mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-10-29 09:14:59 +03:00
feat(amneziawg): add opt-in Linux kernel datapath (#6877)
* feat(amneziawg): add opt-in Linux kernel datapath Add the kernel backend as an explicit per-inbound option while keeping the embedded backend as the default. Include host preflight, UI/API support, the bundled installer CLI, lifecycle and accounting integration, regression tests, and upstream-facing documentation. Kernel mode is NAT-only and rejects unsupported routing, IPv6, forwarding, and pinned-listen configurations. Local saves check the local host; remote nodes check their own host during apply. Preserve adopted interface accounting across panel restarts, retain manager state after failed teardown so the job can retry, prevent embedded startup while a kernel interface remains live, and prune collector state for removed peers. Tested the restart accounting path on Debian 13 with XanMod 7.1.11 on x86_64; Docker and cross-kernel coverage are not claimed. * fix(amneziawg): align readiness and endpoint reporting Expire endpoint sightings using the latest handshake and sweep stale addresses for the polled interface. Keep the readiness API schema, generated client types, and ready-host empty blocker list consistent; watch the nested form field and defer local readiness checks for remote targets. Document safe rollback before using a build without kernel support. Regression evidence: the idle endpoint test failed before the collector change because the old address remained visible after 31 minutes; endpoint tests pass after the fix. The form component suite passes 3 tests; restoring the invalid array watch made its off-mode severity test fail, while the corrected dot-path watch passes. Targeted Go regressions across amneziawgkern, job, and service pass. * style(amneziawg): format readiness test * test: reproduce kernel AWG client validation gaps * test(service): cover kernel AWG shared client fanout * fix(amneziawg): validate kernel client fanout and config values * test(amneziawgkern): cover owned interface lifecycle recovery * fix(amneziawgkern): recover owned interfaces on restart * test(amneziawgkern): retain visibility after recovered cleanup failure * fix(amneziawgkern): report recovered interfaces while cleanup retries * style(amneziawgkern): satisfy static analysis * test(amneziawgkern): cover long rendered peer comments * fix(amneziawgkern): accept long generated config comments * test(amneziawgkern): refuse foreign occupied interfaces Capture the current Ensure ordering failure with real temporary config paths and manager side-effect boundaries. * test(amneziawgkern): cover stale interface collisions Extend the Ensure regression across absent links, mismatched live interfaces, cached manager state, and Remove teardown. * fix(amneziawgkern): verify interface ownership before mutation Refuse to replace or tear down links unless the canonical config is a valid panel-owned file and its key matches the live interface. Preserve normal adoption and key rotation, and document migration of legacy unmarked configs. Validation: go test ./internal/amneziawgkern -count=1; go test -race ./internal/amneziawgkern -count=1; golangci-lint run ./internal/amneziawgkern/...; git diff --check. * build: update Go toolchain to 1.27.3 * test(amneziawg): reproduce unsafe key rotation recovery Keep the previous owned config authoritative until teardown succeeds, and require fresh managers to rebuild structural key changes. These regressions expose the stuck live-key/disk-key mismatch after teardown failure. * fix(amneziawg): recover interrupted key rotations Keep the old owned config on disk until a structural rebuild has confirmed the previous interface is down. Fresh managers only adopt when the live config and desired structural identity match, so retries and removals retain the key needed to prove ownership. * fix(scanner): align Go image with module version * fix(docs): pin pnpm release with bootstrap fix pnpm 12.9.1 restores a Node launcher before its postinstall replaces the target with ELF; pnpm 11 then runs that binary as JavaScript. Pin 12.10.0, which includes the shim fix, so the docs CI bootstrap can switch versions safely. * fix(xray): build core from pinned module The configured Xray release asset tag is unpublished, and the latest published binary lacks GetUsersStats used by the panel. Build the packaged core from the exact Xray module version already selected in go.mod for Docker and release targets. * fix(tests): stabilize local network fixtures Keep the TUIC stream fragmentation check on a working UDP loopback path, allocate the AmneziaWG fixture ports dynamically, and wait for a real Xray stats response before starting API mutation assertions. Recreate failed readiness channels so an early connection cannot stall the probe. Verified host and offline parallel Go suites, repeated occupied-port and UDP tests, race/shuffle runs, and golangci-lint. Production behavior and dependency versions are unchanged. * fix(i18n): add the kernel-mode AmneziaWG keys to sk-SK main