only masquerade ipv6 private address

CMakeLists.txt

@@ -1,6 +1,6 @@
 cmake_minimum_required(VERSION 3.10)
 
-project(cgproxy VERSION 3.5)
+project(cgproxy VERSION 3.7)
 add_executable(cgattach cgattach.cpp)
 
 install(TARGETS cgattach DESTINATION /usr/bin 
@@ -22,6 +22,9 @@ install(FILES cgproxy.conf
 install(FILES cgroup-tproxy.sh 
         DESTINATION /usr/share/cgproxy/scripts/)
         
+install(FILES readme.md
+        DESTINATION /share/doc/cgproxy/)
+
 
 ## package for deb and rpm
 set(CPACK_GENERATOR "DEB;RPM")

cgattach.cpp

@@ -32,10 +32,14 @@ bool validate(string pid, string cgroup) {
 }
 
 string get_cgroup2_mount_point(){
-  char cgroup2_mount_point[100];
+  char cgroup2_mount_point[100]="";
-  FILE* fp = popen("findmnt -t cgroup2 -n |cut -d' '  -f 1", "r");
+  FILE* fp = popen("findmnt -t cgroup2 -n -o TARGET", "r");
-  fscanf(fp,"%s",&cgroup2_mount_point);
+  int count=fscanf(fp,"%s",&cgroup2_mount_point);
   fclose(fp);
+  if (count=0){
+    fprintf(stderr, "cgroup2 not supported\n");
+    exit(EXIT_FAILURE);
+  }
   return cgroup2_mount_point;
 }
 

cgproxy.conf

@@ -1,34 +1,27 @@
-# see how to configure 
-# https://github.com/springzfx/cgproxy
-
-########################################################################
 ## cgroup transparent proxy
+## see how to configure, https://github.com/springzfx/cgproxy
+
 ## any process in cgroup_proxy will be proxied, and cgroup_noproxy the opposite
-## cgroup must start with slash '/'
+## note, cgroup must start with slash '/'
-# cgroup_proxy="/"
+# cgroup_proxy="/"  # for global tproxy
+# cgroup_noproxy="/system.slice/v2ray.service" # for v2ray service
 cgroup_proxy="/proxy.slice"
-# cgroup_noproxy="/system.slice/v2ray.service"
 cgroup_noproxy="/noproxy.slice"
 
-########################################################################
 ## allow as gateway for local network
 enable_gateway=false
 
-########################################################################
 ## listening port of another proxy process, for example v2ray 
 port=12345
 
-########################################################################
 ## if you set to false, it's traffic won't go through proxy, but still can go direct to internet 
+enable_dns=true
 enable_tcp=true
 enable_udp=true
 enable_ipv4=true
 enable_ipv6=true
-enable_dns=true
 
-########################################################################
 ## do not modify this if you don't known what you are doing
 table=100
 fwmark=0x01
-mark_noproxy=0xff
 mark_newin=0x02

cgroup-tproxy.sh

@@ -39,22 +39,21 @@ enable_gateway=false
 
 ## some variables
 port=12345
+
+## some options
+enable_dns=true
 enable_tcp=true
 enable_udp=true
 enable_ipv4=true
 enable_ipv6=true
-enable_dns=true
 
 ## do not modify this if you don't known what you are doing
 table=100
 fwmark=0x01
-mark_noproxy=0xff
 make_newin=0x02
 
 ## cgroup things
-# cgroup_mount_point=$(findmnt -t cgroup,cgroup2 -n -J|jq '.filesystems[0].target')
+cgroup_mount_point=$(findmnt -t cgroup2 -n -o TARGET)
-# cgroup_type=$(findmnt -t cgroup,cgroup2 -n -J|jq '.filesystems[0].fstype')
-cgroup_mount_point=$(findmnt -t cgroup2 -n |cut -d' ' -f 1)
 cgroup_type="cgroup2"
 cgroup_procs_file="cgroup.procs"
 
