记录manjaro的安装过程。
安装操作系统
https://manjaro.org/products/download/x86
GNOME is a modern desktop, the layout is different from other options but easy and intuitive to learn.
优化apt
Recommend: Add/Remove Software & Preferences->Use mirrors from: Change to China, and Refresh Mirrors.
Upgrade:1
2
3
4
5
6
7sudo pacman -Syu
#如果报错执行：
pacman-key --init
pacman-key --populate archlinuxarm
pacman -Sy archlinux-keyring
pacman -Syu
安装基础包
1 | #pacman |
Yay命令
https://wiki.archlinuxcn.org/wiki/Yay
1 | 功能 命令 |
howdy
1 | #https://www.cnblogs.com/gardenialyx/p/19104354 |
扩展
1 | #go to https://extensions.gnome.org/ and search: |
toupad
三指拖放：https://github.com/ferstar/gestures.git
1 | #https://blog.ferstar.org/posts/linux-touchpad-gestures-drag/ |
ssh
1 | sudo pacman -S openssh |
Securecrt
1 | #https://www.cnblogs.com/amsilence/p/19151338 |
Remote Desktop
1 | #向日葵 |
NVM
1 | curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.4/install.sh | bash |
Python Venv
1 | #python -m venv /works/python_venv |
waydroid
https://geek-blogs.com/blog/best-android-emulator-for-linux/
1 | pip install dbus-python gbinder PyGObject |
Fix: This device isn’t Play Protect certified
1 | #获取 Waydroid 的 Android ID（GSF ID） |
在浏览器注册设备
1 | 打开任何浏览器（Manjaro 的 Firefox/Chrome 都行），访问： |
重启 Waydroid：1
2
3waydroid session stop
sudo systemctl restart waydroid-container
waydroid show-full-ui
安装apk
1 | waydroid session start |
Samba
1 | sudo pacman -Syu samba smbclient |
aria2
1 | yay -Syu aria2 |
openwrt
安装后，配置好网络。DHCP/DNS -> 过滤器 -> 勾掉”重绑定保护”
中文包
1 | OpenWRT -> System -> Software -> Filter |
theme-argon
参考以下文章安装主题：https://kwx.cc/post/3880
1 | #https://github.com/jerrykuku/luci-theme-argon |
救砖
1 | https://www.cnblogs.com/dingshaohua/p/18776622 |
proxy+firewall失效
不能使用firewall的页面管理防火墙了，使用以下的脚本管理：
添加指定的mac地址：
1
2
3
4
5
6
7
8cat > /etc/nftables.d/99-reject-mac.nft << 'EOF'
chain reject_mac_early {
type filter hook prerouting priority mangle - 20; policy accept;
ether saddr 08:26:AE:39:54:13 fib daddr type != local meta l4proto { tcp, udp } counter drop comment "block external traffic before homeproxy"
}
EOF
fw4 reload添加指定的ip地址：
1
2
3
4
5
6
7
8cat > /etc/nftables.d/99-reject-mac.nft << 'EOF'
chain reject_mac_early {
type filter hook prerouting priority mangle - 20; policy accept;
ip saddr 192.168.8.100 fib daddr type != local meta l4proto { tcp, udp } counter drop comment "block IP 192.168.8.100"
}
EOF
fw4 reload添加mac+ip：
1
2
3
4
5
6
7
8
9
10cat > /etc/nftables.d/99-reject-mac.nft << 'EOF'
chain reject_mac_early {
type filter hook prerouting priority mangle - 20; policy accept;
# MAC + IP 同时匹配才拦截
ether saddr 08:26:AE:39:54:13 ip saddr 192.168.8.100 fib daddr type != local meta l4proto { tcp, udp } counter drop comment "block specific MAC+IP"
}
EOF
fw4 reload添加mac+time:
1
2
3
4
5
6
7
8
9
10
11
12
13
14cat > /etc/nftables.d/99-reject-mac.nft << 'EOF'
chain reject_mac_early {
type filter hook prerouting priority mangle - 20; policy accept;
# 00:00-17:59 和 23:00-23:59 禁止
ether saddr 08:26:AE:39:54:13 fib daddr type != local meta l4proto { tcp, udp } meta hour "00:00"-"17:59" counter drop comment "block outside allowed hours"
