Skip to content

Instantly share code, notes, and snippets.

@Eminlin

Eminlin/client.json

Last active January 1, 2024 11:33
Show Gist options
  • Save Eminlin/88684f6581bf78e0a92dc7e520b6dd95 to your computer and use it in GitHub Desktop.
Save Eminlin/88684f6581bf78e0a92dc7e520b6dd95 to your computer and use it in GitHub Desktop.
Download ZIP
v2ray服务器配置笔记
Raw
readme.md

前言

  • Nginx(反代) + Websocket + SSL + Docker(防云盾检测进程)方案

一些方案

一些云厂商

  • AWS 信用卡可以可以撸免费额度，选日本节点，所谓的 Global 加速也没有很理想
  • GCP 谷歌云 这个可以作为备选，台湾节点理想，要注意的是，访问谷歌云需要梯子
  • 阿里云 轻量服务器为首选，新加坡节点比较理想
  • Azure 还没尝试，感觉大同小异，不折腾这个了

查看节点走向

  • ipip.net router trace

一些常识

  • 国际出口线路海底就那几条，所以高峰时期会慢是没办法的

推荐配置

  • CentOS 7 x64

准备工作

  • 一台国际服务器，并允许SSH连接
  • 开启80 443端口
  • 域名
  • 域名对应 SSL 证书
  • 新建目录 /etc/v2ray
  • 安装nginx并设置开机启动
  • sudo yum update
  • 注意证书的配置

开启 SSH

vi /etc/ssh/sshd_config

PermitRootLogin yes           //默认为no，需要开启root用户访问改为yes
PasswordAuthentication yes    //默认为no，改为yes开启密码登陆

service sshd restart # 重启 SSH 服务

安装 Nginx

sudo yum install -y nginx # 安装

sudo systemctl enable nginx # 设置开机启动 

sudo service nginx start # 启动 nginx 服务

安装 Docker

sudo yum install -y docker

sudo systemctl enable docker

sudo systemctl start docker

或使用一键安装

curl -fsSL get.docker.com -o get-docker.sh

安装 V2ray

sudo docker pull v2ray/official
  • 设置本地代理端口，映射配置文件
sudo docker run -d --name Emin -v /etc/v2ray:/etc/v2ray -p 127.0.0.1:666:666 v2ray/official  v2ray -config=/etc/v2ray/config.json

sudo docker container restart Emin # 重启容器

sudo docker container logs Emin # 查看日志

docker update --restart=always Emin # 自动启动容器

nginx.conf

wget
https://gist.githubusercontent.com/Eminlin/88684f6581bf78e0a92dc7e520b6dd95/raw/439df17d075991db7050e21d29e21414edaf9001/nginx.conf

config.json

wget 
https://gist.githubusercontent.com/Eminlin/88684f6581bf78e0a92dc7e520b6dd95/raw/2e18521df37a6f777aa8bc1c303151da06cb886a/config.json

可能需要的命令

vim /var/log/nginx/error.log 

systemctl status nginx.service -l

sudo docker container logs v2ray

问题收集

  • 客户端提示 502 Bad Gateway > websocket: bad handshake

    • 从nginx入手 查看日志

    • 权限不足，选择关闭SELinux

    • 查看/usr/sbin/sestatus -v

    • 修改/etc/selinux/config 文件

      将SELINUX=enforcing改为SELINUX=disabled

      重启机器即可

  • connect() failed (111: Connection refused) while connecting to upstream

    • v2ray 未启动成功
*521 connect() to 127.0.0.1:666 failed (13: Permission denied) while connecting to upstream, client: 218.85.120.242, server: brazil.emin.ink, request: "GET /emin HTTP/1.1", upstream: "http://127.0.0.1:666/emin", host: "brazil.emin.ink"

