Use tun2socks as a global router on Linux (Chinese) #102

emptyteeth · 2022-03-05T17:33:49Z

emptyteeth
Mar 5, 2022

碰到一些不支持http/socks5代理也不支持proxychains的应用，于是想到这个方法，思路就是把tun设备放到一个network namespace里，然后通过ip netns exec命令在netns里面执行这些应用。

使用方法

# 以当前用户在netns中执行shell
# 之后在这个shell中执行的命令都会走代理
# Ctrl + d 或 exit 退出
~ sudo ip netns exec t2sns su $USER
# 直接执行命令
~ sudo ip netns exec t2sns su $USER -c "curl myip.ipip.net"

# 或者可以使用firejail, 效果和上面一样
~ firejail --noprofile --netns=t2sns
~ firejail --noprofile --netns=t2sns firefox

# 查看网络接口分辨当前shell是否在netns中
# 有t2s0接口的就是
~ ip link

# 普通用户在netns内没有权限执行ping操作, 需要sudo
~ sudo ip netns exec t2sns ping 1.1.1.1
# 或者在netns中的shell内运行
~ sudo ping 1.1.1.1

systemd启动脚本

[Unit]
Description=tun2socks ns proxy
After=network.target

[Service]
Type=simple

# 这里用DynamicUser的话下面的ip命令会失败,没有深入研究原因
# 建议单独创建一个普通用户,用nobody的话systemd会抱怨不安全
User=nobody

# 启动tun2socks
ExecStart=/opt/git/tun2socks/tun2socks -device tun://t2s0 -proxy socks5://10.123.1.1:1080 -loglevel warning

# 等待tun2socks创建tun设备
ExecStartPost=/usr/bin/sleep 2

# 启动之后创建netns t2sns,并把t2s0放进去
ExecStartPost=+/usr/bin/ip netns add t2sns
ExecStartPost=+/usr/bin/ip link set dev t2s0 netns t2sns

# 在netns中设置ip及默认路由
ExecStartPost=+/usr/bin/ip netns exec t2sns ip link set dev t2s0 up
ExecStartPost=+/usr/bin/ip netns exec t2sns ip addr add 10.23.1.1/24 dev t2s0
ExecStartPost=+/usr/bin/ip netns exec t2sns ip route add default dev t2s0

# 退出后删除netns
ExecStopPost=+/usr/bin/ip netns delete t2sns

# 给tun2socks管理网络接口的权限
CapabilityBoundingSet=CAP_NET_ADMIN
AmbientCapabilities=CAP_NET_ADMIN
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target

LambertZhaglog · 2022-03-25T07:33:19Z

LambertZhaglog
Mar 25, 2022

@emptyteeth ,您好，我按照您的思路

把tun设备放到一个network namespace里，然后通过ip netns exec命令在netns里面执行这些应用

在新的network namespace 中wget google.com，显示主机能够和google 三次握手建立tcp 连接，但是发送http request之后，收不到google的http respond。具体的操作和输出如下

  #运行tun2socks
  sudo ./tun2socks-linux-amd64 --device tun://t2s0 --proxy socks5://127.0.0.1:10808 --loglevel debug
  # 把tun设备放到新建的network namespace
  sudo ip netns add t2sns
  sudo ip link set dev t2s0 netns t2sns
  sudo ip netns exec t2sns ip link set dev t2s0 up
  sudo ip netns exec t2sns ip addr add 10.23.1.1/24 dev t2s0
  sudo ip netns exec t2sns ip route add default dev t2s0
  # 在新建的network namespace中启动shell， 访问网络服务
  sudo ip netns exec t2sns su $USER
  wget 8.7.198.46 # 等价于wget google.com , 因为新建的namespace 不支持DNS

wget 8.7.198.46 的输出为

 ➜  release git:(main) ✗ wget 8.7.198.46
--2022-03-25 07:21:17--  http://8.7.198.46/
Connecting to 8.7.198.46:80... connected.
HTTP request sent, awaiting response... No data received.
Retrying.

--2022-03-25 07:22:45--  (try: 2)  http://8.7.198.46/
Connecting to 8.7.198.46:80... connected.
HTTP request sent, awaiting response... No data received.
Retrying.

--2022-03-25 07:24:14--  (try: 3)  http://8.7.198.46/
Connecting to 8.7.198.46:80... connected.
HTTP request sent, awaiting response...

