Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

wireguard 能添加 reseved 吗? #1730

Closed
fscarmen opened this issue Mar 2, 2023 · 92 comments
Closed

wireguard 能添加 reseved 吗? #1730

fscarmen opened this issue Mar 2, 2023 · 92 comments

Comments

@fscarmen
Copy link

fscarmen commented Mar 2, 2023

3个数字组成的数组来的。
这样就能在 LA 和 HK 使用上 warp 服务了。

@RPRX
Copy link
Member

RPRX commented Mar 2, 2023

加,都可以加,咕咕咕

@fscarmen
Copy link
Author

fscarmen commented Mar 2, 2023

等老大好消息。

@Fangliding
Copy link
Member

@fscarmen sing box可以 性能也更高 大佬的脚本需要的话可以考虑
不过比较大的问题事需要的参数怎么获得 好像网上主流方法都得去拆app

@fscarmen
Copy link
Author

fscarmen commented Mar 2, 2023

@fscarmen sing box可以 性能也更高 大佬的脚本需要的话可以考虑 不过比较大的问题事需要的参数怎么获得 好像网上主流方法都得去拆app

是啊,我也知道 sing box 可以,但我还是支持 R大 xray :)

@RPRX RPRX closed this as completed Mar 2, 2023
RPRX added a commit that referenced this issue Mar 2, 2023
@RPRX
Copy link
Member

RPRX commented Mar 2, 2023

谢谢你的支持,请测试 ccba465

就不该早上喝酒

@cross-hello
Copy link
Contributor

cross-hello commented Mar 2, 2023 via email

@RPRX
Copy link
Member

RPRX commented Mar 2, 2023

To To To:我猜你没用最新的 commit

@RPRX
Copy link
Member

RPRX commented Mar 2, 2023

To Deleted Account:请发个 issue,可能 response.body 并不能被并发 Close()

@RPRX
Copy link
Member

RPRX commented Mar 2, 2023

还有,软路由上的代理开个 Fake DNS 什么的就是让服务端去解析 IP,相当于对电脑上 REALITY 代理的重定向攻击,肯定连不上

@RPRX
Copy link
Member

RPRX commented Mar 2, 2023

To To To:你用的不是最新的 commit

@RPRX
Copy link
Member

RPRX commented Mar 2, 2023

To To To:看看 Xray-core 启动时信息

@RPRX
Copy link
Member

RPRX commented Mar 2, 2023

To To To:我真的是无语,我说了几次了你用的不是最新的 commit,你用的不是最新的 commit,你用的不是最新的 commit,你用的不是最新的 commit,你用的不是最新的 commit,你用的不是最新的 commit,你用的不是最新的 commit,我是要看你的版本

@chika0801

This comment was marked as outdated.

@chika0801

This comment was marked as outdated.

@chika0801
Copy link
Contributor

3个数字组成的数组来的。
这样就能在 LA 和 HK 使用上 warp 服务了。

哪有这方面的资料了?

@RPRX
Copy link
Member

RPRX commented Mar 2, 2023

草了,是不是它没有把 []byte 理解成 []uint8

@RPRX
Copy link
Member

RPRX commented Mar 2, 2023

正确写法:"reserved": [0, 0, 0]

删掉也不行的话,你真的确定你那台机上是 ccba465

@RPRX
Copy link
Member

RPRX commented Mar 2, 2023

To To To:最开始很明显你没有用最新的 commit,不然不会没 reserved 时跑不起来。但当时你 reserved 的写法是对的,问题在于,我说你没有用最新的 commit,你非要说用了,真的用了后又去试其它错误写法,当然跑不起来,直到删了才行。

@RPRX
Copy link
Member

RPRX commented Mar 2, 2023

(同样是没写 reserved,最开始跑不起来,现在能跑起来,很明显就不是同一个版本。)

@RPRX
Copy link
Member

RPRX commented Mar 2, 2023

To To To:唉......有一种操作叫 force-push,b18a071 069386c ccba465 它们三个,最后的才叫“最新的 commit”

@RPRX
Copy link
Member

RPRX commented Mar 2, 2023

血压爆炸

@fscarmen
Copy link
Author

fscarmen commented Mar 2, 2023

大伙保重身体,处理好就去睡觉吧😃

@RPRX
Copy link
Member

RPRX commented Mar 2, 2023

大伙保重身体,处理好就去睡觉吧😃

麻烦先试下能不能用

@RPRX
Copy link
Member

RPRX commented Mar 2, 2023

To 6:......不是写在 "peers" 里面,而且值不用加引号

@fscarmen
Copy link
Author

fscarmen commented Mar 3, 2023

3个数字组成的数组来的。
这样就能在 LA 和 HK 使用上 warp 服务了。

哪有这方面的资料了?

