自建独享落地节点

适用于对 IP 质量要求较高的用户，需要一定的理解与动手能力

基于 L4 转发，理论上支持任何协议，以下仅为示例

• 系统建议：Linux Debian 10 及以上

• 运行环境：Docker

• 运行软件：Shadowsocks rust

安装步骤

1. 安装Docker 环境

2. 安装shadowsocks-rust

3. 添加流量转发规则

apt install docker.io -y

docker pull ghcr.io/shadowsocks/ssserver-rust && \
docker run --entrypoint ssserver \
        -d --name=dler_5050 \
           --net=host \
           --restart=always \
           --log-driver json-file \
           --log-opt max-size=10m \
           --log-opt max-file=3 \
        ghcr.io/shadowsocks/ssserver-rust \
        -s "[::]:8080" -m "aes-128-gcm" -k "dBrf8pZ7CrcRf9X" -U

OR

IPv6 first

docker pull ghcr.io/shadowsocks/ssserver-rust && \
docker run --entrypoint ssserver \
        -d --name=dler_5050 \
           --net=host \
           --restart=always \
           --log-driver json-file \
           --log-opt max-size=10m \
           --log-opt max-file=3 \
        ghcr.io/shadowsocks/ssserver-rust \
        -s "[::]:8080" -m "aes-128-gcm" -k "dBrf8pZ7CrcRf9X" -U -6

对 Telegram Bot 发送指令 "/ssserver" 或 "/ssserver_v6" 即可获取与本站个人端口加密/协议一致的部署命令

添加流量转发规则

1. 选择起源节点

2. 填入目标服务器地址

3. 填入目标端口

4. 勾选[目标节点与本站个人端口加密/协议一致]（如果没有采用 Telegram Bot 命令部署请跳过此步骤）

一分钟内自动生效，正常情况下在代理客户端选择起源节点即可

口碑较好的商家（排名不分先后）

配合流量转发，仅需购买国际宽带网络（Routing Profile: Standard）VPS/VDS

商业：静态 IP (static IP)

香港	台湾	日本	美国	新加坡	全球
Dmit	host.dler.org	Dmit	Dmit	IndoVirtue	Vultr
RFChost	SYM		RFChost		Linode
	TCSCloud				LightNode

流媒体：动态IP (dynamic IP or Random IPv6)

香港	台湾	日本	美国	新加坡	韩国	英国
NNC	NNC	NNC	NNC	NNC	Akile	Akile
Akile	Akile	Akile	Akile	Akile
ITOXray	SYM		ITOXray	ITOXray

以上部分链接包含AFF

优化（将以下内容直接复制粘贴到 Shell 执行即可）

#!/bin/bash

for pkg in ntpdate htpdate; do
    if ! command -v $pkg &> /dev/null; then
        apt install $pkg -y
    fi
done

timedatectl set-timezone Asia/Shanghai

ntpdate time1.google.com || htpdate -s www.baidu.com
hwclock -w

entropy=$(cat /proc/sys/kernel/random/entropy_avail)
if [ $entropy -lt "1000" ] && ! systemctl is-active --quiet haveged; then
    apt install haveged -y
    systemctl enable haveged
    systemctl restart haveged
fi

echo "1048576" > /proc/sys/fs/file-max
ulimit -n 1048576

chattr -i /etc/sysctl.conf
cat > /etc/sysctl.conf << EOF
# Memory usage
# https://blog.cloudflare.com/the-story-of-one-latency-spike/
# https://cloud.google.com/architecture/tcp-optimization-for-network-performance-in-gcp-and-hybrid/
# https://zhensheng.im/2021/01/31/linux-wmem-and-rmem-adjustments.meow
# https://github.com/redhat-performance/tuned/blob/master/profiles/network-throughput/tuned.conf
# ReceiveBuffer: X - (X / (2 ^ tcp_adv_win_scale)) = RTT * Bandwidth / 8
# SendBuffer: RTT * Bandwidth / 8 * 0.7
net.core.netdev_max_backlog = 262144
net.ipv4.tcp_max_syn_backlog = 8192
net.core.rmem_max = 134217728
net.core.wmem_max = 134217728
net.ipv4.tcp_rmem = 16384 131072 67108864
net.ipv4.tcp_wmem = 4096 16384 33554432
net.ipv4.udp_rmem_min = 131072
net.ipv4.udp_wmem_min = 131072

# Layer 2
# No Proxy ARP, obviously
net.ipv4.conf.default.proxy_arp = 0
net.ipv4.conf.all.proxy_arp = 0
# Do not reply ARP requests if the target IP address is not configured on the incoming interface
net.ipv4.conf.default.arp_ignore = 1
net.ipv4.conf.all.arp_ignore = 1
# When sending ARP requests, use the best IP address configured on the outgoing interface
net.ipv4.conf.default.arp_announce = 2
net.ipv4.conf.all.arp_announce = 2
# Enable gratuitous arp requests
net.ipv4.conf.default.arp_notify = 1
net.ipv4.conf.all.arp_notify = 1

