add v2ray support

ss-tproxy

@@ -15,6 +15,25 @@ fi
 
 function check_depend {
 case "$mode" in
+    v2ray_global)
+        modprobe xt_TPROXY &>/dev/null || { echo "Error: xt_TPROXY module is not installed." 1>&2; exit 1; }
+        command -v ip &>/dev/null || { echo "Error: iproute2 is not installed." 1>&2; exit 1; }
+        command -v dnsmasq &>/dev/null || { echo "Error: dnsmasq is not installed." 1>&2; exit 1; }
+        ;;
+    v2ray_gfwlist)
+        modprobe xt_TPROXY &>/dev/null || { echo "Error: xt_TPROXY module is not installed." 1>&2; exit 1; }
+        command -v ip &>/dev/null || { echo "Error: iproute2 is not installed." 1>&2; exit 1; }
+        command -v dnsmasq &>/dev/null || { echo "Error: dnsmasq is not installed." 1>&2; exit 1; }
+        command -v ipset &>/dev/null || { echo "Error: ipset is not installed." 1>&2; exit 1; }
+        command -v perl &>/dev/null || { echo "Error: perl is not installed." 1>&2; exit 1; }
+        ;;
+    v2ray_chnroute)
+        modprobe xt_TPROXY &>/dev/null || { echo "Error: xt_TPROXY module is not installed." 1>&2; exit 1; }
+        command -v ip &>/dev/null || { echo "Error: iproute2 is not installed." 1>&2; exit 1; }
+        command -v dnsmasq &>/dev/null || { echo "Error: dnsmasq is not installed." 1>&2; exit 1; }
+        command -v ipset &>/dev/null || { echo "Error: ipset is not installed." 1>&2; exit 1; }
+        command -v chinadns &>/dev/null || { echo "Error: chinadns is not installed." 1>&2; exit 1; }
+        ;;
     tproxy_global)
         { command -v ss-redir &>/dev/null || command -v ssr-redir &>/dev/null; } || { echo "Error: ss-redir/ssr-redir is not installed." 1>&2; exit 1; }
         { command -v ss-tunnel &>/dev/null || command -v ssr-tunnel &>/dev/null; } || { echo "Error: ss-tunnel/ssr-tunnel is not installed." 1>&2; exit 1; }
@@ -149,7 +168,7 @@ function update_chnroute {
 
 function flush_cache {
 case "$mode" in
-    *global|*gfwlist*|*chnroute)
+    *global|*gfwlist*|*chnroute|v2ray*)
         pgrep '^dnsmasq$' | xargs kill -HUP &>/dev/null
         ;;
     tproxy_global_tcp)
@@ -265,6 +284,9 @@ esac
 
 function start_socks {
 case "$mode" in
+v2ray*)
+    eval "$v2ray_runcmd"
+    ;;
 tproxy*)
     if [ "$server_use_ssr" = 'false' ]; then
         redir_params="-s'$server_addr' -p'$server_port' -m'$server_method' -k'$server_passwd' -b0.0.0.0 -l60080 --no-delay --reuse-port"
@@ -304,6 +326,74 @@ esac
 