wget 时对tun设备进行 tcpdump 抓包的结果为

➜  ~ sudo tcpdump -n -i t2s0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on t2s0, link-type RAW (Raw IP), capture size 262144 bytes
^C07:26:48.326440 IP 8.7.198.46.80 > 10.23.1.1.60660: Flags [F.], seq 135840632, ack 3513994031, win 4096, options [nop,nop,TS val 4255167229 ecr 4014791501], length 0
07:26:48.326473 IP 10.23.1.1.60660 > 8.7.198.46.80: Flags [.], ack 1, win 502, options [nop,nop,TS val 4014796503 ecr 4255167229], length 0
07:26:49.244053 IP 10.23.1.1.32790 > 8.7.198.46.80: Flags [S], seq 933473459, win 64240, options [mss 1460,sackOK,TS val 4014797420 ecr 0,nop,wscale 7], length 0
07:26:49.244344 IP 8.7.198.46.80 > 10.23.1.1.32790: Flags [S.], seq 3449188057, ack 933473460, win 29184, options [mss 1460,sackOK,TS val 4255168147 ecr 4014797420,nop,wscale 7], length 0
07:26:49.244383 IP 10.23.1.1.32790 > 8.7.198.46.80: Flags [.], ack 1, win 502, options [nop,nop,TS val 4014797421 ecr 4255168147], length 0
07:26:49.244480 IP 10.23.1.1.32790 > 8.7.198.46.80: Flags [P.], seq 1:138, ack 1, win 502, options [nop,nop,TS val 4014797421 ecr 4255168147], length 137: HTTP: GET / HTTP/1.1
07:26:49.244583 IP 8.7.198.46.80 > 10.23.1.1.32790: Flags [.], ack 138, win 226, options [nop,nop,TS val 4255168147 ecr 4014797421], length 0
07:27:49.245003 IP 8.7.198.46.80 > 10.23.1.1.32790: Flags [.], ack 138, win 4096, options [nop,nop,TS val 4255228148 ecr 4014797421], length 0
07:27:49.245033 IP 10.23.1.1.32790 > 8.7.198.46.80: Flags [.], ack 1, win 502, options [nop,nop,TS val 4014857421 ecr 4255168147], length 0
07:28:16.563976 IP 8.7.198.46.80 > 10.23.1.1.32790: Flags [F.], seq 1, ack 138, win 4096, options [nop,nop,TS val 4255255467 ecr 4014857421], length 0
07:28:16.564112 IP 10.23.1.1.32790 > 8.7.198.46.80: Flags [F.], seq 138, ack 2, win 502, options [nop,nop,TS val 4014884740 ecr 4255255467], length 0
07:28:16.564382 IP 8.7.198.46.80 > 10.23.1.1.32790: Flags [.], ack 139, win 4095, options [nop,nop,TS val 4255255467 ecr 4014857421], length 0
07:28:17.564497 IP 10.23.1.1.34668 > 8.7.198.46.80: Flags [S], seq 3953575953, win 64240, options [mss 1460,sackOK,TS val 4014885741 ecr 0,nop,wscale 7], length 0
07:28:17.564833 IP 8.7.198.46.80 > 10.23.1.1.34668: Flags [S.], seq 858982458, ack 3953575954, win 29184, options [mss 1460,sackOK,TS val 4255256468 ecr 4014885741,nop,wscale 7], length 0
07:28:17.564872 IP 10.23.1.1.34668 > 8.7.198.46.80: Flags [.], ack 1, win 502, options [nop,nop,TS val 4014885741 ecr 4255256468], length 0
07:28:17.564955 IP 10.23.1.1.34668 > 8.7.198.46.80: Flags [P.], seq 1:138, ack 1, win 502, options [nop,nop,TS val 4014885741 ecr 4255256468], length 137: HTTP: GET / HTTP/1.1
07:28:17.565105 IP 8.7.198.46.80 > 10.23.1.1.34668: Flags [.], ack 138, win 226, options [nop,nop,TS val 4255256468 ecr 4014885741], length 0
07:29:17.566023 IP 8.7.198.46.80 > 10.23.1.1.34668: Flags [.], ack 138, win 4096, options [nop,nop,TS val 4255316469 ecr 4014885741], length 0
07:29:17.566052 IP 10.23.1.1.34668 > 8.7.198.46.80: Flags [.], ack 1, win 502, options [nop,nop,TS val 4014945742 ecr 4255256468], length 0
07:29:44.927583 IP 8.7.198.46.80 > 10.23.1.1.34668: Flags [F.], seq 1, ack 138, win 4096, options [nop,nop,TS val 4255343830 ecr 4014945742], length 0
07:29:44.927661 IP 10.23.1.1.34668 > 8.7.198.46.80: Flags [.], ack 2, win 502, options [nop,nop,TS val 4014973104 ecr 4255343830], length 0
07:29:44.927739 IP 10.23.1.1.34668 > 8.7.198.46.80: Flags [F.], seq 138, ack 2, win 502, options [nop,nop,TS val 4014973104 ecr 4255343830], length 0
07:29:44.927866 IP 8.7.198.46.80 > 10.23.1.1.34668: Flags [.], ack 139, win 4095, options [nop,nop,TS val 4255343831 ecr 4014973104], length 0
07:29:46.928083 IP 10.23.1.1.36576 > 8.7.198.46.80: Flags [S], seq 2571942815, win 64240, options [mss 1460,sackOK,TS val 4014975104 ecr 0,nop,wscale 7], length 0
07:29:46.928331 IP 8.7.198.46.80 > 10.23.1.1.36576: Flags [S.], seq 2654920595, ack 2571942816, win 29184, options [mss 1460,sackOK,TS val 4255345831 ecr 4014975104,nop,wscale 7], length 0
07:29:46.928371 IP 10.23.1.1.36576 > 8.7.198.46.80: Flags [.], ack 1, win 502, options [nop,nop,TS val 4014975105 ecr 4255345831], length 0
07:29:46.928424 IP 10.23.1.1.36576 > 8.7.198.46.80: Flags [P.], seq 1:138, ack 1, win 502, options [nop,nop,TS val 4014975105 ecr 4255345831], length 137: HTTP: GET / HTTP/1.1
07:29:46.928504 IP 8.7.198.46.80 > 10.23.1.1.36576: Flags [.], ack 138, win 226, options [nop,nop,TS val 4255345831 ecr 4014975105], length 0

