客户端 (网关/DNS → 本机)
  │
  ├─ DNS 查询 (UDP 53)
  │   └─ dnsmasq → 10.10.10.2 (sing-box DNS 模块)
  │       ├─ geosite-cn 命中 → 223.5.5.5 直连解析
  │       └─ 其他域名 → tcp://8.8.8.8 通过 SS 解析
  │
  └─ TCP/UDP 数据
      └─ 路由 → tun0 (sing-box TUN)
          ├─ geoip-cn 命中 → direct 直连
          ├─ geosite-cn 命中 → direct 直连
          ├─ 私有 IP → direct 直连
          └─ 其余 → Shadowsocks 出站

传输单个文件
ssh root@172.20.6.217 'cat /root/deploy.sh' > deploy.sh

多文件打包传输
ssh root@172.20.6.217 'tar czf - -C /root deploy.sh troubleshoot.sh transparent-proxy-deploy.md' > r3g-backup.tar.gz

cat /etc/openwrt_release    # DISTRIB_ARCH 决定用什么架构的 sing-box
uname -r                    # 内核版本
ip addr show                # 网络接口名和 IP
ip route show               # 默认网关
df -h /                     # 可用空间

apk add kmod-tun kmod-nf-tproxy kmod-nft-tproxy
modprobe tun nf_tproxy nft_tproxy

# x86_64
https://github.com/SagerNet/sing-box/releases/download/v1.11.9/sing-box-1.11.9-linux-amd64.tar.gz

# MIPS (mipsel_24kc / 1004Kc 软浮点)
https://github.com/SagerNet/sing-box/releases/download/v1.11.9/sing-box-1.11.9-linux-mipsle-softfloat.tar.gz

chmod 755 /usr/local/bin/sing-box
/usr/local/bin/sing-box version   # 确认可执行

mkdir -p /etc/sing-box

# geoip-cn.srs（大陆 IP 段，约 34KB）
wget -O /etc/sing-box/geoip-cn.srs \
  https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs

# geosite-cn.srs（大陆域名列表，约 49KB）
wget -O /etc/sing-box/geosite-cn.srs \
  https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-cn.srs

listen-address=127.0.0.1
listen-address=172.20.6.217
bind-interfaces
server=10.10.10.2
server=/yview.cn/172.20.2.113
cache-size=2048
no-resolv
filter-AAAA

chmod 755 /etc/init.d/sing-box
/etc/init.d/sing-box enable

/etc/init.d/dnsmasq disable
rm -f /etc/rc.d/S*dnsmasq*

echo 1 > /proc/sys/net/ipv4/ip_forward
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf

chmod 755 /usr/local/bin/update-geo.sh
echo "17 03 * * * /usr/local/bin/update-geo.sh" >> /etc/crontabs/root

/etc/init.d/sing-box start

ps | grep -E "sing-box|dnsmasq"

ip addr show tun0

ip rule show | grep 8999

nslookup www.baidu.com 127.0.0.1    # 应返回大陆 IP，如 180.101.x.x
nslookup www.google.com 127.0.0.1   # 应返回海外真实 IP，如 142.251.x.x

cat /tmp/sing-box.log

curl -vvv https://www.baidu.com/    # 应正常返回
curl -vvv https://www.google.com/   # 应正常返回

/etc/init.d/sing-box start
/etc/init.d/sing-box stop
/etc/init.d/sing-box restart

cat /tmp/sing-box.log

ip rule add to SS服务器IP/32 table main priority 8999
ip rule add to DNS服务器IP/32 table main priority 8999

server=/yview.cn/内网DNS的IP

sh /root/troubleshoot.sh

# TUN 残留导致启动失败
ip link del tun0 && /etc/init.d/sing-box start

# bypass 路由丢失
ip rule add to SS的IP/32 table main priority 8999

# 完全重装
sh /root/deploy.sh

#!/bin/sh
# MIPS (ramips/mt7621) 透明代理一键部署
# 旁路由模式, 流量进出 br-wan

SS_SERVER="XX.XX.XX.XX"
SS_PORT="XXX"
SS_PASSWORD="XXX"
SS_METHOD="XXXX"
SING_BOX_VER="1.11.9"
SING_ARCH="linux-mipsle-softfloat"
TUN_ADDR="10.10.10.1/30"
WAN_IF="br-wan"

