巧用香港中转，搭建丝滑稳定的中美三层隧道

# 适用于 Debian/Ubuntu
sudo apt update
sudo apt install -y wireguard

# 开启 BBR
sudo tee -a /etc/sysctl.conf > /dev/null << EOF
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr
EOF
sudo sysctl -p

# 验证 BBR 是否已开启 (输出应包含 bbr)
sysctl net.ipv4.tcp_congestion_control

sudo wg genkey | sudo tee /etc/wireguard/wg1_private.key | sudo wg pubkey | sudo tee /etc/wireguard/wg1_public.key

# 获取你的私钥
PRIVATE_KEY=$(sudo cat /etc/wireguard/wg1_private.key)

# 使用 tee 命令写入配置
sudo tee /etc/wireguard/wg1.conf > /dev/null << EOF
[Interface]
Address = 10.10.20.1/24
ListenPort = 42371
PrivateKey = ${PRIVATE_KEY}
MTU = 1280
# PostUp/Down 脚本用于在 wg 启动/关闭时自动配置 NAT 转发规则。
# 1. 允许来自客户端 (%i) 的流量被转发。
# 2. 允许已建立的连接的返回流量通过。
# 3. 对所有从公网网卡 (eth0) 出去的流量进行源地址伪装 (MASQUERADE)。
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
EOF

# 开启内核 IP 转发
sudo sed -i '/net.ipv4.ip_forward=1/s/^#//' /etc/sysctl.conf
sudo sysctl -p

# 启动并设置开机自启
sudo systemctl enable --now wg-quick@wg1

# 检查服务状态
sudo systemctl status wg-quick@wg1

# 适用于 Debian/Ubuntu
sudo apt update
sudo apt install -y xray

# 开启 BBR
sudo tee -a /etc/sysctl.conf > /dev/null << EOF
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr
EOF
sudo sysctl -p

# 验证 BBR 是否已开启 (输出应包含 bbr)
sysctl net.ipv4.tcp_congestion_control

# 请确保已在准备工作中生成了 UUID_BJ_HK
# echo "北京 -> 香港 的 VLESS UUID: ${UUID_BJ_HK}"

# 写入 Xray 配置
sudo tee /usr/local/etc/xray/config.json > /dev/null << EOF
{
  "log": { "loglevel": "warning" },
  "inbounds": [
    {
      "port": 8445,
      "protocol": "vless",
      "settings": {
        "clients": [
          { "id": "<UUID_BJ_HK>" }
        ],
        "decryption": "none"
      },
      "streamSettings": { "network": "tcp" }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom",
      "settings": {
        "redirect": "<美国服务器IP>:42371"
      }
    }
  ]
}
EOF

sudo systemctl enable --now xray
sudo systemctl status xray

# 适用于 Debian/Ubuntu
sudo apt update
sudo apt install -y xray

# 开启 BBR
sudo tee -a /etc/sysctl.conf > /dev/null << EOF
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr
EOF
sudo sysctl -p

# 验证 BBR 是否已开启 (输出应包含 bbr)
sysctl net.ipv4.tcp_congestion_control

# 请确保已在准备工作中生成了 UUID_BJ_HK
# echo "北京 -> 香港 的 VLESS UUID: ${UUID_BJ_HK}"
sudo tee /usr/local/etc/xray/config.json > /dev/null << EOF
{
  "log": { "loglevel": "warning" },
  "inbounds": [
    {
      "port": 42371,
      "listen": "0.0.0.0",
      "protocol": "dokodemo-door",
      "settings": {
        "network": "udp",
        "address": "127.0.0.1"
      },
      "tag": "wg-in"
    }
  ],
  "outbounds": [
    {
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "<香港服务器IP>",
            "port": 8445,
            "users": [
              { "id": "<UUID_BJ_HK>" }
            ]
          }
        ]
      },
      "streamSettings": { "network": "tcp" },
      "tag": "hk-out"
    }
  ],
  "routing": {
    "rules": [
      {
        "type": "field",
        "inboundTag": ["wg-in"],
        "outboundTag": "hk-out"
      }
    ]
  }
}
EOF

sudo systemctl enable --now xray
sudo systemctl status xray

wg genkey | tee client_private.key | wg pubkey > client_public.key

CLIENT_PUBLIC_KEY=$(cat client_public.key)
sudo wg set wg1 peer ${CLIENT_PUBLIC_KEY} allowed-ips 10.10.20.2/32

# 为了持久化，需要将 Peer 配置追加到 wg1.conf
echo -e "\n# Client from Mac\n[Peer]\nPublicKey = ${CLIENT_PUBLIC_KEY}\nAllowedIPs = 10.10.20.2/32" | sudo tee -a /etc/wireguard/wg1.conf

# 重新加载配置使其生效
sudo systemctl restart wg-quick@wg1

sudo wg-quick up us