太详细的不讲了，国内备案域名会被屏蔽 大神的视频教程：https://www.youtube.com/watch?v=SpxTFes1B8U 文档教程：https://bulianglin.com/archives/nicename.html 安装X-UI bash <(curl -Ls https://raw.githubusercontent.com/FranzKafkaYu/x-ui/956bf85bbac978d56c0e319c5fac2d6db7df9564/install.sh) 0.3.4.4 安装好访问方法 ip+端口号密码为自己设置的，进去后，版本选1.8.3客户端大全https://quantumultx.org/all-proxy-client/
1.一键搭建命令代码如下：sudo wget https://ap-guangzhou-1257892306.cos.ap-guangzhou.myqcloud.com/asi/httpsocks5.sh && sh httpsocks5.sh 安装好后默认是sosks5 端口为59395 帐号为 asi 密码为 asihackerhttp代理端口为 59394下面把shell脚本代码贴出来～～～需要修改帐号密码的可以自己修改一下～可能的坑1.centos 8 可能不行～～～2.安全组 防火墙 注意检查～～～#!/bin/bash install_http() { yum install -y squid #安装http代理 cat <<EOF >/etc/squid/squid.conf # # Recommended minimum configuration: # acl manager proto cache_object acl localhost src 127.0.0.1/32 ::1 acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1 # Example rule allowing access from your local networks. # Adapt to list your (internal) IP networks from where browsing # should be allowed acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT # # Recommended minimum Access Permission configuration: # # Only allow cachemgr access from localhost http_access allow manager localhost http_access deny manager # Deny requests to certain unsafe ports http_access deny !Safe_ports # Deny CONNECT to other than secure SSL ports http_access deny CONNECT !SSL_ports # We strongly recommend the following be uncommented to protect innocent # web applications running on the proxy server who think the only # one who can access services on "localhost" is a local user #http_access deny to_localhost # # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS # # Example rule allowing access from your local networks. # Adapt localnet in the ACL section to list your (internal) IP networks # from where browsing should be allowed http_access allow localnet #http_access allow localhost # And finally deny all other access to this proxy #http_access deny all http_access allow all # Squid normally listens to port 3128 #http_port 3128 http_port 59394 via off forwarded_for delete # We recommend you to use at least the following line. hierarchy_stoplist cgi-bin ? # Uncomment and adjust the following to add a disk cache directory. #cache_dir ufs /var/spool/squid 100 16 256 # Leave coredumps in the first cache dir coredump_dir /var/spool/squid # Add any of your own refresh_pattern entries above these. refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 EOF systemctl start squid #开启squid systemctl restart squid #开启squid systemctl enable squid.service #设置开机自动启动 } install_socks5() { wget --no-check-certificate https://raw.github.com/Lozy/danted/master/install.sh -O install_proxy.sh bash install_proxy.sh --port=59395 --user=asi --passwd=asihacker } install_http install_socks5 参考文档：1
之前开源项目要用到 Yarn，安装后发现报错error joi@13.7.0: The engine "node" is incompatible with this module. Expected version ">=8.9.0". Got "6.17.1" 错误joi@13.7.0：引擎“节点”与此模块不兼容。 预期版本“> = 8.9.0”。 得到了“ 6.17.1”这里以11版本为例，以后更新，安装步骤时一致的。下载node安装包到指定目录wget https://npm.taobao.org/mirrors/node/v11.0.0/node-v11.0.0.tar.gz 解压安装包tar -xvf node-v11.0.0.tar.gz 进入目录并安装相关插件cd node-v11.0.0 sudo yum install gcc gcc-c++ 进行默认配置并编译./configure make 编译大概需要半小时左右～之后就可以开始安装sudo make install 之后验证安装node -v 就会发现已经安装完成可以去官网下载对应匹配的版本英文网址：https://nodejs.org/en/download/中文网址：http://nodejs.cn/download/
闲着没事看到个开源项目，需要用到 yarn 1.在 CentOS, Fedora 和 RHEL 操作系统上，可以通过 RPM 包仓库来安装 Yarn。sudo wget https://dl.yarnpkg.com/rpm/yarn.repo -O /etc/yum.repos.d/yarn.repo 如果没有安装 Node.js（查看是否安装node.js用命令：node -v就可以显示版本。安装方法参考CentOS 下安装 Node.js 8.11.3 LTS Version），你应该配置 Node 源仓库：curl --silent --location https://rpm.nodesource.com/setup_6.x | bash - 2.然后运行：sudo yum install yarn 这样就安装完成了。查看yarn版本用命令：yarn --version
搭建V2,一键脚本bash <(curl -s -L https://git.io/v2ray.sh) 为防止github上文件失效，这里做了本地包，两个文件都在压缩包里v2ray搭建直接上传解压后，直接chmod 777 v2ray.sh 给权限，然后一路下一步就行 小飞机搭建两个文件都上传后 chmod 777 vpn.sh 然后会自动安装 点击下载脚本包.zip
#!/bin/bash red='\e[91m' green='\e[92m' yellow='\e[93m' magenta='\e[95m' cyan='\e[96m' none='\e[0m' _red() { echo -e ${red}$*${none}; } _green() { echo -e ${green}$*${none}; } _yellow() { echo -e ${yellow}$*${none}; } _magenta() { echo -e ${magenta}$*${none}; } _cyan() { echo -e ${cyan}$*${none}; } # Root $(id -u) != 0 && echo -e "\n 哎呀……请使用 ${red}root ${none}用户运行 ${yellow}~(^_^) ${none}\n" && exit 1 cmd="apt-get" sys_bit=$(uname -m) case $sys_bit in i[36]86) v2ray_bit="32" caddy_arch="386" ;; 'amd64' | x86_64) v2ray_bit="64" caddy_arch="amd64" ;; *armv6*) v2ray_bit="arm32-v6" caddy_arch="arm6" ;; *armv7*) v2ray_bit="arm32-v7a" caddy_arch="arm7" ;; *aarch64* | *armv8*) v2ray_bit="arm64-v8a" caddy_arch="arm64" ;; *) echo -e " 哈哈……这个 ${red}辣鸡脚本${none} 不支持你的系统。 ${yellow}(-_-) ${none} 备注: 仅支持 Ubuntu 16+ / Debian 8+ / CentOS 7+ 系统 " && exit 1 ;; esac # 笨笨的检测方法 if | $(command -v yum) && $(command -v systemctl) ; then if $(command -v yum) ; then cmd="yum" fi else echo -e " 哈哈……这个 ${red}辣鸡脚本${none} 不支持你的系统。 ${yellow}(-_-) ${none} 备注: 仅支持 Ubuntu 16+ / Debian 8+ / CentOS 7+ 系统 " && exit 1 fi uuid=$(cat /proc/sys/kernel/random/uuid) old_id="e55c8d17-2cf3-b21a-bcf1-eeacb011ed79" v2ray_server_config="/etc/v2ray/config.json" v2ray_client_config="/etc/v2ray/233blog_v2ray_config.json" backup="/etc/v2ray/233blog_v2ray_backup.conf" _v2ray_sh="/usr/local/sbin/v2ray" systemd=true # _test=true transport=( TCP TCP_HTTP WebSocket "WebSocket + TLS" HTTP/2 mKCP mKCP_utp mKCP_srtp mKCP_wechat-video mKCP_dtls mKCP_wireguard QUIC QUIC_utp QUIC_srtp QUIC_wechat-video QUIC_dtls QUIC_wireguard TCP_dynamicPort TCP_HTTP_dynamicPort WebSocket_dynamicPort mKCP_dynamicPort mKCP_utp_dynamicPort mKCP_srtp_dynamicPort mKCP_wechat-video_dynamicPort mKCP_dtls_dynamicPort mKCP_wireguard_dynamicPort QUIC_dynamicPort QUIC_utp_dynamicPort QUIC_srtp_dynamicPort QUIC_wechat-video_dynamicPort QUIC_dtls_dynamicPort QUIC_wireguard_dynamicPort VLESS_WebSocket_TLS ) ciphers=( aes-128-cfb aes-256-cfb chacha20 chacha20-ietf aes-128-gcm aes-256-gcm chacha20-ietf-poly1305 ) _load() { local _dir="/etc/v2ray/233boy/v2ray/src/" . "${_dir}$@" } _sys_timezone() { IS_OPENVZ= if hostnamectl status | grep -q openvz; then IS_OPENVZ=1 fi echo timedatectl set-timezone Asia/Shanghai timedatectl set-ntp true echo "已将你的主机设置为Asia/Shanghai时区并通过systemd-timesyncd自动同步时间。" echo if $IS_OPENVZ ; then echo echo -e "你的主机环境为 ${yellow}Openvz${none} ，建议使用${yellow}v2ray mkcp${none}系列协议。" echo -e "注意：${yellow}Openvz${none} 系统时间无法由虚拟机内程序控制同步。" echo -e "如果主机时间跟实际相差${yellow}超过90秒${none}，v2ray将无法正常通信，请发ticket联系vps主机商调整。" fi } _sys_time() { echo -e "\n主机时间：${yellow}" timedatectl status | sed -n '1p;4p' echo -e "${none}" $IS_OPENV && pause } v2ray_config() { # clear echo while :; do echo -e "请选择 "$yellow"V2Ray"$none" 传输协议 [${magenta}1-${#transport[*]}$none]" echo for ((i = 1; i <= ${#transport[*]}; i++)); do Stream="${transport[$i - 1]}" if "$i" -le 9 ; then # echo echo -e "$yellow $i. $none${Stream}" else # echo echo -e "$yellow $i. $none${Stream}" fi done echo echo "备注1: 含有 [dynamicPort] 的即启用动态端口.." echo "备注2: [utp | srtp | wechat-video | dtls | wireguard] 分别伪装成 [BT下载 | 视频通话 | 微信视频通话 | DTLS 1.2 数据包 | WireGuard 数据包]" echo read -p "$(echo -e "(默认协议: ${cyan}TCP$none)"):" v2ray_transport [ -z "$v2ray_transport" ] && v2ray_transport=1 case $v2ray_transport in [1-9] | [1-2][0-9] | 3[0-3]) echo echo echo -e "$yellow V2Ray 传输协议 = $cyan${transport[$v2ray_transport - 1]}$none" echo "----------------------------------------------------------------" echo break ;; *) error ;; esac done v2ray_port_config } v2ray_port_config() { case $v2ray_transport in 4 | 5 | 33) tls_config ;; *) local random=$(shuf -i20001-65535 -n1) while :; do echo -e "请输入 "$yellow"V2Ray"$none" 端口 ["$magenta"1-65535"$none"]" read -p "$(echo -e "(默认端口: ${cyan}${random}$none):")" v2ray_port [ -z "$v2ray_port" ] && v2ray_port=$random case $v2ray_port in [1-9] | [1-9][0-9] | [1-9][0-9][0-9] | [1-9][0-9][0-9][0-9] | [1-5][0-9][0-9][0-9][0-9] | 6[0-4][0-9][0-9][0-9] | 65[0-4][0-9][0-9] | 655[0-3][0-5]) echo echo echo -e "$yellow V2Ray 端口 = $cyan$v2ray_port$none" echo "----------------------------------------------------------------" echo break ;; *) error ;; esac done if $v2ray_transport -ge 18 && $v2ray_transport -ne 33 ; then v2ray_dynamic_port_start fi ;; esac } v2ray_dynamic_port_start() { while :; do echo -e "请输入 "$yellow"V2Ray 动态端口开始 "$none"范围 ["$magenta"1-65535"$none"]" read -p "$(echo -e "(默认开始端口: ${cyan}10000$none):")" v2ray_dynamic_port_start_input [ -z $v2ray_dynamic_port_start_input ] && v2ray_dynamic_port_start_input=10000 case $v2ray_dynamic_port_start_input in $v2ray_port) echo echo " 不能和 V2Ray 端口一毛一样...." echo echo -e " 当前 V2Ray 端口：${cyan}$v2ray_port${none}" error ;; [1-9] | [1-9][0-9] | [1-9][0-9][0-9] | [1-9][0-9][0-9][0-9] | [1-5][0-9][0-9][0-9][0-9] | 6[0-4][0-9][0-9][0-9] | 65[0-4][0-9][0-9] | 655[0-3][0-5]) echo echo echo -e "$yellow V2Ray 动态端口开始 = $cyan$v2ray_dynamic_port_start_input$none" echo "----------------------------------------------------------------" echo break ;; *) error ;; esac done if $v2ray_dynamic_port_start_input -lt $v2ray_port ; then lt_v2ray_port=true fi v2ray_dynamic_port_end } v2ray_dynamic_port_end() { while :; do echo -e "请输入 "$yellow"V2Ray 动态端口结束 "$none"范围 ["$magenta"1-65535"$none"]" read -p "$(echo -e "(默认结束端口: ${cyan}20000$none):")" v2ray_dynamic_port_end_input [ -z $v2ray_dynamic_port_end_input ] && v2ray_dynamic_port_end_input=20000 case $v2ray_dynamic_port_end_input in [1-9] | [1-9][0-9] | [1-9][0-9][0-9] | [1-9][0-9][0-9][0-9] | [1-5][0-9][0-9][0-9][0-9] | 6[0-4][0-9][0-9][0-9] | 65[0-4][0-9][0-9] | 655[0-3][0-5]) if $v2ray_dynamic_port_end_input -le $v2ray_dynamic_port_start_input ; then echo echo " 不能小于或等于 V2Ray 动态端口开始范围" echo echo -e " 当前 V2Ray 动态端口开始：${cyan}$v2ray_dynamic_port_start_input${none}" error elif [ $lt_v2ray_port ] && [[ ${v2ray_dynamic_port_end_input} -ge $v2ray_port ]]; then echo echo " V2Ray 动态端口结束范围 不能包括 V2Ray 端口..." echo echo -e " 当前 V2Ray 端口：${cyan}$v2ray_port${none}" error else echo echo echo -e "$yellow V2Ray 动态端口结束 = $cyan$v2ray_dynamic_port_end_input$none" echo "----------------------------------------------------------------" echo break fi ;; *) error ;; esac done } tls_config() { echo local random=$(shuf -i20001-65535 -n1) while :; do echo -e "请输入 "$yellow"V2Ray"$none" 端口 ["$magenta"1-65535"$none"]，不能选择 "$magenta"80"$none" 或 "$magenta"443"$none" 端口" read -p "$(echo -e "(默认端口: ${cyan}${random}$none):")" v2ray_port [ -z "$v2ray_port" ] && v2ray_port=$random case $v2ray_port in 80) echo echo " ...都说了不能选择 80 端口了咯....." error ;; 443) echo echo " ..都说了不能选择 443 端口了咯....." error ;; [1-9] | [1-9][0-9] | [1-9][0-9][0-9] | [1-9][0-9][0-9][0-9] | [1-5][0-9][0-9][0-9][0-9] | 6[0-4][0-9][0-9][0-9] | 65[0-4][0-9][0-9] | 655[0-3][0-5]) echo echo echo -e "$yellow V2Ray 端口 = $cyan$v2ray_port$none" echo "----------------------------------------------------------------" echo break ;; *) error ;; esac done while :; do echo echo -e "请输入一个 ${magenta}正确的域名${none}，一定一定一定要正确，不！能！出！