一行配置都没手敲：用 Claude Code 从零搭一套 sing-box 代理（VLESS Reality + Hysteria2）

Host yt-demo
    HostName 203.0.113.10
    User ubuntu
    IdentityFile ~/.ssh/yt-demo.pem

sudo mkdir -p /etc/apt/keyrings
sudo curl -fsSL https://sing-box.app/gpg.key -o /etc/apt/keyrings/sagernet.asc
sudo chmod a+r /etc/apt/keyrings/sagernet.asc
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/sagernet.asc] https://deb.sagernet.org/ * *" \
  | sudo tee /etc/apt/sources.list.d/sagernet.list
sudo apt-get update
sudo apt-get install sing-box

sing-box version

curl -so /dev/null --tlsv1.3 --http2 \
  -w '%{http_version}  connect=%{time_connect}s\n' \
  https://addons.mozilla.org

sing-box generate uuid              # UUID
sing-box generate reality-keypair   # PrivateKey 放服务端，PublicKey 给客户端
sing-box generate rand 8 --hex      # short ID

{
  "log": { "level": "warn" },
  "inbounds": [
    {
      "type": "vless",
      "tag": "vless-in",
      "listen": "::",
      "listen_port": 443,
      "users": [
        { "uuid": "9bf3fe50-b240-4431-b355-52000d20c45e", "flow": "xtls-rprx-vision" }
      ],
      "tls": {
        "enabled": true,
        "server_name": "addons.mozilla.org",
        "reality": {
          "enabled": true,
          "handshake": { "server": "addons.mozilla.org", "server_port": 443 },
          "private_key": "SKrVhmmC4Dl-IV0tVUQqND8vW8o7j0bmS59s8zuYBVI",
          "short_id": ["d0902526d9e9ea13"]
        }
      }
    }
  ],
  "outbounds": [
    { "type": "direct", "tag": "direct" }
  ]
}

sudo sing-box check -c /etc/sing-box/config.json
sudo systemctl enable --now sing-box
sudo systemctl restart sing-box

# 开启 BBR（写进 sysctl.d，重启后仍然有效）
echo -e "net.core.default_qdisc=fq\nnet.ipv4.tcp_congestion_control=bbr" \
  | sudo tee /etc/sysctl.d/99-bbr.conf
sudo sysctl --system

# 验证
sysctl net.ipv4.tcp_congestion_control   # 应输出 bbr
systemctl is-enabled sing-box            # 应输出 enabled

mixed-port: 7897
mode: rule
ipv6: false

geodata-mode: true
geo-auto-update: true

dns:
  enable: true
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  default-nameserver:
    - 223.5.5.5
    - 119.29.29.29
  nameserver:
    - https://dns.alidns.com/dns-query
    - https://doh.pub/dns-query
  nameserver-policy:
    "geosite:geolocation-!cn":
      - https://1.1.1.1/dns-query
      - https://8.8.8.8/dns-query

proxies:
  - name: yt-demo
    type: vless
    server: 203.0.113.10
    port: 443
    uuid: 9bf3fe50-b240-4431-b355-52000d20c45e
    network: tcp
    udp: true
    tls: true
    flow: xtls-rprx-vision
    servername: addons.mozilla.org
    client-fingerprint: chrome
    reality-opts:
      public-key: I1K-2DVvKABMnBwW-dnr6Y06f1m9spNipAoLhpqy3Ck
      short-id: d0902526d9e9ea13

  - name: yt-demo-hy2
    type: hysteria2
    server: 203.0.113.10
    port: 443
    password: ciVyTAZwk6qsexHDke4CcM0K
    sni: addons.mozilla.org
    alpn:
      - h3
    # 自签证书，用指纹锁定，不是无条件跳过校验
    fingerprint: 0e64804c1e0bdfdc1630560a32f9fd255119e82772e97d55b92663af61672944

proxy-groups:
  - name: Proxy
    type: select
    proxies:
      - yt-demo
      - yt-demo-hy2
      - DIRECT

rules:
  - GEOSITE,private,DIRECT
  - GEOIP,private,DIRECT,no-resolve
  - GEOSITE,category-ads-all,REJECT
  - GEOSITE,cn,DIRECT
  - GEOIP,CN,DIRECT
  - MATCH,Proxy

