From a93c50e81011c2fc66b007ad2c998bccdacbaa8b Mon Sep 17 00:00:00 2001 From: yumoqing Date: Mon, 1 Dec 2025 22:40:58 +0800 Subject: [PATCH] bugfix --- README.md | 3 + scripts/gateway.sh.j2 | 39 ++++++++- scripts/gfw_rules_generator.py | 2 +- scripts/redsocks.sh.j2 | 151 +++++++++++++++++++++++++++++++++ 4 files changed, 193 insertions(+), 2 deletions(-) create mode 100755 scripts/redsocks.sh.j2 diff --git a/README.md b/README.md index 94857f3..9186756 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,8 @@ # softroute +## 依赖 +* [redsocks2](https://github.com/kaizushi/redsocks2) +* [dnsmasq](https://github.com/poseidon/dnsmasq.git) ## 物理机软路由环境 ### 实现的能力： diff --git a/scripts/gateway.sh.j2 b/scripts/gateway.sh.j2 index 4d1e637..d65a7cb 100644 --- a/scripts/gateway.sh.j2 +++ b/scripts/gateway.sh.j2 @@ -81,9 +81,14 @@ sudo systemctl disable systemd-resolved sudo rm /etc/resolv.conf # 创建新的 resolv.conf 文件，将本机地址作为唯一的 DNS 服务器 echo "nameserver 127.0.0.1" | sudo tee /etc/resolv.conf > /dev/null +sudo mkdir -p --mode=0755 /usr/share/keyrings +curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg > /dev/null + +cat </dev/null +deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared jammy main +EOF log_info "开始网关主机配置脚本..." - log_info "更新系统软件包列表..." sudo apt update || log_error "apt update 失败。" @@ -96,6 +101,7 @@ install_package iptables-persistent install_package ipset install_package dnsmasq install_package redsocks +install_package cloudflared install_package git install_package python3-pip install_package isc-dhcp-server # 新增 DHCP 服务器安装 @@ -217,6 +223,31 @@ if ! ss -tnlp | grep ":${LOCAL_SOCKS5_PORT}" &>/dev/null; then fi log_info "SSH SOCKS5 代理已通过 Systemd 启动，并在 127.0.0.1:${LOCAL_SOCKS5_PORT} 监听，支持自动重连。" +cat < 1. 安装依赖" +if command -v apt &>/dev/null; then + apt update -y + apt install -y git gcc make libevent-dev iptables ipset curl +elif command -v yum &>/dev/null; then + yum install -y git gcc make libevent-devel iptables ipset curl +else + echo "仅支持 apt/yum 系"; exit 1 +fi + +# ---------- 3. 写 redsocks 配置 ---------- +cat > $REDSOCKS_CONF < 3. 创建 ipset 国外 IP 集合" +modprobe xt_set 2>/dev/null || true +ipset create oversea hash:net maxelem 65536 2>/dev/null || true + +# 懒人方案：直接拉 chnroute 反向列表（国外 IP） +echo " 下载 chnroute 反向列表…" +cat /d/ymq/data/ip_list.txt | \ + sed 's/^/-A oversea /' | ipset restore -! 2>/dev/null || { + echo " 下载失败，改用静态默认全网国外(0.0.0.0/1+128.0.0.0/1)" + ipset add oversea 0.0.0.0/1 + ipset add oversea 128.0.0.0/1 +} + +# ---------- 5. 打开内核转发 ---------- +echo "==> 4. 打开内核转发" +sysctl -w net.ipv4.ip_forward=1 +grep -q '^net.ipv4.ip_forward' /etc/sysctl.conf && \ + sed -i 's/^net.ipv4.ip_forward.*/net.ipv4.ip_forward = 1/' /etc/sysctl.conf || \ + echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf + +# ---------- 6. 写 iptables 规则 ---------- +echo "==> 5. 配置 iptables" +# 清理旧链（可重复执行） +iptables -t nat -F REDSOCKS2 2>/dev/null || iptables -t nat -N REDSOCKS2 +iptables -t mangle -F REDSOCKS2 2>/dev/null || iptables -t mangle -N REDSOCKS2 + +# 忽略代理自身 → socks5 的流量 +iptables -t nat -A REDSOCKS2 -d $SOCKS_IP -j RETURN +# 忽略局域网 +iptables -t nat -A REDSOCKS2 -d 192.168.0.0/16 -j RETURN +iptables -t nat -A REDSOCKS2 -d 10.0.0.0/8 -j RETURN +iptables -t nat -A REDSOCKS2 -d 172.16.0.0/12 -j RETURN +# 忽略回环 +iptables -t nat -A REDSOCKS2 -d 127.0.0.0/8 -j RETURN + +# 对国外 IP 重定向到 redsocks 61086 +iptables -t nat -A REDSOCKS2 -m set --match-set oversea dst -p tcp \ + -j REDIRECT --to-ports 61086 + +# 桥接到 PREROUTING（转发） 和 OUTPUT（本机） +iptables -t nat -A PREROUTING -i $LAN_IF -j REDSOCKS2 +iptables -t nat -A OUTPUT -j REDSOCKS2 + +# UDP 透明（TPROXY） +iptables -t mangle -A REDSOCKS2 -m set --match-set oversea dst -p udp \ + -j TPROXY --on-port 61086 --on-ip 0.0.0.0 --tproxy-mark 0x29a +iptables -t mangle -A PREROUTING -i $LAN_IF -j REDSOCKS2 +# 让被打标记的包走本地转发 +ip rule add fwmark 0x29a lookup 100 2>/dev/null || true +ip route add local default dev lo table 100 2>/dev/null || true + +# NAT 普通国内流量 +iptables -t nat -A POSTROUTING -s $LAN_NET -o $LAN_IF -j MASQUERADE + +# ---------- 7. 启动 redsocks ---------- +echo "==> 6. 启动 redsocks 并设置开机自启" +cat > /etc/systemd/system/redsocks.service < 7. 保存 iptables 规则" +if command -v netfilter-persistent &>/dev/null; then + netfilter-persistent save +elif command -v iptables-save &>/dev/null; then + iptables-save > /etc/iptables.rules + grep -q 'iptables-restore' /etc/rc.local || \ + echo "iptables-restore < /etc/iptables.rules" >> /etc/rc.local +fi + +echo +echo "================ 部署完成 ================" +echo "网关地址：192.168.16.2 掩码：255.255.255.0" +echo "DHCP 或手动指定网关/DNS 为 192.168.16.2 即可上网" +echo "国外 IP 流量已自动走 socks5 $SOCKS_IP:$SOCKS_PORT" +echo "查看状态：systemctl status redsocks" +echo "================================================" +