 function start_dns {
 case "$mode" in
+v2ray_global)
+    if [ $(grep -Ec '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' <<<"$v2ray_server") -eq 0 ]; then
+        v2ray_server_addr=$(getent hosts $v2ray_server | awk '{print $1}' | head -n1)
+    fi
+    dnsmasq -C <(cat <<EOF
+$([ "$dnsmasq_log_on" = 'true' ] && echo 'log-queries')
+log-async = 20
+log-facility = $dnsmasq_log_file
+domain-needed
+cache-size = $dnsmasq_cache_size
+$([ $(dnsmasq --help | grep -c min-cache-ttl) -ne 0 ] && echo "min-cache-ttl = $dnsmasq_cache_time")
+no-negcache
+no-resolv
+port = 53
+server = 127.0.0.1#${v2ray_tunnel#*:}
+$([ -n "$v2ray_server_addr" ] && echo "address = /$v2ray_server/$v2ray_server_addr")
+EOF
+)
+    ;;
+v2ray_gfwlist)
+    if [ $(grep -Ec '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' <<<"$v2ray_server") -eq 0 ]; then
+        v2ray_server_addr=$(getent hosts $v2ray_server | awk '{print $1}' | head -n1)
+    fi
+    dnsmasq -C <(cat <<EOF
+$([ "$dnsmasq_log_on" = 'true' ] && echo 'log-queries')
+log-async = 20
+log-facility = $dnsmasq_log_file
+domain-needed
+cache-size = $dnsmasq_cache_size
+$([ $(dnsmasq --help | grep -c min-cache-ttl) -ne 0 ] && echo "min-cache-ttl = $dnsmasq_cache_time")
+no-negcache
+no-resolv
+port = 53
+server = $dns_direct
+$([ -n "$v2ray_server_addr" ] && echo "address = /$v2ray_server/$v2ray_server_addr")
+$(perl -pe "s@^.*+\$@server=/$&/127.0.0.1#${v2ray_tunnel#*:}\nipset=/$&/gfwlist@" $dnsmasq_gfwlist <(
+perl -ne 'print unless m@^\s|\s\n$|^#|^\d++\.\d++\.\d++\.\d++(?:/\d++)?$@' $dnsmasq_gfwlist_ext
+))
+EOF
+)
+    ;;
+v2ray_chnroute)
+    chinadns_chnroute_temp=$(mktemp)
+    cat $chinadns_chnroute >$chinadns_chnroute_temp
+    echo "$dns_direct/32" >>$chinadns_chnroute_temp
+    chinadns_params="-b 0.0.0.0 -p 65353 -s $dns_direct,$v2ray_tunnel -c $chinadns_chnroute_temp"
+    [ "$chinadns_mutation" = 'true' ] && chinadns_params+=' -m'
+    [ "$chinadns_verbose" = 'true' ] && chinadns_params+=' -v'
+    nohup chinadns $chinadns_params </dev/null &>>"$chinadns_log" &
+
+    if [ $(grep -Ec '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' <<<"$v2ray_server") -eq 0 ]; then
+        v2ray_server_addr=$(getent hosts $v2ray_server | awk '{print $1}' | head -n1)
+    fi
+    dnsmasq -C <(cat <<EOF
+$([ "$dnsmasq_log_on" = 'true' ] && echo 'log-queries')
+log-async = 20
+log-facility = $dnsmasq_log_file
+domain-needed
+cache-size = $dnsmasq_cache_size
+$([ $(dnsmasq --help | grep -c min-cache-ttl) -ne 0 ] && echo "min-cache-ttl = $dnsmasq_cache_time")
+no-negcache
+no-resolv
+port = 53
+server = 127.0.0.1#65353
+$([ -n "$v2ray_server_addr" ] && echo "address = /$v2ray_server/$v2ray_server_addr")
+EOF
+)
+    ;;
 tproxy_global)
     dnsmasq -C <(cat <<EOF
 $([ "$dnsmasq_log_on" = 'true' ] && echo 'log-queries')
@@ -609,7 +699,10 @@ function start_rule {
         iptables_intranet_nonstd+=($cidr)
     done
 case "$mode" in
-tproxy_global*|tproxy_chnroute*)
+tproxy_global*|tproxy_chnroute*|v2ray_global|v2ray_chnroute)
+    [[ "$mode" == v* ]] && server_addr=$v2ray_server
+    [[ "$mode" == v* ]] && redir_port=${v2ray_redir#*:} || redir_port=60080
+
     iptables -t nat -F OUTPUT
     iptables -t nat -F PREROUTING
     iptables -t nat -F POSTROUTING
@@ -634,9 +727,9 @@ tproxy_global*|tproxy_chnroute*)
         ipset -R <$iptables_ipset_file
         iptables -t nat -A SS-TCP -m set --match-set chnroute dst -j RETURN
     fi
-    iptables -t nat -A SS-TCP -p tcp -j REDIRECT --to-ports 60080
+    iptables -t nat -A SS-TCP -p tcp -j REDIRECT --to-ports $redir_port
 
