Environment and Dependencies#
mkdir -p ~/base/NPS && cd ~/base/NPS && mkdir conf
nano docker-compose.yml
nano conf/nps.conf
touch conf/{clients,hosts,tasks}.json
sudo docker-compose up -d
# Reverse proxy dashboard 8080
version: '3.3'
services:
nps:
container_name: nps
restart: unless-stopped
ports:
- '8024:8024'
- '6000-6002:6000-6002/udp'
volumes:
- './conf:/conf'
- '/etc/localtime:/etc/localtime:ro'
image: yisier1/nps
networks:
default:
external: true
name: ngpm
appname = nps
# Boot mode (dev|pro)
runmode = pro
# HTTP(S) proxy port, no startup if empty
http_proxy_ip=0.0.0.0
http_proxy_port=18081
##bridge
bridge_type=tcp
bridge_port=8024
bridge_ip=0.0.0.0
# Traffic data persistence interval (minute)
# Ignorance means no persistence
# flow_store_interval=1
# log level LevelEmergency->0 LevelAlert->1 LevelCritical->2 LevelError->3 LevelWarning->4 LevelNotice->5 LevelInformational->6 LevelDebug->7
log_level=7
# log_path=nps.log
# Whether to restrict IP access, true or false or ignore
# ip_limit=true
# allow_ports=9001-9009,10001,11000-12000
# Web management multi-user login
allow_user_login=false
allow_user_register=false
allow_user_change_username=false
# extension
allow_flow_limit=false
allow_rate_limit=false
allow_tunnel_num_limit=false
allow_local_proxy=false
allow_connection_num_limit=false
allow_multi_ip=false
system_info_display=true
# cache
http_cache=false
http_cache_length=100
# get origin ip
http_add_origin_header=false
# pprof debug options
# pprof_ip=0.0.0.0
# pprof_port=9999
# client disconnect timeout
disconnect_timeout=60
# The following needs to be configured
# Public password, which clients can use to connect to the server
# After the connection, the server will be able to open relevant ports and parse related domain names according to its own configuration file.
public_vkey=<16 characters>
# Web API unauthenticated IP address (the len of auth_crypt_key must be 16)
# Remove comments if needed
auth_key=<24 characters>
auth_crypt_key=<16 characters>
# web
web_host=limour.top
web_username=Limour
web_password=<16 characters>
web_port = 8080
web_ip=0.0.0.0
web_open_ssl=false
web_base_url=
open_captcha=true
# if web under proxy use sub path. like http://host/nps need this.
# web_base_url=/nps
# p2p
p2p_ip=<write server ip>
p2p_port=6000
# Set to 6000, please open 6000~6002 (additional 2 ports) udp ports in the console firewall
Configure Port Mapping#
nano Port-Hopping.sh && chmod +x Port-Hopping.sh
nano /etc/systemd/system/Port-Hopping.service
systemctl enable Port-Hopping && systemctl start Port-Hopping && systemctl status Port-Hopping && iptables -t nat -L
#!/bin/bash
# IPv4
/usr/sbin/iptables -t nat -A PREROUTING -i eth0 -p udp --dport 32768:61000 -j DNAT --to-destination :3234
# IPv6
/usr/sbin/ip6tables -t nat -A PREROUTING -i eth0 -p udp --dport 32768:61000 -j DNAT --to-destination :3234
[Unit]
Description=Port-Hopping
After=network.target docker.service
[Service]
ExecStart=/root/Port-Hopping.sh
Restart=on-failure
[Install]
WantedBy=multi-user.target
Configure QUIC#
sudo docker network create sswitch
mkdir -p ~/app/quic && cd ~/app/quic && nano docker-compose.yml
nano hysteria.yaml
sudo docker-compose up -d && sudo docker-compose logs
version: '3.9'
services:
hysteria:
image: tobyxdd/hysteria
restart: always
extra_hosts:
- 'host.docker.internal:host-gateway'
ports:
- '3234:3234/udp'
volumes:
- ./hysteria.yaml:/etc/hysteria.yaml
- /root/base/NGPM/letsencrypt:/home/ubuntu/letsencrypt
command: ["server", "-c", "/etc/hysteria.yaml"]
networks:
default:
external: true
name: sswitch
listen: :3234
tls:
cert: /home/ubuntu/letsencrypt/live/npm-1/fullchain.pem
key: /home/ubuntu/letsencrypt/live/npm-1/privkey.pem
auth:
type: password
password: Se7RAuFZ8Lzg
bandwidth:
up: 3 mbps
down: 3 mbps
masquerade:
type: proxy
proxy:
url: https://hexo.limour.top/
rewriteHost: true
Test Forwarding#
- Create
config.yaml
on the client and write the following content
server: hexo.limour.top:32768-61000
auth: Se7RAuFZ8Lzg
bandwidth:
up: 3 mbps
down: 3 mbps
# socks5:
# listen: 127.0.0.1:1580
# http:
# listen: 127.0.0.1:8580
tcpForwarding:
- listen: 127.0.0.1:8024
remote: host.docker.internal:8024
Test Penetration#
.\npc.exe --server=127.0.0.1:8024 -vkey=<vkey> -type=tcp
Client Example#
mkdir -p ~/app/quic-npc && cd ~/app/quic-npc && nano docker-compose.yml
nano config.yaml
sudo docker-compose up -d && sudo docker-compose logs
version: '3.3'
services:
quic_nps:
image: tobyxdd/hysteria
network_mode: host
restart: always
volumes:
- ./config.yaml:/etc/config.yaml
command: ["--config", "/etc/config.yaml"]
npc_lk:
depends_on:
- quic_nps
network_mode: host
image: yisier1/npc
restart: unless-stopped
command: -server=127.0.0.1:8024 -vkey=<vkey> -type=tcp
server: hexo.limour.top:32768-61000
auth: Se7RAuFZ8Lzg
bandwidth:
up: 3 mbps
down: 3 mbps
tcpForwarding:
- listen: 127.0.0.1:8024
remote: host.docker.internal:8024