返回博客列表
用singbox和nftables搭建一台纯美环境armlinux

用singbox和nftables搭建一台纯美环境armlinux

2026-07-08#armlinux#Armbian#singbox#nftables#代理

最近vibecoding手感火热，又不太想在主力机上设置太多网络环境内容，遂入手了一台联想thinkpadx13s，是罕见的高通woa本，打造一个纯美环境的vibecoding专用本，不影响我主力机打游戏。 thinkpad除了是罕见的woa本之外，还有armbian主线和社区支持的archlinux镜像，并且支持sim上网应该是低预算比较好玩的本子了。

纯美环境打造思路如下（网络部分）：

  • sing-box接管与分流：日常流量全由tun0转发分流
  • nftables防护/KillSwitch：按sing-box用户UID放行指定流量
  • DNS/IPv6防漏：接管系统的53端口DNS请求

2026-09-26 更新：更换了Armbian系统镜像、sing-box 1.13.8 的本机配置整理。香港服务端沿用 VLESS → 美国 SOCKS5 出口方案；新增中转vps服务直连分流。

前提条件:

  1. 硬件与系统：Linux 设备.
  2. 中转服务器：一台拥有公网 IP 的香港（或其他低延迟区域）VPS.
  3. 美家宽上游：美国家宽SOCKS5代理.
  4. 软件：sing-box 和 nftables。

sing-box配置

sing-box 1.13.8 官方发布页 ，注意分清楚 x64/arm 包。解压后两端的程序路径统一安装为 /usr/local/bin/sing-box，配置文件统一存放在 /etc/sing-box/config.json。

服务端配置vless+reality协议

# 1. 生成 VLESS 连接所需的 UUID
/usr/local/bin/sing-box generate uuid
# 2. 生成 Reality 的密钥对（会同时输出私钥 PrivateKey 和公钥 PublicKey）
/usr/local/bin/sing-box generate reality-keypair
# 3. 生成 8 字节（16位十六进制字符）的随机 short_id（也可以自己手动设定）
/usr/local/bin/sing-box generate rand --hex 8

服务端config.json配置

sudo mkdir -p /etc/sing-box
sudo vim /etc/sing-box/config.json

写入

{
  "log": {
    "level": "info",
    "timestamp": true
  },
  "dns": {
    "servers": [
      {
        "type": "https",
        "tag": "dns-us",
        "server": "1.1.1.1",
        "server_port": 443,
        "path": "/dns-query",
        "detour": "new-socks-out",
        "tls": {
          "server_name": "cloudflare-dns.com"
        }
      }
    ],
    "final": "dns-us",
    "strategy": "ipv4_only"
  },
  "inbounds": [
    {
      "type": "vless",
      "tag": "vless-in",
      "listen": "0.0.0.0",
      "listen_port": 443,
      "users": [
        {
          "uuid": "<VLESS_UUID>",
          "flow": "xtls-rprx-vision"
        }
      ],
      "tls": {
        "enabled": true,
        "server_name": "www.cloudflare.com",
        "reality": {
          "enabled": true,
          "handshake": {
            "server": "www.cloudflare.com",
            "server_port": 443
          },
          "private_key": "<REALITY_PRIVATE_KEY>",
          "short_id": [
            "<REALITY_SHORT_ID>"
          ]
        }
      }
    },
    {
      "type": "socks",
      "tag": "local-in",
      "listen": "127.0.0.1",
      "listen_port": 1080
    }
  ],
  "outbounds": [
    {
      "type": "socks",
      "tag": "new-socks-out",
      "server": "<UPSTREAM_SOCKS5_IP>",
      "server_port": <UPSTREAM_SOCKS5_PORT>,
      "username": "<SOCKS5_USERNAME>",
      "password": "<SOCKS5_PASSWORD>",
      "version": "5",
      "connect_timeout": "20s",
      "tcp_keep_alive": "2m",
      "tcp_keep_alive_interval": "30s"
    }
  ],
  "route": {
    "rules": [
      {
        "inbound": "local-in",
        "port": 53,
        "action": "hijack-dns"
      },
      {
        "ip_version": 6,
        "action": "reject"
      }
    ],
    "final": "new-socks-out"
  }
}