-    if [[ "$mode" != *tcp ]]; then
+    if [[ "$mode" != *tcp || "$mode" == v* ]]; then
         iptables -t mangle -F PREROUTING
         iptables -t mangle -F SS-UDP &>/dev/null
         iptables -t mangle -X SS-UDP &>/dev/null
@@ -655,7 +748,7 @@ tproxy_global*|tproxy_chnroute*)
         iptables -t mangle -A SS-UDP -d 240/4 -j RETURN
         iptables -t mangle -A SS-UDP -d $server_addr -j RETURN
         [[ "$mode" == *chnroute* ]] && iptables -t mangle -A SS-UDP -m set --match-set chnroute dst -j RETURN
-        iptables -t mangle -A SS-UDP -p udp -j TPROXY --tproxy-mark $iptables_pbr_fwmark --on-ip 127.0.0.1 --on-port 60080
+        iptables -t mangle -A SS-UDP -p udp -j TPROXY --tproxy-mark $iptables_pbr_fwmark --on-ip 127.0.0.1 --on-port $redir_port
 
         ip route add local 0/0 dev lo table $iptables_pbr_number
         ip rule add fwmark $iptables_pbr_fwmark table $iptables_pbr_number
@@ -675,7 +768,9 @@ tproxy_global*|tproxy_chnroute*)
         iptables -t nat -A POSTROUTING -s $intranet ! -d $intranet -j MASQUERADE
     done
     ;;
-tproxy_gfwlist*)
+tproxy_gfwlist*|v2ray_gfwlist)
+    [[ "$mode" == v* ]] && redir_port=${v2ray_redir#*:} || redir_port=60080
+
     iptables -t nat -F OUTPUT
     iptables -t nat -F PREROUTING
     iptables -t nat -F POSTROUTING
@@ -686,15 +781,15 @@ tproxy_gfwlist*)
     ipset -N gfwlist hash:net &>/dev/null
     perl -ne 'print if m@^\d++\.\d++\.\d++\.\d++(?:/\d++)?$@' $dnsmasq_gfwlist_ext | xargs -n1 ipset -A gfwlist &>/dev/null
     [[ "$mode" == *tcp ]] && iptables -t nat -A SS-TCP -p tcp -d ${dns_remote%%:*} -j REDIRECT --to-ports 60080
-    iptables -t nat -A SS-TCP -p tcp -m set --match-set gfwlist dst -j REDIRECT --to-ports 60080
+    iptables -t nat -A SS-TCP -p tcp -m set --match-set gfwlist dst -j REDIRECT --to-ports $redir_port
 
-    if [[ "$mode" != *tcp ]]; then
+    if [[ "$mode" != *tcp || "$mode" == v* ]]; then
         iptables -t mangle -F PREROUTING
         iptables -t mangle -F SS-UDP &>/dev/null
         iptables -t mangle -X SS-UDP &>/dev/null
 
         iptables -t mangle -N SS-UDP
-        iptables -t mangle -A SS-UDP -p udp -m set --match-set gfwlist dst -j TPROXY --tproxy-mark $iptables_pbr_fwmark --on-ip 127.0.0.1 --on-port 60080
+        iptables -t mangle -A SS-UDP -p udp -m set --match-set gfwlist dst -j TPROXY --tproxy-mark $iptables_pbr_fwmark --on-ip 127.0.0.1 --on-port $redir_port
 
         ip route add local 0/0 dev lo table $iptables_pbr_number
         ip rule add fwmark $iptables_pbr_fwmark table $iptables_pbr_number
@@ -858,6 +953,7 @@ function stop {
     pkill -9 '^chinadns$'
     pkill -9 '^dnsforwarder$'
 