错！" read -p "(例如：233blog.com): " domain [ -z "$domain" ] && error && continue echo echo echo -e "$yellow 你的域名 = $cyan$domain$none" echo "----------------------------------------------------------------" break done get_ip echo echo echo -e "$yellow 请将 $magenta$domain$none $yellow 解析到: $cyan$ip$none" echo echo -e "$yellow 请将 $magenta$domain$none $yellow 解析到: $cyan$ip$none" echo echo -e "$yellow 请将 $magenta$domain$none $yellow 解析到: $cyan$ip$none" echo "----------------------------------------------------------------" echo while :; do read -p "$(echo -e "(是否已经正确解析: [${magenta}Y$none]):") " record if -z "$record" ; then error else if [[ "$record" == [Yy] ]]; then domain_check echo echo echo -e "$yellow 域名解析 = ${cyan}我确定已经有解析了$none" echo "----------------------------------------------------------------" echo break else error fi fi done if $v2ray_transport -eq 4 ; then auto_tls_config else caddy=true install_caddy_info="打开" fi if $caddy ; then path_config_ask fi } auto_tls_config() { echo -e " 安装 Caddy 来实现 自动配置 TLS 如果你已经安装 Nginx 或 Caddy $yellow并且..自己能搞定配置 TLS$none 那么就不需要 打开自动配置 TLS " echo "----------------------------------------------------------------" echo while :; do read -p "$(echo -e "(是否自动配置 TLS: [${magenta}Y/N$none]):") " auto_install_caddy if -z "$auto_install_caddy" ; then error else if [[ "$auto_install_caddy" == [Yy] ]]; then caddy=true install_caddy_info="打开" echo echo echo -e "$yellow 自动配置 TLS = $cyan$install_caddy_info$none" echo "----------------------------------------------------------------" echo break elif [[ "$auto_install_caddy" == [Nn] ]]; then install_caddy_info="关闭" echo echo echo -e "$yellow 自动配置 TLS = $cyan$install_caddy_info$none" echo "----------------------------------------------------------------" echo break else error fi fi done } path_config_ask() { echo while :; do echo -e "是否开启 网站伪装 和 路径分流 [${magenta}Y/N$none]" read -p "$(echo -e "(默认: [${cyan}N$none]):")" path_ask -z $path_ask && path_ask="n" case $path_ask in Y | y) path_config break ;; N | n) echo echo echo -e "$yellow 网站伪装 和 路径分流 = $cyan 不想配置 $none" echo "----------------------------------------------------------------" echo break ;; *) error ;; esac done } path_config() { echo while :; do echo -e "请输入想要 ${magenta} 用来分流的路径 $none , 例如 /233blog , 那么只需要输入 233blog 即可" read -p "$(echo -e "(默认: [${cyan}233blog$none]):")" path -z $path && path="233blog" case $path in *[/$]*) echo echo -e " 由于这个脚本太辣鸡了..所以分流的路径不能包含$red / $none或$red $ $none这两个符号.... " echo error ;; *) echo echo echo -e "$yellow 分流的路径 = ${cyan}/${path}$none" echo "----------------------------------------------------------------" echo break ;; esac done is_path=true proxy_site_config } proxy_site_config() { echo while :; do echo -e "请输入 ${magenta}一个正确的 $none ${cyan}网址$none 用来作为 ${cyan}网站的伪装$none , 例如 https://liyafly.com" echo -e "举例...你当前的域名是 $green$domain$none , 伪装的网址的是 https://liyafly.com" echo -e "然后打开你的域名时候...显示出来的内容就是来自 https://liyafly.com 的内容" echo -e "其实就是一个反代...明白就好..." echo -e "如果不能伪装成功...可以使用 v2ray config 修改伪装的网址" read -p "$(echo -e "(默认: [${cyan}https://liyafly.com$none]):")" proxy_site -z $proxy_site && proxy_site="https://liyafly.com" case $proxy_site in *[#$]*) echo echo -e " 由于这个脚本太辣鸡了..所以伪装的网址不能包含$red # $none或$red $ $none这两个符号.... " echo error ;; *) echo echo echo -e "$yellow 伪装的网址 = ${cyan}${proxy_site}$none" echo "----------------------------------------------------------------" echo break ;; esac done } blocked_hosts() { echo while :; do echo -e "是否开启广告拦截(会影响性能) [${magenta}Y/N$none]" read -p "$(echo -e "(默认 [${cyan}N$none]):")" blocked_ad -z $blocked_ad && blocked_ad="n" case $blocked_ad in Y | y) blocked_ad_info="开启" ban_ad=true echo echo echo -e "$yellow 广告拦截 = $cyan开启$none" echo "----------------------------------------------------------------" echo break ;; N | n) blocked_ad_info="关闭" echo echo echo -e "$yellow 广告拦截 = $cyan 关闭 $none" echo "----------------------------------------------------------------" echo break ;; *) error ;; esac done } shadowsocks_config() { echo while :; do echo -e "是否配置 ${yellow}Shadowsocks${none} [${magenta}Y/N$none]" read -p "$(echo -e "(默认 [${cyan}N$none]):") " install_shadowsocks -z "$install_shadowsocks" && install_shadowsocks="n" if [[ "$install_shadowsocks" == [Yy] ]]; then echo shadowsocks=true shadowsocks_port_config break elif [[ "$install_shadowsocks" == [Nn] ]]; then break else error fi done } shadowsocks_port_config() { local random=$(shuf -i20001-65535 -n1) while :; do echo -e "请输入 "$yellow"Shadowsocks"$none" 端口 ["$magenta"1-65535"$none"]，不能和 "$yellow"V2Ray"$none" 端口相同" read -p "$(echo -e "(默认端口: ${cyan}${random}$none):") " ssport [ -z "$ssport" ] && ssport=$random case $ssport in $v2ray_port) echo echo " 不能和 V2Ray 端口一毛一样...." error ;; [1-9] | [1-9][0-9] | [1-9][0-9][0-9] | [1-9][0-9][0-9][0-9] | [1-5][0-9][0-9][0-9][0-9] | 6[0-4][0-9][0-9][0-9] | 65[0-4][0-9][0-9] | 655[0-3][0-5]) if [[ $v2ray_transport == [45] ]]; then local tls=ture fi if $tls && $ssport == "80" || $tls && $ssport == "443" ; then echo echo -e "由于你已选择了 "$green"WebSocket + TLS $none或$green HTTP/2"$none" 传输协议." echo echo -e "所以不能选择 "$magenta"80"$none" 或 "$magenta"443"$none" 端口" error elif | $v2ray_dynamic_port_end_input == $ssport ; then local multi_port="${v2ray_dynamic_port_start_input} - ${v2ray_dynamic_port_end_input}" echo echo " 抱歉，此端口和 V2Ray 动态端口 冲突，当前 V2Ray 动态端口范围为：$multi_port" error elif $v2ray_dynamic_port_start_input -lt $ssport && $ssport -le $v2ray_dynamic_port_end_input ; then local multi_port="${v2ray_dynamic_port_start_input} - ${v2ray_dynamic_port_end_input}" echo echo " 抱歉，此端口和 V2Ray 动态端口 冲突，当前 V2Ray 动态端口范围为：$multi_port" error else echo echo echo -e "$yellow Shadowsocks 端口 = $cyan$ssport$none" echo "----------------------------------------------------------------" echo break fi ;; *) error ;; esac done shadowsocks_password_config } shadowsocks_password_config() { while :; do echo -e "请输入 "$yellow"Shadowsocks"$none" 密码" read -p "$(echo -e "(默认密码: ${cyan}233blog.com$none)"): " sspass [ -z "$sspass" ] && sspass="233blog.com" case $sspass in *[/$]*) echo echo -e " 由于这个脚本太辣鸡了..