Te whakatūnga o Hysteria2 me TUIC

I ēnei rā, kei te piki haere te hiahia mō ngā hangarau VPN me te proxy. Ka whakamahia ēnei e ngā kaiwhakamahi hei urunga haumaru ki te ipurangi, hei karo i te aukati raraunga, hei tiaki hoki i ngā tūmomo riri o waho. Ina hono koe ki tētahi tūmau pēnei, ka haere ō raraunga katoa mā roto i tētahi kauhanga whakamuna, ā, ka noho te tūmau hei kuaha mōu ki te whatunga.

He pai te mahi a ngā kawa tawhito pēnei i a OpenVPN, WireGuard rānei i raro i ngā āhuatanga pumau, engari he maha ngā wā ka heke te tere i ngā hononga ngoikore me te ngaronga nui o ngā pākete (ngā whatunga pūkoro, te Wi-Fi tūmatanui, ngā whenua he tino aukati raraunga). Koinei te wāhi e whai wāhi mai ai ngā kawa hou pēnei i a Hysteria2 me TUIC. He mea hanga ēnei i runga i te QUIC, e tuku ana i te tere teitei, te iti o te whakaroa, me te whai hua o te huna i ngā waka hei HTTPS noa (HTTP/3).

Ka whakamahia e Hysteria2 te pūnaha "Brutal", e whakamahi kaha ana i te whānui o te hononga e wātea ana. Ko te TUIC (putanga 5) he iti noa te utu, he tino pai te tautoko UDP, me te whakatū hononga 0-RTT.

I roto i tēnei tuhinga, ka tirohia e mātou te whakatūnga o te tūmau i runga i te Ubuntu/Debian me te hono atu mai i te Windows.

Ngā mea e hiahiatia ana e koe: he VPS e whakahaere ana i te Ubuntu 22.04/24.04, Debian 12 rānei, he urunga pakiaka, me te wāhitau IP o te tūmau. Kāore he rohe e hiahiatia ana.

Te hono ki te kaituku

Windows (PuTTY): whakatuwheratia a PuTTY, tāuruhia a YOUR_SERVER_IP hei kaihautū, 22 hei tauranga, ka takiuru hei pakiaka me te kupuhipa mai i te īmēra a tō kaiwhakarato VPS.

Linux/macOS (pūtau):

ssh root@YOUR_SERVER_IP

Ka whakahaerehia ngā whakahau katoa i raro nei i runga i te tūmau, i tēnei wātū anō.

Te whakarite tūmau (Ubuntu / Debian)

Whakahohehia te tuku IP

Mā tēnei ka taea e te tūmau te tuku i ngā mōkihi kiritaki ki te ipurangi.

nano /etc/sysctl.conf

Tāuruhia, waihangahia rānei he kupuhipa (whakamahia ngā reta me ngā tau Ingarihi anake, kaua he mokowā).

Kimihia, ka wete i te kōrero (tangohia te # i te tīmatanga) tāpirihia rānei te rārangi e whai ake nei:

net.ipv4.ip_forward=1

Tiakina te kōnae (Ctrl+O, Enter) ka puta (Ctrl+X). Whakamahia ngā huringa me te kore e whakaara anō:

sysctl -p

Tatūnga NAT (whakaahua)

Mā tēnei tautuhinga ka taea e ngā kiritaki te uru atu ki te ipurangi mā tō tūmau mā te whakamahi i tōna wāhitau IP.

Kimihia te ingoa o tō atanga whatunga o waho (te mea e anga atu ana ki te ipurangi):

ip link show

Ko te tikanga ko eth0, ens3, enp1s0 rānei. Tāruatia, maumaharatia rānei, kātahi ka tāpirihia te ture masquerading ki iptables — whakakapia te eth0 ki tō ake ingoa atanga:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Te tiaki i ngā ture iptables

Hei ārai i ngā ture kei tautuhia anō i muri i te whakaara anō i te tūmau, me tiaki.

apt update
apt install iptables-persistent -y
netfilter-persistent save

I te wā tāutanga, tera pea ka kite koe i tētahi tohutohu hei tiaki i ngā ture IPv4/IPv6 o nāianei — whakautua "Āe" i ngā wā e rua.

Tatūnga Pātūahi (UFW)

Ka whakatuwheratia e mātou ngā tauranga katoa e hiahiatia ana i tēnei wā tonu, nō reira kāore he take e hoki mai ai ki tēnei taahiraa ā muri ake nei: 22 mō SSH (ki te pekehia tēnei ka āraia koe i te tūmau), 443/udp mō Hysteria2, me te 8443/udp mō TUIC.

apt install ufw -y
ufw allow 22/tcp
ufw allow 443/udp
ufw allow 8443/udp
ufw --force enable
ufw status

Ko te putanga o te ufw status me whakarārangi i ngā ture e toru hei mea hohe.

