Giter Site home page Giter Site logo

Comments (95)

lmhdrive avatar lmhdrive commented on May 27, 2024 1

把这两条加上就行了,其它的都不影响。这是不和一般的家庭网关一样的配置吗
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024 1

@lmhdrive

有试过只加 iptables -P FORWARD ACCEPT 这一条吗？

还是必须要 INPUT 那条？

另外，-A ufw-not-local -m mark --mark 0x2333 -j RETURN 这条是否还需要？

准备在 wiki 常见问题中标注下（如果实在搞不定的话，个人建议关闭ufw，同时使用多个防火墙并不是最佳实践）

试过了，只加 iptables -P FORWARD ACCEPT 这一条,国内的网站可以打开，国外的谷歌什么的打不开，必须加INPUT。因为iptables 不保存为文件的话命令重启机器会失效，我用UFW命令，
ufw default allow incoming 或者
ufw allow from 内网地址/24
ufw default allow FORWARD
对应上面两条iptables 命令，也可以编辑UFW配置文件：
nano /etc/default/ufw
DEFAULT_INPUT_POLICY="ACCEPT"
DEFAULT_FORWARD_POLICY="ACCEPT"
编辑完后需要重启动UFW，systemctl restart ufw
另外的这条，-A ufw-not-local -m mark --mark 0x2333 -j RETURN 加不加没用，我试过了，加上也不行，不加用上面那两条命令也没影响。我的是Debian12,别的没试过。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

root@lmh3-1:~# netstat -tunlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:2023 0.0.0.0:* LISTEN 646/sshd: /usr/sbin
tcp 0 0 0.0.0.0:188 0.0.0.0:* LISTEN 696/v2ray
tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN 672/dnsmasq
tcp 0 0 0.0.0.0:54 0.0.0.0:* LISTEN 2889/dnsmasq
udp 0 0 0.0.0.0:59881 0.0.0.0:* 672/dnsmasq
udp 168960 0 0.0.0.0:53 0.0.0.0:* 672/dnsmasq
udp 0 0 0.0.0.0:54 0.0.0.0:* 2889/dnsmasq
udp 0 0 0.0.0.0:188 0.0.0.0:* 696/v2ray
udp 0 0 0.0.0.0:52932 0.0.0.0:* 672/dnsmasq
udp 0 0 127.0.0.1:65353 0.0.0.0:* 2883/chinadns-ng
udp 0 0 0.0.0.0:42861 0.0.0.0:* 672/dnsmasq
udp 0 0 0.0.0.0:45465 0.0.0.0:* 672/dnsmasq
udp 0 0 0.0.0.0:51104 0.0.0.0:* 672/dnsmasq

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

执行 ss-tproxy restart -x，把输出发出来，看下是哪条命令出错。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

在附件中，麻烦您了，帮我看看！
debug.txt

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

我的防火墙规则：
ufw rule.txt

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

把 ignlist.ext、chnroute6.txt、ss-tproxy.conf 发出来，看下，感觉是哪个文件格式有问题。

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

我大约感觉到是哪里的问题，把 dns_direct6_white 改为 false，而不是留空。

如果 dns_direct6、dns_remote6 不填东西（不是很建议这么做）
那么对应的 dns_direct6_white、dns_remote6_black 要填 false

不然脚本会报错（后续可能会兼容下，但现在必须这样做）。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

收到，我试试，谢谢了。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

修改完后还是不行，网关和DNS设置成SS-TPROXY地址无法上网提示，解析失败。网关和DNS分开写，网关写SS-TPROXY地址，DNS写DNS地址，就是分开配置，可以上国内网，外－网不行（外部节－点没问题），估计分流有问题，麻烦您帮看看。
ignlist-ext.txt
ss-tproxy-restart-x.txt
ss-tproxy-conf.txt
v2-config.json
v2ray-status.txt
netstat -tunlp.txt

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

你DNS有问题吧，我看直连和远程都是同一个dns服务器。

执行ss-tproxy restart还有报错没。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

没有报错了。我看下DNS

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

我用的PI-HOLE内网地址10.8.1.8就都改成这个了，不知道怎么写DNS配置。远程DNS修改了也不行，显示“域名解析错误”

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

你这个 10.8.1.8#53 可以保证拿到无污染ip的吗？
我看你国内dns和可信dns都是这个。

如果是，那么把 ss-tproxy.conf 的 dns_remote_black='true' 改为 'false'

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

默认的就是这个，没改 dns_remote_black='false' dns_remote6_black='false'

但我看你的 ss-tproxy.conf 不是这样，dns_remote_black='true' 你配置的是这样。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

不好意思，看错了，改过来了，还是那样。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

我的PI-HOLE出口DNS就是本地国内DNS

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

那你这个dns不能这样配，改为这样。

dns_direct='10.8.1.8#53'
dns_direct_white='true'

dns_remote='8.8.8.8#53'
dns_remote_black='true'

