实测Hysteria 2 一个强大、快速、抗审查的代理工具

更新于 分类于 阅读次数： 阅读时长 ≈ 30 分钟

image-20240326195535589

满速传输数据包，优化拥堵算法

有什么用

实现客户端当前恶劣网络环境下的满速访问Hysteria服务端

突破网速限制，应该说是：某种特定情况下，突破往常生活上使用的网速，再比如在网络拥堵的情况下

Hysteria is a feature-packed proxy & relay utility optimized for lossy, unstable connections, powered by a customized QUIC protocol.

怎么用

服务端搭建好以后；根据客户机环境，通过在客户机运行相应的客户端，socks5代理连接到服务端；

客户端运行（以MAC OSX为例）：

同目录下新建一个配置文件config.json

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
vi config.json
#以下为示例的文件内容
{
  "server": "op.carlzeng.top:8998",
  "auth": "your_password",
  "up_mbps": 50,
  "down_mbps": 250,
  "tls": {
    "insecure": true
  },
  "socks5": {
    "listen": "127.0.0.1:1080"
  },
  "http": {
    "listen": "127.0.0.1:8080"
  }
}



#MAC OSX下载该客户端文件后，赋予执行权限
chmod +x hysteria-darwin-amd64

#运行客户端
./hysteria-darwin-amd64

相关内容

实现方法

服务端（搭建及配置）

服务端docker-compse.yml

1
2
3
4
5
6
7
8
9
10
11
version: "3"                                                                                              
services:                                                                                                 
     hysteria:                                                                                            
          ports:                                                                                          
             - 8998:8998/udp                                                                              
          container_name: hysteria                                                                        
          restart: always                                                                                 
          volumes:                                                                                        
             - .:/etc/hysteria/
             - "/etc/localtime:/etc/localtime:ro"
          image: teddysun/hysteria

server.yaml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
listen: :8998

tls:
  cert: /etc/hysteria/cert.crt
  key: /etc/hysteria/private.key

auth:
  type: password
  password: your_password

resolver:
  type: https
  https:
    addr: 8.8.8.8:443 #假设你可以访问google的域名，否则换掉
    timeout: 10s

upload cert.crt, private.key to the /etc/hysteria/. Or download it from here

Debian防火墙，开启8998端口

客户端

以下以Mac运行客户端为例，分享服务端于客户端之间的联系以及配合

下载 相应平台的hysteria客户端，比如下到文件：

hysteria-darwin-amd64

  • 无法运行，即便切换至root运行也是报错误 -sh: ./hysteria-darwin-amd64: Permission denied
  • 解决办法：
1
chmod +x hysteria-darwin-amd64

运行./hysteria-darwin-amd64，然后打开MAC OSX的系统首选项》安全与隐私（Security & Privacy）〉常规（Genernal）》Allow apps downloaded from：。。。 点击运行（一次性授权完成）

新建config.json

1
2
3
4
5
6
7
8
9
10
11
{                                                                                                    
  "server": "op.carlzeng.top:8998",                                                                  
  "auth": "******",                                                                 
  "up_mbps": 50,                                                                                     
  "down_mbps": 250,                                                                                  
  "socks5": {                                                                                        
    "listen": "127.0.0.1:1080"                                                                       
  },                                                                                                 
  "http": {                                                                                          
    "listen": "127.0.0.1:8080"                                                                       
  }

路由器上设置端口转发

image-20240326114307042

新增一条Hysteria8998，转发路由器公网上的IP+8998端口到局域网内部的特定相应服务上，保存并应用

错误及排查

  1. TLS: failed to verify
1
2
FATAL   failed to initialize client     {"error": "connect error: CRYPTO_ERROR 0x12a (local): tls: failed to verify c
ertificate: x509: “www.baidu.com” certificate is not standards compliant"}

解决办法：修改客户端配置，添加

1
2
tls:
  insecure: true

https://github.com/apernet/hysteria/issues/966

  1. dial error: resolve error； network is unreachable
1
2
2024-03-26T12:32:52+08:00       WARN    SOCKS5 TCP error        {"addr": "127.0.0.1:55970", "reqAddr": "www.sohu.com:80", "error": "dial error: resol
ve error: Post \"https://238.5.5.5:443/dns-query\": dial tcp 238.5.5.5:443: connect: network is unreachable"}