Hysteria2

Te tāuta i te tūmau Hysteria2

chmod +x hysteria-linux-amd64
mv hysteria-linux-amd64 /usr/local/bin/hysteria
hysteria version

Kia tino mohio kei te puta te putanga putanga me te kore he hapa — mā tēnei ka whakaū kei te tika te mahi a te rua.

Te waihanga i tētahi tiwhikete SSL kua hainatia e koe anō

Me whai ake mātou i ā mātou ake kī whakamunatanga hei tiaki i te whakawhitiwhiti i waenga i tō rorohiko me te tūmau. Nā te mea kāore ā mātou rohe, ka whakaputahia e mātou he tiwhikete waitohu-ake e whai mana ana mō ngā rā 365. Nā tēnei, me whakahohe e koe te "Hurihia te Manatoko Tiwhikete" i roto i te kiritaki ā muri ake nei.

mkdir -p /etc/hysteria
chmod 755 /etc/hysteria
 
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout /etc/hysteria/private.key \
  -out /etc/hysteria/cert.crt \
  -subj "/CN=YOUR_SERVER_IP"

ls -la /etc/hysteria/

Me whakarārangihia ngā cert.crt me ngā private.key.

Te waihanga i te kōnae whirihoranga

nano /etc/hysteria/config.yaml

Whakapirihia te mea e whai ake nei, me te whakakapi i te YOUR_PASSWORD ki tō ake kupuhipa (ngā reta me ngā tau Ingarihi anake, kaua he mokowā):

listen: :443
 
tls:
  cert: /etc/hysteria/cert.crt
  key: /etc/hysteria/private.key
 
auth:
  type: password
  password: "YOUR_PASSWORD"
 
masquerade:
  type: proxy
  proxy:
    url: https://cloudflare.com
    rewriteHost: true

Mā te poraka masquerade ka rite te āhua o te tūmau ki tētahi paetukutuku noa mēnā ka whakatuwherahia e tētahi tōna wāhitau IP i roto i tētahi pūtirotiro, kaua ki te whakaatu i ngā tohu o tētahi takawaenga.

Tiaki (Ctrl+O, Enter) kātahi ka puta (Ctrl+X).

Te whakarite i te tīmatanga aunoa

nano /etc/systemd/system/hysteria.service

Ko te kōnae wae pūnaha mō te tīmatanga aunoa o Hysteria2. 

[Unit]
Description=Hysteria2 Server
After=network.target
 
[Service]
Type=simple
ExecStart=/usr/local/bin/hysteria server --config /etc/hysteria/config.yaml
Restart=on-failure
RestartSec=5
 
[Install]
WantedBy=multi-user.target
systemctl daemon-reload
systemctl enable --now hysteria.service
systemctl status hysteria.service

Me whakaatu te tūnga kei te hohe (e rere ana). Mena kei te "mau" te papatohu i te tirohanga rangitaki, pēhia te Q hei puta atu.

TUIC v5

Te tango me te tāuta i te TUIC

mkdir -p /usr/local/sbin/tuic

Tirohia ngā tukunga e wātea ana:

curl -s https://api.github.com/repos/tuic-protocol/tuic/releases | grep -Po '"tag_name": "\K[^"]*' | head -10

Tikiake i te putanga rua o te tūmau — whakakapia te tau putanga o nāianei mō te 1.0.0:

wget https://github.com/tuic-protocol/tuic/releases/download/1.0.0/tuic-server-1.0.0-x86_64-unknown-linux-gnu \
  -O /usr/local/sbin/tuic/tuic-server

chmod +x /usr/local/sbin/tuic/tuic-server
/usr/local/sbin/tuic/tuic-server --version

Te waihanga i tētahi tiwhikete waitohu-ā-koe mō TUIC

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout /usr/local/sbin/tuic/privkey.pem \
  -out /usr/local/sbin/tuic/fullchain.pem \
  -subj "/CN=YOUR_SERVER_IP"
 
ls -la /usr/local/sbin/tuic/

Te whakaputa i tētahi UUID

apt install uuid-runtime -y

uuidgen

Tāruatia te UUID i puta mai — ka hiahiatia tēnei i roto i te whirihoranga tūmau i raro nei, me ngā tautuhinga kiritaki hoki.