@@ -85,7 +84,7 @@ case $i in
         ip -6 route flush table $table
         ## may not exist, just ignore, and tracking their existence is not reliable
         iptables -t nat -D POSTROUTING -m owner ! --socket-exists -j MASQUERADE &> /dev/null
-        ip6tables -t nat -D POSTROUTING -m owner ! --socket-exists -j MASQUERADE &> /dev/null
+        ip6tables -t nat -D POSTROUTING -m owner ! --socket-exists -s fc00::/7 -j MASQUERADE &> /dev/null
         exit 0
         ;;
     --config=*)
@@ -109,8 +108,8 @@ test -d $cgroup_mount_point$cgroup_noproxy  || mkdir $cgroup_mount_point$cgroup_
 ip rule add fwmark $fwmark table $table
 ip route add local default dev lo table $table
 iptables -t mangle -N TPROXY_ENT
-iptables -t mangle -A TPROXY_ENT -p tcp -j TPROXY --on-ip 127.0.0.1 --on-port $port --tproxy-mark $fwmark
+iptables -t mangle -A TPROXY_ENT -p tcp -j TPROXY --on-ip localhost --on-port $port --tproxy-mark $fwmark
-iptables -t mangle -A TPROXY_ENT -p udp -j TPROXY --on-ip 127.0.0.1 --on-port $port --tproxy-mark $fwmark
+iptables -t mangle -A TPROXY_ENT -p udp -j TPROXY --on-ip localhost --on-port $port --tproxy-mark $fwmark
 
 iptables -t mangle -N TPROXY_PRE
 iptables -t mangle -A TPROXY_PRE -m socket --transparent -j MARK --set-mark $fwmark
@@ -119,18 +118,15 @@ iptables -t mangle -A TPROXY_PRE -p icmp -j RETURN
 iptables -t mangle -A TPROXY_PRE -p udp --dport 53 -j TPROXY_ENT
 iptables -t mangle -A TPROXY_PRE -p tcp --dport 53 -j TPROXY_ENT
 iptables -t mangle -A TPROXY_PRE -m addrtype --dst-type LOCAL -j RETURN
-iptables -t mangle -A TPROXY_PRE -m pkttype --pkt-type broadcast -j RETURN
+iptables -t mangle -A TPROXY_PRE -m addrtype ! --dst-type UNICAST -j RETURN
-iptables -t mangle -A TPROXY_PRE -m pkttype --pkt-type multicast -j RETURN
 iptables -t mangle -A TPROXY_PRE -j TPROXY_ENT
 iptables -t mangle -A PREROUTING -j TPROXY_PRE
 
 iptables -t mangle -N TPROXY_OUT
-iptables -t mangle -A TPROXY_OUT -o lo -j RETURN
 iptables -t mangle -A TPROXY_OUT -p icmp -j RETURN
 iptables -t mangle -A TPROXY_OUT -m connmark --mark  $make_newin -j RETURN
-iptables -t mangle -A TPROXY_OUT -m pkttype --pkt-type broadcast -j RETURN
+iptables -t mangle -A TPROXY_OUT -m addrtype --dst-type LOCAL -j RETURN
-iptables -t mangle -A TPROXY_OUT -m pkttype --pkt-type multicast -j RETURN
+iptables -t mangle -A TPROXY_OUT -m addrtype ! --dst-type UNICAST -j RETURN
-iptables -t mangle -A TPROXY_OUT -m mark --mark $mark_noproxy -j RETURN
 iptables -t mangle -A TPROXY_OUT -m cgroup --path $cgroup_noproxy -j RETURN
 iptables -t mangle -A TPROXY_OUT -m cgroup --path $cgroup_proxy -j MARK --set-mark $fwmark
 iptables -t mangle -A OUTPUT -j TPROXY_OUT
@@ -139,56 +135,53 @@ iptables -t mangle -A OUTPUT -j TPROXY_OUT
 ip -6 rule add fwmark $fwmark table $table
 ip -6 route add local default dev lo table $table
 ip6tables -t mangle -N TPROXY_ENT
-ip6tables -t mangle -A TPROXY_ENT -p tcp -j TPROXY --on-ip ::1 --on-port $port --tproxy-mark $fwmark
+ip6tables -t mangle -A TPROXY_ENT -p tcp -j TPROXY --on-ip localhost --on-port $port --tproxy-mark $fwmark
-ip6tables -t mangle -A TPROXY_ENT -p udp -j TPROXY --on-ip ::1 --on-port $port --tproxy-mark $fwmark
+ip6tables -t mangle -A TPROXY_ENT -p udp -j TPROXY --on-ip localhost --on-port $port --tproxy-mark $fwmark
 
