R6250+tomato+ssserver+softether+ssr, 2.4G穩定

bunch

前果排因為懶得搞SS SERVER而走去刷MERLIN
不過2.4G一直都斷下斷下(衰在我有幾部野係用2.4G)
但DDWRT又慢, 原廠FIRMWARE直頭冇野玩
最近見有人REPORT話最新版TOMATO夾R6250終於唔斷WIFI就走去試喇
其實下面個方法係任何機行TOMATO都得, 只係要搵返適合自己部機粒U既IPK
(可以睇睇入面有冇你要既野)

事前軟件準備:
1. putty
2. WINSCP(怕之後落黎要響ENTWARE裝既野有問題而備用)
3. IPK&SH, 要黎做後備, 驚之後要用既IPK同SH攞唔到而準備既
4. SoftEther VPN Server Manager, 唔知點解ddns之類個setting佢又食到, 但HUB同BRIDGE之類又整極都食唔到
如果你刷左其他FIRMWARE, 例如MERLIN, 點刷返原廠可以之後再問, 我暫時以原廠FIRMWARE為前題
原廠刷TOMATO我只輕輕帶過:

1. 先刷tomato-R6250-initial.chk
2. 等5分鐘之後督住機背RESET制30秒再放, 進行HARD RESET
3. 再刷tomato-R6250-ARM--140-AIO-64K.trx, 以防萬一講一次, tomato default 係id=root, pw=admin
4. 再次進行hard reset
5. basic setting之類隨意
6. 確認Administrtation->Admin Access入面既SSH Daemon係開住既
7. 要CTF就去Administrtation->Miscellaneous
8. 去Administration->JFFS度ENABLE左JFFS, 然後FORMAT, 等60秒之後, 應該會話FAIL, 唔怕既, RESTART就得
9. 需要2.4G同5G channel冇限制就用putty入下面既野
a. 放2.4G

1. nvram set pci/1/1/ccode=#a
   
2. nvram set pci/1/1/regrev=0
   
3. nvram set regulation_domain=#a
   
4. nvram set wl0_country=#a
   
5. nvram set wl0_country_code=#a
   
6. nvram set wl0_country_rev=0
   
7. nvram set wl0_reg_mode=off
   
8. nvram commit
   
9. reboot

複製代碼

b. 放5G

1. nvram set pci/2/1/ccode=#a
   
2. nvram set pci/2/1/regrev=0
   
3. nvram set regulation_domain_5G=#a
   
4. nvram set wl1_country=#a
   
5. nvram set wl1_country_code=#a
   
6. nvram set wl1_country_rev=0
   
7. nvram set wl1_reg_mode=off
   
8. nvram commit
   
9. reboot

複製代碼

當然NVRAM COMMIT同REBOOT可以兩個都做完先再行

PART1. 裝ENTWARE-NG
1. 用PUTTY入ROUTER(TELNET定SSH自己選擇, LOGIN ID同PASSWORD睇你自己有冇改過)
2. 一句句輸入下面既野

1. cd /jffs
   
2. mkdir opt
   
3. mount -o bind /jffs/opt /opt
   
4. wget http://pkg.entware.net/binaries/armv7/installer/entware_install.sh
   
5. chmod +x entware_install.sh
   
6. ./entware_install.sh
   
7. rm ./entware_install.sh

複製代碼

TOUCHWOOD果個SH FILE真係冇左, 咁就用WINSCP放我果個落JFFS度, SKIP左WGET果句就得
3.Tomato Web UI, Administration->Scripts->INIT度加下面呢段(等佢STARTUP時自動著返ENTWARE)

1. mount -o bind /jffs/opt /opt
   
2. /opt/etc/init.d/rc.unslung start

複製代碼

PART2. 裝SS-SERVER
呢部份參考左唔少upi兄呢編
雖然OPENWRT-DIST有shadowsocks-libev, 但果個冇SS-SERVER, 所以要另外隊
1. 都係入PUTTY一句句黎

1. cd /jffs
   
2. opkg install shadowsocks-libev
   
3. wget http://pkg.entware.net/binaries/armv7/archive/shadowsocks-libev_2.6.1-1_armv7soft.ipk
   
4. opkg --force-downgrade install shadowsocks-libev_2.6.1-1_armv7soft.ipk
   
5. rm ./shadowsocks-libev_2.6.1-1_armv7soft.ipk

複製代碼

假如條LINK唔得你就用我SHARE左果個, 同樣地SKIP WGET就得
2. 之後你可以用VI COMMND去睇 /opt/etc/shadowsocks.json
我自己係用WINSCP去改既

1. {
   
2.     "server":"0.0.0.0",
   
3.     "server_port":443,
   
4.     "local_port":1080,
   
5.     "password":"please_change",
   
6.     "timeout":60,
   
7.     "method":"chacha20-ietf"
   