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

root@lmh3-1:~# ss-tproxy show-iptables
==> iptables-mangle <==
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-N SSTP_OUTPUT
-N SSTP_PREROUTING
-N SSTP_RULE
-A PREROUTING -j SSTP_PREROUTING
-A OUTPUT -j SSTP_OUTPUT
-A SSTP_OUTPUT -m addrtype --dst-type LOCAL -j RETURN
-A SSTP_OUTPUT -m conntrack --ctdir REPLY -j RETURN
-A SSTP_OUTPUT -m owner --gid-owner 13 -j RETURN
-A SSTP_OUTPUT -p udp -m udp --dport 53 -m owner ! --gid-owner 1001 -j RETURN
-A SSTP_OUTPUT -p udp -m conntrack --ctstate NEW,RELATED -j SSTP_RULE
-A SSTP_OUTPUT -m connmark --mark 0x2333 -j MARK --set-xmark 0x2333/0xffffffff
-A SSTP_PREROUTING -m addrtype --dst-type LOCAL -j RETURN
-A SSTP_PREROUTING -m conntrack --ctdir REPLY -j RETURN
-A SSTP_PREROUTING -p udp -m udp ! --dport 53 -m conntrack --ctstate NEW,RELATED -m addrtype ! --src-type LOCAL -j SSTP_RULE
-A SSTP_PREROUTING -p udp -m connmark --mark 0x2333 -j TPROXY --on-port 188 --on-ip 127.0.0.1 --tproxy-mark 0x2333/0xffffffff
-A SSTP_RULE -m set --match-set sstp_white dst -m set ! --match-set sstp_black dst -j RETURN
-A SSTP_RULE -j CONNMARK --set-xmark 0x2333/0xffffffff

==> iptables-nat <==
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-N SSTP_OUTPUT
-N SSTP_POSTROUTING
-N SSTP_PREROUTING
-N SSTP_RULE
-A PREROUTING -j SSTP_PREROUTING
-A OUTPUT -j SSTP_OUTPUT
-A POSTROUTING -j SSTP_POSTROUTING
-A SSTP_OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m addrtype ! --dst-type LOCAL -m owner ! --gid-owner 13 -j SSTP_RULE
-A SSTP_OUTPUT -p udp -m udp --dport 53 -m conntrack --ctstate NEW -m owner ! --gid-owner 13 -m owner ! --gid-owner 1001 -j REDIRECT --to-ports 53
-A SSTP_POSTROUTING ! -s 127.0.0.1/32 -d 127.0.0.1/32 -j SNAT --to-source 127.0.0.1
-A SSTP_PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m addrtype ! --src-type LOCAL ! --dst-type LOCAL -j SSTP_RULE
-A SSTP_PREROUTING -p udp -m udp --dport 53 -m conntrack --ctstate NEW -m addrtype ! --src-type LOCAL -j REDIRECT --to-ports 53
-A SSTP_RULE -m set --match-set sstp_white dst -m set ! --match-set sstp_black dst -j RETURN
-A SSTP_RULE -p tcp -j DNAT --to-destination 127.0.0.1:188
root@lmh3-1:~#

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

检查v2ray配置（对比readme），打开相关log（v2ray的、dns的），先自己排查下。

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

你这个大概率和iptables规则无关，dns解析问题。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

v2没问题吧。我再看看。
root@lmh3-1:~# systemctl status v2ray
● v2ray.service - V2Ray Service
Loaded: loaded (/etc/systemd/system/v2ray.service; enabled; preset: enabled)
Active: active (running) since Wed 2023-10-11 21:52:58 EDT; 2h 20min ago
Main PID: 725 (v2ray)
Tasks: 8 (limit: 1095)
Memory: 29.5M
CPU: 272ms
CGroup: /system.slice/v2ray.service
└─725 /usr/local/bin/v2ray -config /etc/v2ray/config.json

Oct 11 21:52:58 lmh3-1 systemd[1]: Started v2ray.service - V2Ray Service.
Oct 11 21:52:58 lmh3-1 v2ray[725]: V2Ray 4.45.2 (V2Fly, a community-driven edition of V2Ray.) Custom (go1.18.3 linux/amd64)
Oct 11 21:52:58 lmh3-1 v2ray[725]: A unified platform for anti-censorship.
Oct 11 21:52:58 lmh3-1 v2ray[725]: 2023/10/11 21:52:58 [Info] main/jsonem: Reading config: /etc/v2ray/config.json
Oct 11 21:52:58 lmh3-1 v2ray[725]: 2023/10/11 21:52:58 [Warning] V2Ray 4.45.2 started

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

看日志。。。看这些状态没啥用

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

你打开 v2ray 的 debug 日志，然后访问下国外网站（比如google.com），然后看下v2日志（或者发出来）。

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

dnsmasq 和 chinadns-ng 的 verbose 日志也打开（ss-tproxy.conf 里面）

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

readme中，关于v2ray配置那段，有写。。

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

我突然想到一个问题，你v2ray没有以 proxy 组身份来运行吧。估计这里死循环了。

过一遍 readme，ss-tproxy 新版有很多地方改了。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

chinadns.log
command.txt
dnsmasq.log

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

PING BAIDU都PING不通，只能SS-TPROXY STOP才能PING通
root@lmh3-1:# ping www.baidu.com
^C
root@lmh3-1:# ss-tproxy stop
mode: chnroute
proxy/tcp: [running]
proxy/udp: [running]
dnsmasq: [stopped]
chinadns: [stopped]
root@lmh3-1:~# ping www.baidu.com
PING www.a.shifen.com (110.242.68.4) 56(84) bytes of data.
64 bytes from 110.242.68.4 (110.242.68.4): icmp_seq=1 ttl=54 time=10.4 ms
64 bytes from 110.242.68.4 (110.242.68.4): icmp_seq=2 ttl=54 time=9.33 ms
^C
--- www.a.shifen.com ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1031ms
rtt min/avg/max/mdev = 9.326/9.845/10.364/0.519 ms

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

SS-TPROXY打开以后PING/DIG/CURL都不通，关闭以后就可以了。
root@lmh3-1:# ss-tproxy start
mode: chnroute
proxy/tcp: [running]
proxy/udp: [running]
dnsmasq: [running]
chinadns: [running]
root@lmh3-1:# curl www.baidu.com
curl: (6) Could not resolve host: www.baidu.com
root@lmh3-1:# dig www.baidu.com
;; communications error to 10.8.1.8#53: timed out
;; communications error to 10.8.1.8#53: timed out
^Croot@lmh3-1:# ss-tproxy stop
mode: chnroute
proxy/tcp: [running]
proxy/udp: [running]
dnsmasq: [stopped]
chinadns: [stopped]
root@lmh3-1:~# dig www.baidu.com

