1
## Basic
2
sudo cp /etc/apt/sources.list /etc/apt/sources.list.bak
3
sudo nano /etc/apt/sources.list
4
# 替换为清华源。注意：请务必将配置中的 jammy 替换为自己系统的实际版本代号，例如20.04是focal，22.04是jammy，24.04是noble
5
deb https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ jammy main restricted universe multiverse
6
deb https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ jammy-updates main restricted universe multiverse
7
deb https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ jammy-backports main restricted universe multiverse
8
deb https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ jammy-security main restricted universe multiverse
9

10
sudo apt update
11
sudo apt install -y fish
12
chsh -s $(which fish)
13
echo $SHELL
14

15
sudo timedatectl set-timezone Asia/Shanghai
16
date
17

18
sudo apt install -y vim git openssh-server htop
19
git config --global user.name "aLinChe"
20
git config --global user.email "1129332011@qq.com"
21
git config --global core.editor vim
22
git config --global color.ui true
23

24
vim ~/.vimrc
25
:set mouse=a
26
:set nu
27
:set et
28
:set sw=4
29
:set sts=4
30
:set hlsearch
31

32

33
sudo apt install python3 python3-pip
34
python -m pip install --upgrade pip
35
pip config set global.index-url https://mirrors.tuna.tsinghua.edu.cn/pypi/web/simple
36
pip3 config list
37

38

39
## Docker
40
# https://docs.docker.com/desktop/setup/install/linux/ubuntu/
41
for pkg in docker.io docker-doc docker-compose docker-compose-v2 podman-docker containerd runc; do sudo apt-get remove $pkg; done
42

43
# Add Docker's official GPG key:
44
sudo apt-get update
45
sudo apt-get install ca-certificates curl
46
sudo install -m 0755 -d /etc/apt/keyrings
47
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
48
sudo chmod a+r /etc/apt/keyrings/docker.asc
49

50
# Add the repository to Apt sources:
51
echo \
52
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
53
$(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \
54
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
55
sudo apt-get update
56

57
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
58

59
sudo usermod -aG docker ${USER}
60
docker version
61

62
docker pull alinche/echo
63
docker images -a
64

65

66
## Nix
67
sh <(curl -L https://nixos.org/nix/install) --daemon
68
nix-channel --add https://github.com/nix-community/home-manager/archive/master.tar.gz home-manager
69
nix-channel --update
70
nix-shell '<home-manager>' -A install
71
vim ~/.config/home-manager/home.nix
72
#   nix = {
73
#     package = pkgs.nix;
74
#     settings.experimental-features = [ "nix-command" "flakes" ];
75
#     settings.access-tokens = "github.com=<your-github-access-token>";
76
#   };
77

78
#   programs = {
79
#     direnv = {
80
#       enable = true;
81
#       enableBashIntegration = true;
82
#       nix-direnv.enable = true;
83
#     };
84

85
#     fish.enable = true;
86
#     # bash.enable = true; # 使用 nix bash 管理
87
#   };
88
mv ~/.bashrc ~/.bashrc.backup
89
mv ~/.profile ~/.profile.backup
90

91
home-manager switch
92

93

94
## else
95
# disk
96
df -h /tmp
97
sudo vgdisplay
98
sudo lvdisplay
99
sudo lvextend -l +100%FREE /dev/ubuntu-vg/ubuntu-lv
100
sudo resize2fs /dev/ubuntu-vg/ubuntu-lv
101

102
lsblk
103
sudo fdisk /dev/sda
104
p -> d -> n -> w
105
sudo partprobe
106
sudo resize2fs /dev/sda2
107

108
# hostname
109
sudo hostnamectl set-hostname aLinChe
110
# netplan
111
sudo vim /etc/netplan/50-cloud-init.yaml
112
# systemctl
113
systemctl --user list-unit-files --type=service --state=enabled
114

115
## Linux Kernal
116
make menuconfig
117
grep "=m" .config
118
grep "=y" .config
119

