翻墙回国：Linux单臂路由和透明代理-细节

# dnsmasq.conf
port=7753
bind-interfaces

{
  "server": "0.0.0.0",
  "server_port": 7788,
  "password": "ABCDefghijklmnopq",
  "method": "chacha20-ietf-poly1305",
  "timeout": 600,
  "no_delay": true,
  "mode": "tcp_only"
}

# /etc/sysctl.conf
net.ipv4.ip_forward=1

curl 'http://ftp.apnic.net/apnic/stats/apnic/delegated-apnic-latest' | grep ipv4 | grep CN | awk -F\| '{ printf("%s/%d\n", $4, 32-log($5)/log(2)) }' > chnroute.txt
sudo ipset create chnroute hash:net
cat chnroute.txt | sudo xargs -I ip ipset add chnroute ip

# 在 nat 表中创建新链
iptables -t nat -N SHADOWSOCKS
# X.X.X.X 是远程shadowsocks的地址，不用转发它，否则该死循环了
iptables -t nat -A SHADOWSOCKS -d X.X.X.X -j RETURN
# 局域网地址
iptables -t nat -A SHADOWSOCKS -d 0.0.0.0/8 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 10.0.0.0/8 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 127.0.0.0/8 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 169.254.0.0/16 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 172.16.0.0/12 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 192.168.0.0/16 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 224.0.0.0/4 -j RETURN
iptables -t nat -A SHADOWSOCKS -d 240.0.0.0/4 -j RETURN
# 所有的中国IP去本机7892端口
iptables -t nat -A SHADOWSOCKS -p tcp -m set --match-set chnroute dst -j REDIRECT --to-ports 7892
# 把这个Chain放在PREROUTING里
iptables -t nat -I PREROUTING -p tcp -j SHADOWSOCKS

port: 7890
socks-port: 7891
# 这是上面redirect的端口
redir-port: 7892
# 这个似乎是必须的，iptables redirect不是到127.0.0.1，而是本机的外部IP
allow-lan: true
bind-address: '192.168.1.2'
mode: rule
log-level: debug
dns:
  enable: true
  listen: 0.0.0.0:53
  ipv6: true # when the false, response to AAAA questions will be empty
  default-nameserver:
    - 8.8.8.8 # 这个域名服务器是用来解析下面的nameserver的服务器的...
  enhanced-mode: redir-host # or fake-ip
  fake-ip-range: 198.18.0.1/16 # Fake IP addresses pool CIDR
  nameserver:
    - 8.8.8.8 # default value
  fallback:
    - dnsmasq.shawnma.com:7753 # 远程DNSMASQ的地址
  fallback-filter:
    geoip: false # 这很重要，否则它会采用fallback DNS来解析所有非中国域名，错
    domain: # 这里所有的域名都会被fallback DNS解析
       - '+.bilibili.com'
       - '+.biliapi.com'
       - '+.iqiyi.com'
proxies:
  - name: "ss1"
    type: ss
    server: dnsmasq.shawnma.com # 远程shadowsocks server
    port: 7788
    cipher: chacha20-ietf-poly1305
    password: "ABCDefghijklmnopq" # 跟远程ss密码一致
proxy-groups: # 这个好像没有什么用
  - name: "relay"
    type: relay
    proxies:
      - ss1
rules:
  - DOMAIN-SUFFIX,qq.com,ss1 # 对于所有qq.com的域名，走ss1 proxy
  - DOMAIN-SUFFIX,youku.com,ss1
  - DOMAIN-SUFFIX,bilibili.com,ss1
  - DOMAIN-SUFFIX,biliapi.com,ss1
  - DOMAIN-SUFFIX,iqiyi.com,ss1
  - IP-CIDR,203.205.0.0/16,ss1
  - MATCH,DIRECT # 其他所有的直连

[Unit]
Description=Clash Daemon
After=network.target

[Service]
ExecStart=/bin/clash-linux-amd64 -d /home/sma/clash

[Install]
WantedBy=multi-user.target

# cat ipset.service
[Unit]
Description=ipset persistent configuration
Before=network.target

# ipset sets should be loaded before iptables
# Because creating iptables rules with names of non-existent sets is not possible
Before=netfilter-persistent.service
ConditionFileNotEmpty=/etc/ipset.conf

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/sbin/ipset restore -file /etc/ipset.conf
# Uncomment to save changed sets on reboot
# ExecStop=/sbin/ipset save -file /etc/iptables/ipset
ExecStop=/sbin/ipset flush
ExecStopPost=/sbin/ipset destroy

[Install]
WantedBy=multi-user.target

RequiredBy=netfilter-persistent.service