+    pkill -9 '^v2ray$'
     pkill -9 '^ss-redir$'
     pkill -9 '^ss-tunnel$'
     pkill -9 '^ssr-redir$'
@@ -870,6 +966,31 @@ function stop {
 
 function status {
 case "$mode" in
+    v2ray_global)
+        echo "mode:           v2ray_global"
+        rport=${v2ray_redir#*:}; tport=${v2ray_tunnel#*:}
+        [ $(ss -lnpt | grep ":$rport\s" | wc -l) -ne 0 ] && echo -e "v2-redir/tcp       \e[32m[running]\e[0m" || echo -e "v2-redir/tcp       \e[35m[stopped]\e[0m"
+        [ $(ss -lnpu | grep ":$rport\s" | wc -l) -ne 0 ] && echo -e "v2-redir/udp       \e[32m[running]\e[0m" || echo -e "v2-redir/udp       \e[35m[stopped]\e[0m"
+        [ $(ss -lnpu | grep ":$tport\s" | wc -l) -ne 0 ] && echo -e "v2-tunnel/udp      \e[32m[running]\e[0m" || echo -e "v2-tunnel/udp      \e[35m[stopped]\e[0m"
+        [ $(pgrep -c '^dnsmasq$')                -ne 0 ] && echo -e "dnsmasq:           \e[32m[running]\e[0m" || echo -e "dnsmasq:           \e[35m[stopped]\e[0m"
+        ;;
+    v2ray_gfwlist)
+        echo "mode:          v2ray_gfwlist"
+        rport=${v2ray_redir#*:}; tport=${v2ray_tunnel#*:}
+        [ $(ss -lnpt | grep ":$rport\s" | wc -l) -ne 0 ] && echo -e "v2-redir/tcp       \e[32m[running]\e[0m" || echo -e "v2-redir/tcp       \e[35m[stopped]\e[0m"
+        [ $(ss -lnpu | grep ":$rport\s" | wc -l) -ne 0 ] && echo -e "v2-redir/udp       \e[32m[running]\e[0m" || echo -e "v2-redir/udp       \e[35m[stopped]\e[0m"
+        [ $(ss -lnpu | grep ":$tport\s" | wc -l) -ne 0 ] && echo -e "v2-tunnel/udp      \e[32m[running]\e[0m" || echo -e "v2-tunnel/udp      \e[35m[stopped]\e[0m"
+        [ $(pgrep -c '^dnsmasq$')                -ne 0 ] && echo -e "dnsmasq:           \e[32m[running]\e[0m" || echo -e "dnsmasq:           \e[35m[stopped]\e[0m"
+        ;;
+    v2ray_chnroute)
+        echo "mode:         v2ray_chnroute"
+        rport=${v2ray_redir#*:}; tport=${v2ray_tunnel#*:}
+        [ $(ss -lnpt | grep ":$rport\s" | wc -l) -ne 0 ] && echo -e "v2-redir/tcp       \e[32m[running]\e[0m" || echo -e "v2-redir/tcp       \e[35m[stopped]\e[0m"
+        [ $(ss -lnpu | grep ":$rport\s" | wc -l) -ne 0 ] && echo -e "v2-redir/udp       \e[32m[running]\e[0m" || echo -e "v2-redir/udp       \e[35m[stopped]\e[0m"
+        [ $(ss -lnpu | grep ":$tport\s" | wc -l) -ne 0 ] && echo -e "v2-tunnel/udp      \e[32m[running]\e[0m" || echo -e "v2-tunnel/udp      \e[35m[stopped]\e[0m"
+        [ $(pgrep -c '^chinadns$')               -ne 0 ] && echo -e "chinadns:          \e[32m[running]\e[0m" || echo -e "chinadns:          \e[35m[stopped]\e[0m"
+        [ $(pgrep -c '^dnsmasq$')                -ne 0 ] && echo -e "dnsmasq:           \e[32m[running]\e[0m" || echo -e "dnsmasq:           \e[35m[stopped]\e[0m"
+        ;;
     tproxy_global)
         echo "mode:          tproxy_global"
         if [ "$server_use_ssr" != 'true' ]; then

