Tailscale-如何部署-Derp-中转节点

1
# 更新系统并安装必要工具
2
sudo apt update && sudo apt install wget curl openssl net-tools -y

1
# 下载并解压
2
wget https://go.dev/dl/go1.22.1.linux-amd64.tar.gz
3
sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.22.1.linux-amd64.tar.gz
4

5
# 配置环境变量
6
echo 'export PATH=$PATH:/usr/local/go/bin' >> ~/.bashrc
7
echo 'export GOPATH=$HOME/go' >> ~/.bashrc
8
echo 'export PATH=$PATH:$GOPATH/bin' >> ~/.bashrc
9
source ~/.bashrc
10

11
# 验证版本
12
go version

1
# 开启 Go Proxy 加速
2
go env -w GO111MODULE=on
3
go env -w GOPROXY=https://goproxy.cn,direct
4

5
# 编译安装最新版 derper
6
go install tailscale.com/cmd/derper@main

1
# 创建证书存放目录
2
mkdir -p ~/derp-certs
3

4
# 生成包含 SAN (Subject Alternative Name) 的证书
5
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
6
  -keyout ~/derp-certs/8.137.79.119.key \
7
  -out ~/derp-certs/8.137.79.119.crt \
8
  -subj "/CN=8.137.79.119" \
9
  -addext "subjectAltName = IP:8.137.79.119"

1
sudo nano /etc/systemd/system/derp.service

1
[Unit]
2
Description=Tailscale DERP Server
3
After=network.target
4
Wants=network-online.target
5

6
[Service]
7
Type=simple
8
User=root
9
# 核心参数：监听 12443, 禁用 80, 指定证书目录, 开启客户端验证
10
ExecStart=/root/go/bin/derper -hostname 8.156.81.7 \
11
    -c /root/derper.conf \
12
    -a :12443 \
13
    -http-port -1 \
14
    -certmode manual \
15
    -certdir /root/derp-certs \
16
    -stun-port 3478 \
17
    --verify-clients
18
Restart=always
19
RestartSec=5
20
StartLimitInterval=0
21
LimitNOFILE=65536
22

23
[Install]
24
WantedBy=multi-user.target

1
sudo systemctl daemon-reload
2
sudo systemctl enable derp
3
sudo systemctl start derp
4

5
# 检查服务状态
6
sudo systemctl status derp

1
"derpMap": {
2
    "OmitDefaultRegions": false,
3
    "Regions": {
4
        "901": {
5
            "RegionID":   902,
6
            "RegionCode": "Ali-Company",
7
            "RegionName": "Aliyun Company Node",
8
            "Nodes": [
9
                {
10
                    "Name":     "1",
11
                    "RegionID": 901,
12
                    "HostName": "8.137.79.119",
13
                    "IPv4":     "8.137.79.119",
14
                    "STUNPort": 3478,
15
                    "DERPPort": 12443,
16
                    "CertName": "sha256-raw:5bfcc670de4b46313c3898c9b8b5545168f68d490fc386e02877bf3455ed65af"
17
                }
18
            ]
19
        }
20
    }
21
}