8. }

複製代碼

解說: SERVER設做0.0.0.0就係SERVER MODE
SERVER_PORT, 既然想要佢盡最大可能穿牆, 當然係443(但係SET其他都冇問題既)
   注意一點, SS用左443既話OPENVPN係用唔到既, 即使係用SOFTETHER包住
LOCAL_PORT, 都係隨便, 原本用1080我就KEEP住
METHOD: ENCRYPTION METHOD, 我自己用開CHACHA, 你可以用AES-256-CFB, 睇你部電話夠唔夠PROCESSING POWER
3. 去返TOMATO WEB UI, Administration->Scripts
4. FIREWALL加下面呢段(開PORT)

1. iptables -A INPUT -p tcp -s 0/0 --dport 443 -j ACCEPT
   
2. iptables -A OUTPUT -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT

複製代碼

PORT方面睇你用左咩PORT, 我用443就寫443
5. RESTART ROUTER
6. 再之用PUTTY入ROUTER
7.

1. ss-server -c /opt/etc/shadowsocks.json -v

複製代碼

之後試下電話可唔可以經SS-SERVER入去ROUTER, 正常既話PUTTY會見到有CONNECTION
8. 成功就CTRL+C停左佢
9. 去返去返TOMATO WEB UI, Administration->Scripts->INIT加

1. ss-server -c /opt/etc/shadowsocks.json -u

複製代碼

-U係代表用UDP轉發, 否則個DNS會亂七八糟
10. PORT FORWARD果度加返PORT 443(其實可以唔洗, 只係我習慣加埋方便射去第二度做SERVER)

到此SS部份完成, 唔需要SOFTETHER既就跳過下面喇

PART3. SOFTETHER(呢部份係參考HQT, 但我有改少少)
** 仲摸緊ENTWARE-NG入面果個, 但係用COMMAND食CONFIG FILE時得時唔得, 暫時保留舊版

1. 入PUTTY一句句打

1. cd /opt/etc
   
2. wget -c -O SoftEtherVPN-4.20-9608-rtm-arm.tgz goo.gl/DTkk3C
   
3. tar xvzf ./SoftEtherVPN-4.20-9608-rtm-arm.tgz
   
4. rm ./SoftEtherVPN-4.20-9608-rtm-arm.tgz

複製代碼

同樣地, DL唔到就用我BACKUP左果個
2.

1. /opt/etc/init.d/S80softethervpnserver start

複製代碼

3. 用WINDOWS個TOOLS唔知點解時得時唔得(即使係整完用VPNCMD食CONFIG, 甚至放埋去INIT都係一時時)

1. /opt/etc/softethervpn/vpncmd
   
2. 1
   
3. localhost:5555
   
4. 唔打野直接CLICK "ENTER"

複製代碼

因為我SS食左PORT 443, 所以用PORT 5555入去
4. 設定SERVER PASSWORD(set_password自己改)

1. ServerPasswordSet
   
2. set_password
   
3. set_password

複製代碼

5. 整VERTUAL HUB(名我用VPN, 你地自行改, PASSWORD都係)

1. HubCreate VPN
   
2. set_password2
   
3. set_password2

複製代碼

6. 入去設定HUB同USER(VPN睇你頭先改左咩名, user1自己改名, 呢個係OPENVPN, L2TP, SSTP個USERNAME, PASSWORD都自己改)

1. Hub VPN
   
2. UserCreate user1
   
3. 唔打野直接CLICK "ENTER"
   
4. 唔打野直接CLICK "ENTER"
   
5. 唔打野直接CLICK "ENTER"
   
6. UserPasswordSet user1
   
7. set_password3
   
8. set_password3

複製代碼

7. 開NAT

1. SecureNatEnable

複製代碼

8. 設定L2TP, 我唔用L2TPv3, 所以我係將第三個NO左, 想用既果行打y就得, VPN果度都係睇你HUB改左咩名黎改, Pre-shared Key自己改

1. IPsecEnable
   
2. y
   
3. n
   
4. n
   
5. presharedkey
   
6. VPN

複製代碼

9. 睇你想唔想要SSTP同OPENVPN(SS用左443就開左都冇用)

1. sstpEnable yes
   
2. OpenVPNEnable yes /PORTS:1194
   
3. ServerCertRegenerate [YOUR_DDNS]
   
4. OpenVpnMakeConfig softethervpn/OpenVPNconfig.zip

複製代碼

OPENVPN個CONFIG會響/opt/etc/softethervpn, 但佢個DNS NAME係錯既要自己改
10. 用SoftEther VPN Server Manager入去(記得port用5555)

11. 如果你SS係用443, 就響度DELETE左443佢, 費事炒
12(OPTIONAL). 想要SOFTETHER DDNS就響度SET喇, 唔知點解得呢少少野可以響度SET
13. 另外假如你冇開OPENVPN, 呢入面都會見佢開住, CLOSE左佢喇
14. 去返TOMATO WEB UI, 開返INIT SCRIPT, 加多句