所以密码不能包含$red / $none或$red $ $none这两个符号.... " echo error ;; *) echo echo echo -e "$yellow Shadowsocks 密码 = $cyan$sspass$none" echo "----------------------------------------------------------------" echo break ;; esac done shadowsocks_ciphers_config } shadowsocks_ciphers_config() { while :; do echo -e "请选择 "$yellow"Shadowsocks"$none" 加密协议 [${magenta}1-${#ciphers[*]}$none]" for ((i = 1; i <= ${#ciphers[*]}; i++)); do ciphers_show="${ciphers[$i - 1]}" echo echo -e "$yellow $i. $none${ciphers_show}" done echo read -p "$(echo -e "(默认加密协议: ${cyan}${ciphers[6]}$none)"):" ssciphers_opt [ -z "$ssciphers_opt" ] && ssciphers_opt=7 case $ssciphers_opt in [1-7]) ssciphers=${ciphers[$ssciphers_opt - 1]} echo echo echo -e "$yellow Shadowsocks 加密协议 = $cyan${ssciphers}$none" echo "----------------------------------------------------------------" echo break ;; *) error ;; esac done pause } install_info() { clear echo echo " ....准备安装了咯..看看有毛有配置正确了..." echo echo "---------- 安装信息 -------------" echo echo -e "$yellow V2Ray 传输协议 = $cyan${transport[$v2ray_transport - 1]}$none" if [[ $v2ray_transport == [45] || $v2ray_transport == 33 ]]; then echo echo -e "$yellow V2Ray 端口 = $cyan$v2ray_port$none" echo echo -e "$yellow 你的域名 = $cyan$domain$none" echo echo -e "$yellow 域名解析 = ${cyan}我确定已经有解析了$none" echo echo -e "$yellow 自动配置 TLS = $cyan$install_caddy_info$none" if $ban_ad ; then echo echo -e "$yellow 广告拦截 = $cyan$blocked_ad_info$none" fi if $is_path ; then echo echo -e "$yellow 路径分流 = ${cyan}/${path}$none" fi elif $v2ray_transport -ge 18 && $v2ray_transport -ne 33 ; then echo echo -e "$yellow V2Ray 端口 = $cyan$v2ray_port$none" echo echo -e "$yellow V2Ray 动态端口范围 = $cyan${v2ray_dynamic_port_start_input} - ${v2ray_dynamic_port_end_input}$none" if $ban_ad ; then echo echo -e "$yellow 广告拦截 = $cyan$blocked_ad_info$none" fi else echo echo -e "$yellow V2Ray 端口 = $cyan$v2ray_port$none" if $ban_ad ; then echo echo -e "$yellow 广告拦截 = $cyan$blocked_ad_info$none" fi fi if [ $shadowsocks ]; then echo echo -e "$yellow Shadowsocks 端口 = $cyan$ssport$none" echo echo -e "$yellow Shadowsocks 密码 = $cyan$sspass$none" echo echo -e "$yellow Shadowsocks 加密协议 = $cyan${ssciphers}$none" else echo echo -e "$yellow 是否配置 Shadowsocks = ${cyan}未配置${none}" fi echo echo "---------- END -------------" echo pause echo } domain_check() { # if $cmd == "yum" ; then # yum install bind-utils -y # else # $cmd install dnsutils -y # fi # test_domain=$(dig $domain +short) # test_domain=$(ping $domain -c 1 -4 | grep -oE -m1 "([0-9]{1,3}\.){3}[0-9]{1,3}") # test_domain=$(wget -qO- --header='accept: application/dns-json' "https://cloudflare-dns.com/dns-query?name=$domain&type=A" | grep -oE "([0-9]{1,3}\.){3}[0-9]{1,3}" | head -1) test_domain=$(curl -sH 'accept: application/dns-json' "https://cloudflare-dns.com/dns-query?name=$domain&type=A" | grep -oE "([0-9]{1,3}\.){3}[0-9]{1,3}" | head -1) if $test_domain != $ip ; then echo echo -e "$red 检测域名解析错误....$none" echo echo -e " 你的域名: $yellow$domain$none 未解析到: $cyan$ip$none" echo echo -e " 你的域名当前解析到: $cyan$test_domain$none" echo echo "备注...如果你的域名是使用 Cloudflare 解析的话..在 Status 那里点一下那图标..让它变灰" echo exit 1 fi } install_caddy() { # download caddy file then install _load download-caddy.sh _download_caddy_file _install_caddy_service caddy_config } caddy_config() { # local email=$(shuf -i1-10000000000 -n1) _load caddy-config.sh # systemctl restart caddy do_service restart caddy } install_v2ray() { $cmd update -y if $cmd == "apt-get" ; then $cmd install -y lrzsz git zip unzip curl wget qrencode libcap2-bin dbus else # $cmd install -y lrzsz git zip unzip curl wget qrencode libcap iptables-services $cmd install -y lrzsz git zip unzip curl wget qrencode libcap fi ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime [ -d /etc/v2ray ] && rm -rf /etc/v2ray # date -s "$(curl -sI g.cn | grep Date | cut -d' ' -f3-6)Z" _sys_timezone _sys_time if $local_install ; then if ! -d $(pwd)/config ; then echo echo -e "$red 哎呀呀...安装失败了咯...$none" echo echo -e " 请确保你有完整的上传 233v2.com 的 V2Ray 一键安装脚本 & 管理脚本到当前 ${green}$(pwd) $none目录下" echo exit 1 fi mkdir -p /etc/v2ray/233boy/v2ray cp -rf $(pwd)/* /etc/v2ray/233boy/v2ray else pushd /tmp git clone https://github.com/233boy/v2ray -b "$_gitbranch" /etc/v2ray/233boy/v2ray --depth=1 popd fi if ! -d /etc/v2ray/233boy/v2ray ; then echo echo -e "$red 哎呀呀...克隆脚本仓库出错了...$none" echo echo -e " 温馨提示..... 请尝试自行安装 Git: ${green}$cmd install -y git $none 之后再安装此脚本" echo exit 1 fi # download v2ray file then install _load download-v2ray.sh _download_v2ray_file _install_v2ray_service _mkdir_dir } config() { cp -f /etc/v2ray/233boy/v2ray/config/backup.conf $backup cp -f /etc/v2ray/233boy/v2ray/v2ray.sh $_v2ray_sh chmod +x $_v2ray_sh v2ray_id=$uuid alterId=0 ban_bt=true if $v2ray_transport -ge 18 && $v2ray_transport -ne 33 ; then v2ray_dynamicPort_start=${v2ray_dynamic_port_start_input} v2ray_dynamicPort_end=${v2ray_dynamic_port_end_input} fi _load config.sh # if $cmd == "apt-get" ; then # cat >/etc/network/if-pre-up.d/iptables <<-EOF # #!