; <<>> DiG 9.18.19-1~deb12u1-Debian <<>> www.baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61996
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.baidu.com. IN A

;; ANSWER SECTION:
www.baidu.com. 1127 IN CNAME www.a.shifen.com.
www.a.shifen.com. 76 IN A 110.242.68.3
www.a.shifen.com. 76 IN A 110.242.68.4

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

root@lmh3-1:# ss-tproxy stop
mode: chnroute
proxy/tcp: [running]
proxy/udp: [running]
dnsmasq: [stopped]
chinadns: [stopped]
root@lmh3-1:# export ALL_PROXY=socks5://127.0.0.1:7667
root@lmh3-1:~# curl www.google.com
<!doctype html><title>Google</title><script nonce="JYeBT-iAgXI-48Vf32jJUg">(function(

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

SS-TPROXY STOP 以后都能用CURL GOOGLE也可以，说明不是V2的问题。
还有远程DNS地址不是应该由V2来解析的吗？写V2的入口端口。

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

https://github.com/zfl9/ss-tproxy/wiki/%E6%95%85%E9%9A%9C%E6%8E%92%E6%9F%A5

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

image

image

image

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

好的，谢谢！我先学习一下，这里面说的我还不太懂。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

proxy_procgroup='proxy'这个写默认proxy不行吗？该怎么改呢？

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

首先，请把 readme 看一遍。有问题再结合 Wiki，进行自我排查，如果你没有一点自查能力，我只能说这样很浪费时间。

特别是，ss-tproxy.conf配置，请先保持默认配置！！！不要去修改任何一个配置。

请先完全按照 readme 中关于 v2ray 的那段示例，进行配置，然后 ss-tproxy start 启动。

此时先测试 代理是否通畅，本机、内网客户机 是否可以走代理，国内外网络访问是否 OK。

如果都 OK，再来看下面的。

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

proxy_procgroup='proxy'这个写默认proxy不行吗？该怎么改呢？

为什么不行？都说了保持默认配置呀。。然后只修改以下部分，readme说的不够清楚吗。。。

image

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

#233

为什么 v2ray 必须以 proxy 组 的身份来运行？

这是为了在 iptables 规则中，识别哪些进程是 本机代理进程（也即 v2ray/ss/trojan 这些），然后将它们放行。

为什么要放行 v2ray 等进程？

如果不放行，那么就会走后面的 分流规则，就很可能把 v2ray 自己传出的流量，判定为要“走代理”，也就是再一次传递给 v2ray 自己，这就会死循环。

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

为什么 README 用了几乎一半的篇幅，来说“原理”，就是想让你们尽量理解，其中的运行原理。

目的就是让你们能够在代理出问题的时候，进行自我排查，而不是一头雾水，无从下手。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

按您说明又试了一下，把V2和SS-TPROXY的配置文件都按

root@lmh3-1:~# netstat -tunlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:7667            0.0.0.0:*               LISTEN      2952/v2ray
tcp        0      0 0.0.0.0:2023            0.0.0.0:*               LISTEN      656/sshd: /usr/sbin
tcp        0      0 0.0.0.0:54              0.0.0.0:*               LISTEN      2872/dnsmasq
tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN      680/dnsmasq
tcp        0      0 127.0.0.1:188           0.0.0.0:*               LISTEN      2952/v2ray
udp        0      0 0.0.0.0:60389           0.0.0.0:*                           680/dnsmasq
udp        0    768 0.0.0.0:52236           0.0.0.0:*                           680/dnsmasq
udp   180480      0 0.0.0.0:53              0.0.0.0:*                           680/dnsmasq
udp        0      0 0.0.0.0:54              0.0.0.0:*                           2872/dnsmasq
udp        0      0 127.0.0.1:188           0.0.0.0:*                           2952/v2ray
udp        0      0 127.0.0.1:65353         0.0.0.0:*                           2860/chinadns-ng
udp        0      0 0.0.0.0:38233           0.0.0.0:*                           680/dnsmasq
udp        0      0 0.0.0.0:49542           0.0.0.0:*                           680/dnsmasq
root@lmh3-1:~# grep Gid /proc/2952/status
Gid:    0       0       0       0
root@lmh3-1:~#

你说的改了。还是不行，估计还是你说的标志位的问题。

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

你的 v2ray 如何启动的，systemctl 方式？

如果是，请把 v2ray.service 内容贴出来。我看看

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

是啊systemctl restart v2ray

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

使用 systemctl cat v2ray.service 查看 service 文件路径，打开这个文件，找到 User= 这行，在它下面添加 Group=proxy，保存退出，systemctl daemon-reload，systemctl restart v2ray，再看下。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024 
root@lmh3-1:~# systemctl status v2ray
● v2ray.service - V2Ray Service
     Loaded: loaded (/etc/systemd/system/v2ray.service; enabled; preset: enabled)
     Active: active (running) since Fri 2023-10-13 02:36:11 EDT; 1min 23s ago
   Main PID: 706 (v2ray)
      Tasks: 8 (limit: 1095)
     Memory: 29.9M
        CPU: 84ms
     CGroup: /system.slice/v2ray.service
             └─706 /usr/local/bin/v2ray -config /etc/v2ray/config.json

