nanopi SOCKS5 代理

nanopi (SOCKS5+openvpn) + 阿里ES(openvpn + socat)

构建内网代理。

需求：

公网阿里ES服务器1台，内网nanopi1个（可连接公网服务器），

想从外网，访问内网的web服务器。

采用SOCKS5代理方式，由公网服务器将socks5流量转发给nanopi上的socks5服务器。

① 内网nanopi （openvpn client）连接公网阿里ES服务器（openvpn server）

这样阿里ES服务器可访问内网的nanopi。

（部署过程略）

② nanopi 安装并配置 danted （SOCKS5代理服务器）

sudo apt-get install dante-server -y （danted）

sudo apt-get install dnsutils （nslookup）

sudo vim /etc/danted.conf 末尾添加配置：

# block any other http connects to the example.com domain.

#block {

#       from: 0.0.0.0/0 to: .example.com port = http

#       log: connect error

#}

# everyone from our internal network, 10.0.0.0/8 is allowed to use

# tcp and udp for everything else.

#pass {

#       from: 10.0.0.0/8 to: 0.0.0.0/0

#       protocol: tcp udp

#}

# last line, block everyone else.  This is the default but if you provide

# one  yourself you can specify your own logging/actions

#block {

#       from: 0.0.0.0/0 to: 0.0.0.0/0

#       log: connect error

#}

# route all http connects via an upstream socks server, aka "server-chaining".

#route {

# from: 10.0.0.0/8 to: 0.0.0.0/0 port = http via: socks.example.net port = socks

#}

#Where are we going to log all those useful error messages?

logoutput: /var/log/dante.log

#What ip and port should Dante listen on,

# since I am only going to be using this via SSH

#I only want to allow connections over the loopback

internal: tun0 port = 1080

#这里 tun0 为面向openvpn流量的源网卡

#Bind to the eth0 interface

external: eth1

#这里eth1为 面向 内网的网卡

#Since I am only accepting connections over the loopback,

# the only people that COULD connect

# would already be authenticated,

# no need to have dante authenticate also

method: username none

#Which unprivileged user will Dante impersonate if need-be?

user.notprivileged: nobody

# Who can access this proxy?

# Accept only connections from the loopback, all ports

client pass {

# from: 127.0.0.0/8 port 1-65535 to: 0.0.0.0/0

from: 10.5.18.0/24 port 1-65535 to: 0.0.0.0/0

#这里是 tun0 网卡的网段。

}

#Block all other connection attempts

client block {

from: 0.0.0.0/0 to: 0.0.0.0/0

log: connect error

}

# Once connected, where can they go?

block {

from: 0.0.0.0/0 to: 127.0.0.0/8

log: connect error

}

#Pass from the internal IP to anywhere

pass {

# from: 192.168.0.0/16 to: 0.0.0.0/0

from: 10.5.18.0/24 port 1-65535 to: 0.0.0.0/0

protocol: tcp udp

#这里是 tun0 网卡的网段。

}

#Pass from the loopback going anywhere

pass {

#from: 127.0.0.0/8 to: 0.0.0.0/0

from: 127.0.0.0/8 port 1-65535 to: 0.0.0.0/0

protocol: tcp udp

}

# Block everything else

block {

from: 0.0.0.0/0 to: 0.0.0.0/0

log: connect error

}