banner
xingli

xingli

猫娘爱好者
首頁封存Linux

singBox服務端搭建

#linux339
AI 翻譯
這篇文章透過AI由簡體中文翻譯成繁體中文。查看原文
AI 生成的摘要
這是一個用於安裝VMESS/VLESS/TROJAN/SHADOWSOCKS的自用脚本。脚本只用於隧道或IPLC/IEPL中轉，不進行任何偽裝。需要在伺服器建立特定目錄結構，包括data/config.json、data/entry.sh和tls/docker-compose.yml等文件。使用docker compose來啟動容器，並提供entry.sh腳本來啟動服務。配置文件config.json是關鍵的設置文件，包含了日誌、入站和出站設置等信息。

腳本安裝#

VMESS/VLESS/TROJAN/SHADOWSOCKS

  • 自用腳本，此腳本只為隧道或 IPLC/IEPL 中轉而生，無任何偽裝
  • Trojan 的 tls 除非自定義證書路徑，否則也是本地生成的無效證書
  • Trojan 非自定義證書路徑請務必開啟: skip-cert-verify: true

一鍵腳本#

bash <(curl -fsSL https://raw.githubusercontent.com/Slotheve/SingBox/main/singbox.sh)

Docker 安裝#

配置示例

{
    "log": {
        "level": "trace",
        "output": "/data/sing-box.log",
        "timestamp": true
    },
    "inbounds": [
        {
            "type": "shadowsocks",
            "listen": "::",
            "listen_port": 25550,
            "method": "chacha20-ietf-poly1305",
            "password": "IloveNekopara"
        }
    ],
    "outbounds": [
        {
            "type": "direct",
            "tag": "direct"
        },
        {
            "type": "block",
            "tag": "block"
        },
        {
            "type": "dns",
            "tag": "dns-out"
        }
    ],
    "route": {
        "geoip": {
            "path": "/data/geoip.db",
            "download_url": "https://github.com/SagerNet/sing-geoip/releases/latest/download/geoip.db",
            "download_detour": "direct"
        },
        "geosite": {
            "path": "/data/geosite.db",
            "download_url": "https://github.com/SagerNet/sing-geosite/releases/latest/download/geosite.db",
            "download_detour": "direct"
        },
        "rules": [
            {
                "protocol": "dns",
                "outbound": "dns-out"
            }
        ],
        "final": "direct",
        "auto_detect_interface": true
    }
}

1. 文件目錄#

需要在伺服器構建如下目錄結構：

sing-box
├── data
    ├── config.json
    ├── entry.sh
└── tls
└── docker-compose.yml

其中，data/config.json是sing-box的配置文件，所有節點配置信息都在裡面。

data/entry.sh是容器啟動腳本。

tls 文件夾用於存儲 tls 證書，sing-box可以自動頒發證書，你也可以使用自己現有的證書。如果自動頒發，就空文件夾就行，運行後該目錄下會生成證書文件；如果要使用現有證書，可以將證書拷貝到當前文件夾下。

2. docker compose#

docker-compose.yml參考內容如下：

version: '3'

services:
  sing-box:
    image: ghcr.io/sagernet/sing-box
    container_name: sing-box
    restart: unless-stopped
    network_mode: "host"
    # ports:
      # - 80:80
      # - 443:443
      # - 8090:8090
      # - 10080-10099:10080-10099/udp
    volumes:
      - ./data:/data
      - ./tls:/tls
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
    entrypoint: ["/bin/bash", "/data/entry.sh"]

其中，網路模式使用了network_mode: "host"，直接使用了宿主機的網路環境，需要關閉宿主機的防火牆，命令如下：

# CentOS：
systemctl disable firewalld

# Debian/Ubuntu：
sudo ufw disable

如果host模式有問題，也可以切換到指定 ports 模式（註釋掉network_mode，然後刪掉下方 prots 的註釋）

3. entry.sh#

參考內容如下：

#!/bin/bash
set -e

configFilePath="/data/config.json"
logFilePath="/data/sing-box.json"