/bin/sh # /sbin/iptables-restore < /etc/iptables.rules.v4 # /sbin/ip6tables-restore < /etc/iptables.rules.v6 # EOF # chmod +x /etc/network/if-pre-up.d/iptables # # else # # [ $(pgrep "firewall") ] && systemctl stop firewalld # # systemctl mask firewalld # # systemctl disable firewalld # # systemctl enable iptables # # systemctl enable ip6tables # # systemctl start iptables # # systemctl start ip6tables # fi # systemctl restart v2ray do_service restart v2ray backup_config } backup_config() { sed -i "18s/=1/=$v2ray_transport/; 21s/=2333/=$v2ray_port/; 24s/=$old_id/=$uuid/" $backup if $v2ray_transport -ge 18 && $v2ray_transport -ne 33 ; then sed -i "30s/=10000/=$v2ray_dynamic_port_start_input/; 33s/=20000/=$v2ray_dynamic_port_end_input/" $backup fi if $shadowsocks ; then sed -i "42s/=/=true/; 45s/=6666/=$ssport/; 48s/=233blog.com/=$sspass/; 51s/=chacha20-ietf/=$ssciphers/" $backup fi [[ $v2ray_transport == [45] || $v2ray_transport == 33 ]] && sed -i "36s/=233blog.com/=$domain/" $backup $caddy && sed -i "39s/=/=true/" $backup $ban_ad && sed -i "54s/=/=true/" $backup if $is_path ; then sed -i "57s/=/=true/; 60s/=233blog/=$path/" $backup sed -i "63s#=https://liyafly.com#=$proxy_site#" $backup fi } get_ip() { ip=$(curl -s https://ipinfo.io/ip) -z $ip && ip=$(curl -s https://api.ip.sb/ip) -z $ip && ip=$(curl -s https://api.ipify.org) -z $ip && ip=$(curl -s https://ip.seeip.org) -z $ip && ip=$(curl -s https://ifconfig.co/ip) -z $ip && ip=$(curl -s https://api.myip.com | grep -oE "([0-9]{1,3}\.){3}[0-9]{1,3}") -z $ip && ip=$(curl -s icanhazip.com) -z $ip && ip=$(curl -s myip.ipip.net | grep -oE "([0-9]{1,3}\.){3}[0-9]{1,3}") -z $ip && echo -e "\n$red 这垃圾小鸡扔了吧！$none\n" && exit } error() { echo -e "\n$red 输入错误！$none\n" } pause() { read -rsp "$(echo -e "按 $green Enter 回车键 $none 继续....或按 $red Ctrl + C $none 取消.")" -d $'\n' echo } do_service() { if $systemd ; then systemctl $1 $2 else service $2 $1 fi } show_config_info() { clear _load v2ray-info.sh _v2_args _v2_info _load ss-info.sh } install() { if -f /usr/bin/v2ray/v2ray && -f /etc/v2ray/config.json && -f $backup && -d /etc/v2ray/233boy/v2ray ; then echo echo " 大佬...你已经安装 V2Ray 啦...无需重新安装" echo echo -e " $yellow输入 ${cyan}v2ray${none} $yellow即可管理 V2Ray${none}" echo exit 1 elif -f /usr/bin/v2ray/v2ray && -f /etc/v2ray/config.json && -f /etc/v2ray/233blog_v2ray_backup.txt && -d /etc/v2ray/233boy/v2ray ; then echo echo " 如果你需要继续安装.. 请先卸载旧版本" echo echo -e " $yellow输入 ${cyan}v2ray uninstall${none} $yellow即可卸载${none}" echo exit 1 fi v2ray_config blocked_hosts shadowsocks_config install_info # $caddy && domain_check install_v2ray if | $v2ray_port == "80" ; then if $cmd == "yum" ; then $(pgrep "httpd") && systemctl stop httpd $(command -v httpd) && yum remove httpd -y else $(pgrep "apache2") && service apache2 stop $(command -v apache2) && apt-get remove apache2* -y fi fi $caddy && install_caddy ## bbr _load bbr.sh _try_enable_bbr get_ip config show_config_info } uninstall() { if -f /usr/bin/v2ray/v2ray && -f /etc/v2ray/config.json && -f $backup && -d /etc/v2ray/233boy/v2ray ; then . $backup if $mark ; then _load uninstall.sh else echo echo -e " $yellow输入 ${cyan}v2ray uninstall${none} $yellow即可卸载${none}" echo fi elif -f /usr/bin/v2ray/v2ray && -f /etc/v2ray/config.json && -f /etc/v2ray/233blog_v2ray_backup.txt && -d /etc/v2ray/233boy/v2ray ; then echo echo -e " $yellow输入 ${cyan}v2ray uninstall${none} $yellow即可卸载${none}" echo else echo -e " $red 大胸弟...你貌似毛有安装 V2Ray ....卸载个鸡鸡哦...$none 备注...仅支持卸载使用我 (233v2.com) 提供的 V2Ray 一键安装脚本 " && exit 1 fi } args=$1 _gitbranch=$2 [ -z $1 ] && args="online" case $args in online) #hello world -z $_gitbranch && _gitbranch="master" ;; local) local_install=true ;; *) echo echo -e " 你输入的这个参数 <$red $args $none> ...这个是什么鬼啊...脚本不认识它哇" echo echo -e " 这个辣鸡脚本仅支持输入$green local / online $none参数" echo echo -e " 输入$yellow local $none即是使用本地安装" echo echo -e " 输入$yellow online $none即是使用在线安装 (默认)" echo exit 1 ;; esac clear while :; do echo echo "........... V2Ray 一键安装脚本 & 管理脚本 by 233v2.com .........." echo echo "帮助说明: https://233v2.com/post/1/" echo echo "搭建教程: https://233v2.com/post/2/" echo echo " 1. 安装" echo echo " 2. 卸载" echo if $local_install ; then echo -e "$yellow 温馨提示.. 本地安装已启用 ..$none" echo fi read -p "$(echo -e "请选择 [${magenta}1-2$none]:")" choose case $choose in 1) install break ;; 2) uninstall break ;; *) error ;; esac done
最近研究一个项目，基础环境需要 composer ，看了一下，小机子自带了composer 1，需要更新下面为常见报错处理过程将composer更新到最新版本查看当前安装的版本 composer -v ______ / ____/___ ____ ___ ____ ____ ________ _____ / / / __ \/ __ `__ \/ __ \/ __ \/ ___/ _ \/ ___/ / /___/ /_/ / / / / / / /_/ / /_/ (__ ) __/ / \____/\____/_/ /_/ /_/ .___/\____/____/\___/_/ /_/ Composer version 1.10.13 2020-09-09 11:46:34将composer 更新到最新版本执行命令更新到版本2composer self-update --2 如果报错的--2 的话，说明原版本是2，升级一下就行composer self-update 这里会报错，提示禁用函数 putenvputenv 根据提示Updating to version 2.0.8 (2.x channel). Downloading (100%) Use composer self-update --rollback to return to version 1.10.19 运行命令composer self-update composer 安装成功后，执行 composer install 爆了一堆的错处理过程安装php的 fileinfo 和 Swoole 的扩展删除禁用函数 proc_open 和 putenvcomposer安装多php版本会报错，修改一下php版本号rm -f /usr/bin/php 将默认版本改成73ln -sf /www/server/php/71/bin/php /usr/bin/php 环境要求PHP ≥ 7.2.5 Git Composer MySQL (≥ 5.7) or PostgreSQL (≥ 9.4) 操作第一步：拉取项目git clone https://github.com/111 第二步 安装依赖（在项目目录下拉取） 更改权限为WWWcomposer install 第三部，开始配置php artisan sp:setup 创建秘钥php artisan key:generate 更改.env 配置APP_URL=改为网址 使用队列处理消息，会报错，需要删除禁用函数pcntl_signal无参考文档 .