开启 BBR

https://juejin.im/entry/6844903669830254600

Raw
client.json
{
"policy": {
"system": {
"statsInboundUplink": true,
"statsInboundDownlink": true
}
},
"log": {
"access": "",
"error": "",
"loglevel": "warning"
},
"inbounds": [
{
"tag": "proxy",
"port": 10808,
"listen": "127.0.0.1",
"protocol": "socks",
"sniffing": {
"enabled": true,
"destOverride": [
"http",
"tls"
]
},
"settings": {
"auth": "noauth",
"udp": true,
"ip": null,
"address": null,
"clients": null
},
"streamSettings": null
},
{
"tag": "api",
"port": 49417,
"listen": "127.0.0.1",
"protocol": "dokodemo-door",
"sniffing": null,
"settings": {
"auth": null,
"udp": false,
"ip": null,
"address": "127.0.0.1",
"clients": null
},
"streamSettings": null
}
],
"outbounds": [
{
"tag": "proxy",
"protocol": "vmess",
"settings": {
"vnext": [
{
"address": "domain or ip",
"port": 443,
"users": [
{
"id": "uuid",
"alterId": 64,
"email": "email",
"security": "auto"
}
]
}
],
"servers": null,
"response": null
},
"streamSettings": {
"network": "ws",
"security": "tls",
"tlsSettings": {
"allowInsecure": false,
"serverName": null
},
"tcpSettings": null,
"kcpSettings": null,
"wsSettings": {
"connectionReuse": true,
"path": "/path",
"headers": null
},
"httpSettings": null,
"quicSettings": null
},
"mux": {
"enabled": false
}
},
{
"tag": "direct",
"protocol": "freedom",
"settings": {
"vnext": null,
"servers": null,
"response": null
},
"streamSettings": null,
"mux": null
},
{
"tag": "block",
"protocol": "blackhole",
"settings": {
"vnext": null,
"servers": null,
"response": {
"type": "http"
}
},
"streamSettings": null,
"mux": null
}
],
"stats": {},
"api": {
"tag": "api",
"services": [
"StatsService"
]
},
"dns": null,
"routing": {
"domainStrategy": "IPIfNonMatch",
"rules": [
{
"type": "field",
"port": null,
"inboundTag": [
"api"
],
"outboundTag": "api",
"ip": null,
"domain": null
}
]
}
}
Raw
config.json
{
"stats": {},
"api": {
"tag": "api",
"services": [
"StatsService"
]
},
"inbounds": [
{
"port": 666,
//"listen":"127.0.0.1",//只监听 127.0.0.1
"protocol": "vmess",
"settings": {
"clients": [
{
"email":"email",
"id": "uuid",
"level": 1,
"alterId": 64
}
]
},
"streamSettings": {
"network": "ws",
"tlsSettings": {
"allowInsecure": false
},
"wsSettings": {
"path": "/path"
}
},
"sniffing": {
"enabled": true,
"destOverride": ["http", "tls"]
}
},
{
"listen": "127.0.0.1",
"port": 10085,
"protocol": "dokodemo-door",
"settings": {
"address": "127.0.0.1"
},
"tag": "api"
}
],
"outbounds": [{
"protocol": "freedom",
"settings": {}
},
{
"protocol": "blackhole",
"settings": {
},
"tag": "blocked"
}],
"policy":{
"levels": {
"0": {
"handshake": 4,
"connIdle": 300,
"uplinkOnly": 2,
"downlinkOnly": 2,
"statsUserUplink": true,
"statsUserDownlink": true,
"bufferSize": 1024//1M
},
"1": {
"handshake": 4,
"connIdle": 300,
"uplinkOnly": 2,
"downlinkOnly": 5,
"statsUserUplink": true,
"statsUserDownlink": true,
"bufferSize": 20480//20M
}
},
"system": {
"statsInboundUplink": true,
"statsInboundDownlink": true
}
},
"routing": {
"rules": [
{
"inboundTag": [
"Api"
],
"type": "field",
"ip": ["geoip:private"],
"outboundTag": "api"
},
{
"domaIN":[
//"pornhub.com",
//"app.swag.live",
//"swag.live",
"a.live"
//"twitter.com",
//"facebook.com"
],
"type": "field",
"outboundTag":"blocked"
},
{
"type": "field",
"outboundTag": "block",
"protocol": [
"bittorrent"
]
}
]
},
"strategy": "rules"
}
Raw
nginx.conf
# For more information on configuration, see:
# * Official English Documentation: http://nginx.org/en/docs/
# * Official Russian Documentation: http://nginx.org/ru/docs/
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;
events {
use epoll;
worker_connections 1024;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
proxy_connect_timeout 1800;
proxy_send_timeout 1800;
proxy_read_timeout 1800;
send_timeout 1800;
client_max_body_size 2048M;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 1800;
types_hash_max_size 2048;
include /etc/nginx/mime.types;
default_type application/octet-stream;
# Load modular configuration files from the /etc/nginx/conf.d directory.
# See http://nginx.org/en/docs/ngx_core_module.html#include
# for more information.
include /etc/nginx/conf.d/*.conf;
server {
listen 80 default_server;
#listen 80 udp;
listen [::]:80 default_server;
server_name yourServer;
root /usr/share/nginx/html;
index index.html;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
location / {
root /usr/share/nginx/html;
index index.html;
}
error_page 404 /404.html;
location = /40x.html {
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
}
}
# Settings for a TLS enabled server.
#
server {
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
server_name yourServer;
root /usr/share/nginx/html;
index index.html;
ssl_certificate /etc/v2ray/a.crt;
ssl_certificate_key /etc/v2ray/a.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 10m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
location /emin {
if ($http_upgrade != "websocket") { # WebSocket协商失败时返回404
return 404;
}
proxy_redirect off;
proxy_pass http://127.0.0.1:666; #
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
# Show real IP in v2ray access.log
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
error_page 404 /404.html;
location = /40x.html {
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment