Feniks_group
Wireguard-Privoxy

Repository

    1  ip a
    2  sudo useradd -m -G sudo -s /bin/bash infernofeniks
    3  sudo passwd infernofeniks
    4  su - infernofeniks
			1  ssh-keygen -t ed25519
			2  exit
    5  sudo apt update -y && sudo apt install git
    6  sudo git clone https://github.com/pprometey/wireguard_aws.git wireguard_aws
    7  cd wireguard_aws/
    8  sudo ./initial.sh
    9  sudo ./add-client.sh
   10  sudo ls /etc/wireguard/
   11  sudo ls /etc/wireguard/clients
   12  sudo nano /etc/wireguard/clients/Feniks@mobile/Feniks@mobile.conf
   13  ping 8.8.8.8
   14  ip a
   15  sudo nano /proc/sys/net/ipv4/ip_forward
   16  sudo reboot
   17  cd wireguard_aws/
   18  sudo ./add-client.sh user2@mobile
   19  sudo ln -s /etc/wireguard/clients ./clients
   20  sudo ls -la ./clients
   21  cd ~/wireguard_aws/
   22  sudo ./reset.sh
   23  sudo ./remove.sh
   24  sudo ./install.sh
   25  sudo ./add-client.sh user2@mobile
   26  sudo ./add-client.sh user3@home
   27  exit
bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)
x-ui status
x-ui enable
apt update && apt upgrade -y && apt install curl sudo gpg htop
bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)
- username - имя админа
- password - пароль админа
- panel port - порт веб консоли
- the web base path - дополнительный путь url
...
This is a fresh installation, generating random login info for security concerns:
###############################################
Username: NSLLJA958U
Password: avUeCn32pU
Port: 55481
WebBasePath: bPKeaFSW34zEItZ
Access URL: http://<IP_VDS_сервера:<Port_панели>/bPKeaFSW34zEItZ
###############################################
If you forgot your login info, you can type 'x-ui settings' to check
...
apt update && apt upgrade -y && apt autoclean -y && apt clean -y && apt autoremove -y && shutdown -r now
apt install certbot -y
certbot certonly --standalone --agree-tos --register-unsafely-without-email -d <Ваш домен>
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/<Ваш домен>/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/<Ваш домен>/privkey.pem
certbot renew --dry-run
nano /opt/certbot-renew.sh
#!/bin/bash

# Разрешить порт 80
ufw allow 80/tcp

# Обновить сертификаты
if certbot renew --post-hook "/usr/bin/x-ui restart"; then
  echo "Certbot renewal succeeded."
else
  echo "Certbot renewal failed." >&2
  exit 1
fi

# Закрыть порт 80
ufw delete allow 80/tcp
chmod +x /opt/certbot-renew.sh
echo "1   3   *   *   *	/opt/certbot-renew.sh" >> /etc/crontab
echo "1   3   *   *   *   certbot renew --post-hook '/usr/bin/x-ui restart'" >> /etc/crontab
Путь к файлу публичного ключа сертификата панели: /etc/letsencrypt/live/<Ваш домен>/fullchain.pem
Путь к файлу приватного ключа сертификата панели: /etc/letsencrypt/live/<Ваш домен>/privkey.pem
Путь к файлу открытого ключа сертификата подписки: /etc/letsencrypt/live/<Ваш домен>/fullchain.pem
Путь к файлу закрытого ключа сертификата подписки: /etc/letsencrypt/live/<Ваш домен>/privkey.pem
nano /etc/sysctl.conf
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr
sysctl -p
sysctl -a | grep congestion
sysctl net.core.rmem_max
sysctl net.core.wmem_max
net.core.rmem_max = 212992
net.core.wmem_max = 212992
nano /etc/sysctl.conf
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
sysctl -p
apt update && apt install iptables -y
iptables -A INPUT -s 185.224.228.0/22 -j DROP
iptables -A INPUT -s 195.209.120.0/22 -j DROP
iptables -A INPUT -s 212.192.156.0/22 -j DROP
apt update && apt install iptables-persistent
iptables-save
nano /etc/default/ufw
```conf
IPv6=no
```
ss -tulpn | grep LISTEN
ufw allow ssh/tcp && \
ufw limit ssh/tcp && \
ufw allow 55481/tcp && \
ufw allow 2096/tcp && \
ufw allow 443/tcp && \
ufw allow from 11.22.33.44 && \
ufw enable
useradd -m -c "InfernoFeniks" -G sudo -s /bin/bash infernofeniks && passwd infernofeniks
su infernofeniks
cd && mkdir .ssh && nano .ssh/authorized_keys
ssh-rsa AAAAB3Nza.....................QwerY7. user@macbook
exit
apt install rsyslog fail2ban ufw sudo curl gpg openssh-server -y
nano /etc/ssh/sshd_config
# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
AllowUsers infernofeniks # имя вашего пользователя

PermitRootLogin no
PasswordAuthentication yes # Идеально будет поставить значение 'no', чтобы вход был только по ключам
systemctl restart sshd.service
nano /etc/fail2ban/jail.d/jail.local
[sshd]
enabled  = true
filter   = sshd
action   = iptables[name=SSH, port=ssh, protocol=tcp]
logpath  = /var/log/auth.log
findtime    = 10m
maxretry    = 3
bantime     = 60m
ignoreip = <Ваш статический IP, с которого подключаетесь к серверу>/32 127.0.0.1/8 # Список игнорируемы адресов
nano /etc/fail2ban/fail2ban.conf
allowipv6 = no
systemctl restart fail2ban && sleep 3 && fail2ban-client reload
fail2ban-client status
fail2ban-client status sshd
fail2ban-client banned
fail2ban-client set sshd unbanip 1.2.3.4
nano /etc/ufw/before.rules
-A ufw-before-input -р icmp --icmp-type echo-request -j DROP
ss -tulpn | grep LISTEN
ufw allow 22/tcp && ufw allow 2011/tcp && ufw allow 51231/tcp && ufw allow 443/tcp && ufw allow 43534/tcp && ufw enable
nano /etc/motd
|
|FQDN: https://<Домен подключения к консоли x3-ui>:<порт Web консоли>/<базовый путь>/
|
nano /etc/network/interfaces
auto ens192
iface ens192 inet static
	address 192.168.100.20
	netmask 255.255.255.0
	gateway 192.168.100.1
apt update && apt install -y ntp curl net-tools sudo privoxy wireguard resolvconf nmap
nano /etc/wireguard/wg-feniks.conf
	#WireGuard конфиг. У вас будут свои значения