echo "entry"
sing-box version

# https://sing-box.sagernet.org/configuration/
echo -e "\nconfig:"
sing-box check -c $configFilePath || cat $configFilePath
sing-box format -c /data/config.json -w
cat $configFilePath

echo -e "\nstarting"
sing-box run -c $configFilePath
tail -f $logFilePath

會輸出sing-box版本，檢查並格式化配置文件，啟動sing-box，並追蹤日誌。

4. config.json#

最關鍵的配置文件，參考內容如下：

{
    "log": {
      "level": "trace",
      "output": "/data/sing-box.log",
      "timestamp": true
    },
    "inbounds": [
      {
        "type": "hysteria",
        "tag": "hysteria-in",
        "listen": "0.0.0.0",
        "listen_port": 10080,
        "domain_strategy": "ipv4_only",
        "up_mbps": 50,
        "down_mbps": 50,
        "obfs": "nicetofuckyou",
        "users": [
          {
            "name": "<proxy_name>",
            "auth_str": "<proxy_pwd>"
          }
        ],
        "tls": {
          "enabled": true,
          "server_name": "<domain>",
          "acme": {
            "domain": "<domain>",
            "data_directory": "/tls",
            "default_server_name": "<domain>",
            "email": "<email>"
          }
        }
      },
      {
        "type": "naive",
        "tag": "naive-in",
        "listen": "0.0.0.0",
        "listen_port": 8090,
        "domain_strategy": "ipv4_only",
        "users": [
          {
            "username": "<proxy_name>",
            "password": "<proxy_pwd>"
          }
        ],
        "network": "tcp",
        "tls": {
          "enabled": true,
          "server_name": "<domain>",
          "acme": {
            "domain": "<domain>",
            "data_directory": "/tls",
            "default_server_name": "<domain>",
            "email": "<email>"
          }
        }
      }
    ],
    "outbounds": [
      {
        "type": "direct",
        "tag": "direct"
      },
      {
        "type": "block",
        "tag": "block"
      },
      {
        "type": "dns",
        "tag": "dns-out"
      }
    ],
    "route": {
      "geoip": {
        "path": "/data/geoip.db",
        "download_url": "https://github.com/SagerNet/sing-geoip/releases/latest/download/geoip.db",
        "download_detour": "direct"
      },
      "geosite": {
        "path": "/data/geosite.db",
        "download_url": "https://github.com/SagerNet/sing-geosite/releases/latest/download/geosite.db",
        "download_detour": "direct"
      },
      "rules": [
        {
          "protocol": "dns",
          "outbound": "dns-out"
        }
      ],
      "final": "direct",
      "auto_detect_interface": true
    }
  }

其中，有幾處需要替換的地方：

  • <proxy_name>替換為代理的用戶名，自行取，如Ray
  • <proxy_pwd>替換為代理的密碼，自行取，如1234@qwer
  • <domain>替換為域名
  • <email>替換為郵箱
  • obfs是hysteria混淆字符串，可以自定義

如上就配置了兩個節點，一個基於 udp 的 10080 端口的hysteria節點，一個基於 tcp 的 8090 端口的naive節點。

如果你的雲上有安全策略，請確保這兩個端口都開放了。

證書的話，如果 tls 目錄下沒有現有證書，會自動頒發。

其他配置可以查閱官方文檔了解。

5. 運行#

在docker-compose.yml同級目錄下，執行：

docker compose up -d

等待容器啟動。

如果一切正常，就是啟動成功，可以去使用自己的客戶端連接了。（就是這麼簡單）

其他參考指令：

# 查看當前運行中的容器
docker ps

# 查看容器啟動日誌
docker logs sing-box

# 追蹤容器運行日誌（使用Ctrl C退出追蹤）
docker logs -f sing-box

# 進入容器
docker exec -it sing-box bash

完全手動安裝#

wget https://github.com/SagerNet/sing-box/releases/download/v1.7.2/sing-box-1.7.2-linux-amd64.tar.gz
tar -zxvf sing-box-1.7.2-linux-amd64.tar.gz

Reality#

root@xiaolv:~/singbox# ./sing-box generate reality-keypair
PrivateKey: GPqJLU6HiFGE4EnuRoj7PUR3Eb2yr0vVycZVwaoQXng
PublicKey: cE6e-BbY2zu-8TMEb6sWSh8PTemcd-hqVfaUFtAoAzI

