发表在
经验分享
2016-4-25 20:23:37
|
查看全部
| 阅读模式
马上注册，结交更多好友，享用更多功能，让你轻松玩转社区。
您需要 登录 才可以下载或查看，没有帐号？立即注册
x
1.优点明确，只有被墙的站点才走代理，但是GFWList并不能100%涵盖被墙站点。所以要自己添加一些遗漏的被墙网站。
2.缺点， 有些国外站点直连速度远不如走代理，特别是你代理服务器速度较快，希望通过代理加速国外访问时，你需要把这个加入到GFWList里面来达到目的，这个时候显得就不智能了。配置环境:
系统：Tomato shibby（1.28.0000 -129 K26ARM USB AIO-64K)
SS账号：SSH91
测试路由器：NETGEAR R6300V2 (机器性能好的，体验会比较好）
依赖插件：ss-redir、ss-tunnel、ss-local、ss-server
依赖文件：gfwlist.conf、run.sh、load-modules、check_chain、 entware-install_arm.sh
刷Tomato shibby固件:
注意！刷过DD-WRT直刷过去，并且刷完后要双清一下，建议还是要30-30-30，我们直接从原厂固件刷
1.下载Tomato Shibby
我们这里下载最新版本，还有下载还要下载网件.CHK校验包Netgear R-series initial files
2.固定网关
IP为192.168.1.100，子网掩码255.255.255.0
3.刷固件
点击网件固件 高级 >> 管理 >> 路由器升级选项，选入刚才我们下载的tomato-R6300v2-initial.chk
4.再次刷Tomato shibby
大约2分钟左右会重启刷新到Tomato界面，如果没有刷新到Tomato界面，直接在浏览器输入http://192.168.1.1
打开Administration >> upgrade选项。选入刚才我们下载的tomato-R6300v2-ARM--129-AIO-64K.trx
5.双清nvram
再过2分多钟这时候路由器湖进入到Tomato界面
Administration >> Configuration- Restore Default Configuration >> 选择erase all data in Nvram memory(thorough) >> save
路由器会再次重启，这次路由器完全刷好了Tomato
配置过程
1.开启jffs和配置路由器联网
Administration >> JFFS
勾选上Enable,因为初次开启，所以先要Format/Erase格式化一下，然后才save,最后重启一下机器
2.挂载/jffs到/opt- telnet 192.168.1.1root@unknown:/tmp/home/root# cd /jffs
- root@unknown:/jffs# mkdir opt root@unknown:/jffs# cd ../
- root@unknown:/# mount -o bind /jffs/opt /opt
- entwareroot@unknown:/# cd /opt
- root@unknown:/# wget -O - http://qnapware.zyxmon.org/binaries-armv7/installer/entware_install_arm.sh | sh
4.安装配置shadowsocks-libev
我以为entware不会有shadowsocks之类，所以自己交叉编译个shadowsocks,结果发现entware有，还有shadowVPN,罪过啊啊！这里我们以entware来配置，因为静态编译的配置太麻烦- root@unknown:/# opkg update root@unknown:/# opkg install shadowsocks-libev
- root@unknown:/# vi /opt/etc/shadowsocks.json
- root@unknown:/#
- {
- "server":"127.0.0.1",
- "server_port":443,
- "local":"0.0.0.0",
- "local_port":1080,
- "password":"123456789",
- "timeout":60,
- "method":"rc4-md5"
- }
- :wq!
