ERLite配合群晖Docker做路由器梯子

注意:本文仅用做技术交流,任何因尝试本文内步骤所导致的法律后果由您自行承担

局域网网段:192.168.1.0/24 网关192.168.1.254
群晖网段:192.168.0.0/24 网关192.168.0.254
由于家里群晖是单网口的版本,本次采用Docker的macvlan功能来为容器分配独立的IP
配置使用V2Ray的sniffing功能,故无需配置无污染DNS

本文部分配置参考于 新 V2Ray 白话文指南

路由器配置(EdgeRouter Lite)

configure
set firewall group network-group CNIP network 1.0.1.0/24
set firewall group network-group CNIP network 1.0.2.0/23
set firewall group network-group CNIP network 1.0.8.0/21
set firewall group network-group CNIP network 1.0.32.0/19
set firewall group network-group CNIP network 1.1.0.0/24
set firewall group network-group CNIP network 1.1.2.0/23
set firewall group network-group CNIP network 1.1.4.0/22
set firewall group network-group CNIP network 1.1.8.0/21
……
#配置大陆IP段的network-group
#相关信息来自IPIP.net的china_ip_list

commit #跑了差不多半个小时
save #保存以防出意外再跑半个小时

set protocols static table 10 route 0.0.0.0/0 next-hop 192.168.0.2 #设置转发路由表

set firewall modify CNIP rule 10 action accept
set firewall modify CNIP rule 10 protocol tcp
set firewall modify CNIP rule 10 source address 192.168.0.0/24 #设置跳过群晖的规则

set firewall modify CNIP rule 20 action accept
set firewall modify CNIP rule 20 protocol tcp
set firewall modify CNIP rule 20 destination group network-group CNIP #设置跳过大陆IP段

set firewall modify CNIP rule 99 action modify
set firewall modify CNIP rule 99 protocol tcp
set firewall modify CNIP rule 99 modify table 10 #其余流量走路由表10

set interfaces ethernet eth0 firewall in modify CNIP #在局域网接口in方向调用modify规则

commit
save

群晖配置

在控制面板的网络界面中打开Open vSwitch

Dockerfile

FROM v2fly/v2fly-core:v4.34.0

RUN echo 'http://mirrors.aliyun.com/alpine/latest-stable/community/'>/etc/apk/repositories && echo 'http://mirrors.aliyun.com/alpine/latest-stable/main/'>>/etc/apk/repositories && apk add --no-cache iptables
RUN echo -ne "#!/bin/sh\niptables -t nat -N V2RAY\niptables -t nat -A V2RAY -d 192.168.0.0/16 -j RETURN\niptables -t nat -A V2RAY -p tcp -j REDIRECT --to-ports 12345\niptables -t nat -A PREROUTING -p tcp -j V2RAY\n/usr/bin/v2ray -config /etc/v2ray/config.json" > /opt/setiptables.sh && chmod +x /opt/setiptables.sh && cat /opt/setiptables.sh

CMD ["/bin/sh","/opt/setiptables.sh"]
cd V2Ray/docker #进入Dockerfile所在目录
sudo docker build . -t mom0a/v2ray_iptables
sudo docker network create -d macvlan --subnet=192.168.0.0/24 --gateway=192.168.0.254 -o parent=ovs_eth0 Router #创建macvlan网络
sudo docker run -itd --network=Router --ip 192.168.0.2 --name v2ray_iptables mom0a/v2ray_iptables #运行并指定容器IP

然后进入容器的编辑界面,勾选「使用高权限执行容器」,并映射v2ray的配置文件到/etc/v2ray/config.json即可

配置文件参考(GeoSite规则来自 @Loyalsoldier/v2ray-rules-dat):

{
    "inbounds": [
        {
            "port": 12345,
            "protocol": "dokodemo-door",
            "settings": {
                "network": "tcp",
                "followRedirect": true
            },
            "sniffing": {
                "enabled": true,
                "destOverride": ["http", "tls"]
            },
            "streamSettings": {
                "sockopt": {
                    "tproxy": "redirect"
                }
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "freedom",
            "settings": {}
        },
        {
            "protocol": "blackhole",
            "settings": {
                "response": {
                    "type": "http"
                }
            },
            "tag": "block"
        },
        {
            "tag": "proxy",
            "protocol": "trojan",
            "settings": {
                "servers": [
                    {
                        "address": "???.???.???.???",
                        "port": ?????,
                        "password": "????????-????-????-????-????????????"
                    }
                ]
            },
            "streamSettings": {
                "network": "tcp",
                "security": "tls",
                "tlsSettings": {
                    "serverName": "??????????",
                    "allowInsecure": false,
                    "alpn": [
                        "http/1.1"
                    ]
                }
            }
        }
    ],
    "routing": {
        "domainStrategy": "AsIs",
        "rules": [
            {
                "type": "field",
                "outboundTag": "block",
                "protocol": ["bittorrent"]
            },
            {
                "type": "field",
                "outboundTag": "block",
                "ip": [
                    "0.0.0.0/8",
                    "10.0.0.0/8",
                    "100.64.0.0/10",
                    "127.0.0.0/8",
                    "169.254.0.0/16",
                    "172.16.0.0/12",
                    "192.0.0.0/24",
                    "192.0.2.0/24",
                    "192.88.99.0/24",
                    "192.168.0.0/16",
                    "198.18.0.0/15",
                    "198.51.100.0/24",
                    "203.0.113.0/24",
                    "224.0.0.0/4",
                    "240.0.0.0/4",
                    "255.255.255.255/32",
                    "::/128",
                    "::1/128",
                    "100::/64",
                    "64:ff9b::/96",
                    "fc00::/7",
                    "fe80::/10",
                    "ff00::/8"
                ]
            },
            {
                "type": "field",
                "ip": [
                    "geoip:telegram"
                ],
                "outboundTag": "proxy"
            },
            {
                "type": "field",
                "domain": [
                    "geosite:gfw",
                    "geosite:greatfire",
                    "geosite:netflix",
                    "geosite:bahamut"
                ],
                "outboundTag": "proxy"
            }
        ]
    }
}

PS:如果群晖也需要走代理,在v2ray中开放一个inbound并在群晖中设置代理服务器即可
PS2: geoip.dat 和 geosite.dat 映射到 /usr/bin 目录下

PS3:放个开机流程感受一下(27分钟的时候电脑休眠了,实际上大概还要再往后10分钟左右)

点击加载

PS4:因为节点有时会玄学断流需要fallback组又不想配DNS于是V2Ray+Clash的畸形组合诞生了
PS5:如果不想把群晖放到单独的网段,可以配上一个只给V2Ray用的VLAN,然后添加虚拟接口,在macvlan上绑定就好了

sudo vim /usr/local/etc/rc.d/00-dockervlan.sh
#!/bin/sh
#
# Put this file in /usr/local/etc/rc.d/your_script.sh

case "$1" in
stop)
 echo "[Stop]"
 ;;
start) 
 sudo ovs-vsctl add-br ovs_eth0_2 ovs_eth0 2 #VLAN 2
 sudo ip link set ovs_eth0_2 up
 ;;
restart)
 echo "[Restart]"
 ;; 
status)
 echo "[Status]"
 ;;
*)
 echo "usage: $0 { start | stop | restart | status}" >&2
        exit 1
        ;;
esac
chmod +x /usr/local/etc/rc.d/00-dockervlan.sh

标签: 群晖, synology, ubnt, edgerouter, v2ray, iptables, ipset, pbr

添加新评论