You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

185 lines
7.9 KiB

  1. Skip to [recipes](#recipes) for quick setup instructions
  2. # components
  3. `ss-local` provides SOCKS5 proxy with UDP associate support.
  4. socks5 ss plain
  5. --------> tcp:local_address:local_port ----> ss server -------> dest
  6. `ss-redir`. The REDIRECT and TPROXY part are to be provided by `ss-rules` script. REDIRECT is for tcp traffic (`SO_ORIGINAL_DST` only supports TCP). TPROXY is for udp messages, but it's only available in the PREROUTING chain and as such cannot proxy local out traffic.
  7. plain plain ss plain
  8. ---------> REDIRECT ------> tcp:local_address:local_port ----> ss server -----> original dest
  9. plain plain ss plain
  10. ---------> TPROXY -------> udp:local_address:local_port -----> ss server -----> original dest
  11. `ss-tunnel` provides ssh `-L` local-forwarding-like tunnel. Typically it's used to tunnel DNS traffic to the remote.
  12. plain ss plain
  13. ---------> tcp|udp:local_address:local_port ------> ss server -------> tunnel_address
  14. `ss-server`, the "ss server" in the above diagram
  15. # uci
  16. Option names are the same as those used in json config files. Check `validate_xxx` func definition of the [service script](files/shadowsocks-libev.init) and shadowsocks-libev's own documentation for supported options and expected value types. A [sample config file](files/shadowsocks-libev.config) is also provided for reference.
  17. Every section have a `disabled` option to temporarily turn off the component instance or component instances referring to it.
  18. Section type `server` is for definition of remote shadowsocks servers. They will be referred to from other component sections and as such should be named (as compared to anonymous section).
  19. Section type `ss_local`, `ss_redir`, `ss_tunnel` are for specification of shadowsocks-libev components. They share mostly a common set of options like `local_port`, `verbose`, `fast_open`, `timeout`, etc.
  20. Plugin options should be specified in `server` section and will be inherited by other compoenents referring to it.
  21. We can have multiple instances of component and `server` sections. The relationship between them is many-to-one. This will have the following implications
  22. - It's possible to have both `ss_local` and `ss_redir` referring to the same `server` definition
  23. - It's possible to have multiple instances of `ss_redir` listening on the same address:port with `reuse_port` enabled referring to the same or different `server` sections
  24. `ss_rules` section is for configuring the behaviour of `ss-rules` script. There can only exist at most one such section with the name also being `ss_rules`
  25. redir_tcp name of ss_redir section with mode tcp_only or tcp_and_udp
  26. redir_udp name of ss_redir section with mode udp_only or tcp_and_udp
  27. ifnames only apply rules on packets from these ifnames
  28. --- for incoming packets having source address in
  29. src_ips_bypass will bypass the redir chain
  30. src_ips_forward will always go through the redir chain
  31. src_ips_checkdst will continue to have their destination addresses checked
  32. --- otherwise, the default action can be specified with
  33. src_default bypass, forward, [checkdst]
  34. --- if the previous check result is checkdst,
  35. --- then packets having destination address in
  36. dst_ips_bypass_file
  37. dst_ips_bypass will bypass the redir chain
  38. dst_ips_forward_file
  39. dst_ips_forward will go through the redir chain
  40. --- otherwise, the default action can be specified with
  41. dst_default [bypass], forward
  42. --- for local out tcp packets, the default action can be specified with
  43. local_default [bypass], forward, checkdst
  44. Bool option `dst_forward_recentrst` requires iptables/netfilter `recent` match module (`opkg install iptables-mod-conntrack-extra`). When enabled, `ss-rules` will setup iptables rules to forward through `ss-redir` those packets whose destination have recently sent to us multiple tcp-rst.
  45. ss-rules uses kernel ipset mechanism for storing addresses/networks. Those ipsets are also part of the API and can be populated by other programs, e.g. dnsmasq with builtin ipset support. For more details please read output of `ss-rules --help`
  46. Note also that `src_ips_xx` and `dst_ips_xx` actually also accepts cidr network representation. Option names are retained in its current form for backward compatibility coniderations
  47. # incompatible changes
  48. | Commit date | Commit ID | Subject | Comment |
  49. | ----------- | --------- | ------- | ------- |
  50. | 2019-05-09 | afe7d3424 | shadowsocks-libev: move plugin options to server section | This is a revision against c19e949 committed 2019-05-06 |
  51. | 2017-07-02 | b61af9703 | shadowsocks-libev: rewrite | Packaging of shadowsocks-libev was rewritten from scratch |
  52. # notes and faq
  53. Useful paths and commands for debugging
  54. # check current running status
  55. ubus call service list '{"name": "shadowsocks-libev"}'
  56. ubus call service list '{"name": "shadowsocks-libev", "verbose": true}'
  57. # dump validate definition
  58. ubus call service validate '{"package": "shadowsocks-libev"}'
  59. ubus call service validate '{"package": "shadowsocks-libev"}' \
  60. | jsonfilter -e '$["shadowsocks-libev"]["ss_tunnel"]'
  61. # check json config
  62. ls -l /var/etc/shadowsocks-libev/
  63. # set uci config option verbose to 1, restart the service and follow the log
  64. logread -f
  65. ss-redir needs to open a new socket and setsockopt IP_TRANSPARENT when sending udp reply to client. This requires `CAP_NET_ADMIN` and as such the process cannot run as `nobody`
  66. ss-local, ss-redir, etc. supports specifying an array of remote ss server, but supporting this in uci seems to be overkill. The workaround can be defining multiple `server` sections and multiple `ss-redir` instances with `reuse_port` enabled
  67. # recipes
  68. ## forward all
  69. This will setup firewall rules to forward almost all incoming tcp/udp and locally generated tcp traffic (excluding those to private addresses like 192.168.0.0/16 etc.) through remote shadowsocks server
  70. Install components.
  71. Retry each command till it succeed
  72. opkg install shadowsocks-libev-ss-redir
  73. opkg install shadowsocks-libev-ss-rules
  74. opkg install shadowsocks-libev-ss-tunnel
  75. Edit uci config `/etc/config/shadowsocks-libev`.
  76. Replace `config server 'sss0'` section with parameters of your own remote shadowsocks server.
  77. As for other options, change them only when you know the effect.
  78. config server 'sss0'
  79. option disabled 0
  80. option server '_sss_addr_'
  81. option server_port '_sss_port_'
  82. option password '********'
  83. option method 'aes-256-cfb'
  84. config ss_tunnel
  85. option disabled 0
  86. option server 'sss0'
  87. option local_address '0.0.0.0'
  88. option local_port '8053'
  89. option tunnel_address '8.8.8.8:53'
  90. option mode 'tcp_and_udp'
  91. config ss_redir ssr0
  92. option disabled 0
  93. option server 'sss0'
  94. option local_address '0.0.0.0'
  95. option local_port '1100'
  96. option mode 'tcp_and_udp'
  97. option reuse_port 1
  98. config ss_rules 'ss_rules'
  99. option disabled 0
  100. option redir_tcp 'ssr0'
  101. option redir_udp 'ssr0'
  102. option src_default 'checkdst'
  103. option dst_default 'forward'
  104. option local_default 'forward'
  105. Restart shadowsocks-libev components
  106. /etc/init.d/shadowsocks-libev restart
  107. Check if things are in place
  108. iptables-save | grep ss_rules
  109. netstat -lntp | grep -E '8053|1100'
  110. ps ww | grep ss-
  111. Edit `/etc/config/dhcp`, making sure options are present in the first dnsmasq section like the following to let it use local tunnel endpoint for upstream dns query.
  112. Option `noresolv` instructs dnsmasq to not use other dns servers like advertised by local isp.
  113. Option `localuse` intends to make sure the device you are configuring also uses this dnsmasq instance as the resolver, not the ones from other sources.
  114. config dnsmasq
  115. ...
  116. list server '127.0.0.1#8053'
  117. option noresolv 1
  118. option localuse 1
  119. Restart dnsmasq
  120. /etc/init.d/dnsmasq restart
  121. Check network on your computer
  122. nslookup www.google.com
  123. curl -vv https://www.google.com