# 能看到失败记录，说明日志是 sshd-session 写的
sudo journalctl _COMM=sshd-session | grep -i "invalid user\|failed" | tail -5
# 这条如果几乎没有输出，就说明默认规则会漏掉它们
sudo journalctl _COMM=sshd | grep -i "invalid user\|failed" | tail -5

# /etc/fail2ban/filter.d/sshd.local
[Init]
journalmatch = _COMM=sshd + _COMM=sshd-session

# /etc/fail2ban/jail.local
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 198.51.100.20

[sshd]
enabled  = true
backend  = systemd
findtime = 10m
maxretry = 3
bantime  = 1h

# 一天内被封过多次的 IP，直接封一周
[recidive]
enabled  = true
findtime = 1d
maxretry = 3
bantime  = 1w

sudo systemctl restart fail2ban
sudo fail2ban-client status sshd   # 看 Total failed 是否在增长

{
  "type": "hysteria2",
  "tag": "hy2-in",
  "listen": "::",
  "listen_port": 443,
  "users": [
    { "password": "ciVyTAZwk6qsexHDke4CcM0K" }
  ],
  "tls": {
    "enabled": true,
    "alpn": ["h3"],
    "certificate_path": "/etc/sing-box/hy2.crt",
    "key_path": "/etc/sing-box/hy2.key"
  }
}

sudo openssl req -x509 -nodes -days 3650 \
  -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \
  -keyout /etc/sing-box/hy2.key -out /etc/sing-box/hy2.crt \
  -subj "/CN=addons.mozilla.org"

# 客户端 fingerprint 字段要的 SHA-256 指纹（去掉冒号、转小写）
openssl x509 -in /etc/sing-box/hy2.crt -noout -fingerprint -sha256 \
  | cut -d= -f2 | tr -d ':' | tr 'A-F' 'a-f'

# 服务器上
sudo tcpdump -ni any udp port 443

# 本地
echo test | nc -u -w1 203.0.113.10 443

echo -e "net.core.rmem_max=16777216\nnet.core.wmem_max=16777216" \
  | sudo tee /etc/sysctl.d/99-udp-buffer.conf
sudo sysctl --system
sudo systemctl restart sing-box

{
  "log": { "level": "warn", "timestamp": true },
  "inbounds": [
    {
      "type": "vless",
      "tag": "vless-in",
      "listen": "::",
      "listen_port": 443,
      "users": [
        { "name": "yt-demo", "uuid": "9bf3fe50-b240-4431-b355-52000d20c45e", "flow": "xtls-rprx-vision" }
      ],
      "tls": {
        "enabled": true,
        "server_name": "addons.mozilla.org",
        "reality": {
          "enabled": true,
          "handshake": { "server": "addons.mozilla.org", "server_port": 443 },
          "private_key": "SKrVhmmC4Dl-IV0tVUQqND8vW8o7j0bmS59s8zuYBVI",
          "short_id": ["d0902526d9e9ea13"]
        }
      }
    },
    {
      "type": "hysteria2",
      "tag": "hy2-in",
      "listen": "::",
      "listen_port": 443,
      "users": [
        { "name": "yt-demo", "password": "ciVyTAZwk6qsexHDke4CcM0K" }
      ],
      "tls": {
        "enabled": true,
        "server_name": "addons.mozilla.org",
        "alpn": ["h3"],
        "certificate_path": "/etc/sing-box/hy2.crt",
        "key_path": "/etc/sing-box/hy2.key"
      }
    }
  ],
  "outbounds": [
    { "type": "direct", "tag": "direct" }
  ]
}

sudo sing-box check -c /etc/sing-box/config.json && sudo systemctl restart sing-box
sudo ss -tulnp | grep 443   # 应同时看到 tcp 和 udp 两行