通过 warp 解锁 chatGPT 的方法

这个方法在除香港和 LA 外的其他vps或者容器 xray 上十分可行,用户十分喜欢这个轻量级解决方案,因为不需要在自己的机器上安装 warp 或者 warp client 。
现在以痛点是对于香港和la不能通过 wgcf 来获取 warp 服务的,是换作通过 warp-go 或者 warp client 来实现 warp ,我与 warp-go 的作者 coia 沟通过,他说加上 resered 应该可以,再查了一下 xray 的资料暂时是没有该变量的,所以过来提个 issue。

@RPRX
Copy link
Member

RPRX commented Mar 3, 2023

To 6:现在的写法是对的,但具体值应该是不能乱填,我猜某服务端会检查这个值,就像 REALITY 会检查 Short ID 一样,不能乱填

@RPRX
Copy link
Member

RPRX commented Mar 3, 2023

比如,REALITY 客户端只能填 REALITY 服务端存在的 Short ID,服务端最多允许客户端省略它(全 0),但不会允许客户端乱填值

@RPRX
Copy link
Member

RPRX commented Mar 3, 2023

......方向错了

@RPRX
Copy link
Member

RPRX commented Mar 3, 2023

可能除了 Send(),还要改其它的地方

我抓包看reserved填写正确的时候服务器是有返回数据的,错误的时候则没有。 会不会是接收的时候要从收到的数据包里删除这个值?我看nft规则似乎有个把返回数据的reserved值归零的操作。(不太懂nft,也有可能说错了)

抱歉之前没注意到这个反馈,这样看来对端行为是检查后把它们置 0 再校验 MAC

@RPRX
Copy link
Member

RPRX commented Mar 3, 2023

@IRN-Kawakaze
Copy link

这样应该可以了 554cbc7 https://github.com/XTLS/Xray-core/actions/runs/4323697163

ccba465 版本只需要加上这个nft规则即可正常连接(xray配置里要填正确reserved):

nftables:

add table inet wg0
flush table inet wg0
define routing_id = xxxxxx
table inet wg0 {
    chain input {
        type filter hook input priority mangle; policy accept;
        ip saddr 162.159.192.1 udp sport 2408 @th,72,24 $routing_id @th,72,24 set 0 counter;
    }
}

@IRN-Kawakaze
Copy link

这样应该可以了 554cbc7 https://github.com/XTLS/Xray-core/actions/runs/4323697163

554cbc7 这个版本设置reserved之后能正常收到回包,但不通。不设reserved可以正常连接。

@RPRX
Copy link
Member

RPRX commented Mar 3, 2023

群里说蚌埠住那位,你是不是有什么毛病在身上?

第一,我不用,之前更没研究过这协议,今天才仔细看了看它的协议结构
第二,我并不指望一次弄好,不断改代码就是为了控制变量,不断试错、收集反馈,这对于开发来说很正常
第三,最重要的是我没有测试环境,并且我不会和他私聊,所以就在 GitHub 上公开沟通,让他替我进行每次试错

我不觉得这样做有什么问题,只是效率低,我自己有测试环境的话效率会高很多,而且不用在这里公开沟通,仅此而已

@Larvan2
Copy link

Larvan2 commented Mar 3, 2023

		if len(buff) > 3 {
			buff[1] = bind.reserved[0]
			buff[2] = bind.reserved[1]
			buff[3] = bind.reserved[2]
		}

大概)

@RPRX
Copy link
Member

RPRX commented Mar 3, 2023

一我不用 WireGuard,二我不用 WARP,三我没有需要改 reserved 的机器,四我不知道改了 reserved 结果会怎么样

改 reserved 也分两种,一种是 MAC 前改,一种是 MAC 后改,WARP 的规则是自己定的,后者有效,不试能知道?

