|
|
@@ -0,0 +1,147 @@
|
|
|
+---
|
|
|
+title: "利用 trojan 搭建网络跳转服务"
|
|
|
+date: 2022-09-14T16:30:09+07:00
|
|
|
+draft: true
|
|
|
+---
|
|
|
+
|
|
|
+# trojan
|
|
|
+
|
|
|
+[trojan](https://github.com/trojan-gfw/trojan) is
|
|
|
+an unidentifiable mechanism that helps you bypass GFW.
|
|
|
+
|
|
|
+## 准备材料
|
|
|
+
|
|
|
+1. 一台服务器，带固定 IP (假设为 x.x.x.x)
|
|
|
+2. 一个可管理的域名 (假设为 x.x.com)
|
|
|
+
|
|
|
+## 安装
|
|
|
+
|
|
|
+目前 trojan 仓库的最新版本为 1.16.0，在未来，这个安装方法可能会不适用。
|
|
|
+
|
|
|
+### 安装 SSL 域名证书
|
|
|
+
|
|
|
+1. 解析域名 x.x.com 到 IP x.x.x.x
|
|
|
+2. 安装 LetsEncrypt 证书工具 certbot 或类似工具 `apt install certbot`
|
|
|
+3. 获取域名证书
|
|
|
+
|
|
|
+```shell
|
|
|
+# 如果也同时使用网页服务，则去掉 certonly 选项
|
|
|
+certbot [certonly] --agree-tos --standalone --no-eff-email -m <mail> -d <domain>
|
|
|
+```
|
|
|
+4. 安全配置，主程序 trojan 单独使用属于 certusers 组的 trojan 用户，certusers 组拥有对证书的访问权限。
|
|
|
+
|
|
|
+```shell
|
|
|
+useradd -M trojan # 创建没有 home 的 trojan 用户
|
|
|
+usermod -L trojan # 禁止登录使用终端
|
|
|
+groupadd certusers # 添加用户组
|
|
|
+usermod -aG certusers trojan # 将 trojan 用户加入组
|
|
|
+
|
|
|
+chown -R root:certusers /etc/letsencrypt # 将 letsencrypt 目录所有权交给 certusers 组
|
|
|
+chmod g+x /etc/letsencrypt/archive # 可访问路径 passthrough
|
|
|
+chmod g+x /etc/letsencrypt/live
|
|
|
+chmod g+r /etc/letsencrypt/archive/x.x.com/privkey1.pem # 授予组可读权限
|
|
|
+```
|
|
|
+
|
|
|
+### 安装 trojan
|
|
|
+
|
|
|
+- Arch based system
|
|
|
+
|
|
|
+```shell
|
|
|
+yay -S trojan
|
|
|
+```
|
|
|
+
|
|
|
+- Debian based system
|
|
|
+
|
|
|
+```shell
|
|
|
+apt install trojan
|
|
|
+```
|
|
|
+
|
|
|
+- CentOS
|
|
|
+
|
|
|
+```shell
|
|
|
+cd /opt
|
|
|
+wget https://github.com/trojan-gfw/trojan/releases/download/v1.16.0/trojan-1.16.0-linux-amd64.tar.xz
|
|
|
+tar xf trojan-1.16.0-linux-amd64.tar.xz
|
|
|
+# create config
|
|
|
+mkdir -p /etc/trojan
|
|
|
+cp trojan/config.json /etc/trojan
|
|
|
+vi /lib/systemd/system/trojan.service
|
|
|
+```
|
|
|
+输入以下内容：
|
|
|
+
|
|
|
+```shell
|
|
|
+[Unit]
|
|
|
+Description=trojan
|
|
|
+After=network.target network-online.target nss-lookup.target mysql.service mariadb.service mysqld.service
|
|
|
+
|
|
|
+[Service]
|
|
|
+Type=simple
|
|
|
+StandardError=journal
|
|
|
+User=trojan # 注意为 trojan 用户
|
|
|
+AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
|
+ExecStart=/opt/trojan/trojan -c /etc/trojan/config.json
|
|
|
+ExecReload=/bin/kill -HUP $MAINPID
|
|
|
+Restart=on-failure
|
|
|
+RestartSec=1s
|
|
|
+
|
|
|
+[Install]
|
|
|
+WantedBy=multi-user.target
|
|
|
+```
|
|
|
+
|
|
|
+### 修改 trojan 配置
|
|
|
+
|
|
|
+```json
|
|
|
+{
|
|
|
+ "run_type": "server",
|
|
|
+ "local_addr": "0.0.0.0",
|
|
|
+ "local_port": 443,
|
|
|
+ "remote_addr": "127.0.0.1",
|
|
|
+ "remote_port": 80,
|
|
|
+ "password": [
|
|
|
+ "密码1",
|
|
|
+ "密码2"
|
|
|
+ ],
|
|
|
+...
|
|
|
+ "ssl": {
|
|
|
+ "cert": "/etc/letsencrypt/live/x.x.com/fullchain.pem",
|
|
|
+ "key": "/etc/letsencrypt/live/x.x.com/privkey.pem",
|
|
|
+ }
|
|
|
+...
|
|
|
+}
|
|
|
+```
|
|
|
+
|
|
|
+配置中 `remote_addr` 和 `remote_port` 为非 trojan 协议请求到 443 端口时，转发到的相应的地址。
|
|
|
+
|
|
|
+## 启动服务
|
|
|
+
|
|
|
+```shell
|
|
|
+systemctl start trojan
|
|
|
+```
|
|
|
+
|
|
|
+## 客户端
|
|
|
+
|
|
|
+- Windows v2rayN/Qv2ray
|
|
|
+- Android igniter/v2rayNG
|
|
|
+- Mac ClashX/Qv2ray
|
|
|
+- Linux Qv2ray/Trojan-Qt5
|
|
|
+- iOS OneClick/Leaf/Shadowrocket/PharosPro
|
|
|
+
|
|
|
+## 问题
|
|
|
+
|
|
|
+1. 申请证书时，需要先进行域名解析，并确认 DNS 记录已生效
|
|
|
+2. LetsEncrypt 证书有有效期，可做 cron 任务，定期 renew
|
|
|
+```shell
|
|
|
+0 3 1 * * /usr/bin/certbot renew --quiet # 每月 1 号 凌晨 3 点 renew
|
|
|
+```
|
|
|
+3. 启动 trojan 时，报错 `atal listen tcp 0.0.0.0:443: bind: permission denied`
|
|
|
+
|
|
|
+因为端口在 1024 一下，需要设置
|
|
|
+```shell
|
|
|
+setcap 'cap_net_bind_service=+ep' /opt/trojan/trojan
|
|
|
+```
|
|
|
+4. 客户端连接 443 无法访问，需要在服务器上防火墙放开 443/tcp 端口，或在云服务器后台添加规则放开 443 端口。
|
|
|
+
|
|
|
+## 参考
|
|
|
+
|
|
|
+[k4yt3x](https://k4yt3x.com/trojan-%E5%9C%A8-debian-%E4%B8%8A%E7%9A%84%E5%9F%BA%E7%A1%80%E5%AE%89%E8%A3%85%E4%B8%8E%E9%85%8D%E7%BD%AE/)
|
|
|
+[itlanyan.com](https://itlanyan.com/trojan-clients-download/)
|
joe