get it to work on macOS

[cattyhouse]

better approach : #104 (comment)

i make this short writeup, open to discuss, welcome more ideas

how

• start a trojan client, listening on socks5

trojan-go -config us.json

• start hev-socks5-tunnel

#....
name: utun
ipv4: 198.18.0.1
#....

• set routes

# bypass TROJAN_SERVER_IP
sudo route add -host TROJAN_SERVER_IP ROUTER_IP

# add some routes
# 0.0.0.0/1 + 128.0.0.0/1 = 0.0.0.0/0 , but they have higher priority.
# so we don't have to replace the default route
sudo route add 0.0.0.0/1 TUN_IP
sudo route add 128.0.0.0/1 TUN_IP

• set dns

networksetup -setdnsservers Wi-Fi 1.1.1.1

• test

curl -IL google.com

• view route table

netstat -nr -f inet

• view interface

ifconfig | less

pros and cons

• pro: this is a global proxy
• pro: it's fast
• con: does NOT split dns/ip traffic

[cuicanju]

if you don't know the trojan service ip , what should you do? Alternatively, the IP address of the trojan service may change at any time.

[cattyhouse]

macOS is not that flexible as Linux, on Linux you can use iptables to match uid/gid/cgroup to bypass a process's traffic.

You have to know the ip addr, and bypass it, or there will be a dead loop. Maybe there are some advanced methods on macOS that i don't know of

[heiher]

Here is an example of policy-route by pf. I suggest running the proxy client and hev-socks5-tunnel on special users, and bypassing them.

https://github.com/heiher/hev-socks5-tunnel?tab=readme-ov-file#freebsdmacos

[cattyhouse]

interesting idea!

[cattyhouse]

Just now i wrote a little helper to get tproxy running on macOS via local virtual machine (vm)

requirements:

• start a Linux vm using QEMU with vmnet-bridged nic
• run ss-tproxy inside the vm
• get the ip addr from vm via ip -c a
• run this helper on macOS

#!/bin/sh
# ~/bin/vmtproxy
action=$1
vmip=$2

# 0.0.0.0/1 + 128.0.0.0/1 = 0/0
dest="0.0.0.0/1 128.0.0.0/1"

show_help () {
    printf '%s\n' \
        "vmtproxy -s vmip : add routes and set dns" \
        "vmtproxy -x      : del routes and reset dns" \
        "vmtproxy -l      : list routes and dns" \
        "requirements     : start the vm with vmnet-bridged and run tproxy inside vm"
    exit
}

add_route () {
    sudo route add $1 $2
}

del_route () {
    sudo route delete $1
}

set_dns () {
    networksetup -setdnsservers Wi-Fi $1
}

case $action in
    -s)
        [ "$vmip" ] || exit
        vmtproxy -x >/dev/null 2>&1
        for i in $dest ; do add_route $i $vmip ; done
        set_dns $vmip
        ;;
    -x)
        for i in $dest ; do del_route $i ; done
        set_dns empty
        ;;
    -l)
        printf '%s\n\n' "ROUTING TABLE :"
        netstat -nr -f inet
        printf '\n%s\n' "DNS :"
        grep -Ev '^[[:blank:]]*#|^[[:blank:]]*$' /etc/resolv.conf
        ;;
    *)
        show_help
        ;;
esac

pros:

• the tproxy in Linux vm is able to split ip and dns and even dest ports, and macOS inherit that feature.

cons:

• a little bit complex to setup especially the Linux vm part.
• if macOS connects to a different Wi-Fi, we have to manually restart the network manager in Linux vm to get a new ip and rerun this helper.

[cattyhouse]

pf method on macOS

SUMMARY

features

• transparent proxy
• chnroute based ip/cidr split
• super fast
• very simple rules compare to nftable/iptables
• does not need to rerun if network changes because no routing table was modified, e.g. connect to new Wi-Fi SSID

todo

• DNS split, use overture
• start everything via launchd on boot, should be easy
• script to switch trojan servers, easy to write a small shell script, use ln -sf server_a.json client.json, and restart trojan
• let hev-socks5-tunnel create a fixed utun device instead of random. workaround (1) get it via netstat -nr | awk '/^198.18.0.1/ {print $4}' , (2) macOS : specific/fixed utun device name #106 , the issue is fixed, just set name to like utun999

START

commands to run

• sudo sysctl net.inet.tcp.tso=0 see pf route-to : very slow upload speed (less than 0.2 Mb/s) #107
• trojan-go -config client.json
• sudo hev-socks5-tunnel main.yml
• networksetup -setdnsservers Wi-Fi 1.1.1.1 (replace 1.1.1.1 with 127.0.0.1 if using overture)
• sudo pfctl -E -f /etc/pf.tproxy/tproxy.conf

content of /etc/pf.tproxy/tproxy.conf

include "/etc/pf.conf"

# marcos
# the utun name from hev-socks5-tunnel's config
tun_if = "utun999"
server_ip = "trojan_server_ip"
server_port = "443"

# need to prepared the 2 files
table <direct> persist file "/etc/pf.tproxy/chnroute" file "/etc/pf.tproxy/direct"

# do not apply rules to lo0, e.g. 127.0.0.1 <-> 127.0.0.1
pass quick on lo0

# quick pass server ip and port
pass out quick proto tcp from any to $server_ip port $server_port

# can also match Username, in this case, run trojan-go under that specific user, e.g. nobody
pass out quick user = nobody

# quick pass chnroute and private network
pass out quick proto { tcp , udp } from any to <direct>

# route everything else to utun
pass out route-to $tun_if proto { tcp, udp } all

STOP

restore original network

• networksetup -setdnsservers empty
• sudo pfctl -d -F all
• sudo killall trojan-go hev-socks5-tunnel

@heiher @cuicanju