 ip6tables -t mangle -N TPROXY_PRE
 ip6tables -t mangle -A TPROXY_PRE -m socket --transparent -j MARK --set-mark $fwmark
 ip6tables -t mangle -A TPROXY_PRE -m socket --transparent -j RETURN
-ip6tables -t mangle -A TPROXY_PRE -p icmp -j RETURN
+ip6tables -t mangle -A TPROXY_PRE -p icmpv6 -j RETURN
 ip6tables -t mangle -A TPROXY_PRE -p udp --dport 53 -j TPROXY_ENT
 ip6tables -t mangle -A TPROXY_PRE -p tcp --dport 53 -j TPROXY_ENT
 ip6tables -t mangle -A TPROXY_PRE -m addrtype --dst-type LOCAL -j RETURN
-ip6tables -t mangle -A TPROXY_PRE -m pkttype --pkt-type broadcast -j RETURN
+ip6tables -t mangle -A TPROXY_PRE -m addrtype ! --dst-type UNICAST -j RETURN
-ip6tables -t mangle -A TPROXY_PRE -m pkttype --pkt-type multicast -j RETURN
 ip6tables -t mangle -A TPROXY_PRE -j TPROXY_ENT
 ip6tables -t mangle -A PREROUTING -j TPROXY_PRE
 
 ip6tables -t mangle -N TPROXY_OUT
-ip6tables -t mangle -A TPROXY_OUT -o lo -j RETURN
+ip6tables -t mangle -A TPROXY_OUT -p icmpv6 -j RETURN
-ip6tables -t mangle -A TPROXY_OUT -p icmp -j RETURN
-ip6tables -t mangle -A TPROXY_OUT -m pkttype --pkt-type broadcast -j RETURN
-ip6tables -t mangle -A TPROXY_OUT -m pkttype --pkt-type multicast -j RETURN
 ip6tables -t mangle -A TPROXY_OUT -m connmark --mark  $make_newin -j RETURN
-ip6tables -t mangle -A TPROXY_OUT -m mark --mark $mark_noproxy -j RETURN
+ip6tables -t mangle -A TPROXY_OUT -m addrtype --dst-type LOCAL -j RETURN
+ip6tables -t mangle -A TPROXY_OUT -m addrtype ! --dst-type UNICAST -j RETURN
 ip6tables -t mangle -A TPROXY_OUT -m cgroup --path $cgroup_noproxy -j RETURN
 ip6tables -t mangle -A TPROXY_OUT -m cgroup --path $cgroup_proxy -j MARK --set-mark $fwmark
 ip6tables -t mangle -A OUTPUT -j TPROXY_OUT
 
 ## allow to disable, order is important
-$enable_dns    	|| iptables  -t mangle -I TPROXY_OUT -p udp --dport 53 -j RETURN
+$enable_dns     || iptables  -t mangle -I TPROXY_OUT -p udp --dport 53 -j RETURN
-$enable_dns    	|| ip6tables -t mangle -I TPROXY_OUT -p udp --dport 53 -j RETURN
+$enable_dns     || ip6tables -t mangle -I TPROXY_OUT -p udp --dport 53 -j RETURN
-$enable_udp 	|| iptables  -t mangle -I TPROXY_OUT -p udp -j RETURN
+$enable_udp     || iptables  -t mangle -I TPROXY_OUT -p udp -j RETURN
-$enable_udp 	|| ip6tables -t mangle -I TPROXY_OUT -p udp -j RETURN
+$enable_udp     || ip6tables -t mangle -I TPROXY_OUT -p udp -j RETURN
-$enable_tcp 	|| iptables  -t mangle -I TPROXY_OUT -p tcp -j RETURN
+$enable_tcp     || iptables  -t mangle -I TPROXY_OUT -p tcp -j RETURN
-$enable_tcp 	|| ip6tables -t mangle -I TPROXY_OUT -p tcp -j RETURN
+$enable_tcp     || ip6tables -t mangle -I TPROXY_OUT -p tcp -j RETURN
-$enable_ipv4 	|| iptables  -t mangle -I TPROXY_OUT -j RETURN
+$enable_ipv4    || iptables  -t mangle -I TPROXY_OUT -j RETURN
-$enable_ipv6 	|| ip6tables -t mangle -I TPROXY_OUT -j RETURN
+$enable_ipv6    || ip6tables -t mangle -I TPROXY_OUT -j RETURN
 