Oct 13 02:36:11 lmh3-1 systemd[1]: Started v2ray.service - V2Ray Service.
Oct 13 02:36:11 lmh3-1 v2ray[706]: V2Ray 4.45.2 (V2Fly, a community-driven edition of V2Ray.) Custom (go1.18.3 linux/amd64)
Oct 13 02:36:11 lmh3-1 v2ray[706]: A unified platform for anti-censorship.
Oct 13 02:36:11 lmh3-1 v2ray[706]: 2023/10/13 02:36:11 [Info] main/jsonem: Reading config: /etc/v2ray/config.json
Oct 13 02:36:11 lmh3-1 v2ray[706]: 2023/10/13 02:36:11 [Info] transport/internet/tcp: listening TCP on 0.0.0.0:7667
Oct 13 02:36:11 lmh3-1 v2ray[706]: 2023/10/13 02:36:11 [Info] transport/internet/tcp: listening TCP on 127.0.0.1:188
Oct 13 02:36:11 lmh3-1 v2ray[706]: 2023/10/13 02:36:11 [Info] transport/internet/udp: listening UDP on 127.0.0.1:188
Oct 13 02:36:11 lmh3-1 v2ray[706]: 2023/10/13 02:36:11 [Warning] V2Ray 4.45.2 started
root@lmh3-1:~# nano /etc/systemd/system/v2ray.service
root@lmh3-1:~# systemctl daemon-reload
root@lmh3-1:~# systemctl restart v2ray
root@lmh3-1:~# systemctl status v2ray

谷歌，白度还是浏览器显示域名解析错误

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024 
root@lmh3-1:~# netstat -tunlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:188           0.0.0.0:*               LISTEN      929/v2ray
tcp        0      0 0.0.0.0:7667            0.0.0.0:*               LISTEN      929/v2ray
tcp        0      0 0.0.0.0:2023            0.0.0.0:*               LISTEN      654/sshd: /usr/sbin
tcp        0      0 0.0.0.0:54              0.0.0.0:*               LISTEN      803/dnsmasq
tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN      679/dnsmasq
udp        0      0 0.0.0.0:53858           0.0.0.0:*                           679/dnsmasq
udp        0      0 127.0.0.1:188           0.0.0.0:*                           929/v2ray
udp        0      0 0.0.0.0:54994           0.0.0.0:*                           679/dnsmasq
udp        0      0 0.0.0.0:48426           0.0.0.0:*                           679/dnsmasq
udp        0      0 127.0.0.1:65353         0.0.0.0:*                           789/chinadns-ng
udp        0    768 0.0.0.0:52101           0.0.0.0:*                           679/dnsmasq
udp        0      0 0.0.0.0:51097           0.0.0.0:*                           679/dnsmasq
udp   161280      0 0.0.0.0:53              0.0.0.0:*                           679/dnsmasq
udp        0      0 0.0.0.0:54              0.0.0.0:*                           803/dnsmasq
root@lmh3-1:~# grep Gid /proc/929/status
Gid:    13      13      13      13

标志位上来了。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024 
root@lmh3-1:~# grep Gid /proc/929/status
Gid:    13      13      13      13
root@lmh3-1:~# grep Gid /proc/679/status
Gid:    30      30      30      30
root@lmh3-1:~# grep Gid /proc/789/status
Gid:    0       1001    1001    1001
root@lmh3-1:~#

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

grep proxy /etc/group 看下gid是多少

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024 
root@lmh3-1:~# grep Gid /proc/929/status
Gid:    13      13      13      13
root@lmh3-1:~# grep Gid /proc/679/status
Gid:    30      30      30      30
root@lmh3-1:~# grep Gid /proc/789/status
Gid:    0       1001    1001    1001
root@lmh3-1:~# grep proxy /etc/group
proxy:x:13:
proxy_dns:x:1001:
root@lmh3-1:~#

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

proxy:x:13:
proxy_dns:x:1001:

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

把 v2ray.service 内容发出来，我帮你改下，看下啥情况。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024 
[Unit]
Description=V2Ray Service
After=network.target nss-lookup.target

[Service]
User=root
Group=proxy
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
NoNewPrivileges=true
Environment=V2RAY_LOCATION_ASSET=/usr/local/lib/v2ray/
ExecStart=/usr/local/bin/v2ray -config /etc/v2ray/config.json
Restart=on-failure

[Install]
WantedBy=multi-user.target

改为这样，看下：

改完后 systemctl daemon-reload && systemctl restart v2ray，然后检查下 Gid 啥情况

[Unit]
Description=V2Ray Service
After=network.target nss-lookup.target

[Service]
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
NoNewPrivileges=true
Environment=V2RAY_LOCATION_ASSET=/usr/local/lib/v2ray/
ExecStartPre=/usr/local/bin/ss-tproxy set-proxy-group /usr/local/bin/v2ray
ExecStart=/usr/local/bin/v2ray -config /etc/v2ray/config.json
Restart=on-failure

[Install]
WantedBy=multi-user.target

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

后面我会记录到 readme 或者 wiki 里面，防止其他人遇到同样的问题，避免浪费时间。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

OK,那麻烦你了。建议下一版本自动化程度高点儿。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

● v2ray.service - V2Ray Service
Loaded: loaded (/etc/systemd/system/v2ray.service; enabled; preset: enabled)
Active: active (running) since Fri 2023-10-13 02:53:29 EDT; 8s ago
Process: 975 ExecStartPre=/usr/local/bin/ss-tproxy set-proxy-group /usr/local/bin/v2ray (code=exited, status=0/SUCCESS)
Main PID: 989 (v2ray)
Tasks: 8 (limit: 1095)
Memory: 7.3M
CPU: 89ms
CGroup: /system.slice/v2ray.service
└─989 /usr/local/bin/v2ray -config /etc/v2ray/config.json