1. /opt/etc/init.d/S80softethervpnserver start

複製代碼

15. FIREWALL加下面既(有用OPENVPN就自行加多句開PORT喇)

1. iptables -I INPUT -p udp --dport 500 -j ACCEPT
   
2. iptables -I INPUT -p udp --dport 4500 -j ACCEPT
   
3. iptables -I INPUT -p udp --dport 1701 -j ACCEPT
   
4. iptables -I INPUT -p tcp --dport 992 -j ACCEPT
   
5. iptables -I INPUT -p tcp --dport 5555 -j ACCEPT

複製代碼

16. PORT FORWARD加返下面既(其實可以唔洗, 只係我習慣加埋方便射去第二度做SERVER)


街外用SOFTETHER連上去都係992或者5555喇

PART4. SSR(呢部份係參考Mobile 01, 但版本有唔同)
** 遲下會連同SS一齊改用呢個版本, 又或者睇ENTWARE-NG幾時加SIMPLE-OBFS(見到有人REQUEST)
1. 裝好PYTHON之類

1. opkg install python
   
2. opkg install libsodium
   
3. opkg install git-http

複製代碼

2. 裝SSR

1. cd /jffs
   
2. git clone -b manyuser https://github.com/shadowsocksr/shadowsocksr.git

複製代碼

3. 用VI COMMAND或者WINSCP改/jffs/shadowsocksr/config.json改成下面
{
    "server":"0.0.0.0",
    "server_port":8388,
    "local_port":1081,
    "password":"please_change",
    "protocol": "origin",
    "obfs": "tls1.2_ticket_auth",
    "obfs_param": "",
    "timeout":120,
    "method":"chacha20-ietf"
}
其實都只係加左obfs部份, protocol我冇打算改(其實唔寫都一樣行到)
至於obfs行邊個就自行決定喇
4. 用vi或者winscp去/jffs/shadowsocksr/shadowsocks/crypto/util.py
將入面
'/usr/lib*/lib%s.*' % name,
改做
'/opt/lib*/lib%s.*' % name,
5. FIREWALL SCRIPT度加

1. iptables -I INPUT -p tcp --dport 8388 -j ACCEPT

複製代碼

6. INIT SCRIPT度加

1. /jffs/shadowsocksr/shadowsocks/server.py -d start -c /jffs/shadowsocksr/config.json

複製代碼

**SSR其實係後備架ZE, 假如SS真係唔得先至用佢, 因為SSR係比較慢

bunch

回復 2 #devilwai123

R7000用左koolshare個Merlin點解仲要用entware裝多次？
直接用佢Software center唔係快手d咩？

Anyway, r7000都係arm7，係可以用嘅

via HKEPC Reader for Android

Eric j

回復 1 #bunch
好耐都唔見有ching咁用心去寫呢D教學

via HKEPC Reader for Android

bunch

回覆 5# Eric j

反正我自己SET果陣邊SET邊用NOTEPAD記住做過咩
(方便出事時TROUBLE SHOOT)
咁咪順便翻譯返NOTEPAD入面既野放出黎

其實SOFTETHER都係順手搞, 方便自己打機

bunch

回覆 4# devilwai123

xvortex, 未試過裝唔知咩情況
不過我記得我好耐之前試過響KOOLSHARE版X6.5上面裝ENTWARE
佢/OPT只係一條SHORTCUT指向/TMP/OPT(仲要未起FOLDER)
要響STARTUP SCRIPT度咁樣寫先WORK

1. MKDIR /TMP/OPT
   
2. MOUNT -O BIND /JFFS/OPT /TMP/OPT

複製代碼

如果你發現RESTART咩都冇, 最好開WINSCP睇睇/OPT係乜黎

另外我記得MERLIN既STARTUP SCRIPT係自己寫FILE UPLOAD上JFFS
然後響WEB UI唔知邊度有地方加WAN UP既SCRIPT
而每個SCRIPT FILE開頭要加一句

1. #!/bin/sh

複製代碼

大概要注意既係咁, 其餘應該可以直接做

mdws2002

睇完師兄篇文，搞到我都想即時去淘返隻返嚟改添。

mdws2002

忘記一問，咁樣改完之後，直插速度得返幾多？(係咪會無咗HW NAT？)

gameplayer

前果排因為懶得搞SS SERVER而走去刷MERLIN
不過2.4G一直都斷下斷下(衰在我有幾部野係用2.4G)
但DDWRT又慢,  ...
bunch 發表於 2017-7-16 17:04

    我之前跟upi兄 篇文安裝左 ssserver 系個AP到，但係會出現以下error message,中連到線，有流量:


root@unknown:/tmp/home/root# ss-server -c /opt/etc/shadowsocks.json -v

2017-07-17 05:20:14 INFO: initializing ciphers... rc4-md5
2017-07-17 05:20:14 ERROR: bind: Address already in use
2017-07-17 05:20:14 ERROR: Could not bind
2017-07-17 05:20:14 ERROR: bind() error

改下shadowsocks.json 裡面個server_port, 行頭次正常，之後又出現error message

{
    "server":"0.0.0.0",
    "server_port":8866,
    "local_port":1080,
    "password":"XXXXX",
    "timeout":60,
    "method":"rc4-md5"
}

個router port forwarding 設定如下圖：到點set 先可以正常返？