 if $enable_gateway; then
-$enable_dns    	|| iptables  -t mangle -I TPROXY_PRE -p udp --dport 53 -j RETURN
+$enable_dns     || iptables  -t mangle -I TPROXY_PRE -p udp --dport 53 -j RETURN
-$enable_dns    	|| ip6tables -t mangle -I TPROXY_PRE -p udp --dport 53 -j RETURN
+$enable_dns     || ip6tables -t mangle -I TPROXY_PRE -p udp --dport 53 -j RETURN
-$enable_udp 	|| iptables  -t mangle -I TPROXY_PRE -p udp -j RETURN
+$enable_udp     || iptables  -t mangle -I TPROXY_PRE -p udp -j RETURN
-$enable_udp 	|| ip6tables -t mangle -I TPROXY_PRE -p udp -j RETURN
+$enable_udp     || ip6tables -t mangle -I TPROXY_PRE -p udp -j RETURN
-$enable_tcp 	|| iptables  -t mangle -I TPROXY_PRE -p tcp -j RETURN
+$enable_tcp     || iptables  -t mangle -I TPROXY_PRE -p tcp -j RETURN
-$enable_tcp 	|| ip6tables -t mangle -I TPROXY_PRE -p tcp -j RETURN
+$enable_tcp     || ip6tables -t mangle -I TPROXY_PRE -p tcp -j RETURN
-$enable_ipv4 	|| iptables  -t mangle -I TPROXY_PRE -j RETURN
+$enable_ipv4    || iptables  -t mangle -I TPROXY_PRE -j RETURN
-$enable_ipv6 	|| ip6tables -t mangle -I TPROXY_PRE -j RETURN
+$enable_ipv6    || ip6tables -t mangle -I TPROXY_PRE -j RETURN
 fi
 
 ## do not handle local device connection through tproxy if gateway is not enabled
-$enable_gateway || iptables  -t mangle -I TPROXY_PRE  -m addrtype ! --src-type LOCAL -m addrtype ! --dst-type LOCAL -j RETURN
+$enable_gateway || iptables  -t mangle -I TPROXY_PRE -m addrtype ! --src-type LOCAL -j RETURN
-$enable_gateway || ip6tables -t mangle -I TPROXY_PRE  -m addrtype ! --src-type LOCAL -m addrtype ! --dst-type LOCAL -j RETURN
+$enable_gateway || ip6tables -t mangle -I TPROXY_PRE -m addrtype ! --src-type LOCAL -j RETURN
 
 ## make sure following rules are the first in chain TPROXY_PRE to mark new incoming connection or gateway proxy connection
 ## so must put at last to insert first
@@ -204,7 +197,7 @@ DOC
 
 if $enable_gateway; then
     iptables  -t nat -A POSTROUTING -m owner ! --socket-exists -j MASQUERADE
-    ip6tables -t nat -A POSTROUTING -m owner ! --socket-exists -j MASQUERADE
+    ip6tables -t nat -A POSTROUTING -m owner ! --socket-exists -s fc00::/7 -j MASQUERADE # only masquerade ipv6 private address
     sysctl -w net.ipv4.ip_forward=1
     sysctl -w net.ipv6.conf.all.forwarding=1
     echo "gateway enabled"

readme.md

@@ -1,3 +1,5 @@
+
+
 # Transparent Proxy with cgroup v2
 
 
@@ -6,7 +8,7 @@
 
 cgproxy will transparent proxy anything running in specific cgroup. It resembles with *proxychains* and *tsock*, but without their disadvantages, and more powerfull.
 
