pipistrelloandClaude Opus 4.8
ebf94e668b
Retire the generic SOCKS5 :1080 (raw SOCKS5 is blocked by TSPU/DPI for the external Telegram use case) and add ts-lan-mtproto (alexbers/mtprotoproxy) on :1080 instead: a Fake-TLS MTProto proxy whose Telegram-DC connections chain through the Tailscale userspace SOCKS5 (SOCKS5_HOST=ts-proxy:1055), so egress still rides the Hetzner exit node. Client-facing hop is domestic Fake-TLS to test the hypothesis that TSPU bites hardest at the border. 3proxy keeps only the HTTP front (:3128). The proxy secret lives in a host-only config.py (0600, uid 10000, not in git); config.py.example is the secret-free template. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
51 lines
2.0 KiB
INI
51 lines
2.0 KiB
INI
# HTTP proxy for the tekhnohim Tailscale exit-node egress.
|
|
#
|
|
# This 3proxy instance serves an HTTP proxy (:3128) chained to the Tailscale
|
|
# userspace SOCKS5 (ts-proxy:1055) so clients exit the internet as the Hetzner
|
|
# exit-node IP (89.167.72.79). TCP only (no QUIC/HTTP3).
|
|
#
|
|
# The generic SOCKS5 (:1080) was RETIRED 2026-07-24: raw SOCKS5 is blocked by
|
|
# TSPU/DPI for the external Telegram use case. Telegram is now served by the
|
|
# `ts-lan-mtproto` container (Fake-TLS MTProto proxy) instead, which reuses the
|
|
# :1080 external forward. See the profile / mtproto diagnostic.
|
|
#
|
|
# Access model (LAN free, outside password):
|
|
# * LAN 192.168.0.0/22 -> authorised by source IP, NO password.
|
|
# * everyone else -> must authenticate (external clients arriving via
|
|
# the router port-forward keep their public source
|
|
# IP, so they fall through to the password rule).
|
|
# The username/password lives in a host-only file (0600, NOT in git), mounted
|
|
# separately and pulled in with the include below - same pattern as ts.env.
|
|
|
|
nserver 127.0.0.11
|
|
nscache 65536
|
|
timeouts 1 5 30 60 180 1800 15 60
|
|
log
|
|
|
|
# Account(s) for external, password-authenticated access (host-only secret):
|
|
include /etc/3proxy/3proxy.secret
|
|
|
|
# iponly authorises the LAN by address; strong forces login for the rest.
|
|
auth iponly strong
|
|
|
|
# Safety guard: never treat the router's own address as a trusted LAN client.
|
|
# If the port-forward ever SNATs external traffic to the gateway IP, this rule
|
|
# makes the proxy fail CLOSED (external denied) instead of becoming an open
|
|
# proxy. Verify after opening the port: an unauthenticated external client
|
|
# must be refused.
|
|
deny * 192.168.0.1
|
|
|
|
# LAN clients: allowed by source IP, no password. Egress via the Tailscale
|
|
# userspace SOCKS5 (a `parent` binds to the `allow` line directly above it).
|
|
allow * 192.168.0.0/22
|
|
parent 1000 socks5 ts-proxy 1055
|
|
|
|
# External clients: must present the configured account, same egress.
|
|
allow thproxy
|
|
parent 1000 socks5 ts-proxy 1055
|
|
|
|
# Anything else: denied.
|
|
deny *
|
|
|
|
proxy -p3128 -a -i0.0.0.0
|