120
bear -- make -n
121
make ARCH=x86_64 compile_commands.json -j$(nproc) # x86_64
122
make -j$(nproc)
123
sudo make modules_install
124
sudo make install
125

126
make -j$(nproc) bzImage
127
cp arch/x86/boot/bzImage vmlinuz-x86_64
128
# if ARM aarch64: make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- -j$(nproc) # arch/arm64/boot/Image
129

130
# make menuconfig
131
Kernel hacking  --->
132
    Compile-time checks and compiler options  --->
133
        [*] Compile the kernel with debug info
134
        [*]   Provide GDB scripts for kernel debugging
135
Device Drivers  --->
136
    Network device support  --->
137
        [*]   Network core driver support
138
        <*>     Virtual eXtensible Local Area Network (VXLAN)
139
        <*>     Universal TUN/TAP device driver support
140
        [*]   Ethernet driver support  --->
141
        -*-   PHY Device support and infrastructu  --->
142
        -*-   MDIO bus device drivers  --->
143
        # ​​USB网卡：
144
        <*>   USB Network Adapters  --->
145
        ​# ​无线网卡​​：
146
        [*]   Wireless LAN  --->
147
        # 虚拟机网卡​​：
148
        <*>   VMware VMXNET3 ethernet driver
149
        <M>   Simulated networking device
150
        <M>   Failover driver
151
    Virtio drivers --->
152
Networking support  --->
153
    Networking options  --->
154
        [*] TCP/IP networking
155
        [*]   IP: advanced router
156
        [*]     IP: policy routing
157
        <*>   The IPv6 protocol  --->
158
        <*> 802.1d Ethernet Bridging

1
https://archlinux.org/download/ # archinstall
2

3
systemctl stop reflector.service
4
vim /etc/pacman.d/mirrorlist
5
Server = http://mirrors.tuna.tsinghua.edu.cn/archlinux/$repo/os/$arch
6
Server = https://mirrors.tuna.tsinghua.edu.cn/archlinux/$repo/os/$arch
7
Server = http://mirrors.hust.edu.cn/archlinux/$repo/os/$arch
8
Server = https://mirrors.hust.edu.cn/archlinux/$repo/os/$arch
9

10
pacman -Sy pacman-mirrorlist
11
cat /etc/pacman.d/mirrorlist.pacnew | grep China -A 42
12
cat /etc/pacman.d/mirrorlist.pacnew | grep China -A 42 > /etc/pacman.d/mirrorlist
13
vim /etc/pacman.d/mirrorlist
14

15
vim /etc/pacman.conf
16

17

18
fdisk /dev/sda # mnw
19
lsblk
20
mkfs.ext4 /dev/sda1
21
mount /dev/sda1 /mnt/
22

23
pacstrap -i /mnt base base-devel linux linux-firmware
24
genfstab -U -p /mnt > /mnt/etc/fstab
25
arch-chroot /mnt
26

27

28
echo ArchKK > /etc/hostname
29
pacman -S iw wpa_supplicant wireless_tools net-tools
30
pacman -S networkmanager
31
systemctl enable NetworkManager
32
pacman -S openssh
33
systemctl enable sshd
34
pacman -S dialog
35

36
ln -s -f /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
37
hwclock --systohc
38
date
39

40
vim /etc/locale.gen  # zh_CN.UTF-8
41
locale-gen
42
echo LANG=en_US.UTF-8 > /etc/locale.conf
43
cat /etc/locale.conf
44

45
useradd -m -G wheel -s /bin/bash kkArch
46
passwd kkArch
47
pacman -S fish
48
chsh -s /bin/fish kkArch
49

50
pacman -S grub
51
grub-install /dev/sda
52
grub-mkconfig -o /boot/grub/grub.cfg
53