gained the sk-SK locale after this branch added its kernel-mode keys to the other 13, so i18n-dead-keys.test.ts failed on the merged tree. * refactor(amneziawgkern): apply kernel interfaces with direct commands, no awg-quick awg-quick evaluates PostUp/PostDown through a root shell, so every value the panel rendered into its config was one validation slip away from root command execution. The interface is now built with direct ip/awg/nft execs from a setconf-only file: link add, awg setconf, address, mtu, an atomically replaced nftables table per inbound, and the IPv4 forwarding sysctl written directly. - Panel-owned names and paths: xui-awg<id> interfaces, xui_awg<id> NAT tables and configs under the panel's data dir, so nothing collides with an operator's own awg0/awg1 awg-quick tunnels in /etc/amnezia/amneziawg. - FORWARD accepts (comment 3x-ui:xui-awg<id>) when iptables is present: Docker and ufw set the FORWARD policy to DROP, which silently black-holed the tunnel. - A full panel stop records the final counters and tears the interfaces down, like the embedded datapath; a stopped panel enforces no quota or expiry. Crash survivors are still adopted without a rebuild. - The job reads counters before reconciling, and from every managed interface, so a client disabled for quota, or a removed inbound, is charged for its last interval instead of losing it with the dropped peer. - An unchanged reconcile tick forks no process (it probed the live key with `awg show` every 10s); readiness no longer loads the module from a GET. Verified on the real module (WSL2 6.6 kernel, v3.1.20260906): create, peer and egress changes in place, SIGKILL adoption with the same ifindex, SIGTERM teardown leaving no link, table, FORWARD rule or config behind. * fix(amneziawg): gate kernel host readiness only when a save starts the datapath Every save of a kernel-mode inbound re-ran the host preflight, so a host that lost its module (a kernel upgrade without a DKMS rebuild) refused even disabling the inbound or switching it back to embedded mode. Host blockers now apply only when the save starts the kernel datapath: a new inbound, a switch from embedded, or enabling a disabled one. Feature blockers (IPv6, forwarded ports, pinned listen) still apply to every save. * feat(nodes): refuse kernel-mode AmneziaWG pushes to nodes that predate it A node built before kernel mode drops the unknown kernelMode field and serves the inbound on the embedded datapath while the master's form shows kernel mode on. Nodes now advertise awg-kernel in X-3x-Node-Caps, and Remote refuses to push a kernel-mode inbound to a node that has not advertised it, learning the caps with an inbound list first when this Remote has not heard from it. * fix(amneziawg): pin the kernel module installer to verified commits The installer ran as root and built whatever upstream tag sorted newest at install time. It now clones fixed tags (module v3.1.20260906, tools v3.1.20260812) and refuses unless each resolves to its recorded commit. The udp_tunnel perl patch is gone: those releases carry the kernel 7.1.5 compat upstream, so the patch never matched. * fix(i18n): translate the kernel-mode AmneziaWG strings All thirteen non-English locales carried the English text verbatim. * fix(amneziawg): skip the kernel traffic flush when no kernel interface runs Shutdown listed the desired AmneziaWG inbounds from the database even on a panel with no kernel interface, an unneeded query on every stop. A server stopped before its database was opened panicked on it, which turned TestServerStopWhenXrayNotRunningSucceeds red whenever it ran first. --------- Co-authored-by: MHSanaei <ho3ein.sanaei@gmail.com>
This commit is contained in:
YoungReckless4
GitHub
@@ -2236,7 +2236,19 @@
|
||||
"disableCookiesHint": "عدم إرسال ردود الكوكي — يزيل بصمة DPI لكنه يضعف الحماية من الفيضانات.",
|
||||
"listenPort": "Listen Port (optional)",
|
||||
"listenPortHint": "Fixed local UDP source port. Leave 0 to pick one automatically.",
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters."
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters.",
|
||||
"kernelUnavailable": "هذا الخادم لا يمكنه تشغيل وضع النواة بعد",
|
||||
"kernelBlocker": {
|
||||
"root": "اللوحة لا تعمل بصلاحيات root، لذا لا يمكنها إنشاء واجهة شبكة",
|
||||
"tools": "أمر مطلوب غير موجود؛ ثبّت amneziawg-tools و iproute2",
|
||||
"module": "وحدة النواة amneziawg غير مثبتة",
|
||||
"nft": "nftables غير مثبت؛ وهو مطلوب لقواعد NAT الخاصة بالنفق",
|
||||
"ipv6": "الخروج عبر IPv6 لكل نظير غير مدعوم بعد في وضع النواة",
|
||||
"portForwarding": "إعادة توجيه المنافذ لكل عميل غير مدعومة بعد في وضع النواة",
|
||||
"routeThroughXray": "لا يوجد تنفيذ لـ routeThroughXray في وضع النواة؛ سيترك النفق بلا مسار خروج"
|
||||
},
|
||||
"kernelMode": "وضع النواة",
|
||||
"kernelModeHint": "تشغيل هذا الـ inbound على وحدة نواة AmneziaWG بدلاً من مكدس مساحة المستخدم المدمج. عادةً أسرع، خاصة على الروابط ذات التأخير العالي، لكن توجيه Xray والـ sniffing و IPv6 وإعادة توجيه المنافذ لا تنطبق على نظرائه. يتطلب وحدة نواة AmneziaWG و amneziawg-tools على الخادم."
|
||||
},
|
||||
"tuic": {
|
||||
"congestionControl": "التحكم في الازدحام",
|
||||
|
||||
@@ -2357,7 +2357,19 @@
|
||||
"disableCookiesHint": "Never send cookie replies — removes a DPI fingerprint; weakens flood mitigation.",
|
||||
"listenPort": "Listen Port (optional)",
|
||||
"listenPortHint": "Fixed local UDP source port. Leave 0 to pick one automatically.",
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters."
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters.",
|
||||
"kernelUnavailable": "This host cannot run kernel mode yet",
|
||||
"kernelBlocker": {
|
||||
"root": "The panel is not running as root, so it cannot create a network interface",
|
||||
"tools": "A required command is missing; install amneziawg-tools and iproute2",
|
||||
"module": "The amneziawg kernel module is not installed",
|
||||
"nft": "nftables is not installed; it is needed for the tunnel's NAT rules",
|
||||
"ipv6": "Per-peer IPv6 egress is not supported in kernel mode yet",
|
||||
"portForwarding": "Per-client port forwarding is not supported in kernel mode yet",
|
||||
"routeThroughXray": "routeThroughXray has no kernel-mode implementation; it would leave the tunnel with no egress path"
|
||||
},
|
||||
"kernelMode": "Kernel mode",
|
||||
"kernelModeHint": "Run this inbound on the AmneziaWG kernel module instead of the built-in userspace stack. Usually faster, especially over high-latency links, but Xray routing, sniffing, IPv6 and port forwarding do not apply to its peers. Requires the AmneziaWG kernel module and amneziawg-tools on the host."
|
||||
},
|
||||
"tuic": {
|
||||
"congestionControl": "Congestion Control",
|
||||
|
||||
@@ -2236,7 +2236,19 @@
|
||||
"disableCookiesHint": "No enviar cookie replies — elimina una huella para DPI, pero debilita la mitigación de inundaciones.",
|
||||
"listenPort": "Listen Port (optional)",
|
||||
"listenPortHint": "Fixed local UDP source port. Leave 0 to pick one automatically.",
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters."
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters.",
|
||||
"kernelUnavailable": "Este host aún no puede ejecutar el modo kernel",
|
||||
"kernelBlocker": {
|
||||
"root": "El panel no se ejecuta como root, así que no puede crear una interfaz de red",
|
||||
"tools": "Falta un comando necesario; instala amneziawg-tools e iproute2",
|
||||
"module": "El módulo del kernel amneziawg no está instalado",
|
||||
"nft": "nftables no está instalado; es necesario para las reglas NAT del túnel",
|
||||
"ipv6": "La salida IPv6 por peer aún no es compatible con el modo kernel",
|
||||
"portForwarding": "El reenvío de puertos por cliente aún no es compatible con el modo kernel",
|
||||
"routeThroughXray": "routeThroughXray no tiene implementación en modo kernel; dejaría el túnel sin ruta de salida"
|
||||
},
|
||||
"kernelMode": "Modo kernel",
|
||||
"kernelModeHint": "Ejecuta este inbound en el módulo del kernel de AmneziaWG en lugar de la pila integrada en espacio de usuario. Suele ser más rápido, sobre todo en enlaces de alta latencia, pero el enrutamiento de Xray, el sniffing, IPv6 y el reenvío de puertos no se aplican a sus peers. Requiere el módulo del kernel de AmneziaWG y amneziawg-tools en el host."
|
||||
},
|
||||
"tuic": {
|
||||
"congestionControl": "Control de congestión",
|
||||
|
||||
@@ -2236,7 +2236,19 @@
|
||||
"disableCookiesHint": "هرگز پاسخ کوکی ارسال نشود — اثر انگشت DPI را حذف میکند اما دفاع در برابر سیلآسا را ضعیف میکند.",
|
||||
"listenPort": "Listen Port (optional)",
|
||||
"listenPortHint": "Fixed local UDP source port. Leave 0 to pick one automatically.",
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters."