解决办法：

  • 服务端重新docker pull 最新版的（搭配客户端的版本号）
  • 修改配置文件中的IP地址为223.5.5.5

特殊流量怎么处理

由于浏览器使用了socks5代理；无法穿墙；如何结合clash使用呢？？

目前仅仅是浏览页面全部走服务端的流量去了，那么特殊流量怎么处理？

解决办法：

服务端配置需要增加一些内容拓展功能（Hysteria还是强大的，很多深入的功能）

修改server.yaml文件内容

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
listen: :8998

tls:
  cert: /etc/hysteria/cert.crt
  key: /etc/hysteria/private.key

auth:
  type: password
  password: ******

resolver:
  type: https
  https:
    addr: 223.5.5.5:443 #8.8.8.8:443
    timeout: 10s

outbounds:
  - name: out_direct
    type: direct
  - name: out_proxy
    type: socks5
    socks5:
      addr: 192.168.6.110:8080 #请根据自身情况，修改为服务端可用的socks5服务器

acl:
  file: alc.txt

同目录下，新增alc.txt文件：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
out_proxy(suffix:google.com)
out_proxy(suffix:twitter.com)
out_proxy(suffix:youtube.com)
out_proxy(suffix:googlevideo.com)
out_proxy(suffix:googleapis.com)

