内核级高性能透明代理工具 Dae(大鹅) 安装及配置指南

CONFIG_BPF=y
CONFIG_BPF_SYSCALL=y
CONFIG_BPF_JIT=y
CONFIG_CGROUPS=y
CONFIG_KPROBES=y
CONFIG_NET_INGRESS=y
CONFIG_NET_EGRESS=y
CONFIG_NET_SCH_INGRESS=m
CONFIG_NET_CLS_BPF=m
CONFIG_NET_CLS_ACT=y
CONFIG_BPF_STREAM_PARSER=y
CONFIG_DEBUG_INFO=y
# CONFIG_DEBUG_INFO_REDUCED is not set
CONFIG_DEBUG_INFO_BTF=y
CONFIG_KPROBE_EVENTS=y
CONFIG_BPF_EVENTS=y

zcat /proc/config.gz || cat /boot/{config,config-$(uname -r)}

sudo sh -c "$(wget -qO- https://cdn.jsdelivr.net/gh/daeuniverse/dae-installer/installer.sh)" @ install use-cdn

sudo sh -c "$(wget -qO- https://cdn.jsdelivr.net/gh/daeuniverse/dae-installer/installer.sh)" @ install-prerelease use-cdn

sudo sh -c "$(curl -sL https://raw.githubusercontent.com/daeuniverse/dae-installer/main/uninstaller.sh)"

opkg update
opkg install kmod-nft-bridge kmod-veth kmod-sched-core kmod-sched-bpf kmod-xdp-sockets-diag kmod-sched-bpf kmod-sched-core kmod-xdp-sockets-diag dae dae-geoip dae-geosite

autocore automount base-files block-mount ca-bundle default-settings-chn dnsmasq-full dropbear fdisk firewall4 fstools grub2-bios-setup i915-firmware-dmc kmod-8139cp kmod-8139too kmod-button-hotplug kmod-e1000e kmod-fs-f2fs kmod-i40e kmod-igb kmod-igbvf kmod-igc kmod-ixgbe kmod-ixgbevf kmod-nf-nathelper kmod-nf-nathelper-extra kmod-nft-offload kmod-pcnet32 kmod-r8101 kmod-r8125 kmod-r8126 kmod-r8168 kmod-tulip kmod-usb-hid kmod-usb-net kmod-usb-net-asix kmod-usb-net-asix-ax88179 kmod-usb-net-rtl8150 kmod-usb-net-rtl8152-vendor kmod-vmxnet3 libc libgcc libustream-openssl logd luci-app-package-manager luci-compat luci-lib-base luci-lib-ipkg luci-light mkf2fs mtd netifd nftables odhcp6c odhcpd-ipv6only opkg partx-utils ppp ppp-mod-pppoe procd-ujail uci uclient-fetch urandom-seed urngd kmod-amazon-ena kmod-amd-xgbe kmod-bnx2 kmod-e1000 kmod-dwmac-intel kmod-forcedeth kmod-fs-vfat kmod-tg3 kmod-drm-i915 kmod-nft-bridge kmod-veth kmod-sched-core kmod-sched-bpf kmod-xdp-sockets-diag kmod-sched-bpf kmod-sched-core kmod-xdp-sockets-diag dae dae-geoip dae-geosite

sudo sh -c "$(wget -qO- https://cdn.jsdelivr.net/gh/daeuniverse/dae-installer/installer.sh)" @ update-geoip use-cdn

sudo sh -c "$(wget -qO- https://cdn.jsdelivr.net/gh/daeuniverse/dae-installer/installer.sh)" @ update-geosite use-cdn

global {
    log_level: warn
    tproxy_port: 12345
    allow_insecure: false
    check_interval: 30s
    check_tolerance: 50ms
    lan_interface: 网卡名称
    wan_interface: auto
    udp_check_dns:'dns.google.com:53,8.8.8.8,2001:4860:4860::8888'
    tcp_check_url: 'http://cp.cloudflare.com,1.1.1.1,2606:4700:4700::1111'
    dial_mode: domain
    tcp_check_http_method: HEAD
    disable_waiting_network: true
    auto_config_kernel_parameter: true
    sniffing_timeout: 100ms
    tls_implementation: tls
    utls_imitate: chrome_auto
    tproxy_port_protect: true
    so_mark_from_dae: 0
}

subscription {
    my_sub: '你的订阅地址'
}

dns {
  upstream {
    googledns: 'tcp+udp://dns.google:53'
    alidns: 'udp://dns.alidns.com:53'
  }
  routing {
    # 根据 DNS 查询，决定使用哪个 DNS 上游。
    # 按由上到下的顺序匹配。
    request {
      # 对于中国大陆域名使用 alidns，其他使用 googledns 查询。
      qname(geosite:cn) -> alidns
      # fallback 意为 default。
      fallback: googledns
    }
  }
}

group {
    proxy {
        policy: min_moving_avg
        filter: subtag(my_sub) && name(keyword: '香港家宽')
    }

    sg {
        policy: min_moving_avg
        filter: subtag(my_sub) && name(keyword: '新加坡家宽')
    }
}

routing {
    pname(NetworkManager) -> direct
    dip(224.0.0.0/3, 'ff00::/8') -> direct
    dscp(4) -> direct