ether saddr 08:26:AE:39:54:13 fib daddr type != local meta l4proto { tcp, udp } meta hour "23:00"-"23:59" counter drop comment "block outside allowed hours"
ether saddr 08:26:AE:39:54:13 fib daddr type != local meta l4proto { tcp, udp } \
meta day { Monday, Tuesday, Wednesday, Thursday, Friday } \
meta hour "22:00"-"23:59" counter drop
}
EOF
fw4 reload验证：
1
2
3
4
5
6
7nft list chain inet fw4 reject_mac_early
table inet fw4 {
chain reject_mac_early {
type filter hook prerouting priority -170; policy accept;
ether saddr 08:26:ae:39:54:13 fib daddr type != local meta l4proto { tcp, udp } counter packets 58 bytes 41170 drop comment "block external traffic before homeproxy"
}
}删除：
1
2rm -f /etc/nftables.d/99-reject-mac.nft
fw4 reload完整脚本：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417cat > /root/proxy-block.sh << 'EOF'
#!/bin/sh
NFT_FILE="/etc/nftables.d/99-reject-mac.nft"
CHAIN_NAME="reject_mac_early"
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'
print_header() {
clear
echo -e "${GREEN}========================================${NC}"
echo -e "${GREEN} HomeProxy 外部流量拦截管理脚本${NC}"
echo -e "${GREEN}========================================${NC}"
}
check_root() {
if [ "$(id -u)" -ne 0 ]; then
echo -e "${RED}请使用 root 用户运行此脚本${NC}"
exit 1
fi
}
reload_fw() {
echo -e "${YELLOW}正在重新加载防火墙...${NC}"
fw4 reload >/dev/null 2>&1
if [ $? -eq 0 ]; then
echo -e "${GREEN}防火墙已重新加载${NC}"
else
echo -e "${RED}防火墙加载失败，请检查规则语法${NC}"
fi
}
show_current() {
echo -e "\n${YELLOW}当前规则：${NC}"
if [ -f "$NFT_FILE" ]; then
echo -e "${BLUE}---------- nft 实际生效规则 ----------${NC}"
nft list chain inet fw4 $CHAIN_NAME 2>/dev/null || echo "链未加载"
echo -e "\n${BLUE}---------- 规则文件内容 ----------${NC}"
cat "$NFT_FILE"
else
echo "当前没有拦截规则"
fi
}
gen_header() {
cat << HEADER
chain $CHAIN_NAME {
type filter hook prerouting priority mangle - 20; policy accept;
HEADER
}
validate_mac() {
local mac="$1"
echo "$mac" | grep -Eq '^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$'
return $?
}
validate_time() {
local time="$1"
echo "$time" | grep -Eq '^([01][0-9]|2[0-3]):[0-5][0-9]$'
return $?
}
parse_weekdays() {
local input="$1"
local result=""
expanded=""
for part in $(echo "$input" | tr ',' ' '); do
if echo "$part" | grep -q '-'; then
start=$(echo "$part" | cut -d'-' -f1)
end=$(echo "$part" | cut -d'-' -f2)
if ! echo "$start" | grep -Eq '^[1-7]$' || ! echo "$end" | grep -Eq '^[1-7]$'; then
return 1
fi
i=$start
while [ "$i" -le "$end" ]; do
expanded="$expanded $i"
i=$((i + 1))
done
else
if ! echo "$part" | grep -Eq '^[1-7]$'; then
return 1
fi
expanded="$expanded $part"
fi
done
for d in $expanded; do
case $d in
1) name="Monday" ;;
2) name="Tuesday" ;;
3) name="Wednesday" ;;
4) name="Thursday" ;;
5) name="Friday" ;;
6) name="Saturday" ;;
7) name="Sunday" ;;
*) continue ;;
esac
if [ -z "$result" ]; then
result="$name"
else
result="$result, $name"
fi
done
echo "$result"
}
add_rule() {
local mac="$1"
local ip="$2"
local start_hour="$3"
