shadowtunnel
Introduce
shadowtunnel is a secure encryption tunnel between your local machine and remote service to protect your TCP flow，
which can efficiently compress transmission, and the flow has no characteristics.
local machine <----> shadowtunnel <----> service on remote.
Usage
Usage of ./shadowtunnel:
-E outbound connection is encrypted
-U outbound connection is udp
-c compress traffic
-cache string
dns query cache file path (default "cache.dat")
-daemon
daemon mode
-debug
show debug info
-dns string
local dns server listen on address
-dns-hosts string
path of dns hosts file
-dns-proxy
is dns endpoint or not
-dns-server string
remote dns server to resolve domain (default "8.8.8.8:53")
-e inbound connection is encrypted
-f weight
forward address,such as : 127.0.0.1:8080 or with @weight: 127.0.0.1:8080@1
-forever
forever mode
-l string
local listen address, such as : 0.0.0.0:33000 (default ":50000")
-lb-activeafter int
host going actived after this success count (default 1)
-lb-hashtarget hash
use target address to choose parent for LB, only worked for LB's hash
method and using `-redir` (default true)
-lb-inactiveafter int
host going inactived after this fail count (default 2)
-lb-method string
load balance method when use multiple parent,can be
<roundrobin|leastconn|leasttime|hash|weight> (default "leasttime")
-lb-onlyha high availability mode
use only high availability mode to choose parent for LB
-lb-retrytime int
sleep time milliseconds after checking (default 2000)
-lb-timeout int
tcp milliseconds timeout of connecting to parent (default 3000)
-log string
logging output to file
-m string
method of encrypt/decrypt, these below are supported :
aes-128-cfb,aes-192-cfb,des-cfb,cast5-cfb,rc4-md5,chacha20,aes-256-cfb,
aes-128-ctr,aes-192-ctr,aes-256-ctr,bf-cfb,rc4-md5-6,chacha20-ietf
(default "aes-192-cfb")
-nolog
turn off logging
-p string
password of encrypt/decrypt (default "shadowtunnel")
-profiling
profiling mode, in this mode, you should stopping process
by : Ctrl+C or 'kill -s SIGHUP $PID_OF_shadowtunnel'
-redir
read target from socket's redirect opts of iptables
-t int
connection timeout seconds (default 3)
-ttl int
cache seconds of dns query , if zero , default ttl used. (default 300)
-u inbound connection is udp
-v show version
for example
1.http proxy
if we have a vps, IP is 2.2.2.2
firstly, we start a http proxy on 2.2.2.2.
download http proxy program, execute below on line command on vps with root：
wget https://github.com/snail007/goproxy/releases/download/v4.9/proxy-linux-amd64.tar.gz && tar zxfv proxy-linux-amd64.tar.gz && rm proxy-linux-amd64.tar.gz && mv proxy /usr/bin/ && proxy http -p 127.0.0.1:38080 &
2.Start a tunnel on VPS
download shadowtunnel program, execute below on line command on vps with root：
wget https://github.com/snail007/shadowtunnel/releases/download/v1.1/shadowtunnel-linux-amd64.tar.gz && tar zxfv shadowtunnel-linux-amd64.tar.gz && rm shadowtunnel-linux-amd64.tar.gz && mv shadowtunnel /usr/bin/
start a tunnel on vps listening on :50000 and forward to 127.0.0.1:38080 ：
shadowtunnel -e -f 127.0.0.1:38080 -l :50000
3.start a tunnel on local machine
start a tunnel on local machine listening on :50000 and forward to 2.2.2.2:50000 :
shadowtunnel -E -f 2.2.2.2:50000 -l :50000
4.set http proxy configuration in chrome
setting local chrome's http proxy configuration as below：
ip: 127.0.0.1 port: 50000
5.done
TCP over UDP
1.http proxy
if we have a vps, IP is 2.2.2.2.
firstly, we start a http proxy on 2.2.2.2.