ss-tproxy.conf

@@ -1,79 +1,47 @@
 ## 代理模式
 #
-# tproxy_*: 利用 iptables (REDIRECT/TPROXY) 进行透明代理
-# tun2socks_*: 利用 tun 虚拟网卡 + tun2socks 进行透明代理
+# 因脚本不断的更新、改进，部分模式的命名可能不是很准确
+# ss-tproxy 脚本目前已支持 v2ray、ss/ssr、socks5 透明代理
+# 脚本不建议在 v2ray、ss/ssr、socks5 上配置 acl/pac 等过滤规则
+# 因为这些任务已经由 ss-tproxy 接手并处理了，但即使配置了也不影响
 #
-# global: 全局代理模式，所有网站都走代理隧道
-# gfwlist: gfwlist 模式，gfwlist 域名走代理，其余走直连
-# chnroute: chnroute 模式，大陆 IP 走直连，其余走代理隧道
+# global 模式：全部流量都走代理，不进行分流
+# gfwlist 模式：gfwlist 域名走代理，其他均走直连
+# chnonly 模式：chnlist 域名走代理，其他均走直连
+# chnroute 模式：chnroute 地址走直连，其他均走代理
 #
-# *_tcp: 针对不支持 udp relay 的 SS/SSR 的代理模式
-# 无 tcp 后缀的模式要求 SS/SSR 服务器支持 udp relay
+# chnonly 模式与 gfwlist 模式仅仅是域名列表不同，底层实现是完全相同的
+# 所以下面并没有单独分出 chnonly mode，你只需要选择对应的 gfwlist mode
 #
-# 相关依赖
-# tproxy_global:            ss/ssr-libev, haveged, xt_TPROXY, iproute2, dnsmasq
-# tproxy_gfwlist:           ss/ssr-libev, haveged, xt_TPROXY, iproute2, ipset, perl, dnsmasq
-# tproxy_chnroute:          ss/ssr-libev, haveged, xt_TPROXY, iproute2, ipset, chinadns, dnsmasq
-# tproxy_global_tcp:        ss/ssr-libev, haveged, dnsforwarder
-# tproxy_gfwlist_tcp:       ss/ssr-libev, haveged, ipset, perl, dnsmasq, dnsforwarder
-# tproxy_chnroute_tcp:      ss/ssr-libev, haveged, ipset, chinadns, dnsforwarder
-# tun2socks_global:         ss/ssr(版本不限), haveged, tun2socks, iproute2, dnsmasq
-# tun2socks_gfwlist:        ss/ssr(版本不限), haveged, tun2socks, iproute2, ipset, perl, dnsmasq
-# tun2socks_chnroute:       ss/ssr(版本不限), haveged, tun2socks, iproute2, ipset, chinadns, dnsmasq
-# tun2socks_global_tcp:     ss/ssr(版本不限), haveged, tun2socks, iproute2, dnsforwarder
-# tun2socks_gfwlist_tcp:    ss/ssr(版本不限), haveged, tun2socks, iproute2, ipset, perl, dnsmasq, dnsforwarder
-# tun2socks_chnroute_tcp:   ss/ssr(版本不限), haveged, tun2socks, iproute2, ipset, chinadns, dnsforwarder
-# (注: *gfwlist* 模式更新列表时依赖 curl、base64；*chnroute* 模式更新列表时依赖 curl；建议安装，以备不时之需)
+# tcponly 的 mode 表示仅代理 TCP 流量，不处理 UDP 流量，DNS 使用 TCP 方式解析
+# 这些 mode 主要用于不支持 udp relay 的 ss/ssr、socks5 代理（v2ray 没有此问题）
 #
-# 相关端口
-# tproxy_global:            ss-redir=60080, ss-tunnel=60053, dnsmasq=53
-# tproxy_gfwlist:           ss-redir=60080, ss-tunnel=60053, dnsmasq=53
-# tproxy_chnroute:          ss-redir=60080, ss-tunnel=60053, chinadns=65353, dnsmasq=53
-# tproxy_global_tcp:        ss-redir=60080, dnsforwarder=53
-# tproxy_gfwlist_tcp:       ss-redir=60080, dnsforwarder=60053, dnsmasq=53
-# tproxy_chnroute_tcp:      ss-redir=60080, dnsforwarder=60053, chinadns=65353, dnsforwarder=53
-# tun2socks_global:         dnsmasq=53
