
  #   - '*.lan'
  #   - localhost.ptlogin2.qq.com

  # Supports UDP, TCP, DoT, DoH. You can specify the port to connect to.
  # All DNS questions are sent directly to the nameserver, without proxies
  # involved. Clash answers the DNS question with the first result gathered.
  nameserver:
    - 114.114.114.114 # default value
    - 8.8.8.8 # default value
    - tls://dns.rubyfish.cn:853 # DNS over TLS
    - https://1.1.1.1/dns-query # DNS over HTTPS
    - dhcp://en0 # dns from dhcp
    # - '8.8.8.8#en0'

proxies:
  - name: "ss"
    type: ss
    server: server
    port: 443
    cipher: chacha20-ietf-poly1305
    password: "password"
    plugin: v2ray-plugin
    plugin-opts:
      mode: websocket # no QUIC now
      # tls: true # wss
      # skip-cert-verify: true
      # host: bing.com
      # path: "/"
      # mux: true
      # headers:
      #   custom: value

  # vmess
  # cipher support auto/aes-128-gcm/chacha20-poly1305/none
  - name: "vmess"
    type: vmess
    server: server
    port: 443
    uuid: uuid
    alterId: 32
    cipher: auto
    # udp: true
    tls: true
    # skip-cert-verify: true
    # servername: example.com # priority over wss host
    network: ws
    ws-opts:
      path: /path
    #   headers:
    #     Host: v2ray.com
    #   max-early-data: 2048
    #   early-data-header-name: Sec-WebSocket-Protocol

proxy-groups:
  # url-test select which proxy will be used by benchmarking speed to a URL.
  - name: "auto"
    type: fallback
    proxies:
      - ss
      - vmess
    # tolerance: 150
    # lazy: true
    url: 'http://www.gstatic.com/generate_204'
    interval: 300

rules:
  - DOMAIN-SUFFIX,google.com,auto
  - DOMAIN-KEYWORD,google,auto
  - DOMAIN,google.com,auto
  - DOMAIN-SUFFIX,github.io,auto
  - DOMAIN-SUFFIX,github.com,auto
  - DOMAIN-KEYWORD,github,auto
  - DOMAIN,github.com,auto
  - DOMAIN-SUFFIX,ad.com,REJECT
  - SRC-IP-CIDR,192.168.1.201/32,DIRECT
  # optional param "no-resolve" for IP rules (GEOIP, IP-CIDR, IP-CIDR6)
  - IP-CIDR,127.0.0.0/8,DIRECT
  - GEOIP,CN,DIRECT
  - DST-PORT,80,DIRECT
  - SRC-PORT,7777,DIRECT
  - MATCH,auto

订阅链接

tproxy-port: 7893

# Set to true to allow connections to the local-end server from
# other LAN IP addresses
allow-lan: false

# This is only applicable when `allow-lan` is `true`
# '*': bind all IP addresses
# 192.168.122.11: bind a single IPv4 address
# "[aaaa::a8aa:ff:fe09:57d8]": bind a single IPv6 address
bind-address: '*'

# Clash router working mode
# rule: rule-based packet routing
# global: all packets will be forwarded to a single endpoint
# direct: directly forward the packets to the Internet
mode: rule

# Clash by default prints logs to STDOUT
# info / warning / error / debug / silent
log-level: info

# When set to false, resolver won't translate hostnames to IPv6 addresses
ipv6: false

# fwmark on Linux only
routing-mark: 255

profile:
  # Store the `select` results in $HOME/.config/clash/.cache
  # set false If you don't want this behavior
  # when two different configurations have groups with the same name, the selected values are shared
  store-selected: false

  # persistence fakeip
  store-fake-ip: true

# DNS server settings
# This section is optional. When not present, the DNS server will be disabled.
dns:
  enable: false
  listen: 0.0.0.0:53
  # ipv6: false # when the false, response to AAAA questions will be empty

  # These nameservers are used to resolve the DNS nameserver hostnames below.
  # Specify IP addresses only
  default-nameserver:
    - 114.114.114.114
    - 8.8.8.8
  enhanced-mode: fake-ip # or redir-host (not recommended)
  fake-ip-range: 198.18.0.1/16 # Fake IP addresses pool CIDR
  # use-hosts: true # lookup hosts and return IP record

  # Hostnames in this list will not be resolved with fake IPs
  # i.e. questions to these domain names will always be answered with their
  # real IP addresses
  # fake-ip-filter:
  #   - '*.lan'
  #   - localhost.ptlogin2.qq.com

  # Supports UDP, TCP, DoT, DoH. You can specify the port to connect to.
  # All DNS questions are sent directly to the nameserver, without proxies
  # involved. Clash answers the DNS question with the first result gathered.
  nameserver:
    - 114.114.114.114 # default value
    - 8.8.8.8 # default value
    - tls://dns.rubyfish.cn:853 # DNS over TLS
    - https://1.1.1.1/dns-query # DNS over HTTPS
    - dhcp://en0 # dns from dhcp
    # - '8.8.8.8#en0'

proxy-providers:
  provider1:
    type: http
    # 使用 Proxy Provider Converter 转换订阅链接
    # 如：https://proxy-provider-converter-iota-cyan.vercel.app
    url: "url"
    interval: 3600
    path: ./provider1.yaml
    health-check:
      enable: true
      interval: 600
      # lazy: true
      url: http://www.gstatic.com/generate_204

proxy-groups:
  - name: PROXY
    type: select
    use:
      - provider1
    proxies:
      - DIRECT

rules:
  - DOMAIN-SUFFIX,google.com,PROXY
  - DOMAIN-KEYWORD,google,PROXY
  - DOMAIN,google.com,PROXY
  - DOMAIN-SUFFIX,github.io,PROXY
  - DOMAIN-SUFFIX,github.com,PROXY
  - DOMAIN-KEYWORD,github,PROXY
  - DOMAIN,github.com,PROXY
  - DOMAIN-SUFFIX,ad.com,REJECT
  - SRC-IP-CIDR,192.168.1.201/32,DIRECT
  # optional param "no-resolve" for IP rules (GEOIP, IP-CIDR, IP-CIDR6)
  - IP-CIDR,127.0.0.0/8,DIRECT
  - GEOIP,CN,DIRECT
  - DST-PORT,80,DIRECT
  - SRC-PORT,7777,DIRECT
  - MATCH,PROXY

系统规则配置

通过 iptables 配置系统的访问规则，默认是 tcp 和 udp 一起代理。

start_transparent_proxy 函数开启代理， stop_transparent_proxy 函数则关闭代理， check_environment 函数检查运行条件是否满足。

其它细节请直接阅读 ./transparent_v2ray.sh 文件。

代理服务器

依赖

• haveged: 随机数服务
• v2ray: 查看上文
• caddy: 反向代理，从 https://caddyserver.com/download 下载合适的版本，根据自己域名的 dns 服务商决定，如 aliyun 则应该下载 github.com/caddy-dns/lego-deprecated

配置

• v2ray: 配置参见 ./simple/v2ray_server.json ，是一个 ws 的配置
• caddy: 配置参见 ./simple/Caddyfile

参考链接

• 在 Linux 中使用 Clash
• Clash配置proxy-providers实现自由搭配自建及机场节点
• Clash config using proxy-providers and rule-providers
• Proxy Provider Converter