周末在家摸鱼，给路由器配置个可以直接登录外网的功能 一、安装脚本 下载脚本一键安装l2tp *** wget --no-check-certificate https://raw.githubusercontent.com/teddysun/across/master/l2tp.sh chmod +x l2tp.sh //添加可执行权限 . l2tp.sh 执行脚本 如果非root用户使用su sh 根据提示进行安装 二、服务器启动命令 启动服务 service ipsec start service xl2tpd start 停止服务 service ipsec stop service xl2tpd stop 重启服务 service ipsec restart service xl2tpd restart 分析ipsec的状态 ipsec verify 查看服务是否启动成功 [root@centos7 download]# ps -ef | grep -E "(ipsec|l2tp)" root 4164 1 0 17:32 ? 00:00:00 /usr/sbin/xl2tpd -D root 4461 1 0 17:32 ? 00:00:00 /usr/libexec/ipsec/pluto --leak-detective --config /etc/ipsec.conf --nofork root 4513 3692 0 17:40 pts/4 00:00:00 grep --color=auto -E (ipsec|l2tp) 将启动命令写入到/etc/rc.local中，并查看/etc/rc.local是否为链接文件，如果无法执行需要检查源文件是否有执行权限，用chomod +x添加执行权限。添加完命令之后，服务器每次开机才会自动执行脚本命令将所需的服务开启。 三、管理账号 修改/etc/ppp/chap-secrets文件 [root@centos7 ~]# cat /etc/ppp/chap-secrets # Secrets for authentication using CHAP # client server secret IP addresses jacky l2tpd yourpassword * ** 四、调整网络参数 修改 /etc/sysctl.conf 文件开启路由功能， vi /etc/sysctl.conf 将下面两项找到： net.ipv4.ip_forward = 0 net.ipv4.conf.default.rp_filter = 1 改为： net.ipv4.ip_forward = 1 net.ipv4.conf.default.rp_filter = 0 之后先让修改后的配置生效， sysctl -p iptables修改 root@centos7 ~]# iptables -t nat -A POSTROUTING -s 192.168.17.0/24 -o eth0 -j MASQUERADE [root@centos7 ~]# iptables -I FORWARD -s 192.168.17.0/24 -j ACCEPT [root@centos7 ~]# iptables -I FORWARD -d 192.168.17.0/24 -j ACCEPT [root@centos7 ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere 192.168.17.0/24 ACCEPT all -- 192.168.17.0/24 anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination 将Iptables修改添加到配置文件中，/etc/rc.d/init.d/iptables CentOS7默认没有这个文件，可以将iptables命令写到/etc/rc.local中开机执行。 UDP 500,1701是L2TP的默认通信端口,需要在防火墙，安全组策略这些地方允许其通过。 五、终端连接 支持的终端 win7+win10自带***客户端，andriod自带***客户端等 连接问题解决 1、win10系统 L2TP连接尝试失败:ERROR因为安全层在初始化与远程计算机的协商时遇到了一个处理错误 (1)创建 AllowL2TPWeakCrypto 注册表项，并将其设置为 1 的值。 1. 单击开始，单击运行，键入regedit，然后单击确定 2. 在注册表编辑器中，找到并单击以下注册表子项︰ HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\Parameters 3. 在编辑菜单上，指向新建，然后单击DWORD 值。 4. 键入AllowL2TPWeakCrypto，然后按 enter 键。 5. 在编辑菜单上，单击修改。 6. 在数值数据框中，键入1，然后单击确定。 7. 在文件菜单上，单击退出以退出注册表编辑器。 (2)ProhibitIpSec 注册表项，并将其设置为 0 的值 1.定位注册表HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\Parameters 在“编辑”菜单上，单击“新建”->“DWORD值”在“名称”框中，键入“ProhibitIpSec”在“数值数据”框中，键入“1”，然后单击“确定”（ps: “ProhibitIpSec”=dword:00000000 ;使用RAS的L2TP功能[1=关闭]） 重启服务：IPsec Policy Agent，Routing and Remote Access，Remote Access Connection Manager 2、L2TP 809错误,win10提示l2tp被防火墙等设备不允许通过 有三个服务需要启动（“Remote Access Auto Connection Manager”、“Remote Access Connection Manager”和“Secure Socket Tunneling Protocol Service”）， “Remote Access Auto Connection Manager”服务是手动的，如果未启动，改成自动启动并启动之，后再连接L2TP/IPSec的××× 参考文档 文档1
服务器环境：1，阿里云香港主机2，外网47.52.57.XX 内网172.31.160.200安装步骤：1，安装依赖组件LSZ（一种无损压缩算法），PAM(一种可插入式的身份验证模块)# yum install -y gcc openssl-devel lzo-devel pam-devel 2，网络设置开启内核转发 # vi /etc/sysctl.conf net.ipv4.ip_forward = 1 # sysctl -p 保证vpn地址池可路由出外网(为客户端分配172.16.30.0/24网段ip) iptables -t nat -A POSTROUTING -s 172.16.30.0/24 -o eth0 -j MASQUERADE 设置openvpn服务端口通过 iptables -A INPUT -p UDP --dport 1194 -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 注：阿里云默认不用设置，请在安全组中开始1194端口 3，时间同步客户端和服务器时间不统一将会无法连接 ntpdate asia.pool.ntp.org 4，安装Openvpn服务端wget http://swupdate.openvpn.org/community/releases/openvpn-2.4.3.tar.gz tar zxvf openvpn-2.4.3.tar.gz cd openvpn-2.4.3 ./configure --prefix=/usr/local/openvpn make && make install 5，配置服务端主要有两个部分：生成服务器和客户端所需的各种证书。是编写服务器和客户端所需的配置文件。（1）下载easy-rsa，创建证书(这部分可以参考"easy-rsa 生成Openvpn证书"快速生成所有证书)。Github 源码2.x地址：https://github.com/OpenVPN/easy-rsa/archive/release/2.x.zipcd wget https://github.com/OpenVPN/easy-rsa/archive/release/2.x.zip yum install -y unzip unzip 2.x.zip cp -rf easy-rsa-release-2.x/easy-rsa/ /usr/local/openvpn/ ########创建CA证书######## #cd /usr/local/openvpn/easy-rsa/2.0 #source ./vars #初始化命令，用于设置后续命令所需的相关变量信息 NOTE: If you run ./clean-all, I will be doing a rm -rf on /usr/local/openvpn/easy-rsa/2.0/keys #./clean-all #清除之前创建的所有证书和密钥 #./build-ca #生成CA证书和密钥 Generating a 2048 bit RSA private key ...+++ ...........................................................................+++ writing new private key to 'ca.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [US]:CN State or Province Name (full name) [California]:BJ Locality Name (eg, city) [SanFrancisco]:BJ Organization Name (eg, company) [Fort-Funston]:BJ Organizational Unit Name (eg, section) [MyOrganizationalUnit]:OPS Common Name (eg, your name or your server's hostname) [Fort-Funston CA]:Openvpn_CA Name [EasyRSA]: Email Address [me@myhost.mydomain]: ##我们的CA证书和密钥就已经生成成功了，生成的证书和密码默认均存放在当前目录keys。 [root@localhost 2.0]#ls keys/ ca.crt ca.key index.txt serial ############创建服务端证书############# 命令./build-key-server ServerName来生成客户端证书和密钥 [root@localhost 2.0]#./build-key-server server Generating a 2048 bit RSA private key ............................+++ ....................+++ writing new private key to 'server.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [US]:CN State or Province Name (full name) [California]:BJ Locality Name (eg, city) [SanFrancisco]:BJ Organization Name (eg, company) [Fort-Funston]:BJ Organizational Unit Name (eg, section) [MyOrganizationalUnit]:OPS Common Name (eg, your name or your server's hostname) [server]: Name [EasyRSA]: Email Address [me@myhost.mydomain]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /usr/local/open***/easy-rsa/2.0/openssl-1.0.0.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'CN' stateOrProvinceName :PRINTABLE:'BJ' localityName :PRINTABLE:'BJ' organizationName :PRINTABLE:'BJ' organizationalUnitName:PRINTABLE:'OPS' commonName :PRINTABLE:'server' name :PRINTABLE:'EasyRSA' emailAddress :IA5STRING:'me@myhost.mydomain' Certificate is to be certified until Aug 20 05:16:14 2027 GMT (3650 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated [root@localhost 2.0]#ls ./keys/ 01.pem ca.crt ca.key index.txt index.txt.attr index.txt.old serial serial.old server.crt server.csr server.key ############创建客户端证书############### 命令./build-key clientName来生成客户端证书和密钥 [root@localhost 2.0]#./build-key client1 Generating a 2048 bit RSA private key ........................................................+++ ..................................................+++ writing new private key to 'client1.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [US]:CN State or Province Name (full name) [California]:BJ Locality Name (eg, city) [SanFrancisco]:BJ Organization Name (eg, company) [Fort-Funston]:BJ Organizational Unit Name (eg, section) [MyOrganizationalUnit]:OPS Common Name (eg, your name or your server's hostname) [client1]:Openvpn_Client Name [EasyRSA]: Email Address [me@myhost.mydomain]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /usr/local/openvpn/easy-rsa/2.0/openssl-1.0.0.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'CN' stateOrProvinceName :PRINTABLE:'BJ' localityName :PRINTABLE:'BJ' organizationName :PRINTABLE:'BJ' organizationalUnitName:PRINTABLE:'OPS' commonName :T61STRING:'Client1' name :PRINTABLE:'EasyRSA' emailAddress :IA5STRING:'me@myhost.mydomain' Certificate is to be certified until Aug 20 05:34:01 2027 GMT (3650 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated [root@localhost 2.0]#ls ./keys/ 01.pem 02.pem ca.crt ca.key client1.crt client1.csr client1.key index.txt index.txt.attr index.txt.attr.old index.txt.old serial serial.old server.crt server.csr server.key生成迪菲·赫尔曼交换密钥命令为./build-dh(无需额外输入，耐心等待生成完毕即可)。迪菲·赫尔曼交换密钥是一种安全协议，用以对数据进行加密。./build-dh###########生成TLS-auth密钥############ 这一步骤是可选操作。Openvpn提供了TLS-auth功能，可以用来抵御Dos、UDP端口淹没攻击。出于安全考虑，你可以启用该功能；启用该功能，你需要执行命令openvpn --genkey --secret keys/ta.key来生成TLS-auth所需的密钥文件。 #/usr/local/openvpn/sbin/openvpn --genkey --secret keys/ta.key 到这里，我们的证书生成就告一段落了。如果你以后想要生成新的客户端或执行其他操作，只需要先执行命令. ./vars，然后执行相应的命令即可，例如./build-key client2。 1：CA证书和密钥2：服务器端证书和密钥。3：客户端client1的证书和密钥，4：迪菲·赫尔曼交换密钥 (如果你的KEY_SIZE=1024，则该文件名称为dh1024.pem)。5：启用tls-auth所需的文件。其中，服务器端需要用到的文件有：ca.crt ca.key dh2048.pem (如果最初的变量KEY_SIZE设为1024，这里就是dh1024.pem) server.crt server.key ta.key (如果不开启tls-auth，则无需该文件)客户端client1需要用到的文件有：ca.crt client1.crt client1.key (名称client1根据个人设置可能有所不同) ta.key (如果不开启tls-auth，则无需该文件)（2）编辑服务器所需的配置文件。mkdir -p /usr/local/openvpn/config cd /usr/local/openvpn/config cp /usr/local/openvpn/easy-rsa/2.0/keys/{ca.crt,ca.key,server.crt,server.key,client1.crt,client1.key,dh2048.pem,ta.key} . # ls ca.crt ca.key dh2048.pem server.crt server.key cp /usr/local/openvpn/openvpn-2.4.3/server.conf . mkdir -p /var/log/openvpn #创建日志目录 # vim server.conf port 11944 proto udp dev tun ca /usr/local/openvpn/config/ca.crt cert /usr/local/openvpn/config/server.crt key /usr/local/openvpn/config/server.key dh /usr/local/openvpn/config/dh2048.pem server 172.16.30.