-# tun2socks_gfwlist:        dnsmasq=53
-# tun2socks_chnroute:       chinadns=60053, dnsmasq=53
-# tun2socks_global_tcp:     dnsforwarder=53
-# tun2socks_gfwlist_tcp:    dnsforwarder=60053, dnsmasq=53
-# tun2socks_chnroute_tcp:   dnsforwarder=60053, chinadns=65353, dnsforwarder=53
+# 关于代理模式的更多细节，请参考 README.md 或 https://www.zfl9.com/ss-redir.html
 #
-# 切换代理模式有两种方法：
-# 1. 将要启用的模式放到所有 mode 变量的后面
-# 2. 使用 # 注释其它模式，保留要启用的 mode
-#
-#mode='tproxy_global'           # tproxy 全局模式
-#mode='tproxy_global_tcp'       # tproxy 全局模式 (tcponly)
-#mode='tproxy_gfwlist'          # tproxy gfwlist 模式
-#mode='tproxy_gfwlist_tcp'      # tproxy gfwlist 模式 (tcponly)
-mode='tproxy_chnroute'          # tproxy chnroute 模式
-#mode='tproxy_chnroute_tcp'     # tproxy chnroute 模式 (tcponly)
-#mode='tun2socks_global'        # tun2socks 全局模式
-#mode='tun2socks_global_tcp'    # tun2socks 全局模式 (tcponly)
-#mode='tun2socks_gfwlist'       # tun2socks gfwlist 模式
-#mode='tun2socks_gfwlist_tcp'   # tun2socks gfwlist 模式 (tcponly)
-#mode='tun2socks_chnroute'      # tun2socks chnroute 模式
-#mode='tun2socks_chnroute_tcp'  # tun2socks chnroute 模式 (tcponly)
-
-## socks5 配置
-# 适用于 tun2socks_* 模式
-socks5_listen='127.0.0.1:1080'  # socks5 本地监听地址
-socks5_remote='node.proxy.net'  # socks5 服务器的地址
-# 启动 socks5 代理的命令行，必须在后台运行，不能占用前台，根据实际情况修改
-# 如果使用非 *_tcp 模式，请确保该 socks5 代理的 udp relay 已开启，否则无法解析 DNS
-socks5_runcmd='nohup ss-local -c /etc/ss/ss-local.json </dev/null &>>/var/log/ss-local.log &'
-#socks5_runcmd='ssh -CNf -D 0.0.0.0:1080 user@node.proxy.net'   # 仅限 tun2socks*tcp 模式
-#socks5_runcmd='service shadowsocks-libev start'                # 通过 service 命令启动
-#socks5_runcmd='systemctl start shadowsocks-libev.service'      # 通过 systemctl 命令启动
+#mode='v2ray_global'            # v2ray  global   模式
+#mode='v2ray_gfwlist'           # v2ray  gfwlist  模式
+#mode='v2ray_chnroute'          # v2ray  chnroute 模式
+#mode='tproxy_global'           # ss/ssr global   模式
+#mode='tproxy_gfwlist'          # ss/ssr gfwlist  模式
+mode='tproxy_chnroute'          # ss/ssr chnroute 模式
+#mode='tproxy_global_tcp'       # ss/ssr global   模式 (tcponly)
+#mode='tproxy_gfwlist_tcp'      # ss/ssr gfwlist  模式 (tcponly)
+#mode='tproxy_chnroute_tcp'     # ss/ssr chnroute 模式 (tcponly)
+#mode='tun2socks_global'        # socks5 global   模式
+#mode='tun2socks_gfwlist'       # socks5 gfwlist  模式
+#mode='tun2socks_chnroute'      # socks5 chnroute 模式
+#mode='tun2socks_global_tcp'    # socks5 global   模式 (tcponly)
+#mode='tun2socks_gfwlist_tcp'   # socks5 gfwlist  模式 (tcponly)
+#mode='tun2socks_chnroute_tcp'  # socks5 chnroute 模式 (tcponly)
 