-It aslo supports global transparent proxy and gateway proxy. See [Global transparent proxy](#global-transparent-proxy) and  [Gateway proxy](#gateway-proxy)
+It aslo supports global transparent proxy and gateway proxy. See [Global transparent proxy](#global-transparent-proxy) and  [Gateway proxy](#gateway-proxy).
 
 <!--ts-->
 
@@ -36,25 +38,24 @@ It aslo supports global transparent proxy and gateway proxy. See [Global transpa
 
 - TPROXY
 
-  A process listening on port (e.g.  12345)  to accept iptables TPROXY, for example v2ray's dokodemo-door  in tproxy mode.
+  A process listening on port (e.g.  12345)  to accept iptables TPROXY, for example v2ray's dokodemo-door in tproxy mode.
 
 ## How to install
 
 ```bash
-mkdir build && cd build && cmake .. && make && make install
+mkdir build && cd build && cmake .. && make && sudo make install
 ```
 
-- It is alreay in [archlinux AUR](https://aur.archlinux.org/packages/cgproxy/). 
+- It is alreay in [archlinux AUR](https://aur.archlinux.org/packages/cgproxy-git/). 
 
 - DEB and RPM are packaged in [release page](https://github.com/springzfx/cgproxy/releases).
 
 ## How to use
 
-- First enable service
+- First enable and start service
 
   ```bash
   sudo systemctl enable --now cgproxy.service
-  sudo systemctl status cgproxy.service
   ```
   
 - Then prefix with cgproxy with your command, just like proxychains
@@ -69,8 +70,13 @@ mkdir build && cd build && cmake .. && make && make install
   cgproxy curl -vIs https://www.google.com
   ```
 
+- To completely stop
+  ```
+  sudo systemctl disable --now cgproxy.service
+  ```
+----
 <details>
-  <summary>More config in `/etc/cgproxy.conf`  (click to expand)</summary>
+  <summary>More config in <i>/etc/cgproxy.conf</i>  (click to expand)</summary>
 
 ```bash
 ########################################################################
@@ -78,6 +84,7 @@ mkdir build && cd build && cmake .. && make && make install
 ## any process in cgroup_proxy will be proxied, and cgroup_noproxy the opposite
 ## cgroup must start with slash '/'
 # cgroup_proxy="/"
+# cgroup_noproxy="/system.slice/v2ray.service"
 cgroup_proxy="/proxy.slice"
 cgroup_noproxy="/noproxy.slice"
 
@@ -91,17 +98,16 @@ port=12345
 
 ########################################################################
 ## if you set to false, it's traffic won't go through proxy, but still can go direct to internet 
+enable_dns=true
 enable_tcp=true
 enable_udp=true
 enable_ipv4=true
 enable_ipv6=true
-enable_dns=true
 
 ########################################################################
 ## do not modify this if you don't known what you are doing
 table=100
 fwmark=0x01
-mark_noproxy=0xff
 mark_newin=0x02
 ```
 </details>
@@ -113,24 +119,27 @@ sudo systemctl restart cgproxy.service
 
 ## Global transparent proxy
 
-- First, set **cgroup_proxy="/"**  in `/etc/cgproxy.conf`, this will proxy all connection
+- Set `cgroup_proxy="/"`  in */etc/cgproxy.conf*, this will proxy all connection
 
-- Then,  run your proxy software in cgroup_noproxy to allow  direct to internet
+- And allow your proxy program (v2ray) direct to internet, two ways:
+  - active way
 
