虚拟世界的懒猫

搭建 sing-box NaiveProxy 服务端并配置客户端的教程

· 技术分享 · 阅读 -

这个教程会创建两个上网协议 NaiveProxy（sing-box当前主推的协议） Hysteria2（备用），我们只开80和443端口，我们用的sing-box 1.14.4版本。

环境准备

  • vps一个，本文以ubuntu26为例
  • 自己的域名一个，本文中我们以 speedtest.abc.com 为例
  • 开放80/tcp端口，给你的域名申请证书用
  • 开放443/tcp 443/udp分别给两个上网协议用

安装并配置服务端

安装

直接在vps执行命令

1
2
3
4
5
6
7
8
9
10
11
12
sudo mkdir -p /etc/apt/keyrings &&
sudo curl -fsSL https://sing-box.app/gpg.key -o /etc/apt/keyrings/sagernet.asc &&
sudo chmod a+r /etc/apt/keyrings/sagernet.asc &&
echo '
Types: deb
URIs: https://deb.sagernet.org/
Suites: *
Components: *
Enabled: yes
Signed-By: /etc/apt/keyrings/sagernet.asc
' | sudo tee /etc/apt/sources.list.d/sagernet.sources &&
sudo apt-get update && sudo apt-get install sing-box

其他操作系统可以看官方给的 https://sing-box.sagernet.org/zh/installation/package-manager/

生成两个密钥

1
2
sing-box generate rand --base64 32   # naive的密码
sing-box generate rand --base64 32   # hy2的密码

服务端配置

修改 /etc/sing-box/config.json

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

{
  "log": { "level": "warn", "timestamp": true },
  "certificate_providers": [
    {
      "type": "acme",
      "tag": "cert",
      "domain": ["speedtest.abc.com"],
      "email": "admin@abc.com",
      "data_directory": "/var/lib/sing-box/acme",
      "key_type": "p256"
    }
  ],
  "inbounds": [
    {
      "type": "naive",
      "tag": "naive-in",
      "network": "tcp",
      "listen": "::",
      "listen_port": 443,
      "users": [{ "username": "admin", "password": "刚刚用命令生成的naive的密码字符串" }],
      "tls": {
        "enabled": true,
        "server_name": "speedtest.abc.com",
        "certificate_provider": "cert"
      }
    },
    {
      "type": "hysteria2",
      "tag": "hy2-in",
      "listen": "::",
      "listen_port": 443,
      "users": [{ "name": "admin", "password": "刚刚用命令生成的hy2的密码字符串" }],
      "masquerade": "https://www.bing.com",
      "tls": {
        "enabled": true,
        "server_name": "speedtest.abc.com",
        "certificate_provider": "cert"
      }
    }
  ],
  "outbounds": [{ "type": "direct", "tag": "direct" }],
  "route": {
    "rules": [{ "ip_is_private": true, "action": "reject" }],
    "final": "direct"
  }
}

这里的"masquerade": "https://www.bing.com",并不是类似vless的伪装地址，而是说当有机器人访问你的hy2的443端口是让它跳到masquerade指定的网址。

防火墙

开启 80/tcp 443/tcp 443/udp

比如ufw防火墙 

1
2
3
4
5
6
7
8
ufw allow 80/tcp
ufw allow 443/tcp
ufw allow 443/udp
ufw allow ssh   # 别把自己的ssh端口忘了，不然进不去机器了

ufw reload # 重新加载规则生效

ufw status # 查看所有规则

启动服务端

1
2
3
sudo sing-box check -c /etc/sing-box/config.json
sudo systemctl enable --now sing-box
sudo journalctl -u sing-box --output cat -f   # 查看日志

安装并配置客户端

安装

https://github.com/SagerNet/sing-box/releases

我们以 sing-box 1.14.4 为例

  • windows图形客户端叫SFW-1.14.4-x64.exe
  • macOS的图形客户端叫SFM-1.14.4-Apple.pkg，你也可以brew install sfm安装，看你喜欢哪个