	[Interface]
	PrivateKey = 8O######Kx3TBkxQoF9V94##############M7pcxY6gULHE=
	dns = 8.8.8.8
	ListenPort = 23317
	Address = 10.0.246.161/24

	PreUp = nping --udp --count 1 --data-length 16 --source-port 23317 --dest-port 18024 wireguard.server.com

	[Peer]
	PublicKey = ipW9/ys########################XIqz4PQY=
	AllowedIPs = 0.0.0.0/0, ::/0
	Endpoint = wireguard.server.com:18024
wg genkey | tee client_private.key | wg pubkey | tee client_public.key
curl 2ip.ru
wg-quick up wg-feniks
curl 2ip.ru
systemctl enable wg-quick@wg-feniks
apt update && apt upgrade && apt install sudo curl gpg openssh-server ssh htop -y
usermod -aG sudo infernofeniks
curl -fsSL https://get.docker.com -o get-docker.sh && sh ./get-docker.sh && apt install docker-compose -y
usermod -aG docker infernofeniks
mkdir -p docker/v2raya && cd docker/v2raya/ && nano docker-compose.yaml
version: '3.8'

services:
  v2raya:
    image: mzz2017/v2raya
    container_name: v2raya
    restart: always

# если нужен прозрачный прокси:
#    privileged: true
#    network_mode: host
#    environment:
#      - V2RAYA_LOG_FILE=/tmp/v2raya.log
#      - V2RAYA_V2RAY_BIN=/usr/local/bin/v2ray
#      - V2RAYA_NFTABLES_SUPPORT=off # "on" если ОС использует nftables, иначе "off"
#      - IPTABLES_MODE=legacy # "nftables", если nft или "legacy", если iptables
#    volumes:
#      - /lib/modules:/lib/modules:ro
#      - /etc/resolv.conf:/etc/resolv.conf
#      - /etc/v2raya:/etc/v2raya


# если не нужен прозрачный прокси:
    ports:
      - 2017:2017
      - 20170:20170
      - 20171:20171
      - 20172:20172
    environment:
      - V2RAYA_LOG_FILE=/tmp/v2raya.log
    volumes:
      - /etc/v2raya:/etc/v2raya

docker-compose up -d
nano /etc/privoxy/config
	listen-address  127.0.0.1:20170
	listen-address  192.168.100.20:20170
systemctl restart privoxy.service
nano /etc/network/interfaces
	iface ens192 inet static
	address 192.168.100.21
	netmask 255.255.255.0
	gateway 192.168.100.1
	dns-nameservers 8.8.8.8
	auto ens192
apt update && apt install -y ntp curl net-tools sudo privoxy
nano /etc/privoxy/config
	listen-address  127.0.0.1:1080
	listen-address  192.168.100.21:1080
	#  2.5. actionsfile
	actionsfile via-nuc.action   # Allow sites
	actionsfile antiban.action   # Antiban ROSREESTR
# Pass through NUC's privoxy

{ +forward-override{forward 192.168.100.20:20170} }
#.2ip.ru/
.myip.com
sed -i 's/192\.168\.100\.20:1080/192\.168\.100\.20:20170/g' /etc/privoxy*.action
# Pass through NUC's privoxy

{ +forward-override{forward 127.0.0.1:20171} }
#.2ip.ru/
.myip.com
sed -i 's/192\.168\.100\.20:8118/127\.0\.0\.1:20171/g' /etc/privoxy*.action
systemctl restart privoxy.service
apt update && apt-get install redsocks -y
nano /etc/redsocks.conf
base {
    log_debug = off;
    log_info = on;
    daemon = on;
    redirector = iptables;
}

redsocks {
    local_ip = 0.0.0.0; # Адрес на котором доступен redsocks
    local_port = 12345;  # Порт, на который будет перенаправляться весь трафик
    ip = 127.0.0.1; # # Адрес вашего SOCKS5 прокси-сервера (docker v2rayA)
    port = 20170;  # Порт вашего SOCKS5 прокси-сервера (docker v2rayA)
    type = socks5;  # Тип прокси-сервера
}
systemctl restart redsocks
nano /etc/sysctl.conf
net.ipv4.ip_forward=1
sysctl -p
iptables -t nat -N REDSOCKS
iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN
iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN
iptables -t nat -A REDSOCKS -p tcp --dport 1080 -j RETURN
iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports 12345
iptables -t nat -A PREROUTING -i ens18 -p tcp -j REDSOCKS
apt update && apt install iptables-persistent
iptables-save
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
iptables -t nat -A PREROUTING -s 192.168.100.0/24 -d 192.168.100.0/24 -j ACCEPT
chmod 755 /etc/privoxy/privoxy-bl-upd.pl
nano /etc/privoxy
		actionsfile adblock.action
		actionsfile rpft.action
		filterfile rpft.filter
crontab -e
	# Update ADBlock list for Privoxy
	0 5 * * 1 /etc/privoxy/privoxy-bl-upd.pl