Oct 13 02:53:29 lmh3-1 systemd[1]: Starting v2ray.service - V2Ray Service...
Oct 13 02:53:29 lmh3-1 systemd[1]: Started v2ray.service - V2Ray Service.
Oct 13 02:53:29 lmh3-1 v2ray[989]: V2Ray 4.45.2 (V2Fly, a community-driven edition of V2Ray.) Custom (go1.18.3 linux/amd64)
Oct 13 02:53:29 lmh3-1 v2ray[989]: A unified platform for anti-censorship.
Oct 13 02:53:29 lmh3-1 v2ray[989]: 2023/10/13 02:53:29 [Info] main/jsonem: Reading config: /etc/v2ray/config.json
Oct 13 02:53:29 lmh3-1 v2ray[989]: 2023/10/13 02:53:29 [Info] transport/internet/tcp: listening TCP on 0.0.0.0:7667
Oct 13 02:53:29 lmh3-1 v2ray[989]: 2023/10/13 02:53:29 [Info] transport/internet/tcp: listening TCP on 127.0.0.1:188
Oct 13 02:53:29 lmh3-1 v2ray[989]: 2023/10/13 02:53:29 [Info] transport/internet/udp: listening UDP on 127.0.0.1:188
Oct 13 02:53:29 lmh3-1 v2ray[989]: 2023/10/13 02:53:29 [Warning] V2Ray 4.45.2 started
root@lmh3-1:~# grep Gid /proc/989/status
Gid: 0 0 0 0
变回来了。

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

OK,那麻烦你了。建议下一版本自动化程度高点儿。

不是不想优化，是真的个人时间和精力有限。。望理解。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

好的，主要是debian12和v2ray也经常变来变去。

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024 
[Unit]
Description=V2Ray Service
After=network.target nss-lookup.target

[Service]
Environment=V2RAY_LOCATION_ASSET=/usr/local/lib/v2ray/
ExecStartPre=/usr/local/bin/ss-tproxy set-proxy-group /usr/local/bin/v2ray
ExecStart=/usr/local/bin/v2ray -config /etc/v2ray/config.json
Restart=on-failure

[Install]
WantedBy=multi-user.target

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

这回上来了。
root@lmh3-1:~# systemctl status v2ray
● v2ray.service - V2Ray Service
Loaded: loaded (/etc/systemd/system/v2ray.service; enabled; preset: enabled)
Active: active (running) since Fri 2023-10-13 02:58:28 EDT; 2s ago
Process: 1106 ExecStartPre=/usr/local/bin/ss-tproxy set-proxy-group /usr/local/bin/v2ray (code=exited, status=0/SUCCESS)
Main PID: 1119 (v2ray)
Tasks: 7 (limit: 1095)
Memory: 7.3M
CPU: 84ms
CGroup: /system.slice/v2ray.service
└─1119 /usr/local/bin/v2ray -config /etc/v2ray/config.json

Oct 13 02:58:28 lmh3-1 systemd[1]: Starting v2ray.service - V2Ray Service...
Oct 13 02:58:28 lmh3-1 systemd[1]: Started v2ray.service - V2Ray Service.
Oct 13 02:58:28 lmh3-1 v2ray[1119]: V2Ray 4.45.2 (V2Fly, a community-driven edition of V2Ray.) Custom (go1.18.3 linux/amd64)
Oct 13 02:58:28 lmh3-1 v2ray[1119]: A unified platform for anti-censorship.
Oct 13 02:58:28 lmh3-1 v2ray[1119]: 2023/10/13 02:58:28 [Info] main/jsonem: Reading config: /etc/v2ray/config.json
Oct 13 02:58:29 lmh3-1 v2ray[1119]: 2023/10/13 02:58:29 [Info] transport/internet/tcp: listening TCP on 0.0.0.0:7667
Oct 13 02:58:29 lmh3-1 v2ray[1119]: 2023/10/13 02:58:29 [Info] transport/internet/tcp: listening TCP on 127.0.0.1:188
Oct 13 02:58:29 lmh3-1 v2ray[1119]: 2023/10/13 02:58:29 [Info] transport/internet/udp: listening UDP on 127.0.0.1:188
Oct 13 02:58:29 lmh3-1 v2ray[1119]: 2023/10/13 02:58:29 [Warning] V2Ray 4.45.2 started
root@lmh3-1:~# grep Gid /proc/1119/status
Gid: 0 13 13 13

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

网还是打不开，域名解析错误。

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

你把v2ray的日志等级调一下（改为debug），然后 restart v2ray，journalctl -afu v2ray 看日志，另一个窗口 curl google.com，看下v2ray这边日志是啥。