set -e
echo "========================================"
echo " MIPS 透明代理部署"
echo " sing-box ${SING_BOX_VER} ${SING_ARCH}"
echo "========================================"

echo "[1/8] 内核模块..."
apk add kmod-tun kmod-nf-tproxy kmod-nft-tproxy 2>&1 | tail -1
modprobe tun nf_tproxy nft_tproxy 2>/dev/null

echo "[2/8] sing-box..."
mkdir -p /usr/local/bin /var/cache/sing-box /etc/sing-box
if [ -x /usr/local/bin/sing-box ]; then
    echo "  已安装"
else
    URL="https://github.com/SagerNet/sing-box/releases/download/v${SING_BOX_VER}/sing-box-${SING_BOX_VER}-${SING_ARCH}.tar.gz"
    wget -q --timeout=30 -O /tmp/sb.tar.gz "$URL" || {
        echo "下载失败! 手动下载 $URL"
        exit 1
    }
    cd /tmp && tar xzf sb.tar.gz && cp sing-box-*/sing-box /usr/local/bin/
    chmod 755 /usr/local/bin/sing-box
    rm -rf /tmp/sb.tar.gz /tmp/sing-box-*
fi

echo "[3/8] geo 规则..."
for f in geoip-cn.srs geosite-cn.srs; do
    repo="sing-geoip"; [ "$f" = "geosite-cn.srs" ] && repo="sing-geosite"
    wget -q --timeout=15 -O /etc/sing-box/$f \
      "https://raw.githubusercontent.com/SagerNet/${repo}/rule-set/${f}" 2>/dev/null
done

echo "[4/8] 配置..."
WAN_IP=$(ip addr show $WAN_IF | grep "inet " | awk '{print $2}' | cut -d/ -f1)
cat > /etc/sing-box/config.json << EOF
{"log":{"level":"info","timestamp":true},"dns":{"servers":[{"tag":"dns-direct","address":"223.5.5.5","detour":"direct"},{"tag":"dns-remote","address":"tcp://8.8.8.8","detour":"ss-out"}],"rules":[{"rule_set":"geosite-cn","server":"dns-direct"}],"final":"dns-remote","strategy":"ipv4_only"},"inbounds":[{"type":"tun","tag":"tun-in","interface_name":"tun0","mtu":1500,"address":["${TUN_ADDR}"],"auto_route":true,"strict_route":true,"sniff":true,"sniff_override_destination":false}],"outbounds":[{"type":"dns","tag":"dns-out"},{"type":"shadowsocks","tag":"ss-out","server":"${SS_SERVER}","server_port":${SS_PORT},"password":"${SS_PASSWORD}","method":"${SS_METHOD}"},{"type":"direct","tag":"direct"}],"route":{"rule_set":[{"tag":"geoip-cn","type":"local","format":"binary","path":"/etc/sing-box/geoip-cn.srs"},{"tag":"geosite-cn","type":"local","format":"binary","path":"/etc/sing-box/geosite-cn.srs"}],"rules":[{"protocol":"dns","outbound":"dns-out"},{"ip_is_private":true,"outbound":"direct"},{"rule_set":"geoip-cn","outbound":"direct"},{"rule_set":"geosite-cn","outbound":"direct"}],"final":"ss-out","auto_detect_interface":true},"experimental":{"cache_file":{"enabled":false}}}
EOF