local end_hour="$4"
local weekdays="$5"
local comment="$6"
match=""
[ -n "$mac" ] && match="$match ether saddr $mac"
[ -n "$ip" ] && match="$match ip saddr $ip"
match="$match fib daddr type != local meta l4proto { tcp, udp }"
comment_str=""
if [ -n "$comment" ]; then
comment_str=" comment \"$comment\""
fi
if [ -n "$start_hour" ] && [ -n "$end_hour" ]; then
if [ -n "$weekdays" ]; then
echo " ${match} meta day { $weekdays } meta hour \"${start_hour}\"-\"${end_hour}\" counter drop${comment_str}"
else
echo " ${match} meta hour \"${start_hour}\"-\"${end_hour}\" counter drop${comment_str}"
fi
else
echo " ${match} counter drop${comment_str}"
fi
}
write_rules() {
local content="$1"
if [ -z "$(echo -e "$content" | sed '/^$/d')" ]; then
rm -f "$NFT_FILE"
echo -e "${YELLOW}规则已全部清空${NC}"
else
gen_header > "$NFT_FILE"
echo -e "$content" >> "$NFT_FILE"
echo "}" >> "$NFT_FILE"
fi
reload_fw
show_current
}
get_rule_lines() {
if [ ! -f "$NFT_FILE" ]; then
return
fi
sed -n '/type filter/,/^}/p' "$NFT_FILE" | sed '1d;$d' | grep -E '^[[:space:]]*(ether|ip)[[:space:]]' | sed 's/^[[:space:]]*//'
}
print_numbered() {
local i=1
echo "$1" | while read -r line; do
printf "%2d. %s\n" "$i" "$line"
i=$((i + 1))
done
}
confirm_action() {
echo -e "\n${YELLOW}请确认以上操作 (Y/n):${NC}"
read -p "> " confirm
if [ -z "$confirm" ] || [ "$confirm" = "y" ] || [ "$confirm" = "Y" ]; then
return 0
else
echo -e "${RED}已取消操作${NC}"
return 1
fi
}
menu_add() {
echo -e "\n${YELLOW}【添加拦截规则】${NC}"
echo "1. 仅 MAC"
echo "2. 仅 IP"
echo "3. MAC + IP"
read -p "请选择类型 [1-3]: " type
mac=""
ip=""
case $type in
1)
while true; do
read -p "请输入 MAC 地址 (例如 08:26:AE:39:54:13): " mac
if validate_mac "$mac"; then
break
else
echo -e "${RED}MAC 地址格式错误，请重新输入（示例：08:26:AE:39:54:13）${NC}"
fi
done
;;
2)
read -p "请输入 IP 地址 (例如 192.168.8.100): " ip
;;
3)
while true; do
read -p "请输入 MAC 地址: " mac
if validate_mac "$mac"; then
break
else
echo -e "${RED}MAC 地址格式错误，请重新输入（示例：08:26:AE:39:54:13）${NC}"
fi
done
read -p "请输入 IP 地址: " ip
;;
*) echo -e "${RED}无效选择${NC}"; return ;;
esac
# 新增：输入 comment（可为空）
read -p "请输入备注 comment（可直接回车为空）: " comment
echo -e "\n时间控制（填写【禁止】的时间段）："
echo "1. 全天禁止"
echo "2. 指定禁止时段 + 星期"
read -p "请选择 [1-2]: " time_type
rules=""
case $time_type in
1)
rules=$(add_rule "$mac" "$ip" "" "" "" "$comment")
;;
2)
while true; do
read -p "禁止开始时间 (HH:MM，例如 00:00): " start
if validate_time "$start"; then
break
else
echo -e "${RED}时间格式错误，请输入 HH:MM（00:00 - 23:59）${NC}"
fi
done
while true; do
read -p "禁止结束时间 (HH:MM，例如 08:00): " end
if validate_time "$end"; then
break
else
echo -e "${RED}时间格式错误，请输入 HH:MM（00:00 - 23:59）${NC}"
fi
done
echo ""
echo "星期设置说明："
echo " 1=周一 2=周二 3=周三 4=周四 5=周五 6=周六 7=周日"
echo " 示例: 1,3,5 或 1-5 或 1-3,5,7"
echo " 留空表示每天"
read -p "请输入要禁止的星期 (直接回车=每天): " day_input
weekdays=""
if [ -n "$day_input" ]; then
weekdays=$(parse_weekdays "$day_input")
if [ -z "$weekdays" ]; then
echo -e "${RED}星期格式错误，请重新添加规则${NC}"
return
fi
fi
rules=$(add_rule "$mac" "$ip" "$start" "$end" "$weekdays" "$comment")
;;
*) echo -e "${RED}无效选择${NC}"; return ;;
esac