image

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024 
root@lmh3-1:~# journalctl -afu v2ray
Oct 13 03:04:14 lmh3-1 v2ray[1153]: V2Ray 4.45.2 (V2Fly, a community-driven edition of V2Ray.) Custom (go1.18.3 linux/amd64)
Oct 13 03:04:14 lmh3-1 v2ray[1153]: A unified platform for anti-censorship.
Oct 13 03:04:14 lmh3-1 v2ray[1153]: 2023/10/13 03:04:14 [Info] main/jsonem: Reading config: /etc/v2ray/config.json
Oct 13 03:04:14 lmh3-1 v2ray[1153]: 2023/10/13 03:04:14 [Debug] app/log: Logger started
Oct 13 03:04:14 lmh3-1 v2ray[1153]: 2023/10/13 03:04:14 [Debug] app/proxyman/inbound: creating stream worker on 127.0.0.1:188
Oct 13 03:04:14 lmh3-1 v2ray[1153]: 2023/10/13 03:04:14 [Debug] app/proxyman/inbound: creating stream worker on 0.0.0.0:7667
Oct 13 03:04:14 lmh3-1 v2ray[1153]: 2023/10/13 03:04:14 [Info] transport/internet/tcp: listening TCP on 0.0.0.0:7667
Oct 13 03:04:14 lmh3-1 v2ray[1153]: 2023/10/13 03:04:14 [Info] transport/internet/tcp: listening TCP on 127.0.0.1:188
Oct 13 03:04:14 lmh3-1 v2ray[1153]: 2023/10/13 03:04:14 [Info] transport/internet/udp: listening UDP on 127.0.0.1:188
Oct 13 03:04:14 lmh3-1 v2ray[1153]: 2023/10/13 03:04:14 [Warning] V2Ray 4.45.2 started
^C
root@lmh3-1:~# journalctl -afu v2ray
Oct 13 03:04:14 lmh3-1 v2ray[1153]: V2Ray 4.45.2 (V2Fly, a community-driven edition of V2Ray.) Custom (go1.18.3 linux/amd64)
Oct 13 03:04:14 lmh3-1 v2ray[1153]: A unified platform for anti-censorship.
Oct 13 03:04:14 lmh3-1 v2ray[1153]: 2023/10/13 03:04:14 [Info] main/jsonem: Reading config: /etc/v2ray/config.json
Oct 13 03:04:14 lmh3-1 v2ray[1153]: 2023/10/13 03:04:14 [Debug] app/log: Logger started
Oct 13 03:04:14 lmh3-1 v2ray[1153]: 2023/10/13 03:04:14 [Debug] app/proxyman/inbound: creating stream worker on 127.0.0.1:188
Oct 13 03:04:14 lmh3-1 v2ray[1153]: 2023/10/13 03:04:14 [Debug] app/proxyman/inbound: creating stream worker on 0.0.0.0:7667
Oct 13 03:04:14 lmh3-1 v2ray[1153]: 2023/10/13 03:04:14 [Info] transport/internet/tcp: listening TCP on 0.0.0.0:7667
Oct 13 03:04:14 lmh3-1 v2ray[1153]: 2023/10/13 03:04:14 [Info] transport/internet/tcp: listening TCP on 127.0.0.1:188
Oct 13 03:04:14 lmh3-1 v2ray[1153]: 2023/10/13 03:04:14 [Info] transport/internet/udp: listening UDP on 127.0.0.1:188
Oct 13 03:04:14 lmh3-1 v2ray[1153]: 2023/10/13 03:04:14 [Warning] V2Ray 4.45.2 started

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024 
root@lmh3-1:~# systemctl restart v2ray
root@lmh3-1:~# curl google.com
curl: (6) Could not resolve host: google.com
root@lmh3-1:~#

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

systemctl restart v2ray 之后再 journalctl -afu v2ray 看 log（这里会占用当前终端），然后再 curl 测试（在另一个终端执行）

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024 
root@lmh3-1:~#  journalctl -afu v2ray
Oct 13 03:13:44 lmh3-1 v2ray[1240]: A unified platform for anti-censorship.
Oct 13 03:13:44 lmh3-1 v2ray[1240]: 2023/10/13 03:13:44 [Info] main/jsonem: Reading config: /etc/v2ray/config.json
Oct 13 03:15:45 lmh3-1 systemd[1]: Stopping v2ray.service - V2Ray Service...
Oct 13 03:15:45 lmh3-1 systemd[1]: v2ray.service: Deactivated successfully.
Oct 13 03:15:45 lmh3-1 systemd[1]: Stopped v2ray.service - V2Ray Service.
Oct 13 03:15:45 lmh3-1 systemd[1]: Starting v2ray.service - V2Ray Service...
Oct 13 03:15:45 lmh3-1 systemd[1]: Started v2ray.service - V2Ray Service.
Oct 13 03:15:45 lmh3-1 v2ray[1288]: V2Ray 4.45.2 (V2Fly, a community-driven edition of V2Ray.) Custom (go1.18.3 linux/amd64)
Oct 13 03:15:45 lmh3-1 v2ray[1288]: A unified platform for anti-censorship.
Oct 13 03:15:45 lmh3-1 v2ray[1288]: 2023/10/13 03:15:45 [Info] main/jsonem: Reading config: /etc/v2ray/config.json
^C
root@lmh3-1:~#

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

root@lmh3-1:~# journalctl -afu v2ray
Oct 13 03:15:45 lmh3-1 v2ray[1288]: 2023/10/13 03:15:45 [Info] main/jsonem: Reading config: /etc/v2ray/config.json
Oct 13 03:17:06 lmh3-1 systemd[1]: v2ray.service: Main process exited, code=killed, status=9/KILL
Oct 13 03:17:06 lmh3-1 systemd[1]: v2ray.service: Failed with result 'signal'.
Oct 13 03:17:06 lmh3-1 systemd[1]: v2ray.service: Scheduled restart job, restart counter is at 1.
Oct 13 03:17:06 lmh3-1 systemd[1]: Stopped v2ray.service - V2Ray Service.
Oct 13 03:17:06 lmh3-1 systemd[1]: Starting v2ray.service - V2Ray Service...
Oct 13 03:17:06 lmh3-1 systemd[1]: Started v2ray.service - V2Ray Service.
Oct 13 03:17:06 lmh3-1 v2ray[1422]: V2Ray 4.45.2 (V2Fly, a community-driven edition of V2Ray.) Custom (go1.18.3 linux/amd64)
Oct 13 03:17:06 lmh3-1 v2ray[1422]: A unified platform for anti-censorship.
Oct 13 03:17:06 lmh3-1 v2ray[1422]: 2023/10/13 03:17:06 [Info] main/jsonem: Reading config: /etc/v2ray/config.json

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

我都替你累了 😂 ，要不试试 v2raya 吧，实在搞不定的话。

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

https://github.com/v2rayA/v2rayA

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

v2ray.没问题啊。
root@lmh3-1:# ss-tproxy stop
mode: chnroute
proxy/tcp: [stopped]
proxy/udp: [stopped]
dnsmasq: [stopped]
chinadns: [stopped]
root@lmh3-1:# export ALL_PROXY=socks5://127.0.0.1:7667
root@lmh3-1:~# curl google.com

<TITLE>301 Moved</TITLE>

301 Moved

The document has moved here.