{
    "inbounds": [
        {
            "type": "vless",
            "tag": "vless-in",
            "listen": "::",
            "listen_port": 25001,
            "sniff": true,
            "sniff_override_destination": true,
            "users": [
                {
                    "uuid": "3e8e5eae-6720-4668-8187-052840b385a7",
                    "flow": "xtls-rprx-vision"
                }
            ],
            "tls": {
                "enabled": true,
                "server_name": "oceanhero.today",
                "reality": {
                    "enabled": true,
                    "handshake": {
                        "server": "oceanhero.today",
                        "server_port": 443
                    },
                    "private_key": "GPqJLU6HiFGE4EnuRoj7PUR3Eb2yr0vVycZVwaoQXng",
                    "short_id": [
                        "8535dfc6b2e73c78"
                    ]
                }
            }
        }
    ],
    "outbounds": [
        {
            "type": "direct"
        }
    ]
}

Config

{
    "inbounds": [
        {
            "type": "shadowsocks",
            "listen": "::",
            "listen_port": 25565,
            "method": "2022-blake3-aes-128-gcm",
            "password": "LZ/4gLsyAbJQCWdT6iu1aQ==", // 執行 sing-box generate rand 16 --base64 生成
            "multiplex": {
                "enabled": true
            }
        }
    ],
    "outbounds": [
        {
            "type": "direct"
        }
    ]
}

{
    "inbounds": [
        {
            "type": "shadowsocks",
            "listen": "::",
            "listen_port": 25565,
            "method": "chacha20-ietf-poly1305",
            "password": "LZ/4gLsyAbJQCWdT6iu1aQ==", // 執行 sing-box generate rand 16 --base64 生成
            "multiplex": {
                "enabled": true
            }
        }
    ],
    "outbounds": [
        {
            "type": "direct"
        }
    ]
}

系統服務#

vim /etc/systemd/system/singbox.service

[Unit]
Description=singbox
After=network.target

[Service]
ExecStart=/root/singbox/sing-box run -C /root/singbox
Restart=always
User=root

[Install]
WantedBy=multi-user.target

分流規則示例#

{
    "inbounds": [
        {
            "type": "shadowsocks",
            "listen": "::",
            "listen_port": 2023,
            "method": "chacha20-ietf-poly1305",
            "password": "LZ/4gLsyAbJQCWdT6iu1aQ==",
            "multiplex": {
                "enabled": true
            }
        }
    ],
    "outbounds": [
        {
            "type": "direct",
            "tag": "direct"
        },
        {
            "type": "socks",
            "tag": "hosthijack",
            "server": "74.48.100.149",
            "server_port": 10800,
            "version": "5",
            "username": "neko",
            "password": "Vzkjs&Cm4@#TT5"
        },
        {
            "type": "block",
            "tag": "block"
        },
        {
            "type": "dns",
            "tag": "dns-out"
        }
    ],
    "route": {
        "geoip": {
            "download_url": "https://github.com/soffchen/sing-geoip/releases/latest/download/geoip.db",
            "download_detour": "proxy"
        },
        "geosite": {
            "download_url": "https://github.com/soffchen/sing-geosite/releases/latest/download/geosite.db",
            "download_detour": "proxy"
        },
        "rules": [
            {
                "protocol": "dns",
                "outbound": "dns-out"
            },
            {
                "protocol": [
                    "quic"
                ],
                "outbound": "block"
            },
            {
                "domain": [
                    "ip.sb",
                    "ai.com",
                    "claude.ai",
                    "geosite:openai",
                    "cdn.openai.com",
                    "chat.openai.com",
                    "pay.openai.com",
                    "challenges.cloudflare.com",
                    "auth0.openai.com",
                    "platform.openai.com",
                    "invoice.stripe.com",
                    "stripe.com"
                ],
                "outbound": "hosthijack"
            }
        ],
        "auto_detect_interface": true
    }
}
載入中......
此文章數據所有權由區塊鏈加密技術和智能合約保障僅歸創作者所有。