校验配置语法是否正确：

/usr/local/bin/sing-box check -c /etc/sing-box/config.json

服务端systemd配置

sudo mkdir -p /etc/systemd/system
sudo vi /etc/systemd/system/sing-box.service

写入

[Unit]
Description=sing-box Proxy Service (Vps Server)
After=network.target nss-lookup.target

[Service]
User=root
WorkingDirectory=/etc/sing-box
ExecStart=/usr/local/bin/sing-box run -c /etc/sing-box/config.json
Restart=on-failure
RestartSec=10s
LimitNOFILE=1000000

[Install]
WantedBy=multi-user.target

重载配置、启动服务并设置开机自启：

sudo systemctl daemon-reload &&
sudo systemctl enable sing-box.service &&
sudo systemctl restart sing-box.service

# 检查运行状态与监听端口
systemctl status sing-box.service --no-pager
sudo ss -lntp

# 从本地 SOCKS5 入口验证上游出口是否连通
curl --proxy socks5h://127.0.0.1:1080 https://www.cloudflare.com/cdn-cgi/trace

客户端config.json配置

sudo mkdir -p /etc/sing-box
sudo vim /etc/sing-box/config.json

写入

{
  "log": {
    "level": "warn",
    "timestamp": true
  },
  "dns": {
    "servers": [
      {
        "type": "https",
        "tag": "dns-us",
        "server": "1.1.1.1",
        "server_port": 443,
        "path": "/dns-query",
        "detour": "hk-vless-reality",
        "tls": {
          "server_name": "cloudflare-dns.com"
        }
      }
    ],
    "final": "dns-us",
    "strategy": "ipv4_only"
  },
  "inbounds": [
    {
      "type": "tun",
      "tag": "tun-in",
      "interface_name": "tun0",
      "address": [
        "172.18.0.1/30"
      ],
      "mtu": 1500,
      "auto_route": true,
      "auto_redirect": false,
      "strict_route": true,
      "route_exclude_address": [],
      "stack": "mixed"
    }
  ],
  "outbounds": [
    {
      "type": "vless",
      "tag": "hk-vless-reality",
      "server": "<香港_VPS_IP>",
      "server_port": 443,
      "uuid": "<VLESS_UUID>",
      "flow": "xtls-rprx-vision",
      "tls": {
        "enabled": true,
        "server_name": "www.cloudflare.com",
        "utls": {
          "enabled": true,
          "fingerprint": "chrome"
        },
        "reality": {
          "enabled": true,
          "public_key": "<REALITY_PUBLIC_KEY>",
          "short_id": "<REALITY_SHORT_ID>"
        }
      }
    },
    {
      "type": "direct",
      "tag": "hk-direct"
    }
  ],
  "route": {
    "auto_detect_interface": true,
    "rules": [
      {
        "port": 53,
        "action": "hijack-dns"
      },
      {
        "protocol": "quic",
        "action": "reject"
      },
      {
        "ip_version": 6,
        "action": "reject"
      },
      {
        "ip_cidr": [
          "<香港_VPS_IP>/32"
        ],
        "action": "route",
        "outbound": "hk-direct"
      }
    ],
    "final": "hk-vless-reality"
  }
}

校验配置语法是否正确：

sudo /usr/local/bin/sing-box check -c /etc/sing-box/config.json

客户端systemd配置

创建用户并设置权限：

# 创建 sing-box 用户（供 nftables 按进程 UID 限制出网）
getent group sing-box >/dev/null || sudo groupadd --system sing-box
id sing-box >/dev/null 2>&1 || sudo useradd --system -g sing-box -s /usr/sbin/nologin -d /var/lib/sing-box sing-box

# 设置配置权限
sudo chown root:sing-box /etc/sing-box /etc/sing-box/config.json
sudo chmod 750 /etc/sing-box
sudo chmod 640 /etc/sing-box/config.json

sudo mkdir -p /etc/systemd/system
sudo vi /etc/systemd/system/sing-box.service

写入

[Unit]
Description=sing-box Client
Wants=network-online.target
After=network.target nss-lookup.target network-online.target nftables.service
Requires=nftables.service