@0xffffharry
Copy link
Contributor

真的喜欢你不如去用世界的sing-box

@cross-hello
Copy link
Contributor

cross-hello commented Mar 3, 2023 via email

@RPRX
Copy link
Member

RPRX commented Mar 3, 2023

		if len(buff) > 3 {
			buff[1] = bind.reserved[0]
			buff[2] = bind.reserved[1]
			buff[3] = bind.reserved[2]
		}

大概)

是有的 554cbc7#diff-9078df66591acc1f171ace725bce8798960f40711f88e574bf6be3d01e1ca696R167-R169

@RPRX
Copy link
Member

RPRX commented Mar 3, 2023

我不继续试了,谁愿意改谁改吧。

我这边半点测试环境都没有,WARP 又是个黑箱,为了探测这个黑箱,只能不断改让别人测,为了安全在 GitHub 上公开沟通,开个分支,commit 明确写的是 test,看不懂 test 是什么意思吗?竟然还有 SB 路过说风凉话,蚌埠住了。

这里的事情,关我屁事。

@cross-hello
Copy link
Contributor

cross-hello commented Mar 3, 2023 via email

@RPRX
Copy link
Member

RPRX commented Mar 3, 2023

@RPRX
Copy link
Member

RPRX commented Mar 3, 2023

上面已经测出来了 WARP 接受 MAC 后改 reserved,因为有回包,而 MAC 前改 reserved 没有回包

由此,我猜回包也是 MAC 后改的 reserved,需要先把它置零,客户端校验才能通过,需要试一下插哪里合适

@IRN-Kawakaze
Copy link

换个位置试试 c6a4d30 https://github.com/XTLS/Xray-core/actions/runs/4324323532

c6a4d30 这个版本成功了🎉

在hkg服务器上不加reserved不通,加上reserved可以正常连接。

@RPRX
Copy link
Member

RPRX commented Mar 3, 2023

OK,谢谢你的测试

本来就已经测得了很多信息,对端黑箱行为逐渐明晰,已经在最后一步了,硬是有 SB 路过说风凉话,实在是不能忍

@Larvan2
Copy link

Larvan2 commented Mar 3, 2023

🎉辛苦了,刚刚也想着在这位置改来着,但是写成了 if v.buff > 3 没通

@chika0801
Copy link
Contributor

使用 c6a4d30 版本,香港VPS,先安装warp-go注册,导出sing-box配置,找到配置文件里面的 "reserved":[23,250,48] 字段和"private_key","private_key"填到Xray配置里的"secretKey"

在服务端添加出站配置,成功连到Warp。"reserved":[23,250,48]里面的值乱填是不通,或删除"reserved":[23,250,48]也是不通。

谢谢大佬的开发。

        {
            "protocol": "wireguard",
            "settings": {
                "secretKey": "",
                "address": [
                    "172.16.0.2/32",
                    "2606:4700:110:8bdf:6d2f:7eab:ce2b:ece0/128"
                ],
                "peers": [
                    {
                        "publicKey": "bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=",
                        "allowedIPs": [
                            "0.0.0.0/0",
                            "::/0"
                        ],
                        "endpoint": "162.159.192.1:2408"
                    }
                ],
                "mtu": 1280,
                "reserved":[23,250,48]
            }
        }

@chika0801
Copy link
Contributor

chika0801 commented Mar 4, 2023

再找了一台东京VPS,用warp-go注册,导出singbox配置,把导出配置里的"private_key"和"reserved",填到香港VPS的xray配置里,也可以连进warp,IP显示是cf的香港。如果只把东京的"reserved"和香港的"private_key"组合,就连不通warp。

由此推测warp-go注册了"private_key"和"reserved"是一组。不能混用和乱组合。

@IRN-Kawakaze
Copy link

再找了一台东京VPS,用warp-go注册,导出singbox配置,把配置里的"private_key"和"reserved",填到香港VPS的xray配置里,也可以联通,CF的IP显示是香港。如果只把东京的"reserved"加香港的"private_key"组合,香港机是不通的。

由此推测warp-go注册了"private_key"和"reserved"是一组吧。不能混用。

对的,reserved绑定客户端配置,不绑定客户端设备。warp-cli也是如此。

@barney2022
Copy link

我有一台甲骨文凤凰城的机器, 也是用不了warp,获取不了IP,只能用warp-go.
但我没有添加reserved字段,我的做法是:
关闭warp-go,让warp-go运行在非全局模式下,重启XRAY.重复这一串动作,直到成功连上.
但是我也不知道为什么,我用的是xray 1.7.5

@chika0801
Copy link
Contributor

我有一台甲骨文凤凰城的机器, 也是用不了warp,获取不了IP,只能用warp-go. 但我没有添加reserved字段,我的做法是: 关闭warp-go,让warp-go运行在非全局模式下,重启XRAY.重复这一串动作,直到成功连上. 但是我也不知道为什么,我用的是xray 1.7.5