54
exit
55
reboot

1
https://github.com/oeasy1412/nixos_config/

1
## LTSC is all you need.
2
https://next.itellyou.cn/Original/
3

4
## MAS
5
https://massgrave.dev/
6
irm https://get.activated.win | iex
7

8
## WSL2
9
“控制面板”->“程序”->“启用或关闭Windows功能”中勾选“适用于 Linux 的 Windows 子系统”和“虚拟机平台”
10
重启计算机。重启后，以管理员身份打开PowerShell：
11
wsl --set-default-version 2
12
通过 Microsoft Store 搜索"Ubuntu"点击"获取"进行安装
13
# 法2：wsl --list --online (wsl --install -d Ubuntu-22.04)
14

15
## WSL迁移到D盘
16
wsl -l -v
17
wsl --shutdown
18
wsl --export Arch D:\WSL2\Arch\arch.tar
19
wsl --unregister Arch
20
wsl --import D:\WSL2\Arch D:\WSL2\Arch\Arch.tar --version 2
21
del D:\WSL2\Arch\Arch.tar
22
Arch.exe config --default-user [your name]
23
# 同理 wsl --import Ubuntu-22.04 D:\WSL2\Ubuntu-22.04 D:\WSL2\Ubuntu-22.04\Ubun.tar --version 2
24

25
## disk 硬盘盒启动 + Ventoy安装系统
26
diskpart
27
list disk              # 确认新硬盘是磁盘1（根据容量931GB判断）
28
select disk 1          # 选中您的机械硬盘（⚠️绝对不要选错磁盘！）
29
clean                  # 删除所有分区（新硬盘可安全执行）
30
convert gpt            # 转换为GPT分区表（兼容大硬盘）
31
create partition primary # 创建主分区（默认占用全部空间）
32
format fs=ntfs quick   # 快速格式化为NTFS文件系统
33
assign letter=E        # 手动分配驱动器号为E（可替换为F,G等）
34
exit

1
## python
2
https://www.python.org/downloads/ # Windows
3
## conda
4
## 安装
5
curl -O https://mirrors.tuna.tsinghua.edu.cn/anaconda/archive/Anaconda3-2025.06-1-Linux-x86_64.sh
6
chmod +x Anaconda3-2025.06-1-Linux-x86_64.sh
7
bash ./Anaconda3-2025.06-1-Linux-x86_64.sh
8

9
conda info --envs
10
conda deactivate
11
conda config --set auto_activate_base false
12
## d2l
13
conda create -n d2l-env python=3.11
14
conda activate d2l-env
15
conda config --add channels https://mirrors.tuna.tsinghua.edu.cn/anaconda/pkgs/main/
16
conda config --add channels https://mirrors.tuna.tsinghua.edu.cn/anaconda/cloud/pytorch/
17
conda config --add channels https://mirrors.tuna.tsinghua.edu.cn/anaconda/cloud/conda-forge/
18
pip install jupyter torch torchvision
19
pip install d2l
20
conda install ipykernel
21
python -m ipykernel install --user --name d2l-env --display-name "d2l"
22
# rm
23
conda remove --name d2l-env --all
24
conda env list
25
# ​​导出环境配置​​
26
conda activate d2l-env
27
conda env export > d2l-env.yml
28
# 复用
29
# conda env create -f d2l-env.yaml --name new_torch_env
30
conda env create -n NewProject --file d2l-env.yml
31
conda activate NewProject
32
conda config --show
33
conda env list
34

35
## ROCm
36
https://github.com/likelovewant/ROCmLibs-for-gfx1103-AMD780M-APU/ # 鸡哥无界14X（
37
conda create -n ROCm python=3.11
38
conda activate ROCm
39
# pip install torch==2.7.1 torchvision==0.22.1 torchaudio==2.7.1 --index-url https://download.pytorch.org/whl/rocm6.3
40
pip install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cu118
41
pip install jupyter d2l
42
conda install ipykernel
43
python -m ipykernel install --user --name ROCm --display-name "ROCm"
44

45
## jupyter
46
jupyter kernelspec list
47
jupyter nbconvert --to script a.ipynb # html markdown pdf
48
jupyter notebook list
49
jupyter notebook --ip=0.0.0.0 --port=8888 --allow-root