-  ```bash
+      run `cgnoproxy <PROXY PROGRAM>`
-  cgnoproxy  <PROXY PROGRAM>
-  # qv2ray as example
-  cgnoproxy   qv2ray
-  # v2ray as example
-  cgnoproxy sudo v2ray --config config_file
-  ```
       
-- Finally, restart service `sudo systemctl restart cgproxy.service`, that's all
+      example: `cgnoproxy sudo v2ray -config config_file`
+      
+  - passive way
+  
+      set `cgroup_noproxy="<PROXY PROGRAM's CGROUP>"`
+  
+      example:  `cgroup_noproxy="/system.slice/v2ray.service"`
+  
+- Finally, restart cgproxy service, that's all
 
 ## Gateway proxy
 
-- Set **enable_gateway=true** in `/etc/cgproxy.conf` and restart service
+- Set `enable_gateway=true` in */etc/cgproxy.conf*
-- Run your proxy software in cgroup_noproxy to allow  direct to internet as above. This is necessary when you use global transparent proxy the same time.
+- And allow your proxy software (v2ray) direct to internet, described above
 - Other device set this host as gateway, and set public dns if necessary
 
 ## Other useful tools provided in this project
@@ -159,7 +168,7 @@ sudo systemctl restart cgproxy.service
 
 ## NOTES
 
-- `cgattach` attach pid to specific cgroup, and has *suid* bit set by default, be careful to use on multi-user server for securiry. To avoid this situation,  you can remove the *suid* bit , then it will fallback to use *sudo*, with *visudo* you can restrict permission or set NOPASSWD for youself.
+- `cgattach` has *suid* bit set by default, be careful to use on multi-user server for securiry. To avoid this situation,  you can remove the *suid* bit , then it will fallback to use *sudo*, with *sudoer* you can restrict permission or set NOPASSWD for youself.
 
 - v2ray TPROXY need root or special permission
   
@@ -167,13 +176,14 @@ sudo systemctl restart cgproxy.service
   sudo setcap "cap_net_admin,cap_net_bind_service=ep" /usr/lib/v2ray/v2ray
   ```
 
-- Why not outbound mark solution, because in v2ray [when `"localhost"` is used, out-going DNS traffic is not controlled by V2Ray](https://www.v2fly.org/en/configuration/dns.html), so no mark at all, that's pitty.
+- Why not outbound mark solution, because in v2ray [when `"localhost"` is used, out-going DNS traffic is not controlled by V2Ray](https://www.v2fly.org/en/configuration/dns.html), so no mark at all, that's pity.
 
 ## TIPS
 
 - `systemd-cgls` to see the cgroup hierarchical tree.
-- v2ray full config exmaple in [v2ray_buid](https://github.com/springzfx/cgproxy/tree/master/v2ray_buid), more to see [v2ray multi-file config](https://www.v2fly.org/chapter_02/multiple_config.html)
+- Check cgroup2 support `findmnt -t cgroup2`
-- Qv2ray config example
+- Offer you v2ray service and full config exmaple in [v2ray_config](https://github.com/springzfx/cgproxy/tree/master/v2ray_config)
+- Offer you qv2ray config example
   
 
 ![Qv2ray config example](https://i.loli.net/2020/04/28/bdQBzUD37FOgfvt.png)

v2ray_config/00_log.json

@@ -1,5 +1,5 @@
 {
   "log": {
-    "loglevel": "debug"
+    "loglevel": "none"
   }
 }

v2ray_config/02_dns.json

@@ -1,6 +1,11 @@
 {
   "dns": {
+    "hosts": {
+      "geosite:category-ads": "127.0.0.1"
+    },
     "servers": [
+      "https+local://223.5.5.5/dns-query",
+      "https://1.1.1.1/dns-query",
       {
         "address": "localhost",
         "port": 53,
@@ -10,9 +15,7 @@
         "expectIPs": [
           "geoip:cn"
         ]
-      },
+      }
-      "https+local://1.1.1.1/dns-query",
-      "223.6.6.6"
     ],
     "tag": "dns_inbound"
   }

