cf 我觉得是要上的，用替代方案会多花很多钱。cf 一定要把相关接口速率设置好，对于一些非受众国家的 ip 直接盾，如果可以设置 ip 白名单解高速率。此举针对 cc 有奇效。
服务器开 ip 白名单，只允许 cf 的 ip 段访问。而且很重要的是，使用 cf 给的服务器证书，不要自己去申请其他免费的证书。此举针对 fofa 之类的找源 ip 有奇效。
如果你的服务器需要出口访问，容易被对方钓真实 ip 。可以买个 ovh 的小鸡部署代理，同时只给你服务器 ip 开白名单，让你服务器走 ovh 出去（一般设置 http_proxy 之类的环境变量即可，特殊软件具体对待）。这样对方最多能获得 ovh 的地址，难打不说，打死了也对你业务影响不大。此举针对 d 有奇效。
另外如果使用了 smtp 发信，注意 smtp 服务泄露你的 ip 。用大厂的服务一般无此问题。
这一套下来，打你的代价就会非常大，收效非常小，而你几乎没有增加什么支出。
来源 https://linux.do/t/topic/242440
{
"outbounds": [
{
"tag": "direct",
"type": "direct",
"domain_strategy": "prefer_ipv4"
},
{
"type": "shadowsocks",
"tag": "unlock-netflix",
"server": "www.mydomain.com",
"server_port": 28000,
"method": "aes-128-gcm",
"password": "eebeeba9-e02b-49ef-98a4-013a806825de"
},
{
"type": "shadowsocks",
"tag": "unlock-disney",
"server": "www.mydomain.com",
"server_port": 27000,
"method": "aes-128-gcm",
"password": "3e9eb602-a0b0-4ffe-b996-89c5c2e28dd1"
},
{
"type": "shadowsocks",
"tag": "unlock-openai",
"server": "www.mydomain.com",
"server_port": 26000,
"method": "aes-128-gcm",
"password": "886b5631-732e-440a-af1e-2448922364e7"
},
{
"type": "block",
"tag": "block"
}
],
"route": {
"rules": [
{
"domain": [
"1.1.1.1"
],
"outbound": "direct"
},
{
"domain": [
"fast.com"
],
"outbound": "direct"
},
{
"domain_keyword": [
"gemini"
],
"outbound": "unlock-netflix"
},
{
"rule_set": [
"geosite-netflix"
],
"outbound": "unlock-netflix"
},
{
"rule_set": [
"geosite-disney"
],
"outbound": "unlock-disney"
},
{
"domain_keyword": [
"disney"
],
"outbound": "unlock-disney"
},
{
"rule_set": [
"geosite-anthropic"
],
"outbound": "unlock-disney"
},
{
"rule_set": [
"geosite-openai"
],
"outbound": "unlock-openai"
},
{
"domain_suffix": [
"openai.com",
"oaistatic.com",
"oaiusercontent.com"
],
"outbound": "unlock-netflix"
},
{
"package_name": "com.openai.chatgpt",
"outbound": "unlock-netflix"
},
{
"ip_is_private": true,
"outbound": "block"
},
{
"rule_set": [
"geosite-google"
],
"outbound": "direct"
},
{
"domain_keyword": [
"apple"
],
"outbound": "direct"
},
{
"rule_set": [
"geosite-cn",
"geoip-cn"
],
"outbound": "block"
},
{
"domain_regex": [
"(torrent|.torrent|peer_id=|info_hash|get_peers|find_node|BitTorrent|announce_peer|announce.php?passkey=)",
"(.?)(xunlei|sandai|Thunder|XLLiveUD)(.)",
"(ed2k|.torrent|peer_id=|announce|info_hash|get_peers|find_node|BitTorrent|announce_peer|announce.php?passkey=|magnet:|xunlei|sandai|Thunder|XLLiveUD|bt_key)",
"(.+.|^)(360).(cn|com|net)",
"(.*.||)(guanjia.qq.com|qqpcmgr|QQPCMGR)",
"(.*.||)(rising|kingsoft|duba|xindubawukong|jinshanduba).(com|net|org)",
"(.*.||)(netvigator|torproject).(com|cn|net|org)",
"(.*.||)(taobao).(com)"
],
"outbound": "block"
},
{
"outbound": "direct",
"network": [
"udp",
"tcp"
]
}
],
"rule_set": [
{
"tag": "geoip-cn",
"type": "remote",
"format": "binary",
"url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs",
"download_detour": "direct"
},
{
"tag": "geosite-cn",
"type": "remote",
"format": "binary",
"url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-cn.srs",
"download_detour": "direct"
},
{
"tag": "geosite-netflix",
"type": "remote",
"format": "binary",
"url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-netflix.srs",
"download_detour": "direct"
},
{
"tag": "geosite-disney",
"type": "remote",
"format": "binary",
"url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-disney.srs",
"download_detour": "direct"
},
{
"tag": "geosite-openai",
"type": "remote",
"format": "binary",
"url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-openai.srs",
"download_detour": "direct"
},
{
"tag": "geosite-anthropic",
"type": "remote",
"format": "binary",
"url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-anthropic.srs",
"download_detour": "direct"
},
{
"tag": "geosite-google",
"type": "remote",
"format": "binary",
"url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-google.srs",
"download_detour": "direct"
}
]
},
"experimental": {
"cache_file": {
"enabled": true
}
}
}
#假设已安装好docker
#建立docker打通网络
sudo docker network create --driver bridge --subnet 172.18.0.0/16 my_network
#拉取并创建 ssh Docker 容器
sudo docker run -d --name ssh-container \
--network my_network \
-v /:/host \
-p 2222:22 \
-e ROOT_PASSWORD=123456 \
--restart unless-stopped \
rastasheep/ubuntu-sshd:18.04
ssh连接2222 root 123456提示密码错误
重建 docker ssh 密码为 123456
sudo docker exec -it ssh-container passwd root
重新连接连接 ssh 2222 （root 123456）
进入主机的文件系统并使用 chroot：
cd /host
chroot .
现在尝试更新包列表：
apt update
您应该能够重建容器以外的 SSH 服务器：
apt purge openssh-server && apt install openssh-server
passwd root
#国内机
gost -L "tcp://:10004" -L "udp://:10004" -F "relay+wss://海外vpsip.com:15000"
