创建 VPN 以绕过被阻止的端口

Question

这是我根据以下情况提出的解决方案Unix SE 的“根据目标端口在不同接口上输出流量”，Netfilter 指南，和iptables 规则提交与特定负面规则匹配的数据包。

首先添加一个新的路由表到/etc/iproute2/rt_tables：

$ grep vpntab /etc/iproute2/rt_tables
200 vpntab

此脚本需要安装在转发数据包的服务器上：

$ cat =setup-vps-forwarding
#!/bin/zsh

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

# Allow established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Masquerade
iptables -t nat -A POSTROUTING -j MASQUERADE
# this doesn't work
#iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

这是设置 VPN 的主要脚本。SSH_VPSHOST 之所以是一个单独的变量，是因为如果您的 VPS 主机不允许您以 root 身份使用 ssh，如下例所示sudo，或者您想通过多个主机建立 ssh 隧道。在后一种情况下，VPSHOST 应该是链中第一个主机的数字 IP 地址。

$ cat simple-ppp-vpn
#!/bin/zsh
# EDIT ME
USER=myusername
VPSHOST=myhostname.net
PORT=22
SSH_VPSHOST="sudo -u $USER ssh -vTax $USER@$VPSHOST sudo"

# remember to put setup-vps-forwarding on $VPSHOST

# the IPs to use; just need that someone else isn't using them
REMPPP=192.168.3.2
LOCPPP=192.168.3.1
# try to infer the current default network interface
DEFIF=$(route -n | grep UG | head -n 1 | awk '{print $8}')

[[ "$UID" -eq 0 ]] || { >&2 echo "Need to be root"; exit 1 }

disable_rpfilt () {
    # disable rp_filter
    for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
        echo 0 > $f;
    done
    echo 1 > /proc/sys/net/ipv4/route/flush
}

case $1 in
    restart)
        $0 stop; $0 start;;
    stop)
        killall pppd
        iptables -F OUTPUT
        iptables -F POSTROUTING
        iptables -t nat -F
        iptables -t mangle -F
        ip route flush table vpntab
        >&2 echo waiting for PPPD to die
        while pgrep pppd > /dev/null; do
            sleep 0.5;
        done
        ;;
    start)
        if pgrep pppd; then >&2 echo Another pppd is running; exit 1; fi
        set -x
        set -e

        disable_rpfilt

        # start pppd's on both ends
        pppd updetach defaultroute noauth passive pty "$SSH_VPSHOST pppd nodetach noauth notty" $LOCPPP:$REMPPP

        # enable NAT on $VPSHOST
        ssh $USER@$REMPPP sudo setup-vps-forwarding

        # set up route-based forwarding

        # add a new routing table 'vpntab', it must first exist in /etc/iproute2/rt_tables
        grep vpntab /etc/iproute2/rt_tables
        # e.g. 200 vpntab

        # the new routing table sends stuff through the PPP device
        ip route add default via $REMPPP dev ppp0 table vpntab
        ip rule add fwmark 0x1 table vpntab

        ################################################################
        # allow ourselves to access the VPS host directly. change these two
        # commands if you want different traffic to be forwarded

        iptables -A OUTPUT -t mangle -o $DEFIF -p tcp --dport $PORT -d $VPSHOST -j ACCEPT
        # this would be less specific
        # iptables -A OUTPUT -t mangle -o $DEFIF -p tcp --dport $PORT -j ACCEPT

        # mark everything else for VPN routing
        iptables -A OUTPUT -t mangle -o $DEFIF -j MARK --set-mark 1

        # replace the above two commands with this, to route only
        # one protocol through the VPN:
        # iptables -A OUTPUT -t mangle -o $DEFIF -p tcp --dport 587 -j MARK --set-mark 1
        ################################################################

        # we need to rewrite the source address of routed packets.
        # this is a bit cleaner than duplicating the test as in
        # the Unix SE question
        iptables -A POSTROUTING -t nat -o ppp0 -m mark --mark 1 -j SNAT --to $LOCPPP

        ip route flush cache
        ;;
esac

我尝试让这个尽可能简单，但有些事情我还是不明白。链接的问题描述了一些小技巧，例如必须禁用 rp_filter，并使用 SNAT 重写源地址，这两者都是必要的。

我想象这个更好的版本会使用 socks 或 openvpn 或ssh -D，而不是 PPP。

Answer 1