    dip(geoip:private) -> direct
    
    ### OpenAI
    domain(geosite:openai) -> proxy

    ### AppleCN
    domain(geosite:apple@cn) -> direct

    ### SteamCN
    domain(geosite:steam@cn) -> direct

    ### telegram
    dip(geoip:telegram) -> proxy

    ### WX DOMAIN
    domain(geosite:tencent) -> direct

    ### Github
    domain(geosite:github) -> proxy

    ### Docker
    domain(geosite:docker) -> proxy

    ### DIRECT MACHINE
    # mac("BC:24:11:XX:XX:XX") -> direct
    
    ### Game
    domain(geosite: category-games@cn) -> direct

    ### Write your rules below.
    ### 如果使用小米路由器，配置放行，避免内存泄露
    domain(suffix: miwifi.com) -> direct(must)
    ### 小米系统更新CDN
    domain(suffix: cdn.pandora.xiaomi.com) -> direct(must)
    ### 小米电视
    domain(suffix: tv.global.mi.com) -> direct(must)

    ### 禁用Quic，避免CPU高负载及内存泄露
    l4proto(udp) && dport(443) -> block
    domain(geosite:geolocation-!cn) -> proxy
    dip(geoip:cn) -> direct
    domain(geosite:china-list) -> direct
    domain(geosite:cn) -> direct

    fallback: proxy
}

systemctl start Dae

/etc/init.d/dae start

/usr/local/bin/dae run --disable-timestamp -c /usr/local/etc/dae/config.dae

dae run --disable-timestamp -c /etc/dae/config.dae

/usr/local/bin/dae reload

/etc/init.d/dae reload

#!/bin/bash

# Change the path to suit your needs
cd /usr/local/etc/dae || exit 1
version="$(dae --version | head -n 1 | sed 's/dae version //')"
UA="dae/${version} (like v2rayA/1.0 WebRequestHelper) (like v2rayN/1.0 WebRequestHelper)"
fail=false

while IFS=':' read -r name url
do
        curl --retry 3 --retry-delay 5 -fL -A "$UA" "$url" -o "${name}.sub.new"
        if [[ $? -eq 0 ]]; then
                mv "${name}.sub.new" "${name}.sub"
                chmod 0600 "${name}.sub"
                echo "Downloaded $name"
        else
                if [ -f "${name}.sub.new" ]; then
                        rm "${name}.sub.new"
                fi
                fail=true
                echo "Failed to download $name"
        fi
done < sublist

dae reload

if $fail; then
        echo "Failed to update some subs"
        exit 2
fi

chmod +x /usr/local/bin/update-dae-subs.sh

[Unit]
Description=Auto-update dae subscriptions

[Timer]
OnBootSec=15min
OnUnitActiveSec=12h

[Install]
WantedBy=timers.target

[Unit]
Description=Update dae subscriptions
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
ExecStart=/usr/local/bin/update-dae-subs.sh
Restart=on-failure

sub1:https://mysub1.com
sub2:https://mysub2.com
sub3:https://mysub3.com

chmod 0600 /usr/local/etc/dae/sublist

subscription {
    # Add your subscription links here.
    sub1:'file://sub1.sub'
    sub2:'file://sub2.sub'
    sub3:'file://sub3.sub'
}

systemctl enable --now update-dae-subs.timer

# If you need to renew your subscription immediately or haven't pulled a subscription before
systemctl start update-dae-subs.service

#!/bin/bash

# Change the path to suit your needs
cd /usr/local/etc/dae || exit 1
version="$(dae --version | head -n 1 | sed 's/dae version //')"
UA="dae/${version} (like v2rayA/1.0 WebRequestHelper) (like v2rayN/1.0 WebRequestHelper)"
fail=false

while IFS=':' read -r name url
do
        curl --retry 3 --retry-delay 5 -fL -A "$UA" "$url" -o "${name}.sub.new"
        if [[ $? -eq 0 ]]; then
                mv "${name}.sub.new" "${name}.sub"
                chmod 0600 "${name}.sub"
                echo "Downloaded $name"
        else
                if [ -f "${name}.sub.new" ]; then
                        rm "${name}.sub.new"
                fi
                fail=true
                echo "Failed to download $name"
        fi
done < sublist

dae reload

if $fail; then
        echo "Failed to update some subs"
        exit 2
fi

0 */12 * * * bash /usr/local/bin/update-dae-subs.sh

domain(geosite:category-ai-chat-!cn) -> ai

domain(
    suffix: copilot.microsoft.com,
    suffix: gateway-copilot.bingviz.microsoftapp.net,
    suffix: mobile.events.data.microsoft.com,
    suffix: graph.microsoft.com,
    suffix: analytics.adjust.com,
    suffix: analytics.adjust.net.in,
    suffix: api.revenuecat.com,
    suffix: t-msedge.net,
    suffix: cloudapp.azure.com,
    suffix: browser-intake-datadoghq.com,
    suffix: in.appcenter.ms,
    suffix: guzzoni.apple.com,
    suffix: smoot.apple.com,
    suffix: apple-relay.cloudflare.com,
    suffix: apple-relay.fastly-edge.com,
    suffix: cp4.cloudflare.com,
    suffix: apple-relay.apple.com,
    suffix: anthropic.com,
    suffix: claude.ai,
    suffix: cdn.usefathom.com,
    suffix: claudeusercontent.com
) -> ai

l4proto(udp) && dport(443) -> block