- root@unknown:/# /opt/etc/init.d/S22shadowsocks start
6.配置自动挂载脚本
Administration >> Scripts >> init选项写入 - mount -o bind /jffs/opt /opt
ss-redir透明代理- root@unknown:/tmp/home/root# vi /opt/etc/init.d/S22shadowsocks
- #!/bin/sh
- ENABLED=yes
- PROCS=ss-local
- ARGS="-c /opt/etc/shadowsocks.json"
- PREARGS="" DESC=$PROCS PATH=/opt/sbin:/opt/bin:/opt/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin . /opt/etc/init.d/rc.func
- #!/bin/sh
- ENABLED=yes
- PROCS=ss-redir
- ARGS="-c /opt/etc/shadowsocks.json"
- PREARGS="" DESC=$PROCS PATH=/opt/sbin:/opt/bin:/opt/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin . /opt/etc/init.d/rc.func
(可选)UDP转发脚本- #!/bin/sh
- # Copyright (C) 2015 OpenWrt.org
- CONFIG=/opt/etc/shadowsocks.json
- /opt/bin/ss-tunnel -c $CONFIG -b 0.0.0.0 -l 5300 -L 8.8.8.8:53 -u
8.配置dnsmasq配合UDP转发和DNS解析(二选一)
Advanced >> DHCP/DNS >> DHCP / DNS Server (LAN) >> Dnsmasq
Custom configuration 框内写入 conf-dir=/jffs/dnsmasq.d
A.配合UDP转发防污染- root@unknown:/tmp/home/root# cd /jffs
- root@unknown:/tmp/home/root# mkdi dnsmasq.d
- # gfw list ipset rules for dnsmasq
- # updated on 2015-05-30 21:22:09
- #
- server=/.lsxszzg.com/127.0.0.1#5300 #转发到tunnel(UDP转发)的本地 listen port ,注意该本地端口跟UDP转发脚本的端口一定要一致
- ipset=/.lsxszzg.com/gfwlist
- server=/.altrec.com/127.0.0.1#5300
- ipset=/.altrec.com/gfwlist
- server=/.azubu.tv/127.0.0.1#5300
- ipset=/.azubu.tv/gfwlist
- server=/.beeg.com/127.0.0.1#5300
- ipset=/.beeg.com/gfwlist
- server=/.darpa.mil/127.0.0.1#5300
- ipset=/.darpa.mil/gfwlist
- server=/.fastpic.ru/127.0.0.1#5300
- ipset=/.fastpic.ru/gfwlist
- server=/.fxnetworks.com/127.0.0.1#5300
- ipset=/.fxnetworks.com/gfwlist
- server=/.hulu.com/127.0.0.1#5300
- ·······
- root@unknown:/tmp/home/root# cd /jffs
- root@unknown:/tmp/home/root# mkdi dnsmasq.d
- # gfw list ipset rules for dnsmasq
- # updated on 2015-05-30 21:22:09
- #
- server=/.lsxszzg.com/208.67.222.222#443
- ipset=/.lsxszzg.com/gfwlist
- server=/.altrec.com/208.67.222.222#443
- ipset=/.altrec.com/gfwlist
- server=/.azubu.tv/208.67.222.222#443
- ipset=/.azubu.tv/gfwlist
- server=/.beeg.com/208.67.222.222#443
- ipset=/.beeg.com/gfwlist
- server=/.darpa.mil/208.67.222.222#443
- ipset=/.darpa.mil/gfwlist
- server=/.fastpic.ru/208.67.222.222#443
- ipset=/.fastpic.ru/gfwlist
- server=/.fxnetworks.com/208.67.222.222#443
- ipset=/.fxnetworks.com/gfwlist
- server=/.hulu.com/208.67.222.222#443
- ·······
9.配置防火墙策略和加载ipset内核模块脚本- #!/bin/sh
- # Copyright (C) 2015 OpenWrt.org
- # Load ipset netfilter kernel modules and kernel modules
- insmod ip_set
- insmod ip_set_bitmap_ip
- insmod ip_set_bitmap_ipmac
- insmod ip_set_bitmap_port
- insmod ip_set_hash_ip
- insmod ip_set_hash_ipport
- insmod ip_set_hash_ipportip
- insmod ip_set_hash_ipportnet
- insmod ip_set_hash_net
- insmod ip_set_hash_netport
- insmod ip_set_list_set
- insmod xt_set
- # Configure firewall forwarding tactics
- ipset -N gfwlist iphash
- iptables -t nat -A PREROUTING -p tcp -m set --match-set gfwlist dst -j REDIRECT --to-port 1080
- iptables -t nat -A OUTPUT -p tcp -m set --match-set gfwlist dst -j REDIRECT --to-port 1080 #注意本地监控端口
10.配置自动判段加载防火墙策略脚本并加入计划任务- #!/bin/sh
- # a VPN check script
- # HOUZI<span style="box-sizing: border-box;">[</span>http;//www.router008.com]
- LOGTIME=$(date "+%Y-%m-%d %H:%M:%S")
- CHAIN=`iptables -t nat --list | grep -i gfwlist`
- if <span style="box-sizing: border-box;">[</span> -z "$CHAIN" ]
- then
- sh /jffs/load_modules
- echo 'chain has finished loading at <span style="box-sizing: border-box;">[</span>'$LOGTIME'].' >> /tmp/load_chain.log 2>&1
- else
- echo 'no problem at <span style="box-sizing: border-box;">[</span>'$LOGTIME'].' >> /tmp/load_chain.log 2>&1
- fi
Administration >> Scheduler >> Custom 1 框内填入
清理脚本生成的监控记录
11.重启
所有配置完成后重启，来看看效果吧！
|
|
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
千斤顶
照妖镜
