代理 App 选型尝试：Sing-box VS Mihomo

, ,

Sing-box

安装

GitHub下载地址： sing-box-1.14.0-linux-amd64.tar.gz

安装步骤如下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
# 1. 下载
curl -LO https://github.com/SagerNet/sing-box/releases/download/v1.14.0/sing-box-1.14.0-linux-amd64.tar.gz

# 2. 校验
sha256sum sing-box-1.14.0-linux-amd64.tar.gz
# sha256:2375de6999f4f56ab46b4fc5ddf26a6aba1d3e61a0f4e7ddec2f4690457d5f63

# 3. 解压缩
tar zxf sing-box-1.14.0-linux-amd64.tar.gz 

# 4. 查看
tree sing-box-1.14.0-linux-amd64
# sing-box-1.14.0-linux-amd64
# ├── libcronet.so
# ├── LICENSE
# └── sing-box

# 5. 或使用install安装到指定位置
mv sing-box-1.14.0-linux-amd64/sing-box /usr/local/bin/

# 6. 查看版本信息
sing-box version
# Environment: go1.26.7 linux/amd64
# Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,with_cloudflared,with_naive_outbound,with_usbip,with_openvpn,with_openconnect,badlinkname,tfogo_checklinkname0,with_purego
# Revision: 0b8995879f29a9b98ee027bc17b75e101445b238
# CGO: disabled

配置

编辑配置文件 /etc/sing-box/config.json

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
{
  "log": {
    "level": "info",
    "timestamp": true
  },
  "inbounds": [
    {
      "type": "vless",
      "tag": "vless-reality-in",
      "listen": "0.0.0.0",
      "listen_port": 30002,
      "users": [
        {
          "name": "user1",
          "uuid": "<uuidgen>",
          "flow": "xtls-rprx-vision"
        }
      ],
      "tls": {
        "enabled": true,
        "server_name": "www.microsoft.com",
        "min_version": "1.3",
        "reality": {
          "enabled": true,
          "handshake": {
            "server": "www.microsoft.com",
            "server_port": 443
          },
          "private_key": "<sing-box generate reality-keypair>",
          "short_id": [
            "<openssl rand -hex 8>"
          ]
        }
      }
    }
  ],
  "outbounds": [
    {
      "type": "direct",
      "tag": "direct"
    },
    {
      "type": "block",
      "tag": "block"
    }
  ],
  "route": {
    "rules": [
      {
        "ip_cidr": [
          "127.0.0.0/8",
          "::1/128"
        ],
        "outbound": "direct"
      },
      {
        "ip_cidr": [
          "169.254.169.254/32",
          "10.0.0.0/8",
          "172.16.0.0/12",
          "192.168.0.0/16",
          "100.64.0.0/10",
          "fc00::/7",
          "fe80::/10"
        ],
        "outbound": "block"
      }
    ],
    "final": "direct"
  },
  "experimental": {
    "clash_api": {
      "external_controller": "127.0.0.1:10002",
      "secret": "your_api_secret_here"
    }
  }
}

启动测试：

1
2
3
4
5
# 检查配置
sing-box check -c /etc/sing-box/config.json

# 启动
/usr/local/bin/sing-box run -D /etc/sing-box/

流量监控

1
2
3
# 通过api获取流量信息
curl http://127.0.0.1:10002/traffic
# {"up":1200,"down":1682164}

Systemd 配置

编辑/etc/systemd/system/sing-box.service

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
[Unit]
Description=Sing-box Service
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=vagrant
Group=vagrant
ExecStart=/usr/local/bin/sing-box run -D /etc/sing-box/
Restart=on-failure
LimitNOFILE=512000

[Install]
WantedBy=multi-user.target

安装并设置开机启动

1
2
3
sudo systemctl daemon-reload
sudo systemctl enable --now sing-box.service
sudo systemctl status sing-box.service

Mihomo

安装

GitHub下载地址： mihomo-linux-amd64-v3-v1.19.30.gz

安装步骤如下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
# 1. 下载
curl -LO https://github.com/MetaCubeX/mihomo/releases/download/v1.19.30/mihomo-linux-amd64-v3-v1.19.30.gz

# 2. 校验
sha256sum mihomo-linux-amd64-v3-v1.19.30.gz
# sha256:2c3d87ea31a8b420285fa4c1dedd9fb2356fe289b609edac1c671c00738a1544

