Dejinta Hysteria2 iyo TUIC

Maanta, teknoolojiyada VPN iyo wakiillada ayaa si isa soo taraysa loogu baahan yahay. Isticmaalayaashu waxay u adeegsadaan si ay u helaan internet ammaan ah, uga gudbaan faafreebka, iyo uga difaacaan khataraha dibadda. Markaad ku xidho server-kaas, dhammaan taraafikadaadu waxay maraan god qarsoon, server-kuna wuxuu noqdaa albaabkaaga shabakadda.

Hab-raacyada caadiga ah sida OpenVPN ama WireGuard si fiican ayay u shaqeeyaan xaaladaha deggan laakiin badanaa waxay la kulmaan hoos u dhac xawaaraha ah marka xiriirku xumaado oo ay la kulmaan khasaaro badan oo baakad ah (shabakadaha moobaylka, Wi-Fi dadweynaha, waddamada leh faafreeb adag). Halkan waa meesha ay ka ciyaaraan hab-raacyada casriga ah sida Hysteria2 iyo TUIC. Waxay ku dhisan yihiin QUIC, iyagoo bixiya xawaare sare, dib u dhac yar, iyo xannibaadda taraafikada oo wax ku ool ah sida HTTPS-ka caadiga ah (HTTP/3).

Hysteria2 wuxuu adeegsadaa algorithm-ka "Brutal", kaas oo si xoog leh u adeegsanaya bandwidth-ka la heli karo. TUIC (nooca 5) waxaa lagu gartaa kharash yar, taageero UDP oo aad u fiican, iyo xiriir 0-RTT.

Maqaalkan, waxaan ku socon doonnaa dejinta server-ka Ubuntu/Debian iyo isku xirka Windows.

Waxaad u baahan doontaa: VPS oo ku shaqeeya Ubuntu 22.04/24.04 ama Debian 12, marin u helidda xididka, iyo cinwaanka IP-ga ee server-ka. Looma baahna domain.

Ku xidhnaanta adeegaha

Windows (PuTTY): Fur PuTTY, geli YOUR_SERVER_IP sida martida, 22 sida dekedda, oo gal sida asalka adoo isticmaalaya erayga sirta ah ee ka yimid iimaylka bixiyahaaga VPS.

Linux/macOS (terminal):

ssh root@YOUR_SERVER_IP

Dhammaan amarrada hoos ku qoran waxaa lagu maamulaa server-ka, isla kalfadhigan.

Diyaarinta server-ka (Ubuntu / Debian)

Daar gudbinta IP-ga

Tani waxay u oggolaanaysaa server-ku inuu baakadaha macaamiisha u gudbiyo internetka.

nano /etc/sysctl.conf

Geli ama samee erayga sirta ah (isticmaal xarfaha iyo lambarrada Ingiriisiga oo keliya, meel bannaan ha ku jirin).

Soo hel oo faallo ka bixi (ka saar # bilowga) ama ku dar sadarrada soo socda:

net.ipv4.ip_forward=1

Keydi faylka (Ctrl+O, Enter) oo ka bax (Ctrl+X). Ku dhaqan isbeddellada adiga oo aan dib u bilaabin:

sysctl -p

Dejinta NAT (is-qarin)

Dejintani waxay u oggolaanaysaa macaamiisha inay internetka ka galaan server-kaaga iyagoo isticmaalaya cinwaanka IP-ga.

Soo ogow magaca isku-xirka shabakaddaada dibadda (kan u jeeda internetka):

ip link show

Badanaa kani waa eth0, ens3, ama enp1s0. Koobi ama xasuuso, ka dibna ku dar xeerka qarinta iptables - ku beddel eth0 magacaaga interface-ka:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Kaydinta xeerarka iptables

Si looga hortago in xeerarka dib loo dejiyo ka dib dib-u-bilaabista server-ka, waxay u baahan yihiin in la badbaadiyo.

apt update
apt install iptables-persistent -y
netfilter-persistent save

Inta lagu jiro rakibidda waxaad arki kartaa jawaab degdeg ah oo lagu keydinayo xeerarka hadda jira ee IPv4/IPv6 - ku jawaab "Haa" labada jeerba.

Dejinta Dab-damiska (UFW)

Waxaan fureynaa dhammaan dekedaha aan u baahan doono isla markiiba, markaa looma baahna inaan dib ugu soo laabano tallaabadan dambe: 22 SSH (ka boodista tan waxay kaa xiri doontaa server-ka), 443/udp Hysteria2, iyo 8443/udp TUIC.

apt install ufw -y
ufw allow 22/tcp
ufw allow 443/udp
ufw allow 8443/udp
ufw --force enable
ufw status

Soo saarista xaaladda ufw waa inay liis gareysaa saddexda xeerba inay yihiin kuwo firfircoon.