[Service]
Type=simple
User=sing-box
Group=sing-box
StateDirectory=sing-box
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_NET_BIND_SERVICE CAP_SYS_PTRACE CAP_DAC_READ_SEARCH
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW CAP_NET_BIND_SERVICE CAP_SYS_PTRACE CAP_DAC_READ_SEARCH
ExecStartPre=/usr/local/bin/sing-box check -c /etc/sing-box/config.json
ExecStart=/usr/local/bin/sing-box run -c /etc/sing-box/config.json
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
RestartSec=3
LimitNOFILE=infinity

[Install]
WantedBy=multi-user.target

nftables配置

安装nftables

debian系

sudo apt update
sudo apt install nftables

检查安装和 TUN 设备：

nft --version
systemctl --version
ls -l /dev/net/tun

配置出口白名单

sudo vi /etc/nftables.conf

写入

flush ruleset

define TUN_IF = "tun0"
define HK_IP = <香港_VPS_IP>
define HK_PORT = { 22, 80, 443, 11451, 11452, 11453, 11454 }

table inet x13s_lock {

    chain input {
        type filter hook input priority filter; policy drop;

        # 本机回环，IPv4/IPv6 都允许，仅限本机内部
        iifname "lo" accept

        # 禁止所有来自真实网络的 IPv6
        meta nfproto ipv6 drop

        # 已建立连接的返回流量
        ct state established,related accept

        # DHCPv4 返回流量
        udp sport 67 udp dport 68 accept

        # 允许 sing-box TUN 返回的数据
        iifname $TUN_IF accept
    }

    chain forward {
        type filter hook forward priority filter; policy drop;
    }

    chain output {
        type filter hook output priority filter; policy drop;

        # 本机内部通信
        oifname "lo" accept

        # 禁止所有对外 IPv6
        meta nfproto ipv6 drop

        # DHCPv4
        # 保证 Wi-Fi / 有线网络能够获得 IPv4 地址
        udp sport 68 udp dport 67 accept

        # 普通程序只能把流量送入 sing-box 的 TUN
        oifname $TUN_IF accept

        # 只允许 sing-box 对外连接 HK 的指定 TCP 端口
        # 包括 Reality 代理入口和 hk-direct 使用的服务端口
        meta skuid "sing-box" ip daddr $HK_IP tcp dport $HK_PORT accept
    }
}

DNS配置

固定系统DNS 1.1.1.1，防止 Wi-Fi 或 DHCP 改写；请求进入 TUN 后由 sing-box 转为代理内 DoH。

sudo vi /etc/NetworkManager/conf.d/99-static-dns.conf

写入

[main]
dns=none

重载配置并写入固定 DNS：

# 重新读取配置让 dns=none 生效
sudo systemctl reload NetworkManager.service

# 若原文件是软链接先解除，并写入 1.1.1.1
[ -L /etc/resolv.conf ] && sudo unlink /etc/resolv.conf
echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.conf >/dev/null

# 上锁防篡改（若后续需要修改，先执行 sudo chattr -i /etc/resolv.conf 解锁）
sudo chattr +i /etc/resolv.conf

启动服务与管理

加载防火墙与启动代理

校验通过后加载防火墙、设置自启并重启代理：

sudo -u sing-box /usr/local/bin/sing-box check -c /etc/sing-box/config.json &&
sudo nft -c -f /etc/nftables.conf &&
sudo systemctl daemon-reload &&
sudo nft -f /etc/nftables.conf &&
sudo systemctl enable --now nftables.service &&
sudo systemctl enable sing-box.service &&
sudo systemctl restart sing-box.service

# 检查运行状态与防火墙规则
systemctl status nftables.service sing-box.service --no-pager
sudo nft list ruleset

验证

在终端执行一条命令，查看当前出网 IP 和地区：

curl --noproxy '*' -4 https://www.cloudflare.com/cdn-cgi/trace