echo -e "\n${BLUE}即将添加的规则：${NC}"
echo "$rules"
if ! confirm_action; then
return
fi
old_content=$(get_rule_lines)
if [ -n "$old_content" ]; then
new_content="${old_content}
${rules}"
else
new_content="$rules"
fi
write_rules "$new_content"
echo -e "${GREEN}规则已添加并生效${NC}"
}
menu_delete_one() {
echo -e "\n${YELLOW}【清除指定拦截规则】${NC}"
if [ ! -f "$NFT_FILE" ]; then
echo "当前没有任何规则"
return
fi
lines=$(get_rule_lines)
if [ -z "$lines" ]; then
echo "当前没有任何规则"
return
fi
echo -e "${BLUE}当前规则列表：${NC}"
print_numbered "$lines"
total=$(echo "$lines" | wc -l)
echo ""
read -p "请输入要删除的规则序号 (1-$total，多个用空格分隔，输入 all 删除全部): " input
if [ -z "$input" ]; then
echo -e "${RED}你没有输入任何序号，操作已取消${NC}"
return
fi
if [ "$input" = "all" ] || [ "$input" = "ALL" ]; then
echo -e "\n${YELLOW}即将删除【全部】规则${NC}"
if ! confirm_action; then
return
fi
rm -f "$NFT_FILE"
reload_fw
echo -e "${GREEN}已删除全部规则${NC}"
return
fi
valid=0
for num in $input; do
if [ "$num" -ge 1 ] 2>/dev/null && [ "$num" -le "$total" ] 2>/dev/null; then
valid=1
break
fi
done
if [ $valid -eq 0 ]; then
echo -e "${RED}输入的序号无效，操作已取消${NC}"
return
fi
echo -e "\n${BLUE}即将删除以下规则：${NC}"
i=1
echo "$lines" | while read -r line; do
for num in $input; do
if [ "$i" -eq "$num" ]; then
echo " $i. $line"
fi
done
i=$((i + 1))
done
if ! confirm_action; then
return
fi
i=1
echo "$lines" | while read -r line; do
delete=0
for num in $input; do
if [ "$i" -eq "$num" ]; then
delete=1
break
fi
done
if [ $delete -eq 0 ]; then
echo "$line"
fi
i=$((i + 1))
done > /tmp/proxy_block_new.rules
new_content=$(cat /tmp/proxy_block_new.rules 2>/dev/null)
rm -f /tmp/proxy_block_new.rules
write_rules "$new_content"
echo -e "${GREEN}指定规则已删除${NC}"
}
menu_clear() {
echo -e "\n${YELLOW}即将删除【所有】拦截规则${NC}"
if ! confirm_action; then
return
fi
rm -f "$NFT_FILE"
reload_fw
echo -e "${GREEN}所有拦截规则已清除${NC}"
}
main_menu() {
while true; do
print_header
echo "1. 查看当前规则"
echo "2. 添加拦截规则（MAC / IP / 时间）"
echo "3. 清除指定拦截规则"
echo "4. 清除所有拦截规则"
echo "5. 手动重新加载防火墙"
echo "0. 退出"
echo "----------------------------------------"
read -p "请选择操作 [0-5]: " choice
case $choice in
1) show_current ;;
2) menu_add ;;
3) menu_delete_one ;;
4) menu_clear ;;
5) reload_fw ;;
0) echo "退出"; exit 0 ;;
*) echo -e "${RED}无效选择${NC}" ;;
esac
echo ""
read -p "按回车键继续..."
done
}
check_root
main_menu
EOF
chmod +x /root/proxy-block.sh
ocserv
1 | opkg update |
通用配置：1
2
3
4用户身份验证: plan
端口： 443
VPN IPv4–网络地址： 192.168.4.1
DNS 服务器： 223.5.5.5
用户设置中配置账户信息即可。
配置vpns+规则：
1 | 进入：网络->防火墙->常规设置： |
配置其他网段的route:
1 | #vim /etc/config/ocserv |
ssl证书：1
2
3
4
5
6
7
8
9#VPN->OpenConect VPN->编辑模板：
server-cert = /data/ocserv/ssl/xxxx.net.pem
server-key = /data/ocserv/ssl/xxxx.net.key
#提交并重启
/etc/init.d/ocserv restart
#blog的备份文件：backup/vpn/ocserv.zip
手机openconnect后，dns无效时，把DNS从8.8.8.8改为223.5.5.5即可
Proxmox
安装debain 13
1 | #下载debain |
安装Proxmox 9
1 | #安装Proxmox 9 on debain 13，按照以下文档安装即可 |
创建网桥
Create a Linux Bridge called vmbr0, and add your first network interface to it.
The recommended default configuration can be adapted from the example given in the documentation.