Te waihanga i te kōnae whirihoranga

Ko te config.json kua oti mō te tūmau TUIC:

nano /usr/local/sbin/tuic/config.json
{
    "server": "[::]:8443",
    "users": {
        "YOUR_UUID": "YOUR_TUIC_PASSWORD"
    },
    "certificate": "/usr/local/sbin/tuic/fullchain.pem",
    "private_key": "/usr/local/sbin/tuic/privkey.pem",
    "congestion_control": "bbr",
    "alpn": ["h3"],
    "log_level": "warn"
}

Ka whakamahia e mātou te tauranga 8443 i konei nā te mea kua tangohia kētia te 443 e Hysteria2. Whakakapia a YOUR_UUID ki te uara mai i te taahiraa 4.3 me YOUR_TUIC_PASSWORD ki tō ake kupuhipa.

Tiaki (Ctrl+O, Enter) kātahi ka puta (Ctrl+X).

Te whakamātautau i te tīmatanga ā-ringa

/usr/local/sbin/tuic/tuic-server -c /usr/local/sbin/tuic/config.json

Ki te kore he hapa e puta, he tika te whirihoranga. Kati mā te pēhi Ctrl+C ka neke atu ki te whakarite i te tīmatanga aunoa.

Te whakarite i te tīmatanga aunoa

nano /etc/systemd/system/tuic-server.service

[Unit]
Description=TUIC Server
After=network.target nss-lookup.target
 
[Service]
User=root
WorkingDirectory=/usr/local/sbin/tuic
ExecStart=/usr/local/sbin/tuic/tuic-server -c config.json
Restart=on-failure
RestartPreventExitStatus=1
RestartSec=5
 
[Install]
WantedBy=multi-user.target
systemctl daemon-reload
systemctl enable --now tuic-server.service
systemctl status tuic-server.service

Me whakaatu te tūnga kei te hohe (e oma ana).

Inaianei kei te rere whakarara ngā kawa hou e rua pai rawa atu, tere rawa atu hoki i runga i te tūmau, e whakaahua ana i a rātou anō he waka QUIC/HTTPS noa: ko Hysteria2 i runga i te tauranga paerewa 443/udp, me TUIC v5 i runga i te tauranga 8443/udp.

Te hono atu mai i Windows

Te Tāuta i a Hiddify

Tikiake me te tāuta i te Hiddify mō Windows mai i te paetukutuku mana: https://hiddify.com. Pāwhiritia te tāutanga me te "Next" / "Install". Mena ka puta te Windows SmartScreen, whiriwhiria "Ētahi atu mōhiohio" → "Run anyway".

Kōtaha Hysteria2

Pāwhiritia + (Kōtaha Hou) → "Whakaurunga Ā-ringa" → kawa Hysteria2 , ka whakakīia:

Me whakahohe te Skip Cert Verify nā te mea kua hainatia e te tiwhikete — kāore he mana tiwhikete pono kei muri.

Kōtaha TUIC v5

Pāwhiritia + (Kōtaha Hou) → "Whakaurunga Ā-ringa" → kawa TUIC , ka whakakīia:

Te hono me te manatoko

Tīpakohia he kōtaha, kātahi ka pāwhiri i te pātene "Hono". Me huri te tūnga ki "Kua Honoa".

Hei whakaū kei te tukuna ngā waka mā roto i tō tūmau, whakatuwheratia tētahi ratonga tirotiro IP i roto i tō pūtirotiro — me ōrite te wāhitau e whakaaturia ana ki YOUR_SERVER_IP.

Opaniraa

Mā te whakaoti i tēnei aratohu, e rua ngā kawa tere-teitei, o te whakatupuranga hou e rere tahi ana i runga i tō tūmau: Hysteria2 i te tauranga 443/UDP me TUIC v5 i te tauranga 8443/UDP. E huna ana ngā kawa e rua i te waka kua tukuna hei hononga QUIC kua whakamunahia paerewa (HTTP/3), e whakarite ana i te hononga pumau ahakoa i runga i ngā hongere tino kore pumau.

Kāore e taea te whakamahi i ngā kōtaha whirihora i runga i te Windows anake, engari ka taea hoki te kawemai ki te taupānga pūkoro Hiddify mō te Android, iOS rānei me ngā tautuhinga ōrite.

Ki te pāngia koe e ngā uauatanga hononga, tirohia tuatahitia ngā tūnga ratonga mā te whakamahi i te whakahau systemctl status hysteria.service (tuic-server.service rānei), kia mohio kei te kaha ngā ture pareārai ahi (ufw status), ā, tirohia anō kia tika te whakaurunga o te wāhitau IP, te UUID, me ngā kupuhipa. Kia mōhio mai: he 365 ngā rā e whai mana ai ngā tiwhikete kua hainatia e koe, nō reira, i muri i te kotahi tau, me whakahou anō mā te whakamahi i te whakahau openssl req kotahi.