1
## nvidia 驱动
2
ubuntu-drivers devices
3
# 安装推荐驱动（或手动指定版本）
4
sudo ubuntu-drivers autoinstall
5
sudo reboot
6
nvidia-smi
7

8
https://developer.nvidia.com/cuda-downloads/ # is all you need
9
## PATH
10
sudo ln -s /usr/local/cuda-12.2 /usr/local/cuda
11
export PATH=/usr/local/cuda/bin${PATH:+:${PATH}}
12
export LD_LIBRARY_PATH=/usr/local/cuda/lib64${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}
13
export PATH="$HOME/anaconda3/bin:$PATH"
14

15
## 重装
16
# 清理旧驱动
17
sudo apt purge '^nvidia-.*' && sudo apt autoremove
18
# 安装推荐版本（如575 => cuda12.9）
19
sudo apt install nvidia-driver-575
20
# 禁用 Nouveau 驱动
21
echo "blacklist nouveau" | sudo tee /etc/modprobe.d/blacklist-nouveau.conf
22
sudo update-initramfs -u
23
sudo reboot
24

25
sudo nvidia-smi -pm 1
26
nvidia-smi
27
watch -n 1 nvidia-smi
28

29
## e.g. GTX1060 特化版本
30
# 安装 535 驱动
31
sudo apt install -y nvidia-driver-535
32
# 重建内核模块
33
sudo dpkg-reconfigure nvidia-dkms-535
34
sudo update-initramfs -u
35
# 添加 CUDA 12.2 官方仓库
36
wget https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/x86_64/cuda-ubuntu2204.pin
37
sudo mv cuda-ubuntu2204.pin /etc/apt/preferences.d/cuda-repository-pin-600
38
# 下载并安装CUDA 12.2的本地仓库包
39
wget https://developer.download.nvidia.com/compute/cuda/12.2.0/local_installers/cuda-repo-ubuntu2204-12-2-local_12.2.0-535.54.03-1_amd64.deb
40
sudo dpkg -i cuda-repo-ubuntu2204-12-2-local_12.2.0-535.54.03-1_amd64.deb
41
# 将密钥环复制到正确位置
42
sudo cp /var/cuda-repo-ubuntu2204-12-2-local/cuda-*-keyring.gpg /usr/share/keyrings/
43
sudo apt update
44
# 安装CUDA 12.2工具包（不包含驱动，因为已单独安装）
45
sudo apt install -y cuda-toolkit-12-2
46

47
sudo ln -s /usr/local/cuda-12.2 /usr/local/cuda
48

49
conda install -c nvidia cudnn cudatoolkit=12.2

1
https://tailscale.com/
2
## 安装Tailscale
3
### Linux
4
curl -fsSL https://tailscale.com/install.sh | sh
5
### Windows
6
https://mirrors.scutosc.cn/repository/tailscale/stable/tailscale-setup-latest.exe
7
### MacOS
8
https://mirrors.scutosc.cn/repository/tailscale/stable/Tailscale-latest-macos.pkg
9
### Andriod
10
release: https://github.com/tailscale/tailscale-android/releases/
11
you can also accelerate your download here: https://hub.samuka007.com/tailscale/tailscale-android/releases （x
12

13
## 如何使用
14
### Linux
15
# 将返回的链接COPY到浏览器打开，在浏览器登录验证
16
sudo tailscale up
17
# 打开开机自启
18
sudo systemctl enable tailscaled
19
### Windows
20
- Windows点击右下角的 `∧` ，点击 `Log in`
21
### MacOS
22
- 副歌v我50（x
23
### Andriod
24
- 直接打开登录
25

26
# 查看组网情况
27
tailscale status
28
# IP  Name  User  OS status
29

30
# More
31
tailscale status --json
32
tailscale set
33
tailscale configure
34
tailscale file
35
scp A B # from A to B
36
tailscale ip
37
tailscale netcheck
38
tailscale configure
39

40
## handscale
41
sudo apt install iproute2
42
wget https://github.com/juanfont/headscale/releases/download/v0.26.0/headscale_0.26.0_linux_amd64.deb
43
sudo dpkg -i headscale_0.26.0_linux_amd64.deb
44

