Trojan-gfw 一键脚本&手动安装&TLS1.3

• 项目地址：https://github.com/trojan-gfw/trojan
• 脚本地址：https://github.com/johnrosen1/trojan-gfw-script
• 参考文章：https://www.johnrosen1.com/trojan/
• 特      性：TLS1.3、v2ray

---

• 1.一键脚本
  • 1.1 via wget
  • 1.2 via curl
• 2.手动安装
  • 2.1 申请免费SSL/TLS证书
  • 2.2 安装&配置Trojan-gfw
  • 2.3 安装&配置Nginx
• 3.TCP Turbo (非必须)
• 4.Dnsmasq(非必须)
• 5.客户端
  • 5.1 Windows
    • 5.1.1 西部世界机场提供
    • 5.1.2 手动配置
  • 5.2 移动客户端
  • 5.3 Macos
    • 5.3.1 西部世界机场提供
    • 5.3.2 安装Homebrew并运行命令（方法一）
  • 5.4 路由器（西部世界机场提供）
    • 5.4.1 梅林固件
    • 5.4.2 OpenWRT

1.一键脚本

1.1 via wget

bash -c "$(wget -O- https://raw.githubusercontent.com/johnrosen1/trojan-gfw-script/master/trojan.sh)"

1.2 via curl

bash -c "$(curl -fsSL https://raw.githubusercontent.com/johnrosen1/trojan-gfw-script/master/trojan.sh)"

---

2.手动安装

2.1 申请免费SSL/TLS证书

• 安装acme脚本 用于自动申请Let's encrypt证书

  apt-get update && apt-get install curl -y&& apt-get install socat -y && curl https://get.acme.sh | sh
  mkdir /etc/trojan/
  

• 申请证书

  ~/.acme.sh/acme.sh --issue -d example.com --standalone -k ec-256
  

• 安装证书

  ~/.acme.sh/acme.sh --installcert -d example.com --fullchainpath /etc/trojan/trojan.crt --keypath /etc/trojan/trojan.key --ecc
  chmod +r /etc/trojan/trojan.key #给密钥读取权限
  

---

2.2 安装&配置Trojan-gfw

• 安装Trojan-gfw

apt-get update && sudo apt-get upgrade -y && sudo apt-get install xz-utils -y

#via wget
bash -c "$(wget -O- https://raw.githubusercontent.com/trojan-gfw/trojan-quickstart/master/trojan-quickstart.sh)"

#via curl
bash -c "$(curl -fsSL https://raw.githubusercontent.com/trojan-gfw/trojan-quickstart/master/trojan-quickstart.sh)"

• 配置Trojan-gfw
  • 自动化替换

  sed  -i 's/path/etc/g' /usr/local/etc/trojan/config.json
  sed  -i 's/to/trojan/g' /usr/local/etc/trojan/config.json
  sed  -i 's/certificate.crt/trojan.crt/g' /usr/local/etc/trojan/config.json
  sed  -i 's/private.key/trojan.key/g' /usr/local/etc/trojan/config.json
  sed  -i 's/password1/yourpasswd/g' /usr/local/etc/trojan/config.json
  sed  -i 's/password2/yourpasswd/g' /usr/local/etc/trojan/config.json
  

  • 编辑服务器配置文件

  apt-get install vim -y
  vim nano /usr/local/etc/trojan/config.json
  

  {
  "run_type": "server",
  "local_addr": "0.0.0.0",
  "local_port": 443,
  "remote_addr": "127.0.0.1",
  "remote_port": 80,
  "password": [
      "password1", //密码不支持 ！ 等特殊符号
      "password2"
  ],
  "log_level": 1,
  "ssl": {
      "cert": "/etc/trojan/trojan.crt", //自动化中已替换的证书路径
      "key": "/etc/trojan/trojan.key", //自动化中已替换的密钥路径
      "key_password": "",
      "cipher": "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256",
      "cipher_tls13":"TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384",
      "prefer_server_cipher": true,
      "alpn": [
          "http/1.1"
      ],
      "reuse_session": true,
      "session_ticket": true,
      "session_timeout": 600,
      "plain_http_response": "",
      "curves": "",
      "dhparam": ""
  },
  "tcp": {
      "prefer_ipv4": true,
      "no_delay": true,
      "keep_alive": true,
      "reuse_port": true,
      "fast_open": true,
      "fast_open_qlen": 20
  },
  "mysql": {
      "enabled": false,
      "server_addr": "127.0.0.1",
      "server_port": 3306,
      "database": "trojan",
      "username": "trojan",
      "password": ""
  }
  }
  