文档 https://sing-box.sagernet.org/zh/clients/apple/#source-code

配置

在安装好打开的app界面里创建并编辑配置文件 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
{
  "log": {
    "level": "warn"
  },
  "dns": {
    "servers": [
      {
        "type": "https",
        "tag": "remote",
        "detour": "proxy",
        "server": "1.1.1.1"
      },
      {
        "type": "https",
        "tag": "local",
        "server": "223.5.5.5"
      }
    ],
    "rules": [
      {
        "query_type": "AAAA",
        "action": "reject"
      },
      {
        "rule_set": "geosite-cn",
        "server": "local"
      }
    ],
    "final": "remote"
  },
  "inbounds": [
    {
      "type": "tun",
      "tag": "tun-in",
      "address": "172.19.0.1/30",
      "auto_route": true,
      "strict_route": true
    }
  ],
  "outbounds": [
    {
      "type": "selector",
      "tag": "proxy",
      "outbounds": [
        "naive",
        "hy2"
      ]
    },
    {
      "type": "naive",
      "tag": "naive",
      "server": "speedtest.abc.com",
      "server_port": 443,
      "username": "admin",
      "password": "你的服务端填写的naive的密码",
      "udp_over_tcp": true,
      "tls": {
        "enabled": true,
        "server_name": "speedtest.abc.com"
      }
    },
    {
      "type": "hysteria2",
      "tag": "hy2",
      "server": "speedtest.abc.com",
      "server_port": 443,
      "password": "你的服务端填写的hy2的密码",
      "tls": {
        "enabled": true,
        "server_name": "speedtest.abc.com"
      }
    },
    {
      "type": "direct",
      "tag": "direct"
    }
  ],
  "route": {
    "rules": [
      {
        "action": "sniff"
      },
      {
        "protocol": "dns",
        "action": "hijack-dns"
      },
      {
        "ip_is_private": true,
        "outbound": "direct"
      },
      {
        "rule_set": [
          "geosite-cn",
          "geoip-cn"
        ],
        "outbound": "direct"
      }
    ],
    "rule_set": [
      {
        "type": "remote",
        "tag": "geosite-cn",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geosite-cn.srs"
      },
      {
        "type": "remote",
        "tag": "geoip-cn",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs"
      }
    ],
    "final": "proxy",
    "auto_detect_interface": true,
    "default_domain_resolver": "local"
  }
}

上边的配置里我禁用了ipv6 

1
2
3
4
{
  "query_type": "AAAA",
  "action": "reject"
},

第一次链接会自动下载rule_set里的两个文件，都是github上的，大概率下载不到，然后会一直报错，可以改成把文件放本地文件夹里，把rule_set改成下边这样 

1
2
3
4
5
6
7
8
9
10
11
12
"rule_set": [
      {
        "type": "local",
        "tag": "geosite-cn",
        "path": "geosite-cn.srs"
      },
      {
        "type": "local",
        "tag": "geoip-cn",
        "path": "geoip-cn.srs"
      }
    ],

path里你可以写C:/your/path/geosite-cn.srs没问题，但sing-box客户端会提示让你在设置里开启不安全运行模式，可以开。
你也可以不开，然后把文件放到你的sing-box安装目录下，如果你不知道目录在哪里，你可以先不写具体path，就写两个文件名，这时候编辑配置文件sing-box会自动检查并报错提醒你它的默认path下找不到这个文件，这时候你就知道这个默认path叫啥了。
如果你不想用本地文件的方式，那么你自己在本地起一个fileserver提供一个文件链接就行了。

naive配置里我加了"udp_over_tcp": true来让naive的udp都通过tcp发送到服务端，因为我们配置的服务端443端口的tcp给了naive，udp给了hy2协议，分别监听的。

开始上网

就点击启动就可以了，如果报错会有弹窗提示，或者看app的日志里内容。

参考

https://sing-box.sagernet.org/
https://github.com/SagerNet/sing-box