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

我再学习学习吧，谢谢了。

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

我的意思是 v2rayA，是一个 web UI，类似 ss-tproxy，但是 GUI 操作。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

我是用debian v2ray 转到另一个虚拟机WINDOWS 的 V2RAYN界面操作。用SOCKS5转

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

v2rayA没用过，学习学习。

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

我必须承认，使用 ss-tproxy 需要一些基础，特别是调试问题、查看日志的能力。

建议老哥您看看 v2rayA，这个上手快一些，毕竟是 web、gui 操作。

我看 v2rayA 主页，也是可以全局透明代理的，我认为很适合你。

image

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

OK，谢谢了。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

还是先用我的SSTap吧，V2rayA我再学学，懒得弄了。没时间。

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

嗯，祝你好运，以后有时间再折腾吧。

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

readme 添加了 systemctl 方式的一些说明和相关操作。

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

我是用debian v2ray 转到另一个虚拟机WINDOWS 的 V2RAYN界面操作。用SOCKS5转

如果是你说的这种使用情形，我觉得可以试下 用 ipt2socks 来对接另一台 win 上的 v2rayn 的 socks5 入口

这比使用 v2ray 这种重量级选手 会简单许多。

ipt2socks 直接纯命令行启动，ss-tproxy.conf 的 proxy_startcmd 配置为：

set_proxy_group ipt2socks && (ipt2socks -s socks5的ip -p socks5端口 </dev/null &>/var/log/ipt2socks.log &)。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

好的，谢谢了，我回头试试。在外边，这边连上Github都得翻

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

我是用debian v2ray 转到另一个虚拟机WINDOWS 的 V2RAYN界面操作。用SOCKS5转

如果是你说的这种使用情形，我觉得可以试下 用 ipt2socks 来对接另一台 win 上的 v2rayn 的 socks5 入口

这比使用 v2ray 这种重量级选手 会简单许多。

ipt2socks 直接纯命令行启动，ss-tproxy.conf 的 proxy_startcmd 配置为：

set_proxy_group ipt2socks && (ipt2socks -s socks5的ip -p socks5端口 </dev/null &>/var/log/ipt2socks.log &)。

我就是用SS-TPROXY 主机中的V2RAY 的OUTBOUNDS转WIN那台机器的SOCKS5口，还可以加密码。这样主机安全一些。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

我是用debian v2ray 转到另一个虚拟机WINDOWS 的 V2RAYN界面操作。用SOCKS5转

如果是你说的这种使用情形，我觉得可以试下 用 ipt2socks 来对接另一台 win 上的 v2rayn 的 socks5 入口

这比使用 v2ray 这种重量级选手 会简单许多。

ipt2socks 直接纯命令行启动，ss-tproxy.conf 的 proxy_startcmd 配置为：

set_proxy_group ipt2socks && (ipt2socks -s socks5的ip -p socks5端口 </dev/null &>/var/log/ipt2socks.log &)。

这个能加用户名和密码吗？

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

可以

$ ipt2socks --help
usage: ipt2socks <options...>. the existing options are as follows:
 -s, --server-addr <addr>           socks5 server ip, default: 127.0.0.1
 -p, --server-port <port>           socks5 server port, default: 1080
 -a, --auth-username <user>         username for socks5 authentication
 -k, --auth-password <passwd>       password for socks5 authentication

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

感谢大佬！在你的耐心指导下我终于重新搞定了SS-TPROXY，尤其是V2的Service文件，没你帮忙我搞不定！昨天没搞定是我的原因，不是软件的问题，是我GIT的早期的文件，为了避免翻再下载我图省事儿给忘了，今天重新GIT最新文件一次安装就成功了。
不过有个小问题就是安装完成重启后dnsmasq和chinadns-ng是停止状态，把这个systemctl enable ss-tproxy加上重启就正常了。目前，gfwlist和chnroute都能用了。等回家到内网环境再试一下。
安装完后开机就这样

root@lmh3-1:~# ss-tproxy status
mode:           chnroute
proxy/tcp:      [running]
proxy/udp:      [running]
dnsmasq:        [stopped]
chinadns:       [stopped]
重启动正常
root@lmh3-1:~# ss-tproxy restart
mode:           chnroute
proxy/tcp:      [stopped]
proxy/udp:      [stopped]
dnsmasq:        [stopped]
chinadns:       [stopped]

mode:           chnroute
proxy/tcp:      [running]
proxy/udp:      [running]
dnsmasq:        [running]
chinadns:       [running]
root@lmh3-1:~# curl google.com
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="http://www.google.com/">here</A>.
</BODY></HTML>

加开机重启就可以了。
root@lmh3-1:~# systemctl enable ss-tproxy
Created symlink /etc/systemd/system/multi-user.target.wants/ss-tproxy.service → /etc/systemd/system/ss-tproxy.service.
root@lmh3-1:~#
root@lmh3-1:~# ss-tproxy status
mode:           chnroute
proxy/tcp:      [running]
proxy/udp:      [running]
dnsmasq:        [running]
chinadns:       [running]

mode:           gfwlist
proxy/tcp:      [running]
proxy/udp:      [running]
dnsmasq:        [running]
chinadns:       [running]
root@lmh3-1:~# curl google.com
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="http://www.google.com/">here</A>.
</BODY></HTML>

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

其实我还是挺喜欢这个SS-TPROXY它短小精悍，没一点儿多余的东西，搭配V2强大的功能非常合适。不像很多软件体积非常大，功能也就那样，不知道里面塞的啥东西，这个用起来安全透明。回头我再试试你说的 ipt2socks搭V2rayN.

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

其实我还是挺喜欢这个SS-TPROXY它短小精悍，没一点儿多余的东西，搭配V2强大的功能非常合适。不像很多软件体积非常大，功能也就那样，不知道里面塞的啥东西，这个用起来安全透明。回头我再试试你说的 ipt2socks搭V2rayN.

搞定了就好，搞定了其实也没必要折腾 ipt2socks 了。之前和你说试试 ipt2socks 是看你 v2ray 一直没搞定。。

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

不过有个小问题就是安装完成重启后dnsmasq和chinadns-ng是停止状态，把这个systemctl enable ss-tproxy加上重启就正常了

应该是之前的 ss-tproxy.service 文件是老的吧，v4.7.6 改了一些 service 文件的内容。重新安装 ss-tproxy.service 文件，然后 systemctl daemon-reload && systemctl enable ss-tproxy，应该就可以了。

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

大侠你好，我回家试了一下SS-TPROXY，还有个UFW防火墙的问题，就是防火墙开启后不能使用，客户端机器打不开网页。防火墙关闭就一切正常。
按这个方法试了下也不行。

打开/etc/ufw/before.rules，在-A ufw-before-input -j ufw-not-local这行下面加入以下内容：
# if TPROXY, RETURN
-A ufw-not-local -m mark --mark 0x2333 -j RETURN
如果 fwmark 不是 0x2333，请修改为对应的 fwmark。

下面的命令运行都正常，麻烦再帮忙看看！

root@lmh3-1:~# curl www.baidu.com
!DOCTYPE html>
<!--STATUS OK--><

root@lmh3-1:~# curl google.com
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="http://www.google.com/">here</A>.
</BODY></HTML>
root@lmh3-1:~#

root@lmh3-1:~# netstat -tunlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN      682/dnsmasq
tcp        0      0 0.0.0.0:60053           0.0.0.0:*               LISTEN      834/dnsmasq
tcp        0      0 0.0.0.0:7667            0.0.0.0:*               LISTEN      762/v2ray
tcp        0      0 0.0.0.0:2023            0.0.0.0:*               LISTEN      647/sshd: /usr/sbin
tcp        0      0 127.0.0.1:188           0.0.0.0:*               LISTEN      762/v2ray
udp        0      0 0.0.0.0:52351           0.0.0.0:*                           762/v2ray
udp        0      0 0.0.0.0:60053           0.0.0.0:*                           834/dnsmasq
udp        0      0 0.0.0.0:58006           0.0.0.0:*                           762/v2ray
udp        0      0 0.0.0.0:50842           0.0.0.0:*                           820/chinadns-ng
udp        0      0 127.0.0.1:188           0.0.0.0:*                           762/v2ray
udp        0      0 127.0.0.1:65353         0.0.0.0:*                           820/chinadns-ng
udp        0      0 0.0.0.0:53              0.0.0.0:*                           682/dnsmasq
root@lmh3-1:~#

root@lmh3-1:~# ufw status numbered
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 53,2023,60053,65353,65354/tcp DENY IN     10.8.1.20
[ 2] 53,2023,60053,65353,65354/udp DENY IN     10.8.1.20
[ 3] 53,2023,60053,65353,65354/tcp DENY IN     10.8.1.77
[ 4] 53,2023,60053,65353,65354/udp DENY IN     10.8.1.77
[ 5] 53,2023,60053,65353,65354/tcp ALLOW IN    10.8.1.0/24
[ 6] 53,2023,60053,65353,65354/udp ALLOW IN    10.8.1.0/24
[ 7] 53/udp on enp1s0           ALLOW IN    10.8.1.0/24
root@lmh3-1:~#

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

ufw 不熟，但是看了下 wiki，ufw 好像是基于 iptables 的。

你把【ufw 打开】和【ufw 关闭】的 iptables 规则对比发出来。

查看 iptables 规则：

echo "========== mangle ==========="
iptables -t mangle -S

echo "========== nat ==========="
iptables -t nat -S

echo "========== filter ==========="
iptables -t filter -S

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

好的，麻烦您帮看看。我是一知半解，看不太懂。
start ufw.txt
stop ufw.txt

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

我用Beyond Compare比较了一下，还是有些差异的。
差异

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

是不是开启防火墙 ，这几个有问题？

-P INPUT DROP
-P FORWARD DROP

-A ufw-not-local -j DROP
-A ufw-skip-to-policy-forward -j DROP
-A ufw-skip-to-policy-input -j DROP
-A ufw-skip-to-policy-output -j ACCEPT

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

解决了，麻烦你了！

from ss-tproxy.

zfl9 avatar zfl9 commented on May 27, 2024

@lmhdrive

有试过只加 iptables -P FORWARD ACCEPT 这一条吗？

还是必须要 INPUT 那条？

另外，-A ufw-not-local -m mark --mark 0x2333 -j RETURN 这条是否还需要？

准备在 wiki 常见问题中标注下（如果实在搞不定的话，个人建议关闭ufw，同时使用多个防火墙并不是最佳实践）

from ss-tproxy.

lmhdrive avatar lmhdrive commented on May 27, 2024

有防火墙总觉得安全一点儿，否则虚拟机很容易被黑，我以前的就是。nftables最好但不太会用，只能用UFW凑合了。

from ss-tproxy.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.