|
|
|
本帖最后由 johnny 于 2019-5-16 20:18 编辑
1. Introduction
Trojan GFW is described as "an unidentifiable mechanism that helps you bypass GFW. It imitates the most common protocol across the wall, HTTPS, to trick GFW into thinking that it is HTTPS."
Trojan documentation is located at:
https://trojan-gfw.github.io/trojanhttps://trojan-gfw.github.io/trojan
The Github repository is located at:
https://github.com/trojan-gfw/trojanhttps://github.com/trojan-gfw/trojan
In this post, we install Trojan GFW server on an Ubuntu 18.10 server and Trojan GFW client on a Windows 10 PC.
2. Obtain Domain Name
You can use a paid or a free domain name. We will obtain a free domain name from:
https://www.freenom.comhttps://www.freenom.com
In this post, our example domain name is exdom.cf
3. Obtain VPS
In this post, we use a t2.micro instance from Amazon Web Services (AWS). The operating system is intially Ubuntu Server 18.04 LTS, although we will upgrade it to Ubuntu Server 18.10. The instance has 1 vCPU and 1 GB of memory. It has 8 GB of storage. In the security groups, the open ports are SSH TCP/22 from "My IP" only, and HTTP TCP/80 from "Anywhere" plus HTTPS TCP/443 from "Anywhere". Authentication is by a key pair consisting of a public key that AWS stores and a private key that you store.
After launch, AWS allocates the instance an IPv4 Public IP, for example, 18.19.20.21.
Back at the Freenom website, create a Freedom DNS "A" record pointing from http://www.exdom.cf]www.exdom.cf to (in this example) 18.19.20.21.
4. Prepare VPS
SSH or PuTTY into the instance [url]www.exdom.cf as the default user. On an AWS instance running Ubuntu 18.04, the default user is named ubuntu.
Update all the packages:
sudo apt-get update
sudo apt-get upgrade
sudo apt-get dist-upgrade
sudo apt autoremove
Now upgrade from Ubuntu 18.04 to Ubuntu 18.10. To do this, edit the sources list:
sudo vi /etc/apt/sources.list
Change all instances of bionic to cosmic. Write the sources list to disk, and quit the editor. Then completely update your system from Ubuntu 18.04 to Ubuntu 18.10:
sudo apt-get update
sudo apt-get upgrade
sudo apt-get dist-upgrade
sudo apt autoremove
sudo reboot
On AWS, you can use Security Groups to control access to port 22. On other VPS providers, you can use iptables as your firewall. For example, if your Windows 10 PC has a static IP address of 55.55.55.55:
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -s 55.55.55.55/32 -j ACCEPT
sudo iptables -P INPUT DROP
sudo apt-get install iptables-persistent
If your VPS provider sent you a password by email, then change the password to something only you know:
sudo passwd ubuntu
Specify BBR congestion control algorithm in the system control configuration file:
sudo vi /etc/sysctl.conf
Add lines at the end:
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr
Write the file to disk. Activate these changes:
sudo sysctl -p
5. Install Nginx Web Server
Open firewall ports for HTTP and HTTPS:
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
sudo dpkg-reconfigure iptables-persistent
Install Nginx web server:
sudo apt-get install nginx
Edit the default site definition:
sudo vi /etc/nginx/sites-available/default
Insert the real server name:
server_name [url]www.exdom.cf;
Immediately below that, allow only sensible HTTP request codes:
if ($request_method !~ ^(GET|HEAD|POST)$ )
{
return 405;
}
Add 1 hour of browser caching:
expires 1h;
Write the default site definition file to disk, and quit the editor.
Restart Nginx for these changes:
sudo systemctl restart nginx
6. Add Content to Web Site
You can add any content you like. This is just an example:
wget https://gitlab.com/lwyh/static/raw/master/w3css.tar.gz
tar -xzf w3css.tar.gz
sudo cp -rf w3css/* /var/www/html
sudo rm /var/www/html/index.nginx-debian.html
Allow time for your DNS entries to propagate. Then do an initial test of your website in a browser:
http://www.exdom.cf
7. Obtain SSL Certificate
Visit https://certbot.eff.org https://certbot.eff.org for instructions on how to get a free Let’s Encrypt SSL certificate for your distro. Install Certbot, which is the Let’s Encrypt client software:
sudo apt-get update
sudo apt-get install software-properties-common
sudo add-apt-repository universe
sudo add-apt-repository ppa:certbot/certbot
Press Enter to confirm addition of the personal package archive (ppa). Then continue:
sudo apt-get update
sudo apt-get upgrade
sudo apt-get install certbot
Run Certbot for Nginx to obtain your free SSL certficate:
sudo certbot certonly --webroot -w /var/www/html -d http://www.exdom.cf]www.exdom.cf
Enter your email address
Enter a for agree
Enter y or n to say if you want your email address given to Electronic Frontier Foundation or not
If the verification is successful, you receive messages such as:
Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/www.exdom.cf/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/www.exdom.cf/privkey.pem
Make the certificate and key readable by any user:
sudo chmod +rx /etc/letsencrypt/live
sudo chmod +rx /etc/letsencrypt/archive
sudo chmod +r /etc/letsencrypt/archive/www.exdom.cf/privkey1.pem
Set everything up for SSL certificate renewal:
sudo certbot renew --dry-run
8. Install Trojan GFW
Future versions of Ubuntu include a precompiled package for Trojan GFW. We will manually compile and install the software instead.
