2018-03-30

kali 代理之shadowsocks & proxychains

0x00. 序言

最近和朋友合租了一台vps ，我搭好ss + bbr 之后居然不知道如何给kali 配置代理，真是可耻，果然Mac 用惯了之后人都会变懒！找了很久发现好多关于kali 代理的文章都失效，不过我还是在网上找到了这篇文章，虽然上面的配置过程有些细微的错误，不过大致照着他的配置是没问题的！

0x01. 代理流程

好多人都用过代理，但可能大部分却都不太了解代理是如何工作的，我在这里给大家简单介绍一下，不涉及底层知识，相信很容易理解！

首先通过proxychains 将本地流量发往localhost 的 1080 端口
localhost 的1080 端口和VPS 的8080 端口通过shadowsocks 建立 ss 连接
本地流量 -> localhost 1080 -> VPS 8080 -> 目标站点

以上就是ss 代理的流程，是不是感觉很简单，下面我给大家演示一下如何配置

0x02. 配置 proxychains

vim /etc/proxychains.conf

0x03. 配置shadowsocks

1. 安装shadowsocks

apt-get install python-pip && pip install shadowsocks

2. 优化shadowsocks ，这里我也不懂优化策略

vim /etc/sysctl.d/local.conf

sysctl –system # 优化文件保存之后执行这条命令生效


# max open files
fs.file-max = 51200  
# max read buffer
net.core.rmem_max = 67108864  
# max write buffer
net.core.wmem_max = 67108864  
# default read buffer
net.core.rmem_default = 65536  
# default write buffer
net.core.wmem_default = 65536  
# max processor input queue
net.core.netdev_max_backlog = 4096  
# max backlog
net.core.somaxconn = 4096
# resist SYN flood attacks
net.ipv4.tcp_syncookies = 1  
# reuse timewait sockets when safe
net.ipv4.tcp_tw_reuse = 1  
# turn off fast timewait sockets recycling
net.ipv4.tcp_tw_recycle = 0  
# short FIN timeout
net.ipv4.tcp_fin_timeout = 30  
# short keepalive time
net.ipv4.tcp_keepalive_time = 1200  
# outbound port range
net.ipv4.ip_local_port_range = 10000 65000  
# max SYN backlog
net.ipv4.tcp_max_syn_backlog = 4096  
# max timewait sockets held by system simultaneously
net.ipv4.tcp_max_tw_buckets = 5000  
# turn on TCP Fast Open on both client and server side
net.ipv4.tcp_fastopen = 3  
# TCP receive buffer
net.ipv4.tcp_rmem = 4096 87380 67108864  
# TCP write buffer
net.ipv4.tcp_wmem = 4096 65536 67108864  
# turn on path MTU discovery
net.ipv4.tcp_mtu_probing = 1
# for high-latency network
net.ipv4.tcp_congestion_control = hybla
# for low-latency network, use cubic instead
# net.ipv4.tcp_congestion_control = cubic

3. 配置Shadowsocks配置文件

mkdir /root/ss && cd /root/ss && vim ssserver.json


{
    "server": "my_server_ip", // 这里输入墙外服务器地址
    "server_port": 8080, // 墙外服务器的端口
    "local_address": "127.0.0.1",
    "local_port": 1080, // 为了安全，可修改为大于 1024 的数字
    "password": "mypassword", // 设置一个密码
    "timeout": 300,
    "method": "aes-256-cfb",//要和服务端的加密方式相同
    "fast_open": false
}