# IPv4 routing
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.send_redirects = 0
# Enable when there are 1-2K hosts
net.ipv4.neigh.default.gc_thresh1 = 2048
net.ipv4.neigh.default.gc_thresh2 = 4096
net.ipv4.neigh.default.gc_thresh3 = 8192

# IPv6 routing
net.ipv6.conf.default.disable_ipv6 = 0
net.ipv6.conf.all.disable_ipv6 = 0
net.ipv6.conf.default.forwarding = 1
net.ipv6.conf.all.forwarding = 1
# Enable when there are 1-2K hosts
net.ipv6.neigh.default.gc_thresh1 = 4096
net.ipv6.neigh.default.gc_thresh2 = 8192
net.ipv6.neigh.default.gc_thresh3 = 16384

# PMTUD
# https://blog.cloudflare.com/path-mtu-discovery-in-practice/
net.ipv4.ip_no_pmtu_disc = 0
net.ipv4.tcp_mtu_probing = 1
net.ipv4.tcp_base_mss = 1024

# MPLS & L3VPN support
# https://web.archive.org/web/20210301222346/https://cumulusnetworks.com/blog/vrf-for-linux/
# net.mpls.ip_ttl_propagate = 1
# net.mpls.default_ttl = 255
# net.mpls.platform_labels = 1048575
net.ipv4.tcp_l3mdev_accept = 0
net.ipv4.udp_l3mdev_accept = 0
net.ipv4.raw_l3mdev_accept = 0
# net.mpls.conf.lo.input = 1

# ICMP
net.ipv4.icmp_errors_use_inbound_ifaddr = 1
net.ipv4.icmp_ratelimit = 0
net.ipv6.icmp.ratelimit = 0

# TCP connection accepting
# https://serverfault.com/questions/518862/will-increasing-net-core-somaxconn-make-a-difference
net.core.somaxconn = 8192
net.ipv4.tcp_abort_on_overflow = 0

# TCP connection recycling
# https://dropbox.tech/infrastructure/optimizing-web-servers-for-high-throughput-and-low-latency
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_max_tw_buckets = 4096

# TCP congestion control
# https://blog.cloudflare.com/http-2-prioritization-with-nginx/
net.core.default_qdisc = fq_codel
net.ipv4.tcp_congestion_control = bbr
net.ipv4.tcp_notsent_lowat = 16384
net.ipv4.tcp_window_scaling = 1

# TCP keepalive
net.ipv4.tcp_keepalive_time = 120
net.ipv4.tcp_keepalive_intvl = 60
net.ipv4.tcp_keepalive_probes = 3

# TCP auxiliary
# https://dropbox.tech/infrastructure/optimizing-web-servers-for-high-throughput-and-low-latency
net.ipv4.tcp_fastopen = 3
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_no_metrics_save = 1
net.ipv4.tcp_sack = 1
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_rfc1337 = 1
net.ipv4.tcp_slow_start_after_idle = 0
net.ipv4.tcp_adv_win_scale = 1

# ECN
net.ipv4.tcp_ecn = 0
net.ipv4.tcp_ecn_fallback = 1

# ECMP hashing
# https://web.archive.org/web/20210204031636/https://cumulusnetworks.com/blog/celebrating-ecmp-part-two/
net.ipv4.fib_multipath_hash_policy = 1
net.ipv4.fib_multipath_use_neigh = 1

# GRE keepalive
# https://blog.artech.se/2016/01/10/4/
net.ipv4.conf.default.accept_local = 1
net.ipv4.conf.all.accept_local = 1

# IGMP
# https://phabricator.vyos.net/T863
net.ipv4.igmp_max_memberships = 512

# IPv6 route table size bug fix
# https://web.archive.org/web/20200516030405/https://lists.nat.moe/pipermail/transit-service/2020-May/000000.html
net.ipv6.route.max_size = 2147483647

# Prefer different parity for ip_local_port_range start and end value
net.ipv4.ip_local_port_range = 10000 65535
net.ipv4.ip_local_reserved_ports = 8443
# 👆 建议自行修改需要占用或使用的端口

# Maximum number of open files
fs.file-max = 1048576

# Avoid the use of swap spaces where possible
vm.swappiness = 1

# Disable ICMP
net.ipv4.icmp_echo_ignore_all = 1
net.ipv6.icmp_echo_ignore_all = 1
EOF

sysctl -p

cat > /etc/security/limits.conf << EOF
root     hard   nofile    1048576
root     soft   nproc     1048576
root     hard   nproc     1048576
root     soft   core      1048576
root     hard   core      1048576
root     hard   memlock   unlimited
root     soft   memlock   unlimited

*     soft   nofile    1048576
*     hard   nofile    1048576
*     soft   nproc     1048576
*     hard   nproc     1048576
*     soft   core      1048576
*     hard   core      1048576
*     hard   memlock   unlimited
*     soft   memlock   unlimited
EOF