快速指南
https://github.com/chika0801/Xray-examples/blob/main/wireguard.md
core用测试版

@fscarmen
Copy link
Author

fscarmen commented Mar 6, 2023

谢谢各位佬。

@o0HalfLife0o
Copy link
Contributor

o0HalfLife0o commented Mar 7, 2023

我这每一次通过warp第一次访问某个域名时,都很慢,平均要6-8秒,你们也是吗,如何能改善
比如https://www.cloudflare.com/cdn-cgi/tracehttps://chat.openai.com/cdn-cgi/trace
当访问cf是等8秒左右,页面加载完毕,刷新时瞬间出结果,此时访问openai,又要等8秒左右才能加载出结果,刷新又是瞬间出结果,然后访问cf主页,也能瞬间出结果,此时如果restart xray,则又要等几秒,我猜测是卡在dns解析了,但是这个dns解析是在warp内部完成的吗,还是xray来处理的?

2023/03/07 20:02:22 [Info] [3023551968] proxy/vless/inbound: firstLen = 1186
2023/03/07 20:02:22 [Info] [3023551968] proxy/vless/inbound: received request for tcp:www.cloudflare.com:443
2023/03/07 20:02:22 [Info] [3023551968] proxy/vless/encoding: Xtls Unpadding new block0 16 content 517 padding 609 0
2023/03/07 20:02:22 [Info] [3023551968] proxy/vless/encoding: XtlsFilterTls found tls client hello! 517
2023/03/07 20:02:22 [Info] [3023551968] app/dispatcher: sniffed domain: www.cloudflare.com
2023/03/07 20:02:22 [Info] [3023551968] app/dispatcher: taking detour [warp] for [tcp:www.cloudflare.com:443]
2023/03/07 20:02:22 [Info] [440110306] app/proxyman/inbound: connection ends > proxy/vless/inbound: connection ends > context canceled
2023/03/07 20:02:23 [Info] [813630888] app/proxyman/inbound: connection ends > proxy/vless/inbound: connection ends > context canceled
2023/03/07 20:02:28 [Info] [3023551968] proxy/vless/encoding: XtlsFilterTls found tls 1.3! 1024 TLS_AES_128_GCM_SHA256
2023/03/07 20:02:28 [Info] [3023551968] proxy/vless/encoding: XtlsPadding 1024 222 0
2023/03/07 20:02:28 [Info] [3023551968] proxy/vless/encoding: XtlsPadding 1877 80 0
2023/03/07 20:02:28 [Info] [3023551968] proxy/vless/encoding: Xtls Unpadding new block0 0 content 64 padding 1311 0
2023/03/07 20:02:28 [Info] [3023551968] proxy/vless/encoding: Xtls Unpadding new block0 0 content 170 padding 1138 2
2023/03/07 20:02:28 [Info] [3023551968] proxy/vless/encoding: XtlsRead readV
2023/03/07 20:02:28 [Info] [3023551968] proxy/vless/encoding: XtlsPadding 521 874 2
2023/03/07 20:02:28 [Info] [3023551968] proxy/vless/encoding: XtlsWrite writeV 0 1400 0

@chika0801
Copy link
Contributor

发下你服务端的完整配置,说下vps和你回程线路好不好,你客户端是用的什么软件(如是v2rayn)才能进一步分析。

我没遇到过你说的现象

@o0HalfLife0o
Copy link
Contributor

o0HalfLife0o commented Mar 7, 2023

发下你服务端的完整配置,说下vps和你回程线路好不好,你客户端是用的什么软件(如是v2rayn)才能进一步分析。

我没遇到过你说的现象

我客户端在路由器上,直接用的core,core也只提供fakedns,应该和客户端配置无关,因为服务端如果注释掉路由中转发cfip到warp那一行,cfip的页面加载正常
服务端配置