Hysteria2

Ku rakibidda server-ka Hysteria2

chmod +x hysteria-linux-amd64
mv hysteria-linux-amd64 /usr/local/bin/hysteria
hysteria version

Hubi in wax soo saarka nooca uu soo muuqdo iyada oo aan khaladaad lahayn - tani waxay xaqiijinaysaa in binary-gu si sax ah u shaqeeyo.

Abuuritaanka shahaadada SSL ee is-saxiixatay

Waxaan u baahanahay furayaasha sirta ah si aan u ilaalino taraafikada u dhaxaysa kombiyuutarkaaga iyo server-ka. Maadaama aynaan lahayn domain, waxaan soo saari doonnaa shahaado is-saxiix ah oo ansax ah 365 maalmood. Sababtaas awgeed, waxaad u baahan doontaa inaad ka shaqeyso "Ka bood Shahaadada Hubinta" macaamiisha hadhow.

mkdir -p /etc/hysteria
chmod 755 /etc/hysteria
 
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout /etc/hysteria/private.key \
  -out /etc/hysteria/cert.crt \
  -subj "/CN=YOUR_SERVER_IP"

ls -la /etc/hysteria/

Labada cert.crt iyo private.key waa in la taxaa.

Abuuritaanka faylka qaabeynta

nano /etc/hysteria/config.yaml

Ku dheji kuwa soo socda, adiga oo ku beddelaya YOUR_PASSWORD eraygaaga sirta ah (xuruufaha iyo lambarrada Ingiriisiga oo keliya, meel bannaan ma jiraan):

listen: :443
 
tls:
  cert: /etc/hysteria/cert.crt
  key: /etc/hysteria/private.key
 
auth:
  type: password
  password: "YOUR_PASSWORD"
 
masquerade:
  type: proxy
  proxy:
    url: https://cloudflare.com
    rewriteHost: true

Xadhigga sawir-gacmeedka ayaa server-ka ka dhigaya mid u eg bog internet oo caadi ah haddii qof uu cinwaankiisa IP-ga ku furo biraawsar, halkii uu muujin lahaa calaamado muujinaya wakiil.

Keydi (Ctrl+O, Enter) oo ka bax (Ctrl+X).

Dejinta otomaatiga ah

nano /etc/systemd/system/hysteria.service

Faylka cutubka nidaamka ee Hysteria2 autostart. 

[Unit]
Description=Hysteria2 Server
After=network.target
 
[Service]
Type=simple
ExecStart=/usr/local/bin/hysteria server --config /etc/hysteria/config.yaml
Restart=on-failure
RestartSec=5
 
[Install]
WantedBy=multi-user.target
systemctl daemon-reload
systemctl enable --now hysteria.service
systemctl status hysteria.service

Xaaladdu waa inay muujisaa firfircoon (oo socota). Haddii konsole-ku uu "ku xayiran yahay" muuqaalka log-ga, riix Q si aad uga baxdo.

TUIC v5

Soo dejinta iyo rakibidda TUIC

mkdir -p /usr/local/sbin/tuic

Hubi sii deynta la heli karo:

curl -s https://api.github.com/repos/tuic-protocol/tuic/releases | grep -Po '"tag_name": "\K[^"]*' | head -10

Soo dejiso server-ka binary - ku beddel lambarka nooca hadda jira 1.0.0:

wget https://github.com/tuic-protocol/tuic/releases/download/1.0.0/tuic-server-1.0.0-x86_64-unknown-linux-gnu \
  -O /usr/local/sbin/tuic/tuic-server

chmod +x /usr/local/sbin/tuic/tuic-server
/usr/local/sbin/tuic/tuic-server --version

Abuuritaanka shahaado is-saxiix ah oo loogu talagalay TUIC

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout /usr/local/sbin/tuic/privkey.pem \
  -out /usr/local/sbin/tuic/fullchain.pem \
  -subj "/CN=YOUR_SERVER_IP"
 
ls -la /usr/local/sbin/tuic/

Abuurista UUID

apt install uuid-runtime -y

uuidgen

Nuqul ka samee UUID-ka soo baxay - waxaad u baahan doontaa labadaba qaabeynta server-ka ee hoose iyo dejinta macmiilka.

Abuuritaanka faylka qaabeynta

config.json-kii dhammaaday ee loogu talagalay server-ka TUIC:

nano /usr/local/sbin/tuic/config.json
{
    "server": "[::]:8443",
    "users": {
        "YOUR_UUID": "YOUR_TUIC_PASSWORD"
    },
    "certificate": "/usr/local/sbin/tuic/fullchain.pem",
    "private_key": "/usr/local/sbin/tuic/privkey.pem",
    "congestion_control": "bbr",
    "alpn": ["h3"],
    "log_level": "warn"
}

Waxaan halkan u isticmaalnaa dekedda 8443 sababtoo ah 443 waxaa horey u qaadatay Hysteria2. Ku beddel YOUR_UUID qiimaha laga soo qaatay tallaabada 4.3 iyo YOUR_TUIC_PASSWORD eraygaaga sirta ah.

Keydi (Ctrl+O, Enter) oo ka bax (Ctrl+X).

Tijaabinta bilowga gacanta

/usr/local/sbin/tuic/tuic-server -c /usr/local/sbin/tuic/config.json

Haddii aysan jirin wax khaladaad ah oo muuqda, habayntu waa ansax. Jooji Ctrl+C oo u gudub dejinta otomaatiga ah.

Dejinta otomaatiga ah

nano /etc/systemd/system/tuic-server.service

[Unit]
Description=TUIC Server
After=network.target nss-lookup.target
 
[Service]
User=root
WorkingDirectory=/usr/local/sbin/tuic
ExecStart=/usr/local/sbin/tuic/tuic-server -c config.json
Restart=on-failure
RestartPreventExitStatus=1
RestartSec=5
 
[Install]
WantedBy=multi-user.target
systemctl daemon-reload
systemctl enable --now tuic-server.service
systemctl status tuic-server.service

Xaaladdu waa inay muujisaa firfircoon (orod).

Hadda laba ka mid ah borotokoollada casriga ah ee ugu fiican uguna dhaqsaha badan ayaa si is barbar socda ugu shaqeynaya server-ka, labaduba waxay isu ekeysiinayaan taraafikada caadiga ah ee QUIC/HTTPS: Hysteria2 oo ku taal dekedda caadiga ah ee 443/udp, iyo TUIC v5 oo ku taal dekedda 8443/udp.

Ku xidhitaanka Windows

Ku rakibidda Hiddify

Soo dejiso oo ku rakib Hiddify for Windows bogga rasmiga ah: https://hiddify.com. Guji qalabka rakibaha adigoo isticmaalaya "Next" / "Install". Haddii Windows SmartScreen soo muuqdo, dooro "Macluumaad dheeraad ah" → "Si kastaba ha ahaatee socodsii".

astaanta Hysteria2

Guji + (Astaanta Cusub) → "Gelida Gacanta" → borotokoolka Hysteria2 , oo buuxi:

Skip Cert Verify waa in la hawlgeliyaa sababtoo ah shahaadada iskeed ayay u saxiixan tahay — ma jirto hay'ad shahaado oo la aamini karo oo ka dambeysa.

astaanta TUIC v5

Guji + (Astaanta Cusub) → "Gelida Gacanta" → borotokoolka TUIC , oo buuxi:

Isku xidhka iyo xaqiijinta

Dooro bog, ka dibna dhagsii badhanka "Xidhiidh" ee wareegsan ee weyn. Xaaladdu waa inay isu beddeshaa "Xidhiidh".

Si aad u xaqiijiso in taraafikada dhab ahaantii la mariyay server-kaaga, fur adeeg kasta oo hubinta IP-ga ee biraawsarkaaga - cinwaanka la muujiyay waa inuu la mid noqdaa YOUR_SERVER_IP.

Ugu Dambeyn

Markaad dhammaystirto hagahan, waxaad haysataa laba borotokool oo xawaare sare leh, jiilka xiga oo si is barbar socda ugu shaqeeya server-kaaga: Hysteria2 oo ku yaal dekedda 443/UDP iyo TUIC v5 oo ku yaal dekedda 8443/UDP. Labada borotokoolba waxay qariyaan taraafikada la kala qaado sidii xiriir QUIC ah oo sir ah (HTTP/3), taasoo hubinaysa xiriir deggan xitaa kanaallada aadka u deggan.

Astaamaha la habeeyey waxaa loo isticmaali karaa oo keliya Windows laakiin sidoo kale waxaa loo soo gelin karaa barnaamijka moobaylka ee Hiddify ee loogu talagalay Android ama iOS oo leh dejimo la mid ah.

Haddii aad la kulanto dhibaatooyin xiriir, marka hore hubi xaaladaha adeegga adoo isticmaalaya amarka xaaladda systemctl hysteria.service (ama tuic-server.service), hubi in xeerarka dab-damiska ay firfircoon yihiin ( xaaladda ufw), oo laba jeer hubi in cinwaanka IP-ga, UUID, iyo furaha sirta ah si sax ah loo galiyay. Fadlan ogow: shahaadooyinka is-saxiixa ee la bixiyay waxay shaqeynayaan 365 maalmood, markaa ka dib hal sano oo sax ah, waxay u baahan doonaan in la cusbooneysiiyo iyadoo la adeegsanayo isla amarka req ee opensl.