[v1.0] Tun+MITMProxy 初探

1
#!/bin/bash
2

3
TUN_USER="root"
4
TUN_DEVICE="utun"
5
PROXY_FWMARK="0x162"
6
TUN_ROUTE_TABLE="0x162"
7
TUN_ADDRESS="198.18.0.1/16"
8
CREATE_AP_ADDR="192.168.114.0/24"
9

10
/srv/clash/scripts/clean.sh
11

12
# IPv4 环回地址
13
ipset create localnetwork hash:net
14
ipset add localnetwork 127.0.0.0/8
15
ipset add localnetwork "$CREATE_AP_ADDR"
16

17
# IPv6 环回地址
18
ipset create localnetwork6 hash:net -6
19
ipset add localnetwork6 fe80::/10
20

21
# 启动 Tun
22
ip tuntap add "$TUN_DEVICE" mode tun user $TUN_USER
23
ip link set "$TUN_DEVICE" up
24

25
# 将对应 IP 段分配给 TUN
26
ip address replace "$TUN_ADDRESS" dev "$TUN_DEVICE"
27

28
# 给 TUN 设备增加路由
29
ip route replace default dev "$TUN_DEVICE" table "$TUN_ROUTE_TABLE"
30
ip -6 route replace default dev "$TUN_DEVICE" table "$TUN_ROUTE_TABLE"
31

32
# 对带有 fwmark 的流量走 TUN_ROUTE_TABLE 路由表
33
ip rule add fwmark "$PROXY_FWMARK" lookup "$TUN_ROUTE_TABLE"
34
ip -6 rule add fwmark "$PROXY_FWMARK" lookup "$TUN_ROUTE_TABLE"
35

36
# IPv4 Clash 链
37
iptables -t mangle -N CLASH # 创建 CLASH 链
38
iptables -t mangle -A CLASH -m owner --uid-owner "$TUN_USER" -j RETURN # 绕过指定用户
39
iptables -t mangle -A CLASH -d "$TUN_ADDRESS" -j MARK --set-mark "$PROXY_FWMARK" # 将目标为对应 IP 段的流量打上标记
40
iptables -t mangle -A CLASH -d "$CREATE_AP_ADDR" -j RETURN # 绕过 create_ap 地址
41
iptables -t mangle -A CLASH -m addrtype --dst-type BROADCAST -j RETURN # 绕过广播地址
42
iptables -t mangle -A CLASH -m set --match-set localnetwork dst -j RETURN # 绕过本地地址
43
iptables -t mangle -A CLASH -p tcp -j MARK --set-mark "$PROXY_FWMARK" # 给 TCP 连接打上标记
44
#iptables -t mangle -A CLASH -p udp -j MARK --set-mark "$PROXY_FWMARK" # 给 UDP 连接打上标记
45
iptables -t mangle -A CLASH -p udp -j RETURN
46

47
# IPv6 Clash 链
48
ip6tables -t mangle -N CLASH6 # 创建 CLASH6 链
49
ip6tables -t mangle -A CLASH6 -m owner --uid-owner "$TUN_USER" -j RETURN # 绕过指定用户
50
ip6tables -t mangle -A CLASH6 -m set --match-set localnetwork6 dst -j RETURN # 绕过本地地址
51
ip6tables -t mangle -A CLASH6 -p tcp -j MARK --set-mark "$PROXY_FWMARK" # 给 TCP 连接打上标记
52
#ip6tables -t mangle -A CLASH6 -p udp -j MARK --set-mark "$PROXY_FWMARK" # 给 UDP 连接打上标记
53
ip6tables -t mangle -A CLASH6 -p udp -j RETURN
54

55
iptables -t mangle -I OUTPUT -j CLASH # IPv4 出口使用 CLASH 链
56
#iptables -t mangle -I PREROUTING -m set ! --match-set localnetwork dst -j MARK --set-mark "$PROXY_FWMARK" # 在 PREROUTING 给所有非本地流量打上标记
57

58
ip6tables -t mangle -I OUTPUT -j CLASH6 # IPv6 出口使用 CLASH 链
59
#ip6tables -t mangle -I PREROUTING -m set ! --match-set localnetwork6 dst -j MARK --set-mark "$PROXY_FWMARK" # 在 PREROUTING 给所有非本地流量打上标记
60

61
iptables -t nat -A PREROUTING -p tcp -j REDIRECT --to-ports 7892
62

63
# REJECT 对应 IP 的 Output
64
iptables -t filter -I OUTPUT -d "$TUN_ADDRESS" -j REJECT

1
# mitmproxy
2
port: 1081
3
socks-port: 1080
4

5
allow-lan: true
6
bind-address: "*"
7
redir-port: 7892
8

9
mode: Rule
10

11
log-level: info
12
external-controller: :9090
13

14
tun:
15
  enable: true
16

17
dns:
18
  enable: true
19
  ipv6: true
20
  listen: 0.0.0.0:53
21
  enhanced-mode: redir-host
22
  nameserver:
23
    - 223.5.5.5
24
  fallback:
25
    - 8.8.8.8
26

27
Proxy:
28
  - name: "mitmproxy"
29
    type: http
30
    server: localhost
31
    port: 20020
32

33
  - name: "clash"
34
    type: socks5
35
    server: localhost
36
    port: 11080
37
    udp: true
38

39
Rule:
40
  # mitmproxy
41
  - DOMAIN,mitm.it,mitmproxy
42
  # no-mitm
43
  - MATCH,clash

1
# self
2
port: 11081
3
socks-port: 11080
4

5
mode: Rule
6

7
log-level: info
8
external-controller: :19090
9

10
Proxy:
11
  - ...
12

13
Rule:
14
  # optional param "no-resolve" for IP rules (GEOIP IP-CIDR)
15
  - IP-CIDR,192.168.0.0/16,DIRECT
16
  - IP-CIDR,127.0.0.0/8,DIRECT
17
  - GEOIP,CN,DIRECT
18
  - MATCH,custom-rule