{
    "log": {
        "loglevel": "warning",
        "dnsLog": false,
        "access": "/var/log/xray/access.log",
        "error": "/var/log/xray/error.log"
    },
    "inbounds": [
        {
            "port": 443,
            "tag": "reality-in",
            "protocol": "vless",
            "settings": {
                "clients": [
                    {
                        "flow": "xtls-rprx-vision",
                        "id": "uuid"
                    },
                    {
                        "flow": "xtls-rprx-vision",
                        "id": "uuid"
                    }
                ],
                "decryption": "none"
            },
            "streamSettings": {
                "network": "tcp",
                "security": "reality",
                "realitySettings": {
                    "serverNames": [
                        "addons.mozilla.org"
                    ],
                    "dest": "addons.mozilla.org:443",
                    "privateKey": "NQv_HwHL1Q5Fdv0w-zjGne5-bV6auIKUBvqtzIS1T2s",
                    "shortIds": [
                        "d95700cab89631da"
                    ]
                }
            },
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls"
                ]
            }
        },
        {
            "listen": "/dev/shm/VLESS_WS.sock,0666",
            "protocol": "vless",
            "tag": "vless-ws-in",
            "settings": {
                "clients": [
                    {
                        "id": "uuid"
                    },
                    {
                        "id": "uuid"
                    }
                ],
                "decryption": "none"
            },
            "streamSettings": {
                "network": "ws",
                "security": "none",
                "wsSettings": {
                    //"acceptProxyProtocol": true,
                    "path": "/uuid-vless"
                }
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "freedom",
            "tag": "direct",
            "settings": {}
        },
        {
            "protocol": "blackhole",
            "tag": "block",
            "settings": {
                "response": {
                    "type": "http"
                }
            }
        },
        {
            "protocol": "wireguard",
            "tag": "warp",
            "settings": {
                "secretKey": "SHVqHEGI7k2+OQ/oWMmWY2EQObbRQjRBdDPimh0h1WY=",
                "address":[
                    "172.16.0.2/32",
                    "2606:4700:110:8656:d990:e0f9:a5a4:800d/128"
                ],
                "mtu": 1380,
                "reserved": [159, 163, 74],
                "peers": [
                    {
                        "publicKey": "bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=",
                        "endpoint": "engage.cloudflareclient.com:2408",
                        "keepAlive": 15
                    }
                ]
            }
        }
    ],
    "routing": {
        "domainStrategy": "IPIfNonMatch",
        "rules": [
            {
                "type": "field",
                "ip": [
                    "ext:geoip-asn.dat:cloudflare",
                    "ext:cn.dat:cn"
                ],
                "outboundTag": "warp"
            }
        ]
    }
}

客户端配置

[log]
loglevel = "warning"
dnsLog = false
access = "none"
error = "/var/log/xray/error.log"

[[inbounds]]
protocol = "dokodemo-door"
port = 56
tag = "dns-in"

  [inbounds.settings]
  address = "127.0.0.1"
  network = "udp"

[[inbounds]]
protocol = "dokodemo-door"
port = 1080
tag = "tproxy-in"

  [inbounds.settings]
  network = "tcp,udp"
  followRedirect = true

  [inbounds.sniffing]
  enabled = true
  destOverride = "fakedns"
  metadataOnly = true

[inbounds.streamSettings.sockopt]
tproxy = "tproxy"

[[inbounds]]
port = 1081
protocol = "socks"
tag = "socks-in"

  [inbounds.settings]
  auth = "noauth"
  udp = false
  userLevel = 0

  [inbounds.sniffing]
  enabled = true
  destOverride = [ "http", "tls" ]

[[outbounds]]
protocol = "dns"
tag = "dns-out"

[[outbounds]]
protocol = "blackhole"
tag = "block"

[outbounds.settings.response]
type = "http"

[dns]
servers = [ "fakedns" ]

[fakedns]
ipPool = "198.18.0.0/16"
poolSize = 65535

[routing]
domainStrategy = "AsIs"

  [[routing.rules]]
  type = "field"
  inboundTag = [ "dns-in" ]
  outboundTag = "dns-out"

  [[routing.rules]]
  type = "field"
  port = 443
  network = "udp"
  inboundTag = [ "tproxy-in", "socks-in" ]
  outboundTag = "block"

  [[routing.rules]]
  type = "field"
  inboundTag = [ "tproxy-in", "socks-in" ]
  outboundTag = "reality-1"

[policy.levels.0]
uplinkOnly = 0
downlinkOnly = 0

@chika0801
Copy link
Contributor

chika0801 commented Mar 7, 2023

看你服务端一个reality 一个ws tls入站,vision+reality这入站 ,要求你客户端不能比如,你手机用ss到你家路由,你家路由再转发到服务器的vision入站。
其它可能方面我不知道了。

@kdurov
Copy link

kdurov commented Mar 12, 2023

wireguard的性能问题能也看下么。
outbound走wg的单线程怎么都没法高于30Mbps。

@chika0801
Copy link
Contributor

wireguard的性能问题能也看下么。 outbound走wg的单线程怎么都没法高于30Mbps。

wireguard好像是个老外pr的,我测试过多线程最高70-80Mbps 你要快得用sing-box开wireguard

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests