无域名且不修改源码的部署derp方案。网上纯ip部署derp的方案通常需要修改源码，检索之后发现有大佬分析了其实不用修改源码。遂记录如下。
1. 安装 Tailscale 并登录
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
wget https://pkgs.tailscale.com/stable/tailscale_<VERSION>_<ARCH>.tgz
tar -xf tailscale_<VERSION>_<ARCH>.tgz
mv tailscaled /usr/sbin/
mv tailscale /usr/bin/
mv systemd/tailscaled.service /lib/systemd/system
mv tailscaled.defaults /etc/default/tailscaled
vim /etc/default/tailscale
systemctl enable --now tailscaled
tailscale up --accept-routes=true --accept-dns=false --netfilter-mode=off --login-server=https://example.com
|
2. 安装 DERP
详细请见参考1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
wget https://go.dev/dl/go<VERSION>.linux-<ARCH>.tar.gz
tar -C /usr/local -xf go<VERSION>.linux-<ARCH>.tar.gz
export PATH=$PATH:/usr/local/go/bin
go version
go env -w GOPROXY=https://goproxy.cn,direct
go install tailscale.com/cmd/derper@latest
|
3. 创建自签名证书并启动DERP
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
| DERP_HOST="baidu.com"
DERP_PORT=10086
STUN_PORT=10086
mkdir ~/certdir && cd ~/certdir
openssl genpkey -algorithm RSA -out ${DERP_HOST}.key
openssl req -new -key ${DERP_HOST}.key -out ${DERP_HOST}.csr
openssl x509 -req \
-days 36500 \
-in ${DERP_HOST}.csr \
-signkey ${DERP_HOST}.key \
-out ${DERP_HOST}.crt \
-extfile <(printf "subjectAltName=DNS:${DERP_HOST}")
~/go/bin/derper \
-c ~/derper.key \
-a :${DERP_PORT} -http-port -1 \
-stun-port ${STUN_PORT} \
-hostname ${DERP_HOST} \
--certmode manual \
-certdir ~/certdir \
--verify-clients
|
验证derp服务
1
2
|
curl --insecure --resolve "${DERP_HOST}:${DERP_PUB_PORT}:${DERP_PUB_IP}" "https://${DERP_HOST}:${DERP_PUB_PORT}"
|
4. 修改Headscale的derp服务器
修改 derp.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
| {
"Regions": {
"900": {
"RegionID": 900,
"RegionCode": "rcd",
"RegionName": "Region Name",
"Nodes": [
{
"Name": "node",
"RegionID": 900,
"HostName": "baidu.com",
"IPv4": "<DERP_IPv4>",
"DERPPort": 10086,
"STUNPort": 10086,
"InsecureForTests": true
}
]
}
}
}
|
重启headscale服务（可先调短derp更新时间）
5. 验证
客户端输入
1
2
3
| tailscale netcheck
tailscale status
tailscale ping 100.64.0.x
|
参考