# 3. 解压缩
gzip -d mihomo-linux-amd64-v3-v1.19.30.gz

# 4. 修改权限、名称并安装到指定位置，也可以使用install安装
chmod +x mihomo-linux-amd64-v3-v1.19.30
mv mihomo-linux-amd64-v3-v1.19.30 /usr/local/bin/mihomo

# 5. 查看版本信息
mihomo -v
# Mihomo Meta v1.19.30 linux amd64 with go1.26.6 Sun Aug 16 10:02:25 UTC 2026
# Use tags: with_gvisor

配置

编辑配置文件 /etc/mihomo/config.yaml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
mode: direct
log-level: info
external-controller: 127.0.0.1:10002
secret: "your_api_secret_here"

dns:
  enable: true
  enhanced-mode: redir-host
  default-nameserver:
    - 1.1.1.1
    - 8.8.8.8
    # - 2606:4700:4700::1111
    # - 2001:4860:4860::8888
  nameserver:
    - https://1.1.1.1/dns-query
    # - "https://[2606:4700:4700::1111]/dns-query"
    - https://8.8.8.8/dns-query
    # - "https://[2001:4860:4860::8888]/dns-query"

listeners:
  - name: "vless-reality-in"
    type: vless
    server: 0.0.0.0
    port: 30002
    users:
      - user1: 1
        uuid: <uuidgen>
        flow: xtls-rprx-vision
    reality-config:
      dest: www.microsoft.com:443
      private-key: <mihomo generate reality-keypair>
      short-id:
        - <openssl rand -hex 8>
      server-names:
        - www.microsoft.com

rules:
  # 1. Allow local loopback traffic
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR6,::1/128,DIRECT,no-resolve
  # 2. Block Cloud Provider Metadata API (Security enforcement)
  - IP-CIDR,169.254.169.254/32,REJECT,no-resolve
  # 3. Block Private IPv4 / Internal VPC subnets
  - GEOIP,private,REJECT,no-resolve
  - IP-CIDR,10.0.0.0/8,REJECT,no-resolve
  - IP-CIDR,172.16.0.0/12,REJECT,no-resolve
  - IP-CIDR,192.168.0.0/16,REJECT,no-resolve
  - IP-CIDR,100.64.0.0/10,REJECT,no-resolve
  # 4. Block Private IPv6 subnets
  - IP-CIDR6,fc00::/7,REJECT,no-resolve
  - IP-CIDR6,fe80::/10,REJECT,no-resolve
  # 5. Route all other outbound traffic directly
  - MATCH,DIRECT

启动测试：

1
2
# 启动
/usr/local/bin/mihomo -d /etc/mihomo

流量监控

1
2
3
# 通过api获取流量信息
curl http://127.0.0.1:10002/traffic
# {"up":569,"down":8819,"upTotal":2878,"downTotal":4197581}

测试了好几次，sing-box跟mihomo都可以配置多用户，但无法获取用户级别的流量信息，放弃

Systemd 配置

编辑/etc/systemd/system/mihomo.service

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
[Unit]
Description=Mihomo Service
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=vagrant
Group=vagrant
ExecStart=/usr/local/bin/mihomo -d /etc/mihomo
Restart=on-failure
LimitNOFILE=512000

[Install]
WantedBy=multi-user.target

安装并设置开机启动

1
2
3
sudo systemctl daemon-reload
sudo systemctl enable --now mihomo.service
sudo systemctl status mihomo.service

Nftables 配置

把配置写到/etc/nftables.d/my_custom.conf

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
#!/usr/sbin/nft -f

table inet my_custom_table
delete table inet my_custom_table

table inet my_custom_table {
    chain input {
        type filter hook input priority filter; policy accept;

        tcp dport 30002 meta mark set 2 counter accept comment "input-tcp-30002"
        udp dport 30002 meta mark set 2 counter accept comment "input-udp-30002"
    }

    chain output {
        type filter hook output priority filter; policy accept;

        tcp sport 30002 meta mark set 2 counter accept comment "output-tcp-30002"
        udp sport 30002 meta mark set 2 counter accept comment "output-udp-30002"
    }
}

测试验证

1
2
3
4
5
6
7
8
# dry-run测试
sudo nft -c -f /etc/nftables.d/my_custom.conf

# 生效
sudo nft -f /etc/nftables.d/my_custom.conf

# 查看已有规则
sudo nft -a list ruleset

可以考虑放到/etc/nftables.conf

1
include "/etc/nftables.d/*.conf"

总结

我发现虽然sing-box、mihomo、shadowsocks-rust都可以支持单端口多用户，但是流量却只能做到进程级别，如果生产环境要使用，最好还是用户-端口单一映射管理