一支红杏

|

方案设计

主要问题

任何协议,任何IP都有可能被封.

CDN技术


简单来说CDN服务器代理了我们的访问原服务器的流量. 由于CDN服务器具有众多的IP, 而且更容易伪装成网页访问, 因此用来分发请求可以减少被封的可能.

请求<->CDN集群<->服务器

解决方案

websocket代理

由于CDN服务的特殊性, 必须伪装成正常的网页访问, 所以必须使用websocket代理.

宝塔linux面板

简化安装过程,尤其是安装证书那一块. 由于ssl证书的安装比较繁琐, 用caddy的时候也出现了问题.

安装

wget -O install.sh http://download.bt.cn/install/install-ubuntu.sh && sudo bash install.sh

查看端口占用

ss -lntpd 
netstat -tnlp 
lsof -i tcp:22
fuser

默认的安装方式会出错,改用用DNS安装ssl证书.

开启反向代理,把这个网站做的更像一回事.

再站点的配置页面修改nginx的配置文件.

1
2
3
4
5
6
7
8
9
location /ray 
    {
    	proxy_pass http://127.0.0.1:10000;
        proxy_redirect off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $http_host;
    }

V2ray

现在网上的垃圾太多了, 搜索一个V2ray的配置好累~

  • Server

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    65
    66
    67
    68
    69
    70
    {
      "log": {
        "access": "",
        "error": "",
        "loglevel": "debug"
      },
      "inbounds": [
        {
          "tag": "vmess-in", 
          "port": 10000,
          "listen": null,
          "protocol": "vmess",
          "sniffing": null,
          "settings": {
            "auth": null,
            "udp": false,
            "ip": null,
            "clients": [
              {
                "id": "*",
                "alterId": 64,
                "email": "t@t.tt",
                "security": null
              }
            ]
          },
          "streamSettings": {
            "network": "ws",
            "security": "",
            "tlsSettings": {
              "allowInsecure": true,
              "serverName": null
            },
            "tcpSettings": null,
            "kcpSettings": null,
            "wsSettings": {
              "connectionReuse": true,
              "path": "/ray",
              "headers": null
            },
            "httpSettings": null,
            "quicSettings": null
          }
        }
      ],
      "outbounds": [
        {
          "protocol": "freedom", 
          "settings": { }, 
          "tag": "direct"
        }, 
        {
          "protocol": "blackhole", 
          "settings": { }, 
          "tag": "blocked"
        }
      ], 
      "routing": {
        "domainStrategy": "AsIs", 
        "rules": [
          {
            "type": "field", 
            "inboundTag": [
              "vmess-in"
            ], 
            "outboundTag": "direct"
          }
        ]
      }
    }

  • Client

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    65
    66
    67
    68
    69
    70
    71
    72
    73
    74
    75
    76
    77
    78
    79
    80
    81
    82
    83
    84
    85
    86
    87
    88
    89
    90
    91
    92
    93
    94
    95
    {
      "log": {
        "loglevel": "debug"
      },
      "inbounds": [
        {
          "port": 10086,
          "listen": "0.0.0.0",
          "tag": "socks-in",
          "protocol": "socks",
          "settings": {
            "auth": "noauth",
            "udp": false
          }
        }
      ],
      "outbounds": [
        {
          "mux": {
            "concurrency": 32,
            "enabled": true
          },
          "protocol": "vmess",
          "settings": {
            "vnext": [
              {
                "users": [
                  {
                    //注：填写uuid
                    "id": "UUID",
                    "alterId": 64,
                    "security": "auto"
                  }
                ],
                //注：填写域名、端口
                "address": "domain.Name",
                "port": 1234
              }
            ]
          },
          "streamSettings": {
            "tlsSettings": {
              "allowInsecure": false
            },
            "wsSettings": {
              "headers": {
                "User-Agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.4489.62 Safari/537.36",
                //注：填写对应头部
                "Host": "HOST",
                "Accept-Encoding": "gzip",
                "Pragma": "no-cache"
              },
              //注：ws路径
              "path": "/PATH/"
            },
            "network": "ws",
            "security": "tls"
          },
          "tag": "proxy"
        },
        {
          "protocol": "blackhole",
          "settings": {},
          "tag": "blocked"
        },
        {
          "protocol": "freedom",
          "settings": {},
          "tag": "dicert"
        }
      ],
      "routing": {
        //注：全域名规则匹配
        "domainStrategy": "AsIs",
        "rules": [
          {
            "type": "field",
            "domain": [
              //注：填写对应域名和host
              "domain:domain.Name"
            ],
            "outboundTag": "dicert"
          },
          {
            "type": "field",
            "inboundTag": [
              "socks-in",
              "http-in"
            ],
            "outboundTag": "proxy"
          }
        ]
      },
      "other": {}
    }

V2rayN客户端生成的配置文件没有out的规则, 之前一直傻乎乎的以为有默认配置.

路由表

rules 对应一个数组，数组中每个元素是一个规则。对于每一个连接，路由将根据这些规则依次进行判断，当一个规则生效时，即将这个连接转发至它所指定的outboundTag.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
"routing": {
    //注：全域名规则匹配
    "domainStrategy": "AsIs",
    "rules": [
      {
        "type": "field",
        "domain": [
          //注：填写对应域名和host
          "domain:domain.Name"
        ],
        "outboundTag": "dicert"
      },
      {
        "type": "field",
        "inboundTag": [
          "socks-in",
          "http-in"
        ],
        "outboundTag": "proxy"
      }
    ]
  }

总结

目前websocket+tls+cdn应该是最好的选择,然而使用cloudflare速度太慢,需要考虑使用国内的CDN服务商.

参考

v2ray + CDN
V2RAY配置WebSocket + TLS + Web
V2ray Templates
V2ray 配置

坚持原创技术分享，您的支持是我前进的动力！