45
sudo headscale users create kkubun
46
# 生成预授权密钥
47
sudo headscale preauthkeys create --reusable -e 180d -u <用户ID>
48
sudo headscale preauthkeys ls -u kkubun
49
# 为整个组织创建密钥
50
headscale preauthkeys create -u 0 -e 180d -r -o
51

52
sudo headscale nodes ls
53
sudo headscale nodes list-routes
54
sudo headscale users ls
55

56

57
tailscale up --login-server=http://<headscale-server>:8080 --authkey <key>
58

59
## 流量出口
60
## server
61
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.conf
62
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.conf
63
sudo sysctl -p  # 立即生效
64
# iptables
65
sudo iptables -A FORWARD -i tailscale0 -j ACCEPT
66
sudo iptables -A FORWARD -o tailscale0 -m state --state RELATED,ESTABLISHED -j ACCEPT
67
# 添加流量伪装规则（替换 youreth0 为实际外网网卡名）
68
sudo iptables -t nat -A POSTROUTING -o youreth0 -j MASQUERADE
69
# 保存规则（若使用 netfilter-persistent）
70
sudo netfilter-persistent save
71

72
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
73
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
74
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
75

76
sudo tailscale up --advertise-exit-node
77
sudo tailscale up --advertise-routes=192.168.199.0/24 --advertise-exit-node --accept-routes
78
sudo tailscale set --advertise-exit-node
79

80
![Tailscale 管理后台](https://login.tailscale.com/admin/machines) ​Edit route settings​ -> ​​Use as exit node​​
81
# ip route show default
82
# 停止宣告出口节点​
83
sudo tailscale up --advertise-exit-node=false
84

85
## client
86
sudo tailscale up --exit-node=<节点IP或主机名> --exit-node-allow-lan-access
87
# 清除出口节点配置
88
sudo tailscale up --exit-node=""

1
https://www.bilibili.com/video/BV1wm4UzfEbr/

1
https://www.bilibili.com/video/BV1fZCyBYEuT/

1
https://github.com/LizardByte/Sunshine/
2
https://github.com/moonlight-stream/
3

4
https://github.com/Axixi2233/moonlight-android/ # 阿西西安卓端修改版

1
https://github.com/termux/termux-app/
2
https://github.com/termux/termux-api/
3

4
vim $PREFIX/etc/apt/sources.list # 自带nano
5
deb https://mirrors.tuna.tsinghua.edu.cn/termux/apt/termux-main stable main
6
# termux-change-repo # 使用Termux提供的交互式工具更换镜像源
7
# pkg install tsinghua.sources
8
# pkg install ustc.sources
9

10
pkg update && pkg upgrade
11
pkg install vim openssh termux-services
12
# pkg install htop clang (可选)
13

14
whoami
15
passwd
16
ifconfig
17
sshd
18
# ssh 安卓用户名@IP -p 8022
19
pkg i termux-services
20
sv-enable ssh-agent
21
sv-enable sshd # sv status sshd
22
vim $PREFIX/etc/termux-login.sh
23
if tty -s; then
24
    if pgrep -x "sshd" > /dev/null; then
25
        echo "sshd is already running."
26
    else
27
        sshd
28
        echo "Started sshd."
29
    fi
30
    termux-wake-lock # 阻止手机休眠时CPU和网络被挂起
31
    echo "Welcome Termux!"
32
fi
33

34
vim $PREFIX/etc/ssh/sshd_config
35
ClientAliveInterval 60
36
ClientAliveCountMax 3
37

38
# scp 传输文件
39
scp ./main.cpp myHand:~/cpp
40
# 在您的电脑上创建或编辑SSH客户端配置文件
41
Host myHand
42
  HostName 192.168.1.100 # 请替换为您手机的实际局域网IP
43
  Port 8022
44
  User u0_a118 # 请替换为Termux中`whoami`命令返回的用户名
45
  ServerAliveInterval 60
46
  ServerAliveCountMax 3
47
  IdentityFile C:\Users\Name\.ssh\myHand_id_rsa # 使用密钥认证(推荐)
48

49
termux-setup-storage # 允许访问手机的存储空间
50

51
termux-vibrate
52

53
termux-media-player play "storage/shared/Music/a.mp3"
54

55
termux-camera-info
56
termux-camera-photo storage/shared/a.jpg
57

58
termux-microphone-record -f storage/shared/a.m4a -l 0
59

60
ls storage/shared/Android/data/
61
am start com.tencent.mobileqq/.activity.SplashActivity
62

63
termux-battery-status
64
termux-notification

1
https://tbtool.dawnstd.cn/

1
https://winlibs.com/

1
# sudo apt update && sudo apt upgrade -y
2
sudo apt install openvpn easy-rsa -y
3
mkdir ~/openvpn-ca
4
cd ~/openvpn-ca
5
vim vars
6
set_var EASYRSA_REQ_COUNTRY    "CN"
7
set_var EASYRSA_REQ_PROVINCE   "Beijing"
8
set_var EASYRSA_REQ_CITY       "Beijing"
9
set_var EASYRSA_REQ_ORG        "MyVPN"
10
set_var EASYRSA_REQ_EMAIL      "admin@myvpn.com"
11
set_var EASYRSA_REQ_OU         "MyVPN CA"
12
set_var EASYRSA_KEY_SIZE       4096
13
set_var EASYRSA_CA_EXPIRE      3650
14
set_var EASYRSA_CERT_EXPIRE    1080
15

16
sudo ln -s /usr/share/easy-rsa/easyrsa ./easyrsa
17
./easyrsa init-pki
18
./easyrsa build-ca nopass # openvpn-CA
19
## 生成服务器证书和密钥
20
./easyrsa gen-req server nopass # 这里假设你的name=openvpn-server
21
./easyrsa sign-req server server
22
./easyrsa gen-dh # 等待
23
openvpn --genkey secret pki/ta.key
24

25
## ​创建客户端证书请求和密钥
26
./easyrsa gen-req client1 nopass
27
./easyrsa sign-req client client1
28

29
sudo mkdir /etc/openvpn/server
30
sudo cp ./pki/ca.crt /etc/openvpn/server/
31
sudo cp ./pki/issued/server.crt /etc/openvpn/server/
32
sudo cp ./pki/private/server.key /etc/openvpn/server/
33
sudo cp ./pki/dh.pem /etc/openvpn/server/
34
sudo cp ./pki/ta.key /etc/openvpn/server/
35

36
sudo vim /etc/openvpn/server/server.conf
37
## --- 修改server.conf ---
38
port 1194
39
proto tcp-server
40
proto tcp6-server
41
dev tun
42

43
# 证书路径
44
ca /etc/openvpn/server/ca.crt
45
cert /etc/openvpn/server/server.crt
46
key /etc/openvpn/server/server.key
47
dh /etc/openvpn/server/dh.pem
48
tls-crypt /etc/openvpn/server/ta.key
49

50
# 网络配置
51
;topology subnet
52
server 10.8.0.0 255.255.255.0
53
push "redirect-gateway def1 bypass-dhcp"
54
push "dhcp-option DNS 1.1.1.1"
55
push "dhcp-option DNS 8.8.8.8"
56
;push "route 192.168.1.0 255.255.255.0"
57
client-to-client
58
;client-config-dir /etc/openvpn/ccd
59

60
# 安全强化
61
cipher AES-256-GCM
62
auth SHA512
63
tls-version-min 1.2
64
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384
65

66
# 连接设置
67
keepalive 10 120
68
user nobody
69
group nogroup
70
persist-key
71
persist-tun
72

73
# 日志记录
74
status /var/log/openvpn/openvpn-status.log
75
log /var/log/openvpn/openvpn.log
76
verb 3
77

78
# 额外安全措施
79
# reneg-sec 3600  # 每小时重新协商密钥
80
# remote-cert-tls client
81
# verify-client-cert require
82