望赐教，谢谢

1 reply

emptyteeth Mar 25, 2022
Author

我之前忽略了dns问题, 你先按这个方法把dns的问题解决, 然后再试一下看看
ref: https://serverfault.com/questions/614574/how-to-set-dns-exclusively-for-a-network-namespace-in-linux

sudo mkdir -p /etc/netns/YOUR_NS_NAME_HERE
sudo echo -e 'nameserver 1.1.1.1\n' >/etc/netns/YOUR_NS_NAME_HERE/resolv.conf

m2acgi · 2022-05-28T05:43:09Z

m2acgi
May 28, 2022

@emptyteeth 大佬，请问 netns 可以解决路由环路问题吗？比如在一台主机上同时跑 tun2socks 和 clash 时。

6 replies

m2acgi May 28, 2022

有示例文档吗？一直没有解决同一台主机跑 tun2socks 加 clash 的路由环路问题。我把 clash 放在一个单独的用户下，研究了 linux route by uid/gid, 没有成功。

xjasonlyu May 28, 2022
Maintainer

简单一点的你直接clash tun2socks 绑定同一个interface就行了

emptyteeth May 28, 2022
Author

你说的环路问题是这种情况吗:

主机的默认路由是tun2socks创建的tun设备
tun2socks通过socks5连接clash
clash通过默认路由连接服务器造成环路

如果是这样的话,我想到2种思路可以试一下
假设物理接口eth0, clash uid 1001

ip rule uidrange

ip route add default dev eth0 table 300
ip rule add uidrange 1001-1001 lookup 300

ip rule fwmark

iptables -t mangle -A OUTPUT -m owner --uid-owner 1001  -j MARK --set-mark 3
ip route add default dev eth0 table 300
ip rule add fwmark 3 lookup 300

m2acgi Jul 1, 2022

简单一点的你直接clash tun2socks 绑定同一个interface就行了

@xjasonlyu 大佬，我在 clash 配置中设置了 Outbound interface, 即 interface-name: eth0, 发现流量 loop 没了，但没有经常大量进一步测试验证。您说的绑定同一个 inerface 是这个 clash 参数吗? 还是说在 tun2socks 这边还需要额外的设置？

m2acgi Jul 1, 2022

你说的环路问题是这种情况吗:

主机的默认路由是tun2socks创建的tun设备

tun2socks通过socks5连接clash

clash通过默认路由连接服务器造成环路

如果是这样的话,我想到2种思路可以试一下假设物理接口eth0, clash uid 1001

ip rule uidrange
ip route add default dev eth0 table 300
ip rule add uidrange 1001-1001 lookup 300
ip rule fwmark
iptables -t mangle -A OUTPUT -m owner --uid-owner 1001  -j MARK --set-mark 3
ip route add default dev eth0 table 300
ip rule add fwmark 3 lookup 300

@emptyteeth 大佬，试了下 ip rule uidrange, 可以解决流量 loop. 我查了些资料，有些文章说这种方式还需要额外设置 rp_filter, 本场景下是否必须设置呢？不设置是否有什么影响呢？> https://unix.stackexchange.com/questions/564163/routing-traffic-for-a-user-through-specific-interface-tum1

Uh oh!

Uh oh!

Use tun2socks as a global router on Linux (Chinese) #102

Uh oh!

Uh oh!

emptyteeth Mar 5, 2022

Replies: 2 comments · 7 replies

Uh oh!

LambertZhaglog Mar 25, 2022

Uh oh!

emptyteeth Mar 25, 2022 Author

Uh oh!

Uh oh!

m2acgi May 28, 2022

Uh oh!

m2acgi May 28, 2022

Uh oh!

xjasonlyu May 28, 2022 Maintainer

Uh oh!

emptyteeth May 28, 2022 Author

ip rule uidrange

ip rule fwmark

Uh oh!

m2acgi Jul 1, 2022

Uh oh!

m2acgi Jul 1, 2022

ip rule uidrange

ip rule fwmark

emptyteeth
Mar 5, 2022

Replies: 2 comments 7 replies

LambertZhaglog
Mar 25, 2022

emptyteeth Mar 25, 2022
Author

m2acgi
May 28, 2022

xjasonlyu May 28, 2022
Maintainer

emptyteeth May 28, 2022
Author