v2ray_config/04_routing_00.json

@@ -2,6 +2,20 @@
   "routing": {
     "domainStrategy": "IPIfNonMatch",
     "rules": [
+      {
+        "domain": [
+          "geosite:category-ads-all"
+        ],
+        "outboundTag": "outBound_BLACKHOLE",
+        "type": "field"
+      },
+      {
+        "inboundTag": [
+          "inbound_API"
+        ],
+        "outboundTag": "API",
+        "type": "field"
+      },
       {
         "outboundTag": "dns-out",
         "port": "53",
@@ -20,27 +34,6 @@
         "outboundTag": "outBound_PROXY",
         "type": "field"
       },
-      {
-        "ip": [
-          "geoip:private"
-        ],
-        "outboundTag": "outBound_DIRECT",
-        "type": "field"
-      },
-      {
-        "domain": [
-          "geosite:category-ads-all"
-        ],
-        "outboundTag": "outBound_BLACKHOLE",
-        "type": "field"
-      },
-      {
-        "ip": [
-          "geoip:cn"
-        ],
-        "outboundTag": "outBound_DIRECT",
-        "type": "field"
-      },
       {
         "domain": [
           "geosite:cn"
@@ -49,10 +42,11 @@
         "type": "field"
       },
       {
-        "inboundTag": [
+        "ip": [
-          "inbound_API"
+          "geoip:cn",
+          "geoip:private"
         ],
-        "outboundTag": "API",
+        "outboundTag": "outBound_DIRECT",
         "type": "field"
       }
     ]

v2ray_config/05_inbounds_01_tproxy_ipv4lo.json

@@ -0,0 +1,30 @@
+{
+  "inbounds": [
+    {
+      "listen": "127.0.0.1",
+      "port": 12345,
+      "protocol": "dokodemo-door",
+      "settings": {
+        "address": "",
+        "followRedirect": true,
+        "network": "tcp,udp",
+        "port": 0,
+        "timeout": 300,
+        "userLevel": 0
+      },
+      "sniffing": {
+        "destOverride": [
+          "http",
+          "tls"
+        ],
+        "enabled": true
+      },
+      "streamSettings": {
+        "sockopt": {
+          "tproxy": "tproxy"
+        }
+      },
+      "tag": "tproxy_IN_ipv4lo"
+    }
+  ]
+}

v2ray_config/05_inbounds_02_tproxy_ipv6lo.json

@@ -1,7 +1,7 @@
 {
   "inbounds": [
     {
-      "listen": "0.0.0.0",
+      "listen": "::1",
       "port": 12345,
       "protocol": "dokodemo-door",
       "settings": {
@@ -9,7 +9,7 @@
         "followRedirect": true,
         "network": "tcp,udp",
         "port": 0,
-        "timeout": 0,
+        "timeout": 300,
         "userLevel": 0
       },
       "sniffing": {
@@ -24,7 +24,7 @@
           "tproxy": "tproxy"
         }
       },
-      "tag": "tproxy_IN"
+      "tag": "tproxy_IN_ipv6lo"
     }
   ]
 }

v2ray_config/06_outbounds_10_myproxy.json

@@ -0,0 +1 @@
+{}

v2ray_config/06_outbounds_myproxy.json

@@ -1 +0,0 @@
-{} 

v2ray_config/merge.sh

@@ -1,2 +1,2 @@
 #!/bin/bash
-jq -rs 'reduce .[] as $item ({}; . + $item  + {inbounds: (.inbounds + $item.inbounds)} + {outbounds: ($item.outbounds + .outbounds)})' *.json |sudo tee /etc/v2ray/config.json
+jq -rs 'reduce .[] as $item ({}; . + $item  + {inbounds: (.inbounds + $item.inbounds)} + {outbounds: ($item.outbounds + .outbounds)})' *.json |sudo tee /etc/v2ray/config.json > /dev/null

v2ray_config/readme.md

@@ -1 +1,8 @@
-Fill `06_outbounds_myproxy.json` with your vmess proxy config with tag `outBound_PROXY`.
+## Usage
+- Fill `06_outbounds_myproxy.json` with your vmess proxy config with tag `outBound_PROXY`.
+- Start with  `sudo v2ray -confdir .`
+
+## Reference
+
+- [v2ray multi-file config](https://www.v2fly.org/chapter_02/multiple_config.html)
+

v2ray_config/v2ray.service

@@ -5,12 +5,11 @@ After=network.target nss-lookup.target
 Wants=network-online.target
 
 [Service]
-Type=simple
+Type=exec
+ExecStart=/usr/lib/v2ray/v2ray -config /etc/v2ray/config.json
 User=nobody
-#AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
-CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
 NoNewPrivileges=yes
-ExecStart=+/usr/lib/v2ray/v2ray -config /etc/v2ray/config.json
 Restart=on-failure
 # Don't restart in the case of configuration error
 RestartPreventExitStatus=23