本帖最後由 kingwilliam 於 2019-11-6 06:34 編輯
回復 11# harold
＊
＊
＊
以下config.json是跟你之前的config作了一些改動
！！！一定要修改openwrt內dns port到5301！！！
＊
＊
＊
加入部份
<-- add by kingwilliam (有1項)
刪除部份
<-- disabled by kingwilliam (有7項)- {
- "log": {
- "access": "/var/log/v2rayaccess.log",
- "error": "/var/log/v2rayerror.log",
- //"loglevel": "warning"
- "loglevel": "debug"
- },
- "inbounds": [
- {
- "tag":"transparent",
- "port": 12345,
- "protocol": "dokodemo-door",
- "settings": {"network": "tcp,udp","followRedirect": true},
- "sniffing": {"enabled": true,"destOverride": ["http","tls"]}
- // "sockopt": {"mark": 255} <-- disabled by kingwilliam
- // "streamSettings": {"sockopt": { "tproxy": "tproxy" }} <-- disabled by kingwilliam
- },
- // dokodemo-door:53 <--- add by kingwilliam
- {
- "tag": "dns-in",
- "port": 53,
- "protocol": "dokodemo-door",
- "settings": {
- "address": "127.0.0.1",
- "port": 5301,
- "network": "udp,tcp"
- }
- },
- {
- "port": 1081,
- "protocol": "http",
- "sniffing": {"enabled": true,"destOverride": ["http", "tls"]}
- // "settings": {"network": "tcp,udp"}, <-- disabled by kingwilliam
- // "sockopt": {"mark": 255}, <-- disabled by kingwilliam
- },
- {
- "port": 1080,
- "protocol": "socks",
- "sniffing": {"enabled": true,"destOverride": ["http", "tls"]}
- }
- ],
- "outbounds":[
- {
- "tag": "proxy",
- "protocol": "vmess",
- "settings": {
- "vnext": [
- {
- "address": "server_address",
- "port": 8080,
- "users": [{"id": "uuid","level": 1,"alterId": 64,"security": "aes-128-gcm"}]
- }
- ]
- },
- "streamSettings": {
- "sockopt": {"mark": 255},
- "network": "ws",
- //"security": "true",
- "security": "tls",
- //"allowInsecure": true,
- "tlsSettings": {"allowInsecure": true,"serverName": "server_address"},
- "wsSettings": { "path": "/v2/" }
- //"mux": {"enabled": true,"concurrency": 8}
- },
- "mux": {"enabled": true}
- },
- {
- "tag": "direct",
- "protocol": "freedom",
- // "settings": {"domainStrategy": "UseIP"}, <-- disabled by kingwilliam
- "streamSettings": {"sockopt": {"mark": 255}}
- },
- {
- "tag": "block",
- "protocol": "blackhole",
- "settings": {"response": {"type": "http"}}
- },
- {
- "tag": "dns-out",
- "protocol": "dns",
- "streamSettings": {"sockopt": {"mark": 255}}
- }
- ],
- "dns": {
- "servers": [
- "8.8.8.8","1.1.1.1",
- //,"114.114.114.114", <-- disabled by kingwilliam
- {
- "address": "223.5.5.5",
- "port": 53,
- "domains": ["geosite:cn","ntp.org","changip.com","amy.dns04.com"]
- }
- ]
- },
- "routing": {
- // "domainStrategy": "IPOnDemand", <-- disabled by kingwilliam
- "rules": [
- // {"type": "field","inboundTag": ["transparent"],"port": 53,"network": "udp","outboundTag": "dns-out"}, <-- disabled by kingwilliam
- // dns route <- add by kingwilliam
- {
- "type": "field",