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "route 172.16.30.0 255.255.255.0" push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 8.8.8.8" keepalive 10 120 client-to-client comp-lzo persist-key persist-tun status /var/log/openvpn/openvpn-status.log log /var/log/openvpn/openvpn.log log-append /var/log/openvpn/openvpn.log verb 3 explicit-exit-notify 2 #如果需要开启用户名密码验证开启以下 #auth-user-pass-verify /usr/local/openvpn/checkpsw.sh via-env #username-as-common-name #verify-client-cert #script-security 3 port 1194 #指定监听的本机端口号 proto udp #指定采用的传输协议，可以选择tcp或udp dev tun #指定创建的通信隧道类型，可选tun或tap，前者工作在三层（TCP/IP），后者工作2层(链路层) ca /usr/local/openvpn/config/ca.crt #指定CA证书的文件路径 cert /usr/local/openvpn/config/server.crt #指定服务器端的证书文件路径 key /usr/local/openvpn/config/server.key #指定服务器端的私钥文件路径 dh /usr/local/openvpn/config/dh2048.pem #指定迪菲赫尔曼参数的文件路径 server 172.16.100.0 255.255.255.0 #指定虚拟局域网占用的IP地址段和子网掩码，此处配置的服务器自身占用10.0.0.1。 ifconfig-pool-persist ipp.txt #服务器自动给客户端分配IP后，客户端下次连接时，仍然采用上次的IP地址(第一次分配的IP保存在ipp.txt中，下一次分配其中保存的IP)。 push "redirect-gateway def1 bypass-dhcp" #如果启用，该命令将配置所有客户端通过vpn重定向其默认＃网络网关，导致所有IP流量（如Web浏览和＃和DNS查找）通过vpnpush "dhcp-option DNS 8.8.8.8" #给客户端推送DNS #tls-auth /usr/local/open***/config/ta.key 0 #开启TLS-auth，使用ta.key防御攻击。服务器端的第二个参数值为0，客户端的为1。 keepalive 10 120 #每10秒ping一次，连接超时时间设为120秒。 comp-lzo #开启vpn连接压缩，如果服务器端开启，客户端也必须开启 client-to-client #允许客户端与客户端相连接，默认情况下客户端只能与服务器相连接 persist-key persist-tun #持久化选项可以尽量避免访问在重启时由于用户权限降低而无法访问的某些资源。 status /var/log/openvpn/openvpn-status.log log /var/log/openvpn/openvpn.log log-append /var/log/openvpn/openvpn.log #日志保存路径 verb 4 #指定日志文件的记录详细级别，可选0-9，等级越高日志内容越详细 explicit-exit-notify 2 #服务端重启，客户端自动重连 注意1,push "redirect-gateway def1 bypass-dhcp" 如果启用，该命令将配置所有客户端通过vpn重定向其默认网络网关，导致所有IP流量通过VPN。 2，client-config-dir ccd #指定文件，对客户端进行细粒度配置（单独给某个客户端推送路由等）。 3，TUN和TAP不一样，TUN是点对点的三层设备，工作在IP层，处理IP分组（本文采用tun方式，有兴趣可以尝试tap方式）；TAP是虚拟以太网设备，工作在第二层，处理以太网帧。 6，启动Open/usr/local/openvpn/sbin/openvpn /usr/local/openvpn/openvpn-2.4.3/server.conf & 如有错误请查看日志 tail -f /var/log/openvpn/openvpn.log 遇到的小坑生成ta密钥文件# openvpn --genkey --secret /etc/openvpn/easy-rsa/ta.key 不执行此命令，会报错：Sat Apr 7 12:53:37 2018 WARNING: cannot stat file 'ta.key': No such file or directory (errno=2) Options error: --tls-auth fails with 'ta.key': No such file or directory (errno=2) Options error: Please correct these errors. Use --help for more information.
『原创』Shadowsocks Brook 中继(中转/端口转发) 便捷管理脚本
前天写了个 Brook 的端口转发手动安装使用教程，，最近忙，拖了几天才有空写了个一键管理脚本。优点是：安装、配置简单，支持TCP、UDP转发；缺点是：不支持端口段转发，但是可以配置多个端口转发。Brook 端口转发手动教程：Shadowsocks利用 Brook 实现中继(中转/端口转发)加速其他 Shadowsocks中继（中转）教程：传送门系统要求CentOS 6+ / Debian 6+ / Ubuntu 14.04 + 脚本版本Ver: 1.0.6 安装步骤wget -N --no-check-certificate https://raw.githubusercontent.com/ToyoDAdoubiBackup/doubi/master/brook-pf.sh && chmod +x brook-pf.sh && bash brook-pf.sh 下载并运行脚本后，会显示操作菜单，输入 1 并回车就会开始安装。使用方法bash brook-pf.sh 运行脚本后会显示操作菜单： Brook 端口转发 一键管理脚本 [vX.X.X] ---- Toyo | doub.io/wlzy-jc37 ---- 0. 升级脚本 ———————————— 1. 安装 Brook 2. 升级 Brook 3. 卸载 Brook ———————————— 4. 启动 Brook 5. 停止 Brook 6. 重启 Brook ———————————— 7. 设置 Brook 端口转发 8. 查看 Brook 端口转发 9. 查看 Brook 日志 10. 监控 Brook 运行状态 ———————————— 当前状态: 已安装 但 未启动 请输入数字 [0-10]: 添加端口转发输入 7 并回车后，会提示你选择要干什么：你要做什么？ 1. 添加 端口转发 2. 删除 端口转发 3. 修改 端口转发 4. 启用/禁用 端口转发 [注意] 本地监听端口不能重复，被转发的IP或端口可重复! (默认: 取消) 输入 1 并回车后，会提示你依次输入 本地监听端口、被转发IP、被转发端口：点击展开 查看更多请输入 Brook 本地监听端口 [1-65535]（端口不能重复，避免冲突） (默认取消):2366 ======================== 本地监听端口 : 2333 ======================== 请输入被转发的 IP : (默认取消):1.1.1.1 ======================== 被转发IP : 1.1.1.1 ======================== 请输入 Brook 被转发的端口 [1-65535] (默认取消):2366 ======================== 被转发端口 : 2366 ======================== 立即启用该端口转发，还是禁用？ [Y/n] (默认: Y 启用): [信息] 端口转发 添加成功 [端口: 2333 被转发IP和端口: 1.1.1.1:2366] 是否继续 添加端口转发配置？[Y/n]: [信息] 继续 添加端口转发配置... ... ... ======================== 最后启动成功后 就会提示：当前端口转发总数: 1 当前服务器IP: 2.2.2.2 本地监听端口: 2333 被转发IP: 1.1.1.1 被转发端口:2366 状态: 启用 ======================== 显示所有端口转发输入 8 并回车后，会显示如下：当前端口转发总数: 1 当前服务器IP: 2.2.2.2 本地监听端口: 2333 被转发IP: 1.1.1.1 被转发端口:2366 状态: 启用 本地监听端口: 2377 被转发IP: 1.1.1.1 被转发端口:2388 状态: 启用 ======================== Shadowsocks客户端说明假设你的 海外服务器(被中转) 中搭建的Shadowsocks服务端的IP是 2.2.2.2 ，SS端口是 10000 。假设你的 中转服务器 的IP是 1.1.1.1 ，本地监听端口和SS端口一致，都是 10000 。那么，你的Shadowsocks客户端，添加Shadowsocks服务器，IP填写 1.1.1.1 ，端口填写 10000 ，其他的 密码/加密方式/协议/混淆等等 全部和原Shadowsocks账号一样！文件信息为了和我另一个 Brook 管理脚本不冲突，所以安装目录名字改成了 brook-pf 。安装目录：/usr/local/brook-pf安装文件：/usr/local/brook-pf/brook配置文件：/usr/local/brook-pf/brook.conf日志文件：/usr/local/brook-pf/brook.log （只会显示错误日志）其他说明支持开机启动，支持 TCP UDP端口转发。批量 添加/修改/删除 配置文件虽然我的脚本里每次 添加/删除 端口转发配置后都会提示是否继续，但是并不适合大量的 添加/删除 操作，所以需要手动 添加/修改/删除，当然并不麻烦，配置文件格式很简单：# 格式如下： 本地监听端口 被转发IP 被转发端口 状态 # 示例如下： 2333 1.1.1.1 2366 0 2355 1.1.1.1 2777 1 # 状态 0 为禁用，1 为启用。 提示wget: unknown host “raw.githubusercontent.com” 之类的错误这是无法解析我的域名，多半是DNS的问题，请更换DNS为谷歌DNS。点击展开 查看更多echo -e "nameserver 8.8.8.8\nnameserver 8.8.4.4" > /etc/resolv.conf 提示 wget: command not found 的错误这是你的系统精简的太干净了，wget都没有安装，所以需要安装wget。脚本下载brook.txt端口转发brook-pf.txt