  如需禁用TLS1.2，cipher仅保留TLS1.3的cipher即可

• Trojan-gfw管理

systemctl start trojan #启动trojan
systemctl enable trojan #添加开机自启
journalctl -e -u trojan.service #trojan日志查看方法

---

2.3 安装&配置Nginx

• 安装Nginx

apt-get install nginx -y

• 新建server块的nginx配置文件

rm -rf /etc/nginx/sites-available/*
rm -rf /etc/nginx/sites-enabled/*
rm -rf /etc/nginx/conf.d/*
touch /etc/nginx/conf.d/trojan.conf
vim /etc/nginx/conf.d/trojan.conf

server {
    listen 127.0.0.1:80; #放在Trojan后面即可做伪装也可以是真正的网站
    server_name example.com;
    location / {
        root /usr/share/nginx/html/; #默认的根目录
        index index.html; #默认的html文件
        }
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; #HSTS标头
}

server {
    listen 80;
    listen [::]:80;
    server_name example.com;
    return 301 https://example.com; #301 https重定向
}

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;
    return 444;
}

• 测试配置文件，出现OK即通过

nginx -t

• 启动nginx

systemctl start nginx

建议自行修改/usr/share/nginx/html/下的index.html等文件来使伪装更加真实

• 后期如需修改配置文件可用此命令软重启Nginx 无输出则表示正常

nginx -s reload

---

3.TCP Turbo (非必须)

原理：启用BBR，TFO并禁用TCP慢启动提高吞吐量以及加快连接建立。

• 自动添加并生效

cat > '/etc/sysctl.d/99-sysctl.conf' << EOF
# Overrule forwarding behavior. Accept Router Advertisements
net.ipv6.conf.all.accept_ra = 2
# max open files
fs.file-max = 51200
# max read buffer
net.core.rmem_max = 67108864
# max write buffer
net.core.wmem_max = 67108864
# default read buffer
net.core.rmem_default = 65536
# default write buffer
net.core.wmem_default = 65536
# max processor input queue
net.core.netdev_max_backlog = 4096
# max backlog
net.core.somaxconn = 4096
# resist SYN flood attacks
net.ipv4.tcp_syncookies = 1
# reuse timewait sockets when safe
net.ipv4.tcp_tw_reuse = 1
# short FIN timeout
net.ipv4.tcp_fin_timeout = 30
# short keepalive time
net.ipv4.tcp_keepalive_time = 1200
# outbound port range
net.ipv4.ip_local_port_range = 10000 65000
# max timewait sockets held by system simultaneously
net.ipv4.tcp_max_tw_buckets = 5000
# turn on TCP Fast Open on both client and server side
net.ipv4.tcp_fastopen = 3
# TCP receive buffer
net.ipv4.tcp_rmem = 4096 87380 67108864
# TCP write buffer
net.ipv4.tcp_wmem = 4096 65536 67108864
# turn on path MTU discovery
net.ipv4.tcp_mtu_probing = 1
net.ipv4.tcp_slow_start_after_idle = 0
net.ipv4.tcp_max_syn_backlog = 12800
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr
EOF
sysctl -p

---

4.Dnsmasq(非必须)

原理：缓存Dns加快重复网站访问速度

• 新建

apt-get install dnsmasq -y
mv /etc/dnsmasq.conf /etc/dnsmasq.conf.bak
touch /etc/dnsmasq.conf

• 仅监听本机

cat > '/etc/dnsmasq.conf' << EOF
port=53
domain-needed
bogus-priv
no-resolv
server=8.8.4.4#53
server=1.1.1.1#53
interface=lo
bind-interfaces
cache-size=10000
no-negcache
log-queries 
log-facility=/var/log/dnsmasq.log 
EOF

• 设定系统dns服务器为本机

echo "nameserver 127.0.0.1" > '/etc/resolv.conf'

• 启动dnsmasq并设置开机自启

systemctl restart dnsmasq
systemctl enable dnsmasq
systemctl status dnsmasq

---

5.客户端

5.1 Windows

5.1.1 西部世界机场提供

https://westworldss.com/portal/page/trojan?client=windows

5.1.2 手动配置

• 下载安装Microsoft Visual Studio 2015, 2017 and 2019 https://support.microsoft.com/en-us/help/2977003/the-latest-supported-visual-c-downloads

重启后生效

• 从github下载预编译release并解压
  https://github.com/trojan-gfw/trojan/releases
• 编辑客户端config.json

{
    "run_type": "client",
    "local_addr": "127.0.0.1",
    "local_port": 1080,
    "remote_addr": "1.1.1.1", //你的服务器ip
    "remote_port": 443,
    "password": [
        "example" //你的密码，和服务器必须一致，password1或者2皆可
    ],
    "log_level": 1,
    "ssl": {
        "verify": true,
        "verify_hostname": true,
        "cert": "",
        "cipher": "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:RSA-AES128-GCM-SHA256:RSA-AES256-GCM-SHA384:RSA-AES128-SHA:RSA-AES256-SHA:RSA-3DES-EDE-SHA",
        "cipher_tls13":"TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384",
        "sni": "yourdomain", //你的域名
        "alpn": [
            "h2",
            "http/1.1"
        ],
        "reuse_session": true,
        "session_ticket": true,
        "curves": ""
    },
    "tcp": {
        "no_delay": true,
        "keep_alive": true,
        "reuse_port": true,
        "fast_open": true,
        "fast_open_qlen": 20
    }
}

Trojan客户端仅支持socks5，因此得配合Chrome的Switchomeaga插件或者用V2ray把socks5转换成http使用

• 配合使用V2ray分流的json(可直接使用，无需修改）

{
    "inbounds": [
        {
            "listen": "127.0.0.1",
            "port": 8001,
            "protocol": "http",
            "settings": {
                 "timeout": 0,
                 "allowTransparent": false,
                 "userLevel": 0
                        },
            "sniffing": {
                "enabled": true,
                "destOverride": ["http","tls"]
            }
        }
    ],
    "outbounds": [
    {
      "tag": "proxy",
      "protocol": "socks",
      "settings": {
  "servers": [{
    "address": "127.0.0.1",
    "port": 1080
  }]
}
    },
        {
      "tag": "direct",
      "protocol": "freedom",
      "settings": {},
      "streamSettings": {
        "sockopt": {
          "mark": 255
        }
      }
    },
         {
         "tag": "adblock",
         "protocol" : "blackhole",
         "settings": {},
         "streamSettings": {
         "sockopt": {
           "mark": 255
           }
         }
      }
    ],
    "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      {
        "type": "field",
        "inboundTag": ["dns-in"],
        "outboundTag": "dns-out"
      },
      {
        "type": "field",
        "outboundTag": "direct",
        "ip": ["geoip:private"]
      },
      {
        "type": "field",
        "outboundTag": "direct",
        "ip": ["geoip:cn"]
      },
      {
        "type": "field",
        "outboundTag": "direct",
        "domain": ["geosite:cn"]
      },
      {
         "type": "field",
         "outboundTag": "direct",
         "protocol": ["bittorrent"]
      }
    ]
  },
    "dns": {
    "servers": [
      "8.8.4.4",
        {
           "address": "114.114.114.114",
           "port": 53,
           "domains": ["geosite:cn"]
      }
    ]
  }
}

• 下载安装完成后，点击新增情景模式，代理协议填入socks5 代理伺服器填 127.0.0.1 端口填 1080就可以了。
• 双击trojan.exe运行，如果闪退请安装 Microsoft Visual C++套件
• Trojan本身仅支持全局代理，配合V2ray实现分流后可实现国内分流，代理Steam等功能，运行V2ray并设置系统代理为 http://127.0.0.1:8001 即可（win10在->开始菜单->设置->Proxy-> 127.0.0.1:8001即可，linux为 export https_proxy=http://127.0.0.1:8001之类的 ）

---

5.2 移动客户端

• igniter（Android）
  https://github.com/trojan-gfw/igniter/releases
• Pharos Pro（Android）
  https://github.com/PharosVip/Pharos-Android-Test/releases
• Shadowrocket（ios）
  https://apps.apple.com/us/app/shadowrocket/id932747118
• Pharos Pro（ios）
  https://apps.apple.com/hk/app/pharos-pro/id1456610173

---

5.3 Macos

5.3.1 西部世界机场提供

https://westworldss.com/portal/page/trojan?client=mac

5.3.2 安装Homebrew并运行命令（方法一）

brew tap trojan-gfw/homebrew-trojan
brew install trojan

并使用 brew services 来启动Trojan

---

5.4 路由器（西部世界机场提供）

5.4.1 梅林固件

https://westworldss.com/portal/page/trojan?client=merlin

5.4.2 OpenWRT

https://westworldss.com/portal/page/trojan?client=openwrt

---

6.atrandys的一键脚本（第2脚本）

curl -O https://raw.githubusercontent.com/atrandys/trojan/master/trojan_mult.sh && chmod +x trojan_mult.sh && ./trojan_mult.sh

# trojan服务端配置文件路径

/usr/src/trojan/server.conf
​


# 重启trojan服务端

systemctl restart trojan

转自：https://www.atrandys.com/2019/2154.html