- "inboundTag": "dns-in",
- "outboundTag": "dns-out"
- },
- {"type": "field","inboundTag": ["transparent"],"port": 123,"network": "udp","outboundTag": "direct"},
- {"type": "field","ip": ["223.5.5.5","114.114.114.114"],"outboundTag": "direct"},
- {"type": "field","ip": ["8.8.8.8","1.1.1.1"],"outboundTag": "proxy"},
- {"type": "field","protocol":["bittorrent"],"outboundTag": "direct"},
- {"type": "field","ip": ["geoip:private","geoip:cn"],"outboundTag": "direct" },
- {"type": "field","domain": ["geosite:cn"],"outboundTag": "direct"},
- {"type": "field","ip": ["192.168.1.0/24"],"outboundTag": "direct"}
- ]
- }
- }
＊
＊
iptables
加入部份
iptables -t mangle -A V2RAY_MARK -p udp --dport 53 -j RETURN
刪除部份
<-- disabled by kingwilliam (有1項)- hostip2=`dig -t A +short myservername`
- iptables -t nat -N V2RAY
- iptables -t nat -A V2RAY -d $hostip2 -j RETURN
- iptables -t nat -A V2RAY -d 0.0.0.0/8 -j RETURN
- iptables -t nat -A V2RAY -d 127.0.0.0/8 -j RETURN
- iptables -t nat -A V2RAY -d 192.168.1.0/24 -j RETURN
- iptables -t nat -A V2RAY -d 224.0.0.0/4 -j RETURN
- iptables -t nat -A V2RAY -d 240.0.0.0/4 -j RETURN
- iptables -t nat -A V2RAY -p tcp -j RETURN -m mark --mark 0xff
- iptables -t nat -A V2RAY -p tcp -j REDIRECT --to-ports 12345
- iptables -t nat -A PREROUTING -p tcp -j V2RAY
- # iptables -t nat -A OUTPUT -p tcp -j V2RAY <-- disabled by kingwilliam
- ip rule add fwmark 1 table 100
- ip route add local 0.0.0.0/0 dev lo table 100
- iptables -t mangle -N V2RAY_MASK
- iptables -t mangle -A V2RAY_MASK -d $hostip2 -j RETURN
- iptables -t mangle -A V2RAY_MASK -d 0.0.0.0/8 -j RETURN
- iptables -t mangle -A V2RAY_MARK -d 127.0.0.0/8 -j RETURN
- iptables -t mangle -A V2RAY_MASK -d 192.168.1.0/24 -j RETURN
- iptables -t mangle -A V2RAY_MARK -d 224.0.0.0/4 -j RETURN
- iptables -t mangle -A V2RAY_MARK -d 240.0.0.0/4 -j RETURN
- iptables -t mangle -A V2RAY_MARK -p udp --dport 53 -j RETURN
- iptables -t mangle -A V2RAY_MASK -p udp -j TPROXY --on-port 12345 --tproxy-mark 1
- iptables -t mangle -A PREROUTING -p udp -j V2RAY_MASK
＊
＊
［［［ 解說 ］］］
１。iptables 內的 mark0xff 等同 config.json 內的"sockopt": {"mark": 255}, 目的是識別 那個數據包是入, 那個數據包是出.
所以入的數據不用打mark (就是這原因 config.json 內所有inbound "sockopt": {"mark": 255} 都給刪除.
同一原因, outbound全都要保留
iptables -t nat -A V2RAY -p tcp -j RETURN -m mark --mark 0xff
意思是 tcp 有mark 255 就直連
２。你在routing內攔截udp 53, 好多人都在官網發問接近問題,所以我加入dokodemo-door:53, 同時在iptables 加入udp 53直連. 前題是openwrt dns port 一定要改走.
３。direct freedom 不用刻意用 "useip". 沒甚麼作為 所以給刪除
４。dns servers 內114. 不應同 1.1. 8.8. 放在同一層 所以給刪除
５。 routing 不需用 "ipondemand", 在你的設定看不到有需要 所以給刪除
６。inbounds socks同http 是可以共全的, 同時在 http "settings": {"network": "tcp,udp"} 也給我刪除.
以上改動希望可以幫到你, 如有問題請告知, 看看可否再調配 |
發表於 2019-11-5 19:21
| 