echo "[5/8] init 脚本..."
cat > /etc/init.d/sing-box << 'INITEOF'
#!/bin/sh /etc/rc.common
START=95
USE_PROCD=1
PROG=/usr/local/bin/sing-box
CONFIG=/etc/sing-box/config.json
boot() { start; }
start_service() {
    mkdir -p /var/cache/sing-box
    ip link del tun0 2>/dev/null
    sleep 1
    WAN_IP=$(ip addr show br-wan | grep "inet " | awk '{print $2}' | cut -d/ -f1)
    cat > /etc/dnsmasq-proxy.conf << EOF
listen-address=127.0.0.1
listen-address=${WAN_IP}
bind-interfaces
server=10.10.10.2
    server=/yview.cn/172.20.2.113
cache-size=2048
no-resolv
filter-AAAA
EOF
    for ip in XX.XX.XX.XX 223.5.5.5 172.20.2.113; do
        ip rule add to ${ip}/32 table main priority 8999 2>/dev/null || true
    done
    killall dnsmasq 2>/dev/null; sleep 1
    dnsmasq -C /etc/dnsmasq-proxy.conf
    procd_open_instance
    procd_set_param command /bin/sh -c "$PROG run -c $CONFIG > /tmp/sing-box.log 2>&1"
    procd_set_param respawn
    procd_close_instance
}
stop_service() { killall sing-box dnsmasq; ip link del tun0 2>/dev/null; }
INITEOF
chmod 755 /etc/init.d/sing-box

echo "[6/8] geo 更新..."
cat > /usr/local/bin/update-geo.sh << 'SCRIPT'
#!/bin/sh
for f in geoip-cn.srs geosite-cn.srs; do
    repo="sing-geoip"; [ "$f" = "geosite-cn.srs" ] && repo="sing-geosite"
    wget -q --timeout=15 -O "/etc/sing-box/$f.new" \
      "https://raw.githubusercontent.com/SagerNet/${repo}/rule-set/${f}" && \
      [ -s "/etc/sing-box/$f.new" ] && mv "/etc/sing-box/$f.new" "/etc/sing-box/$f"
done
/etc/init.d/sing-box restart 2>/dev/null
SCRIPT
chmod 755 /usr/local/bin/update-geo.sh
grep -q update-geo /etc/crontabs/root 2>/dev/null || \
  echo "17 03 * * * /usr/local/bin/update-geo.sh" >> /etc/crontabs/root

echo "[7/8] IP 转发..."
echo 1 > /proc/sys/net/ipv4/ip_forward
grep -q ip_forward /etc/sysctl.conf 2>/dev/null || echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf

echo "[8/8] 启动..."
/etc/init.d/dnsmasq disable 2>/dev/null; rm -f /etc/rc.d/S*dnsmasq*
/etc/init.d/sing-box enable 2>/dev/null
killall sing-box dnsmasq 2>/dev/null; ip link del tun0 2>/dev/null; sleep 1
/etc/init.d/sing-box start 2>&1; sleep 3

echo ""
echo "========================================"
echo " 部署完成"
echo " sing-box: $(pgrep sing-box|xargs)  dnsmasq: $(pgrep dnsmasq|xargs)"
echo " TUN: $(ip addr show tun0 2>/dev/null|grep 'inet '|awk '{print $2}')"
echo " 客户端: 网关+DNS = $(ip addr show br-wan|grep 'inet '|awk '{print $2}'|cut -d/ -f1)"
echo "========================================"

#!/bin/sh
#=============================================================================
# 透明代理故障诊断脚本
# 用法: sh /root/troubleshoot.sh
#=============================================================================

echo "========================================"
echo " 透明代理诊断报告"
echo " 时间: $(date)"
echo "========================================"

ERRORS=0

check() {
    local desc="$1"
    local cmd="$2"
    printf "%-50s" "  $desc..."
    if eval "$cmd" > /dev/null 2>&1; then
        echo "✓"
    else
        echo "✗ 故障"
        ERRORS=$((ERRORS + 1))
    fi
}

info() {
    local desc="$1"
    local cmd="$2"
    echo ""
    echo "--- $desc ---"
    eval "$cmd" 2>&1
}

# ============================================================
# 1. 基础连通性
# ============================================================
echo ""
echo "【1】基础连通性"

check "本机默认路由" "ip route show | grep -q default"
info "路由表" "ip route show | grep -E 'default|eth0|tun0'"

check "网关可达" "ping -c 1 -W 2 172.20.6.217 > /dev/null 2>&1"
check "DNS 223.5.5.5 可达" "ping -c 1 -W 2 223.5.5.5 > /dev/null 2>&1"

