Using shadowsocks to build a LAN transparent gateway

apt-get install dnsmasq

no-resolv
server=127.0.0.1#5354

service dnsmasq start

wget -c https://github.com/shadowsocks/ChinaDNS/releases/download/1.3.2/chinadns-1.3.2.tar.gz

tar -xvf chinadns-1.3.2.tar.gz && cd chinadns-1.3.2
./configure && make 
src/chinadns -m -p 5353 -c chnroute.txt & ###Only used to test whether the chinadns can be started netstat -ntlpu ###### View the started port

cp ./src/chinadns /usr/local/bin/

#!/bin/sh
### BEGIN INIT INFO
# Provides: chinadns
# Required-Start: $network $local_fs $remote_fs $syslog
# Required-Stop: $remote_fs
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Start ChinaDNS at boot time
### END INIT INFO ### Begin Deploy Path
# Put this file at /etc/init.d/
### End Deploy PathDAEMON=/usr/local/bin/chinadns
DESC=ChinaDNS
NAME=chinadns
PIDFILE=/var/run/$NAME.pidtest -x $DAEMON || exit 0case "$1" in
  start)
    echo -n "Starting $DESC: "
    $DAEMON \
        -c /etc/chinadns/chnroute.txt \
 -m \
        -p 5354 \
 -s 114.114.114.114,127.0.0.1:5300 \
        1> /var/log/$NAME.log \
        2> /var/log/$NAME.err.log &
    echo $! > $PIDFILE
    echo "$NAME."
    ;;
  stop)
    echo -n "Stopping $DESC: "
    kill `cat $PIDFILE`
    rm -f $PIDFILE
    echo "$NAME."
    ;;
  restart|force-reload)
    $0 stop
    sleep 1
    $0 start
    ;;
  *)
    N=/etc/init.d/$NAME
    echo "Usage: $N {start|stop|restart|force-reload}" >&2
    exit 1
    ;;
esacexit 0

service chinadns start #Start chinadns
service chinadns restart #Restart chinadns
service chinadns stop #Stop chinadns

apt-get install software-properties-common -y
add-apt-repository ppa:max-c-lv/shadowsocks-libev -y
apt-get update
apt install shadowsocks-libev

{
    "server":"111.111.111.111",
    "server_port":8388,
    "local_address":"0.0.0.0",
    "local_port":1080,
    "password":"password",
    "timeout":60,
    "method":"aes-256-cfb",
    "mode": "tcp_and_udp"
}

/usr/bin/ss-tunnel -c /etc/shadowsocks-libev/config.json -u -l 5300 -L 8.8.8.8:53 &
/usr/bin/ss-redir -c /etc/shadowsocks-libev/config.json -b 0.0.0.0 -u &

net.ipv4.ip_forward=1

sysctl -p

curl -sL http://f.ip.cn/rt/chnroutes.txt | egrep -v '^$|^#' > cidr_cn
###If the execution fails, you can use cat /usr/local/src/chinadns-1.3.2/chnroute.txt | egrep -v '^$|^#' > cidr_cn
ipset -N cidr_cn hash:net
for i in `cat cidr_cn`; do echo ipset -A cidr_cn $i >> ipset.sh; done
chmod +x ipset.sh && sudo ./ipset.sh
rm -f ipset.cidr_cn.rules
ipset -S > ipset.cidr_cn.rules
cp ./ipset.cidr_cn.rules /etc/ipset.cidr_cn.rules

iptables -t nat -N shadowsocks# Reserved addresses, private addresses, and loopback addresses do not go through the proxy iptables -t nat -A shadowsocks -d 0/8 -j RETURN
iptables -t nat -A shadowsocks -d 127/8 -j RETURN
iptables -t nat -A shadowsocks -d 10/8 -j RETURN
iptables -t nat -A shadowsocks -d 169.254/16 -j RETURN
iptables -t nat -A shadowsocks -d 172.16/12 -j RETURN
iptables -t nat -A shadowsocks -d 192.168/16 -j RETURN
iptables -t nat -A shadowsocks -d 224/4 -j RETURN
iptables -t nat -A shadowsocks -d 240/4 -j RETURN# The following IPs are the IPs of devices in the LAN that do not use a proxy
iptables -t nat -A shadowsocks -s 192.168.2.10 -j RETURN# Data sent to the shadowsocks server does not go through the proxy, otherwise it will fall into an infinite loop# Replace 111.111.111.111 with your ss server ip/domain nameiptables -t nat -A shadowsocks -d 111.111.111.111 -j RETURN    
# Mainland China addresses do not use the proxy, because it is meaningless and takes a lot of effort iptables -t nat -A shadowsocks -m set --match-set cidr_cn dst -j RETURN# All other redirects are redirected to ss-redir listening port 1080 (the port number is arbitrary, just unify it)
iptables -t nat -A shadowsocks ! -p icmp -j REDIRECT --to-ports 1080# Add a rule to the OUTPUT chain to redirect to the shadowsocks chain iptables -t nat -A OUTPUT ! ​​-p icmp -j shadowsocks
iptables -t nat -A PREROUTING ! -p icmp -j shadowsocks

route del default
route add default gw 192.168.2.1 p2p1