download http proxy program, execute below on line command on vps with root：
wget https://github.com/snail007/goproxy/releases/download/v4.9/proxy-linux-amd64.tar.gz && tar zxfv proxy-linux-amd64.tar.gz && rm proxy-linux-amd64.tar.gz && mv proxy /usr/bin/ && proxy http -p 127.0.0.1:38080 &
2.start a tunnel on vps
download shadowtunnel program, execute below on line command on vps with root：
wget https://github.com/snail007/shadowtunnel/releases/download/v1.1/shadowtunnel-linux-amd64.tar.gz && tar zxfv shadowtunnel-linux-amd64.tar.gz && rm shadowtunnel-linux-amd64.tar.gz && mv shadowtunnel /usr/bin/
start a tunnel on vps listening on udp :50000 and forward to tcp 127.0.0.1:38080 ：
shadowtunnel -u -e -f 127.0.0.1:38080 -l :50000 -p your-password
3.start a tunnel on local machine
start a tunnel on local machine listening on tcp :50000 and forward to udp 2.2.2.2:50000 :
shadowtunnel -U -E -f 2.2.2.2:50000 -l :50000 -p your-password
4.set http proxy configuration in chrome
setting local chrome's http proxy configuration as below：
ip: 127.0.0.1 port: 50000
5.Done
Deamon & Forever & Log
-daemon:
Using the parameter -daemon allows shadowtunnel to detached from the current command line and run in the background.
-forever:
Using parameter -forever allows shadowtunnel to run in the way of creating and monitoring child processes,
If an abnormal exit occurs, the child process will be restarted to ensure that the service is always online..
-log
Using parameter -log, you can set the log output to the file instead of the command line output.
-nolog
Using parameter -nolog can completely shut off log output and save CPU occupation.
Generally, the three parameters (-daemon -forever -log /tmp/st.log) are used together, so that we can find out the cause of the problem by looking at the log when we have a problem.
for example:
shadowtunnel -u -e -f 127.0.0.1:38080 -l :50000 -p your-password -daemon -forever -log /tmp/st.log
DNS SERVICE
Shadowtunnel can provide local DNS query service, and has caching function to improve resolution speed.
It is necessary to have a superior service to start a DNS service while launching the port forwarding locally.
The -dns parameter sets the IP and port which the local DNS service listen, for example:0.0.0.0:5353
The -dns-server Parameters can be set to DNS servers that are ultimately used to resolve domain names, requiring the server to support TCP-style DNS queries, default:8.8.8.8:53.
for example:
shadowtunnel -E -f 2.2.2.2:50000 -l :50000 -p your-password -dns :5353 -dns-server 8.8.8.8:53
superior example:
If the superior is chain-style, then the superior of the DNS proxy in the chain is required to add the -dns-proxy parameter.
shadowtunnel -e -f 127.0.0.1:38080 -l :50000 -p your-password -dns-proxy
DNS CACHE
The -ttl parameter can set the DNS query result cache time. unit is second. if it is 0, and use the TTL of the query result.
The -cache parameter sets DNS cache file location to prevent program restart and cache disappear, which will reduce performance.
LOAD BALANCE
Support superior load balancing, repeat -f parameters if exist multiple superiors.
shadowtunnel -E -f 2.2.2.2:50000 -f 3.3.3.3:50000 -l :50000
SET RETRY INTERVAL AND TIMEOUT TIME
shadowtunnel -E -f 2.2.2.2:50000 -f 3.3.3.3:50000 -l :50000 -lb-method leastconn -lb-retrytime 300 -lb-timeout 300
SETTING WEIGHT
shadowtunnel -E -f 2.2.2.2:50000@2 -f 3.3.3.3:50000@1 -l :50000 -lb-method weight -lb-retrytime 300 -lb-timeout 300
USE TARGET ADDRESS TO SELECT SUPERIOR
shadowtunnel -E -f 2.2.2.2:50000@2 -f 3.3.3.3:50000@1 -l :50000 -lb-method hash -lb-hashtarget -lb-retrytime 300 -lb-timeout 300
DNS HOSTS
The -dns- hosts parameter sets the hosts file to be used when DNS is parsed, with the same content format as the system's hosts file.
shadowtunnel -f 2.2.2.2:50000 -dns :5353 -dns-hosts /etc/hosts