《在 Linux 下利用 iptables 和 ss-redir 进行全局代理》的评论 https://archive.ntzyz.io/2016/01/27/proxy-under-linux-with-iptables-and-ss-redir/ Wed, 26 Sep 2018 02:20:00 +0000 hourly 1 https://wordpress.org/?v=5.8 评论者：maiza https://archive.ntzyz.io/2016/01/27/proxy-under-linux-with-iptables-and-ss-redir/#comment-210 Wed, 26 Sep 2018 02:20:00 +0000 https://blog.dimension.moe/?p=317#comment-210 一大堆iptables -t nat -A SHADOWSOCKS命令很繁琐不是吗？安利一款用户态灵活分流工具，支持按域名和ip分流https://github.com/net-reflow/reflow 搭配tun2socks实现全局翻墙

]]> 评论者：ntzyz https://archive.ntzyz.io/2016/01/27/proxy-under-linux-with-iptables-and-ss-redir/#comment-159 Tue, 12 Apr 2016 14:52:49 +0000 https://blog.dimension.moe/?p=317#comment-159 回复给littleqz。

Too many open files 的话，试试在 /etc/sysctl.conf 最后添加：

fs.file-max = 51200

然后执行

sudo sysctl -p

看看行不行？

]]> 评论者：littleqz https://archive.ntzyz.io/2016/01/27/proxy-under-linux-with-iptables-and-ss-redir/#comment-158 Tue, 12 Apr 2016 14:01:16 +0000 https://blog.dimension.moe/?p=317#comment-158 额，不支持 markdown 啊。。。

]]> 评论者：littleqz https://archive.ntzyz.io/2016/01/27/proxy-under-linux-with-iptables-and-ss-redir/#comment-157 Tue, 12 Apr 2016 14:00:38 +0000 https://blog.dimension.moe/?p=317#comment-157 奇怪，我添加规则后打开 ss-redir 时全是错误：

 2016-04-12 21:35:03 ERROR: accept: Too many open files
 2016-04-12 21:35:03 ERROR: accept: Too many open files
 2016-04-12 21:35:03 ERROR: accept: Too many open files
 2016-04-12 21:35:03 ERROR: accept: Too many open files
 2016-04-12 21:35:03 ERROR: accept: Too many open files
 2016-04-12 21:35:03 ERROR: accept: Too many open files
 ...
 2016-04-12 21:35:03 ERROR: getpeername: Transport endpoint is not connected
 2016-04-12 21:35:03 ERROR: getpeername: Transport endpoint is not connected
 2016-04-12 21:35:03 ERROR: getpeername: Transport endpoint is not connected
 2016-04-12 21:35:03 ERROR: getpeername: Transport endpoint is not connected

shadowsocks-libev 版本是 2.4.5， 启动参数为：

  sudo ss-redir -s aaa.bbb.ccc.ddd -p 998 -l 7777 -k  -m aes-256-cfb -b 127.0.0.1 -u -v

server 也是 shadowsocks-libev：

  sudo ss-server -s 0.0.0.0 -p 998 -k  -m aes-256-cfb -t 300 --fast-open -d 8.8.8.8 -u

iptables 规则为：

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1     1070  162K DOCKER     all  --  *      *       0.0.0.0/0           !127.0.0.0/8          ADDRTYPE match dst-type LOCAL
2        0     0 SHADOWSOCKS  all  --  *      *       0.0.0.0/0            0.0.0.0/0   

Chain SHADOWSOCKS (0 references)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/8           
2      261 15704 RETURN     all  --  *      *       0.0.0.0/0            10.0.0.0/8          
3        3   180 RETURN     all  --  *      *       0.0.0.0/0            169.254.0.0/16      
4      234 14040 RETURN     all  --  *      *       0.0.0.0/0            127.0.0.0/8         
5        7  1120 RETURN     all  --  *      *       0.0.0.0/0            240.0.0.0/4         
6        0     0 RETURN     all  --  *      *       0.0.0.0/0            224.0.0.0/4         
7      119  7140 RETURN     all  --  *      *       0.0.0.0/0            172.16.0.0/16       
8     1406 86516 RETURN     all  --  *      *       0.0.0.0/0            192.168.0.0/16      
9     2794  168K RETURN     all  --  *      *       0.0.0.0/0            aaa.bbb.ccc.ddd      
10   89554 5373K REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            redir ports 7777

是我配置的问题吗？同样的参数， `ss-local` 打开是正常的，但 `ss-redir` + iptables 就报错 ：（

]]>