#从proxypool中替换而来
out_proxy(suffix:9to5mac.com)
out_proxy(suffix:abpchina.org)
out_proxy(suffix:adblockplus.org)
out_proxy(suffix:adobe.com)
out_proxy(suffix:alfredapp.com)
out_proxy(suffix:amplitude.com)
out_proxy(suffix:ampproject.org)
out_proxy(suffix:android.com)
out_proxy(suffix:angularjs.org)
out_proxy(suffix:aolcdn.com)
out_proxy(suffix:apkpure.com)
out_proxy(suffix:appledaily.com)
out_proxy(suffix:appshopper.com)
out_proxy(suffix:appspot.com)
out_proxy(suffix:arcgis.com)
out_proxy(suffix:archive.org)
out_proxy(suffix:armorgames.com)
out_proxy(suffix:aspnetcdn.com)
out_proxy(suffix:att.com)
out_proxy(suffix:awsstatic.com)
out_proxy(suffix:azureedge.net)
out_proxy(suffix:azurewebsites.net)
out_proxy(suffix:bing.com)
out_proxy(suffix:bintray.com)
out_proxy(suffix:bit.com)
out_proxy(suffix:bit.ly)
out_proxy(suffix:bitbucket.org)
out_proxy(suffix:bjango.com)
out_proxy(suffix:bkrtx.com)
out_proxy(suffix:blog.com)
out_proxy(suffix:blogcdn.com)
out_proxy(suffix:blogger.com)
out_proxy(suffix:blogsmithmedia.com)
out_proxy(suffix:blogspot.com)
out_proxy(suffix:blogspot.hk)
out_proxy(suffix:bloomberg.com)
out_proxy(suffix:box.com)
out_proxy(suffix:box.net)
out_proxy(suffix:cachefly.net)
out_proxy(suffix:chromium.org)
out_proxy(suffix:cl.ly)
out_proxy(suffix:cloudflare.com)
out_proxy(suffix:cloudfront.net)
out_proxy(suffix:cloudmagic.com)
out_proxy(suffix:cmail19.com)
out_proxy(suffix:cnet.com)
out_proxy(suffix:cocoapods.org)
out_proxy(suffix:comodoca.com)
out_proxy(suffix:crashlytics.com)
out_proxy(suffix:culturedcode.com)
out_proxy(suffix:d.pr)
out_proxy(suffix:danilo.to)
out_proxy(suffix:dayone.me)
out_proxy(suffix:db.tt)
out_proxy(suffix:deskconnect.com)
out_proxy(suffix:disq.us)
out_proxy(suffix:disqus.com)
out_proxy(suffix:disquscdn.com)
out_proxy(suffix:dnsimple.com)
out_proxy(suffix:docker.com)
out_proxy(suffix:dribbble.com)
out_proxy(suffix:droplr.com)
out_proxy(suffix:duckduckgo.com)
out_proxy(suffix:dueapp.com)
out_proxy(suffix:dytt8.net)
out_proxy(suffix:edgecastcdn.net)
out_proxy(suffix:edgekey.net)
out_proxy(suffix:edgesuite.net)
out_proxy(suffix:engadget.com)
out_proxy(suffix:entrust.net)
out_proxy(suffix:eurekavpt.com)
out_proxy(suffix:evernote.com)
out_proxy(suffix:fabric.io)
out_proxy(suffix:fast.com)
out_proxy(suffix:fastly.net)
out_proxy(suffix:fc2.com)
out_proxy(suffix:feedburner.com)
out_proxy(suffix:feedly.com)
out_proxy(suffix:feedsportal.com)
out_proxy(suffix:fiftythree.com)
out_proxy(suffix:firebaseio.com)
out_proxy(suffix:flexibits.com)
out_proxy(suffix:flickr.com)
out_proxy(suffix:flipboard.com)
out_proxy(suffix:g.co)
out_proxy(suffix:gabia.net)
out_proxy(suffix:geni.us)
out_proxy(suffix:gfx.ms)
out_proxy(suffix:ggpht.com)
out_proxy(suffix:ghostnoteapp.com)
out_proxy(suffix:git.io)
out_proxy(suffix:github.com)
out_proxy(suffix:globalsign.com)
out_proxy(suffix:gmodules.com)
out_proxy(suffix:godaddy.com)
out_proxy(suffix:golang.org)
out_proxy(suffix:gongm.in)
out_proxy(suffix:goo.gl)
out_proxy(suffix:goodreaders.com)
out_proxy(suffix:goodreads.com)
out_proxy(suffix:gravatar.com)
out_proxy(suffix:gstatic.com)
out_proxy(suffix:gvt0.com)
out_proxy(suffix:hockeyapp.net)
out_proxy(suffix:hotmail.com)
out_proxy(suffix:icons8.com)
out_proxy(suffix:ifixit.com)
out_proxy(suffix:ift.tt)
out_proxy(suffix:ifttt.com)
out_proxy(suffix:iherb.com)
out_proxy(suffix:imageshack.us)
out_proxy(suffix:img.ly)
out_proxy(suffix:imgur.com)
out_proxy(suffix:imore.com)
out_proxy(suffix:instapaper.com)
out_proxy(suffix:ipn.li)
out_proxy(suffix:is.gd)
out_proxy(suffix:issuu.com)
out_proxy(suffix:itgonglun.com)
out_proxy(suffix:itun.es)
out_proxy(suffix:ixquick.com)
out_proxy(suffix:j.mp)
out_proxy(suffix:js.revsci.net)
out_proxy(suffix:jshint.com)
out_proxy(suffix:jtvnw.net)
out_proxy(suffix:justgetflux.com)
out_proxy(suffix:kat.cr)
out_proxy(suffix:klip.me)
out_proxy(suffix:libsyn.com)
out_proxy(suffix:linode.com)
out_proxy(suffix:lithium.com)
out_proxy(suffix:littlehj.com)
out_proxy(suffix:live.com)
out_proxy(suffix:live.net)
out_proxy(suffix:livefilestore.com)
out_proxy(suffix:llnwd.net)
out_proxy(suffix:macid.co)
out_proxy(suffix:macromedia.com)
out_proxy(suffix:macrumors.com)
out_proxy(suffix:mashable.com)
