Skip to content

trojan 安装

基本设置

HOST_NAME：xxx.trojan.com HOST_IP: 1.2.3.4 PASSWORD: trojan_password

安装依赖

1
2
3
4
5
apt update
apt upgrade -y
apt install -y socat cron curl libcap2-bin xz-utils vim nginx net-tools
systemctl start cron
systemctl enable cron

Launching Cron

1
vi /etc/nginx/sites-available/<HOST_NAME>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
server {
    listen 127.0.0.1:80 default_server;

    server_name <HOST_NAME>;

    location / {
        proxy_pass http://www.oracle.org;
    }

}

server {
    listen 127.0.0.1:80;

    server_name <HOST_IP>;

    return 301 https://<HOST_NAME>$request_uri;
}

server {
    listen 0.0.0.0:80;
    listen [::]:80;

    server_name _;

    location / {
        return 301 https://$host$request_uri;
    }

    location /.well-known/acme-challenge {
       root /var/www/acme-challenge;
    }
}

1
2
3
4
5
rm /etc/nginx/sites-enabled/default
ln -s /etc/nginx/sites-available/<HOST_NAME> /etc/nginx/sites-enabled/
sudo systemctl enable nginx
sudo systemctl restart nginx
sudo systemctl status nginx

证书

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
mkdir -p /etc/letsencrypt/live
chown -R ubuntu:ubuntu /etc/letsencrypt
mkdir -p  /var/www/acme-challenge
chown -R ubuntu:ubuntu /var/www/acme-challenge
curl  https://get.acme.sh | sh
ln -s .acme.sh/acme.sh $HOME/acme.sh
./acme.sh --set-default-ca  --server  letsencrypt
./acme.sh --issue -d <HOST_NAME> -w /var/www/acme-challenge
./acme.sh --install-cert -d <HOST_NAME> --key-file /etc/letsencrypt/live/private.key --fullchain-file /etc/letsencrypt/live/certificate.crt
echo "auto update"
acme.sh  --upgrade  --auto-upgrade

iptables

1
2
3
iptables -I INPUT 6 -m state --state NEW -p tcp --dport 80 -j ACCEPT
iptables -I INPUT 6 -m state --state NEW -p tcp --dport 443 -j ACCEPT
netfilter-persistent save

trojan

1
2
bash -c "$(curl -fsSL https://raw.githubusercontent.com/trojan-gfw/trojan-quickstart/master/trojan-quickstart.sh)"
sudo cp /usr/local/etc/trojan/config.json /usr/local/etc/trojan/config.json.bak

trojan 配置：

1
vi /usr/local/etc/trojan/config.json

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
{
    "run_type": "server",
    "local_addr": "::",
    "local_port": 443,
    "remote_addr": "127.0.0.1",
    "remote_port": 80,
    "password": [
        "<PASSWORD>"
    ],
    "log_level": 1,
    "ssl": {
        "cert": "/etc/letsencrypt/live/certificate.crt",
        "key": "/etc/letsencrypt/live/private.key",
        "key_password": "",
        "cipher": "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384",
        "cipher_tls13": "TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384",
        "prefer_server_cipher": true,
        "alpn": [
            "http/1.1"
        ],
        "alpn_port_override": {
            "h2": 81
        },
        "reuse_session": true,
        "session_ticket": false,
        "session_timeout": 600,
        "plain_http_response": "",
        "curves": "",
        "dhparam": ""
    },
    "tcp": {
        "prefer_ipv4": false,
        "no_delay": true,
        "keep_alive": true,
        "reuse_port": false,
        "fast_open": false,
        "fast_open_qlen": 20
    },
    "mysql": {
        "enabled": false,
        "server_addr": "127.0.0.1",
        "server_port": 3306,
        "database": "trojan",
        "username": "trojan",
        "password": "",
        "key": "",
        "cert": "",
        "ca": ""
    }
}

1
2
3
4
sudo systemctl daemon-reload
sudo systemctl enable trojan
sudo systemctl restart trojan
sudo systemctl status trojan

配置trojan定时重启

1
sudo crontab -e

1
0 0 1 * * killall -s SIGUSR1 trojan

bbr

1
2
3
sudo bash -c 'echo "net.core.default_qdisc=fq" >> /etc/sysctl.conf'
sudo bash -c 'echo "net.ipv4.tcp_congestion_control=bbr" >> /etc/sysctl.conf'
sudo sysctl -p