83

84
## --- 配置转发设置 ---
85
sudo vim /etc/sysctl.conf
86
# 取消注释
87
#net.ipv4.ip_forward=1
88
sudo sysctl -p
89
sudo ufw allow 1194/tcp
90
sudo ufw allow ssh
91

92
# ​​设置 NAT 规则 (伪装):​​ 这是为了让 VPN 客户端能通过服务器访问互联网
93
# sudo vim /etc/ufw/before.rules
94
# NAT table rules for OpenVPN
95
# *nat
96
# :POSTROUTING ACCEPT [0:0]
97
# -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
98
# COMMIT
99
sudo vim /etc/default/ufw
100
DEFAULT_FORWARD_POLICY="ACCEPT"
101

102
sudo mkdir -p /etc/openvpn/ccd
103
sudo vim /etc/openvpn/ccd/client1
104
ifconfig-push 10.8.0.6 10.8.0.1
105
iroute 192.168.1.0 255.255.255.0
106

107
sudo systemctl -f enable openvpn-server@server.service
108
sudo systemctl start openvpn-server@server.service
109

110
sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o wlp3s0 -j MASQUERADE
111
sudo iptables -A FORWARD -i wlp3s0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
112
sudo iptables -A FORWARD -i tun0 -o wlp3s0 -j ACCEPT
113

114
sudo ip6tables -A FORWARD -i tun0 -o eno1 -j ACCEPT
115
sudo ip6tables -A FORWARD -i eno1 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
116

117
sudo apt install iptables-persistent
118
sudo netfilter-persistent save
119

120
## --- client ---
121
vim ./client.ovpn
122

123
##############################################
124
# OpenVPN 客户端配置文件
125
# 最后更新: 2025-09-03
126
##############################################
127

128
client
129

130
# 网络设置
131
dev tun
132
proto tcp-client
133
proto tcp6-client
134
;proto udp
135

136
# 服务器连接信息
137
remote scut6.alinche.dpdns.org 1194
138
;remote your-server-ip 1194  # 备用服务器地址
139
resolv-retry infinite
140

141
# 连接行为
142
nobind
143
persist-key
144
persist-tun
145
remote-cert-tls server
146
verify-x509-name C10VPN-server name
147

148
# 安全设置
149
cipher AES-256-GCM
150
auth SHA256
151
auth-nocache
152
tls-version-min 1.2
153
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384
154
;ignore-unknown-option block-outside-dns
155
;reneg-sec 3600
156

157
# 性能优化
158
;sndbuf 0
159
;rcvbuf 0
160
;comp-lzo no  # 禁用压缩（安全推荐）
161
;compress lz4-v2  # 如果需要压缩则启用
162

163
# 日志和诊断
164
verb 3
165
;mute 20
166
;log openvpn.log  # 启用日志记录（调试时使用）
167

168
# 证书和密钥嵌入部分
169
<ca>
170
-----BEGIN CERTIFICATE-----
171

172
-----END CERTIFICATE-----
173
</ca>
174

175
<cert>
176
-----BEGIN CERTIFICATE-----
177

178
-----END CERTIFICATE-----
179
</cert>
180

181
<key>
182
-----BEGIN PRIVATE KEY-----
183

184
-----END PRIVATE KEY-----
185
</key>
186

187
<tls-crypt>
188
-----BEGIN OpenVPN Static key V1-----
189

190
-----END OpenVPN Static key V1-----
191
</tls-crypt>
192

193
## 数据来源
194
sudo cat /etc/openvpn/server/ca.crt
195
sudo cat ./pki/issued/client1.crt
196
sudo cat ./pki/private/client1.key
197
sudo cat /etc/openvpn/server/ta.key
198

199
# sudo openssl verify -CAfile /etc/openvpn/server/ca.crt ./pki/issued/client1.crt
200

201
## --- ddns-go --- （可选）
202
docker run -d --name ddns-go --restart=always --net=host -v /opt/ddns-go:/root jeessy/ddns-go
203
# 访问 http://docker对应主机IP:9876/