out_proxy(suffix:mathjax.org)
out_proxy(suffix:medium.com)
out_proxy(suffix:mega.co.nz)
out_proxy(suffix:mega.nz)
out_proxy(suffix:megaupload.com)
out_proxy(suffix:microsofttranslator.com)
out_proxy(suffix:mindnode.com)
out_proxy(suffix:mobile01.com)
out_proxy(suffix:modmyi.com)
out_proxy(suffix:msedge.net)
out_proxy(suffix:myfontastic.com)
out_proxy(suffix:name.com)
out_proxy(suffix:nextmedia.com)
out_proxy(suffix:nsstatic.net)
out_proxy(suffix:nssurge.com)
out_proxy(suffix:nyt.com)
out_proxy(suffix:nytimes.com)
out_proxy(suffix:omnigroup.com)
out_proxy(suffix:onedrive.com)
out_proxy(suffix:onenote.com)
out_proxy(suffix:ooyala.com)
out_proxy(suffix:openvpn.net)
out_proxy(suffix:openwrt.org)
out_proxy(suffix:orkut.com)
out_proxy(suffix:osxdaily.com)
out_proxy(suffix:outlook.com)
out_proxy(suffix:ow.ly)
out_proxy(suffix:paddleapi.com)
out_proxy(suffix:parallels.com)
out_proxy(suffix:parse.com)
out_proxy(suffix:pdfexpert.com)
out_proxy(suffix:periscope.tv)
out_proxy(suffix:pinboard.in)
out_proxy(suffix:pinterest.com)
out_proxy(suffix:pixelmator.com)
out_proxy(suffix:pixiv.net)
out_proxy(suffix:playpcesor.com)
out_proxy(suffix:playstation.com)
out_proxy(suffix:playstation.com.hk)
out_proxy(suffix:playstation.net)
out_proxy(suffix:playstationnetwork.com)
out_proxy(suffix:pushwoosh.com)
out_proxy(suffix:rime.im)
out_proxy(suffix:servebom.com)
out_proxy(suffix:sfx.ms)
out_proxy(suffix:shadowsocks.org)
out_proxy(suffix:sharethis.com)
out_proxy(suffix:shazam.com)
out_proxy(suffix:skype.com)
out_proxy(suffix:smartdnsloadbalance1.com)
out_proxy(suffix:smartmailcloud.com)
out_proxy(suffix:sndcdn.com)
out_proxy(suffix:sony.com)
out_proxy(suffix:soundcloud.com)
out_proxy(suffix:sourceforge.net)
out_proxy(suffix:spotify.com)
out_proxy(suffix:squarespace.com)
out_proxy(suffix:sstatic.net)
out_proxy(suffix:st.luluku.pw)
out_proxy(suffix:stackoverflow.com)
out_proxy(suffix:startpage.com)
out_proxy(suffix:staticflickr.com)
out_proxy(suffix:steamcommunity.com)
out_proxy(suffix:symauth.com)
out_proxy(suffix:symcb.com)
out_proxy(suffix:symcd.com)
out_proxy(suffix:tapbots.com)
out_proxy(suffix:tapbots.net)
out_proxy(suffix:tdesktop.com)
out_proxy(suffix:techcrunch.com)
out_proxy(suffix:techsmith.com)
out_proxy(suffix:thepiratebay.org)
out_proxy(suffix:theverge.com)
out_proxy(suffix:time.com)
out_proxy(suffix:timeinc.net)
out_proxy(suffix:tiny.cc)
out_proxy(suffix:tinypic.com)
out_proxy(suffix:tmblr.co)
out_proxy(suffix:todoist.com)
out_proxy(suffix:trello.com)
out_proxy(suffix:trustasiassl.com)
out_proxy(suffix:tumblr.co)
out_proxy(suffix:tumblr.com)
out_proxy(suffix:tweetdeck.com)
out_proxy(suffix:tweetmarker.net)
out_proxy(suffix:twitch.tv)
out_proxy(suffix:txmblr.com)
out_proxy(suffix:typekit.net)
out_proxy(suffix:ubertags.com)
out_proxy(suffix:ublock.org)
out_proxy(suffix:ubnt.com)
out_proxy(suffix:ulyssesapp.com)
out_proxy(suffix:urchin.com)
out_proxy(suffix:usertrust.com)
out_proxy(suffix:v.gd)
out_proxy(suffix:v2ex.com)
out_proxy(suffix:vimeo.com)
out_proxy(suffix:vimeocdn.com)
out_proxy(suffix:vine.co)
out_proxy(suffix:vivaldi.com)
out_proxy(suffix:vox-cdn.com)
out_proxy(suffix:vsco.co)
out_proxy(suffix:vultr.com)
out_proxy(suffix:w.org)
out_proxy(suffix:w3schools.com)
out_proxy(suffix:webtype.com)
out_proxy(suffix:wikiwand.com)
out_proxy(suffix:wikileaks.org)
out_proxy(suffix:wikimedia.org)
out_proxy(suffix:wikipedia.com)
out_proxy(suffix:wikipedia.org)
out_proxy(suffix:windows.com)
out_proxy(suffix:windows.net)
out_proxy(suffix:wire.com)
out_proxy(suffix:wordpress.com)
out_proxy(suffix:workflowy.com)
out_proxy(suffix:wp.com)
out_proxy(suffix:wsj.com)
out_proxy(suffix:wsj.net)
out_proxy(suffix:xda-developers.com)
out_proxy(suffix:xeeno.com)
out_proxy(suffix:xiti.com)
out_proxy(suffix:yahoo.com)
out_proxy(suffix:yimg.com)
out_proxy(suffix:ying.com)
out_proxy(suffix:yoyo.org)
out_proxy(suffix:ytimg.com)
out_proxy(suffix:telegra.ph)
out_proxy(suffix:telegram.org)
out_proxy(91.108.4.0/22)
out_proxy(91.108.8.0/22)
out_proxy(91.108.12.0/22)
out_proxy(91.108.16.0/22)
out_proxy(91.108.56.0/22)
out_proxy(149.154.160.0/22)
out_proxy(149.154.164.0/22)
out_proxy(149.154.168.0/22)
out_proxy(149.154.172.0/22)
out_proxy(149.154.172.0/22)