# ============================================================
# 2. 进程状态
# ============================================================
echo ""
echo "【2】进程状态"

check "sing-box 运行中" "pgrep sing-box > /dev/null 2>&1"
check "dnsmasq 运行中" "pgrep dnsmasq > /dev/null 2>&1"

info "进程详情" "ps | grep -E 'sing-box|dnsmasq' | grep -v grep"

# ============================================================
# 3. 端口监听
# ============================================================
echo ""
echo "【3】端口监听"

check "DNS 53 端口" "netstat -tlnp 2>/dev/null | grep -q ':53 '"
info "监听端口" "netstat -tlnp 2>/dev/null | grep -E ':53 |:41643'"

# ============================================================
# 4. TUN 接口
# ============================================================
echo ""
echo "【4】TUN 接口"

check "tun0 存在" "ip link show tun0 > /dev/null 2>&1"
info "TUN 详情" "ip addr show tun0 2>&1"

# ============================================================
# 5. 路由规则
# ============================================================
echo ""
echo "【5】路由规则"

check "SS 绕过规则" "ip rule show 2>&1 | grep -q 'XX.XX.XX.XX'"
check "DNS 绕过规则" "ip rule show 2>&1 | grep -q '223.5.5.5'"

info "策略路由" "ip rule show 2>&1 | grep -E '8999|2022|2023|2024'"

# ============================================================
# 6. DNS 解析测试
# ============================================================
echo ""
echo "【6】DNS 解析"

info "百度 (应返回国内IP)" "nslookup www.baidu.com 127.0.0.1 2>&1 | grep -E 'Address: [0-9]+\.'"
info "Google (应返回海外IP, 非CDN)" "nslookup www.google.com 127.0.0.1 2>&1 | grep -E 'Address: [0-9]+\.'"

# ============================================================
# 7. sing-box 日志
# ============================================================
echo ""
echo "【7】sing-box 日志 (最近 20 行)"

# procd 管理的服务日志通过 logread 查看
if which logread > /dev/null 2>&1; then
    logread -e sing-box | tail -20
elif [ -f /tmp/sing-box.log ]; then
    tail -20 /tmp/sing-box.log
else
    echo "  无日志 (检查: logread -e sing-box)"
fi

# 错误统计
echo ""
info "错误/超时统计" "logread -e sing-box 2>/dev/null | grep -iE 'error|fatal|timeout|deadline' | tail -10 || echo '无错误'"

# ============================================================
# 8. 连接测试
# ============================================================
echo ""
echo "【8】TCP 连接测试"

# ============================================================
# 9. IP 转发
# ============================================================
echo ""
echo "【9】IP 转发"

info "转发状态" "cat /proc/sys/net/ipv4/ip_forward"

# ============================================================
# 10. 连接跟踪 (SS 连接)
# ============================================================
echo ""
echo "【10】Shadowsocks 连接"

info "到 SS 服务器的连接" "cat /proc/net/nf_conntrack 2>/dev/null | grep 'XX.XX.XX.XX' | tail -5"

# ============================================================
# 11. 磁盘空间
# ============================================================
echo ""
echo "【11】磁盘空间"

info "空间" "df -h /"

# ============================================================
# 汇总
# ============================================================
echo ""
echo "========================================"
if [ $ERRORS -eq 0 ]; then
    echo " 诊断结果: 全部通过 ✓"
else
    echo " 诊断结果: $ERRORS 项异常, 请检查上方 ✗ 项"
fi

echo ""
echo " 快速修复命令:"
echo "   /etc/init.d/sing-box restart"
echo ""
echo " 日志位置:"
echo "   /tmp/sing-box.log        sing-box 日志"
echo "   /var/log/dnsmasq.log     DNS 日志"
echo ""
echo " 配置文件:"
echo "   /etc/sing-box/config.json"
echo "   /etc/dnsmasq.conf"
echo "   /etc/init.d/sing-box"
echo "========================================"