-## tun2socks 配置
-# 适用于 tun2socks_* 模式
-tun2socks_tundev="tun0"                 # tun 网卡
-tun2socks_address="10.0.0.1"            # 接口地址
-tun2socks_gateway="10.0.0.254"          # 网关地址
-tun2socks_netmask="255.255.255.0"       # 网络掩码
-tun2socks_log='/var/log/tun2socks.log'  # 日志文件
+## v2ray 配置
+# 适用于 v2ray_* 模式
+# redir  地址即 v2ray "inbound" -> "dokodemo-door" -> "followRedirect=true"  的监听地址
+# tunnel 地址即 v2ray "inbound" -> "dokodemo-door" -> "followRedirect=false" 的监听地址
+v2ray_server='node.proxy.net'        # v2ray 服务器地址
+v2ray_redir='127.0.0.1:60080'        # v2ray redir 地址
+v2ray_tunnel='127.0.0.1:60053'       # v2ray tunnel 地址
+v2ray_runcmd='systemctl start v2ray' # 启动 v2ray 的命令
 
 ## ss/ssr 配置
 # 适用于 tproxy_* 模式
@@ -98,6 +66,26 @@ redir_log='/var/log/ss-redir.log'   # 日志文件路径
 tunnel_verbose='false'              # 记录详细日志
 tunnel_log='/var/log/ss-tunnel.log' # 日志文件路径
 
+## socks5 配置
+# 适用于 tun2socks_* 模式
+socks5_listen='127.0.0.1:1080'       # socks5 本地监听地址
+socks5_remote='node.proxy.net'       # socks5 服务器的地址
+# 启动 socks5 代理的命令行，必须在后台运行，不能占用前台，请根据实际情况进行修改
+# 如果使用非 *_tcp 模式，请确保该 socks5 代理的 udp relay 已开启，否则无法解析 DNS
+socks5_runcmd='nohup ss-local -c /etc/ss-local.json </dev/null &>>/var/log/ss-local.log &'
+#socks5_runcmd='service shadowsocks-libev start'                # 通过 service 命令启动
+#socks5_runcmd='systemctl start shadowsocks-libev.service'      # 通过 systemctl 命令启动
+#socks5_runcmd='ssh -CNf -D 0.0.0.0:1080 user@node.proxy.net'   # 仅限使用 tun2socks*tcp 模式
+#socks5_runcmd='systemctl start v2ray.service'                  # 代理至 v2ray 的 socks5 监听端口
+
+## tun2socks 配置
+# 适用于 tun2socks_* 模式
+tun2socks_tundev="tun0"                 # tun 网卡
+tun2socks_address="10.0.0.1"            # 接口地址
+tun2socks_gateway="10.0.0.254"          # 网关地址
+tun2socks_netmask="255.255.255.0"       # 网络掩码
+tun2socks_log='/var/log/tun2socks.log'  # 日志文件
+
 ## dnsmasq 配置
 # 根据模式选择使用
 dnsmasq_gfwlist='/etc/tproxy/gfwlist.txt'       # gfwlist 域名文件