#out_proxy(geoip:us)



# 直连所有其他地址
direct(all)

下一步 添加geoip.dat

假如，假如acl.txt配置了地理位置的选项，比如：out_proxy(geoip:us)

geoip.dat 手动下载了并放在了服务端的相同目录，可是尴尬的是客户端程序仍然会尝试下载，然后失败：

1
2
3
4
5
6
7
8
9
10
hysteria# docker-compose up
[+] Running 2/1
 ✔ Network hysteria_default  Created                                                                 0.1s 
 ✔ Container hysteria        Created                                                                 0.1s 
Attaching to hysteria
hysteria  | 2024-03-27T08:31:47+08:00   INFO    server mode
hysteria  | 2024-03-27T08:31:47+08:00   INFO    downloading database    {"filename": "geoip.dat", "url": "https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/geoip.dat"}
hysteria  | 2024-03-27T08:32:17+08:00   ERROR   failed to download database     {"error": "Get \"https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/geoip.dat\": dial tcp 8.7.198.46:443: i/o timeout"}
hysteria  | 2024-03-27T08:32:17+08:00   FATAL   failed to load server config    {"error": "invalid config: acl.file: error at line 286: Get \"https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/geoip.dat\": dial tcp 8.7.198.46:443: i/o timeout"}
hysteria exited with code 0

暂时解决办法是：取消地域的alc设置，这样服务端就不需要去下载这个geoip.dat文件；错误不被触发。

既然服务端需要下载，我手动下载后，上传到服务端；可是不知道要放到那个目录了？谁知道的，留言或邮件说一声，谢谢

感受

客户端的设置上传和下载的速度，不是越大越好（超出实际的大后，设置越大反而网速效果越差）；
可以测速一下尽量填写准确的。

“up_mbps”: 50,
“down_mbps”: 250,

灵感来源

teddysun/hysteria

Hysteria2|歇斯底里科学上网节点搭建教程，hysteria2一键安装教程，超级简单、详细的搭建方案，搭建vps,hysteria2协议拯救垃圾服务器，vless协议和hysteria2网速对比

视频总结

快速入门 完整服务端配置 ALC