Install prerequisite dependencies:
sudo apt -y install build-essential cmake libboost-system-dev libboost-program-options-dev libssl-dev default-libmysqlclient-dev
Clone the source code from Github:
git clone https://github.com/trojan-gfw/trojan.git
Build and install Trojan GFW:
cd trojan
mkdir build
cd build
cmake ..
make
ctest
sudo make install
9. Create Server Configuration File
Edit the server configuration file:
sudo vi /usr/local/etc/trojan/config.json
Modify the sample to use your password and your certificate and key:
{
"run_type": "server",
"local_addr": "0.0.0.0",
"local_port": 443,
"remote_addr": "127.0.0.1",
"remote_port": 80,
"password": [
"Secret$$$123"
],
"log_level": 1,
"ssl": {
"cert": "/etc/letsencrypt/live/www.exdom.cf/fullchain.pem",
"key": "/etc/letsencrypt/live/www.exdom.cf/privkey.pem",
"key_password": "",
"cipher": "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256",
"prefer_server_cipher": true,
"alpn": [
"http/1.1"
],
"reuse_session": true,
"session_ticket": false,
"session_timeout": 600,
"plain_http_response": "",
"curves": "",
"dhparam": ""
},
"tcp": {
"prefer_ipv4": false,
"no_delay": true,
"keep_alive": true,
"fast_open": false,
"fast_open_qlen": 20
},
"mysql": {
"enabled": false,
"server_addr": "127.0.0.1",
"server_port": 3306,
"database": "trojan",
"username": "trojan",
"password": ""
}
}
Wtite the file to disk, and quit the editor.
10. Start Server
Enable and start Trojan GFW:
sudo systemctl enable trojan
sudo systemctl start trojan
Check that Trojan GFW is active and listening on port 443:
sudo systemctl status trojan
sudo netstat -tulpn
In a non-proxied browser, attempt to visit your website:
http://www.exdom.cf
https://www.exdom.cf
Both HTTP and HTTPS should display a normal website.
11. Download and Configure Windows Client
For the Windows client, visit:
https://github.com/trojan-gfw/trojan/releaseshttps://github.com/trojan-gfw/trojan/releases
Download the latest client, e.g. trojan-1.12.2-win.zip.
Unzip the zip file.
Edit the config.json file, replacing the defaults with your domain name and password. For example:
{
"run_type": "client",
"local_addr": "127.0.0.1",
"local_port": 1080,
"remote_addr": "www.exdom.cf",
"remote_port": 443,
"password": [
"Secret$$$123"
],
"log_level": 1,
"ssl": {
"verify": true,
"verify_hostname": true,
"cert": "",
"cipher": "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305-SHA256:ECDHE-RSA-CHACHA20-POLY1305-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:RSA-AES128-GCM-SHA256:RSA-AES256-GCM-SHA384:RSA-AES128-SHA:RSA-AES256-SHA:RSA-3DES-EDE-SHA",
"sni": "",
"alpn": [
"h2",
"http/1.1"
],
"reuse_session": true,
"session_ticket": false,
"curves": ""
},
"tcp": {
"no_delay": true,
"keep_alive": true,
"fast_open": false,
"fast_open_qlen": 20
}
}
12. Run Windows Client
Open a Windows command prompt.
Change directory to C:\Users\YourUserName\Downloads\trojan-1.12.2-win\trojan.
Start the trojan.exe client application running:
trojan
The client will listen on localhost port 1080. You will see messages such as:
Welcome to trojan 1.12.2
[2019-05-16 04:49:45] [WARN] trojan service (client) started at 127.0.0.1:1080
Leave the Windows command prompt window open. Information messages will appear here in a moment, as you browse the Internet.
Now configure your browser to use the proxy on localhost port 1080.
On Firefox, you can do this under Network Connection Settings. Choose Manual proxy configuration; for SOCKS Host, put 127.0.0.1; for Port, put 1080; select SOCKS v5; check Proxy DNS when using SOCKS v5.
On Chrome, you can do this by installing and configuring SwitchyOmega to send traffic to the SOCKS5 proxy on 127.0.0.1 port 1080. Click Apply Changes, and select Proxy.
To test your Windows client in your browser, visit:
https://www.iplocation.nethttps://www.iplocation.net
When you have finished, stop the client running. In your Windows command prompt window, do Ctrl+c. A message appears, "trojan service stopped."
|
|
发表于 2019-5-16 20:10:01