See the default configuration using a bridge：
https://pve.proxmox.com/wiki/Network_Configuration#_default_configuration_using_a_bridge
编辑文件：1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39vim /etc/network/interfaces:
auto lo
iface lo inet loopback
iface enp1s0 inet manual
iface enp2s0 inet manual
iface wlo1 inet manual
auto vmbr0
iface vmbr0 inet static
address 192.168.3.10/24
#gateway 192.168.3.1
bridge-ports enp1s0
#dns-nameservers 223.5.5.5 8.8.8.8
bridge-stp off
bridge-fd 0
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s '192.168.3.0/24' -o vmbr0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '192.168.3.0/24' -o vmbr0 -j MASQUERADE
auto vmbr1
iface vmbr1 inet static
address 192.168.1.2/24
gateway 192.168.1.1
bridge-ports enp2s0
bridge-stp off
bridge-fd 0
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s '192.168.3.0/24' -o vmbr1 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '192.168.3.0/24' -o vmbr1 -j MASQUERADE
#重新加载：
apt install ifupdown2
ifreload -a
# 或
systemctl restart networking
安装CT
1 | #https://mirrors.ustc.edu.cn/help/proxmox.html |
宿主机进入容器：1
2
3
4
5
6
7
8
9#在web界面安装好后，宿主机进入容器
> pct enter <容器id>
nano /etc/ssh/sshd_config
# 找到 PermitRootLogin，修改为：
PermitRootLogin yes
# 重启服务
systemctl restart ssh
#配置文件位于宿主机：nano /etc/pve/lxc/<ct-id>.conf
Openwrt
1 | #https://downloads.openwrt.org/releases/25.12.0/targets/x86/64/ |
Proxmox 9.x由于ujail限制，homeporxy无法启动，需要修改宿主机的配置：
nano /etc/pve/lxc/104.conf1
2
3
4
5
6unprivileged: 0
lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file
lxc.mount.auto: proc:rw sys:rw
lxc.cap.drop:
lxc.apparmor.profile: unconfined
重启CT容器后生效。
如果需要前移旧设备的信息的话，可以把以下的三个文件里面的内容复制过去：1
2
3
4
5
6#可以直接覆盖
/etc/config/homeproxy
#复制里面的静态ip部分
/etc/config/dhcp
#复制里面的防火墙部分
/etc/config/firewall
解决openwrt作为路由器时，ip能ping通，当域名不能的问题：1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16# 给 WAN 接口强制指定上游 DNS（如果接口名不是 wan，请改成实际名字）
uci set network.lan.peerdns='0'
uci delete network.lan.dns
uci add_list network.lan.dns='223.5.5.5'
uci add_list network.lan.dns='8.8.8.8'
# 同时让 dnsmasq 也使用这些 DNS
uci set dhcp.@dnsmasq[0].noresolv='0'
uci delete dhcp.@dnsmasq[0].server
uci add_list dhcp.@dnsmasq[0].server='223.5.5.5'
uci add_list dhcp.@dnsmasq[0].server='8.8.8.8'
uci commit network
uci commit dhcp
/etc/init.d/network restart
/etc/init.d/dnsmasq restart
ZeroTier
1 | #https://github.com/mwarning/zerotier-openwrt/wiki/Configure-ZeroTier-on-OpenWrt |
如果openwrt采取的是lan+wan的方式的话，从宿主机无法访问到openwrt的解决方式:1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21#openwrt添加路由（推荐）
# 让 OpenWRT 知道 192.168.195.0/24 要走宿主机
#ip route add 192.168.195.0/24 via 192.168.3.10
# 永久生效（写入配置）
uci add network route
uci set network.@route[-1].interface='lan'
uci set network.@route[-1].target='192.168.195.0/24'
uci set network.@route[-1].gateway='192.168.3.10'
uci commit network
/etc/init.d/network restart
#可选：或者在宿主机配置, vmbr0为内网口:
# 把从 ZeroTier 进来、去往 192.168.3.0/24 的流量伪装成主机自己的 IP
iptables -t nat -A POSTROUTING -s 192.168.195.0/24 -d 192.168.3.0/24 -o vmbr0 -j MASQUERADE
# 或者更宽一点:
#iptables -t nat -A POSTROUTING -o vmbr0 -j MASQUERADE
#持久化
apt install -y iptables-persistent
iptables-save > /etc/iptables/rules.v4
# 或
netfilter-persistent save
Arch linux
1 | #http://download.proxmox.com |
Ubuntu arm64
1 | #https://github.com/jiangcuo/pxvirt/issues/174 |