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters.",
|
||||
"kernelUnavailable": "این سرور هنوز نمیتواند حالت کرنل را اجرا کند",
|
||||
"kernelBlocker": {
|
||||
"root": "پنل با دسترسی root اجرا نمیشود و نمیتواند رابط شبکه بسازد",
|
||||
"tools": "یک فرمان لازم پیدا نشد؛ amneziawg-tools و iproute2 را نصب کنید",
|
||||
"module": "ماژول کرنل amneziawg نصب نیست",
|
||||
"nft": "nftables نصب نیست؛ برای قواعد NAT تونل لازم است",
|
||||
"ipv6": "خروجی IPv6 برای هر peer هنوز در حالت کرنل پشتیبانی نمیشود",
|
||||
"portForwarding": "فوروارد پورت برای هر کلاینت هنوز در حالت کرنل پشتیبانی نمیشود",
|
||||
"routeThroughXray": "routeThroughXray در حالت کرنل پیادهسازی ندارد و تونل را بدون مسیر خروجی میگذارد"
|
||||
},
|
||||
"kernelMode": "حالت کرنل",
|
||||
"kernelModeHint": "این inbound را بهجای پشتهٔ داخلی userspace روی ماژول کرنل AmneziaWG اجرا میکند. معمولاً سریعتر است، بهویژه روی لینکهای با تأخیر بالا، اما مسیریابی Xray، sniffing، IPv6 و فوروارد پورت روی peerهای آن اعمال نمیشود. به ماژول کرنل AmneziaWG و amneziawg-tools روی سرور نیاز دارد."
|
||||
},
|
||||
"tuic": {
|
||||
"congestionControl": "کنترل ازدحام",
|
||||
|
||||
@@ -2236,7 +2236,19 @@
|
||||
"disableCookiesHint": "Tidak pernah mengirim cookie reply — menghapus sidik jari DPI, tetapi melemahkan mitigasi banjir.",
|
||||
"listenPort": "Listen Port (optional)",
|
||||
"listenPortHint": "Fixed local UDP source port. Leave 0 to pick one automatically.",
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters."
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters.",
|
||||
"kernelUnavailable": "Host ini belum bisa menjalankan mode kernel",
|
||||
"kernelBlocker": {
|
||||
"root": "Panel tidak berjalan sebagai root, sehingga tidak bisa membuat antarmuka jaringan",
|
||||
"tools": "Perintah yang diperlukan tidak ada; pasang amneziawg-tools dan iproute2",
|
||||
"module": "Modul kernel amneziawg belum terpasang",
|
||||
"nft": "nftables belum terpasang; diperlukan untuk aturan NAT terowongan",
|
||||
"ipv6": "Egress IPv6 per peer belum didukung dalam mode kernel",
|
||||
"portForwarding": "Penerusan port per klien belum didukung dalam mode kernel",
|
||||
"routeThroughXray": "routeThroughXray tidak punya implementasi mode kernel; terowongan akan tanpa jalur keluar"
|
||||
},
|
||||
"kernelMode": "Mode kernel",
|
||||
"kernelModeHint": "Jalankan inbound ini pada modul kernel AmneziaWG alih-alih stack userspace bawaan. Biasanya lebih cepat, terutama pada tautan berlatensi tinggi, tetapi routing Xray, sniffing, IPv6, dan penerusan port tidak berlaku untuk peer-nya. Memerlukan modul kernel AmneziaWG dan amneziawg-tools di host."
|
||||
},
|
||||
"tuic": {
|
||||
"congestionControl": "Kontrol Kemacetan",
|
||||
|
||||
@@ -2236,7 +2236,19 @@
|
||||
"disableCookiesHint": "cookie replyを送信しません。DPIの指紋を消しますが、フラッド緩和は弱まります。",
|
||||
"listenPort": "Listen Port (optional)",
|
||||
"listenPortHint": "Fixed local UDP source port. Leave 0 to pick one automatically.",
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters."
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters.",
|
||||
"kernelUnavailable": "このホストではまだカーネルモードを実行できません",
|
||||
"kernelBlocker": {
|
||||
"root": "パネルが root で実行されていないため、ネットワークインターフェースを作成できません",
|
||||
"tools": "必要なコマンドがありません。amneziawg-tools と iproute2 をインストールしてください",
|
||||
"module": "amneziawg カーネルモジュールがインストールされていません",
|
||||
"nft": "nftables がインストールされていません。トンネルの NAT ルールに必要です",
|
||||
"ipv6": "カーネルモードではピアごとの IPv6 送信はまだサポートされていません",
|
||||
"portForwarding": "カーネルモードではクライアントごとのポート転送はまだサポートされていません",
|
||||
"routeThroughXray": "routeThroughXray にはカーネルモードの実装がなく、トンネルの出口がなくなります"
|
||||
},
|
||||
"kernelMode": "カーネルモード",
|
||||
"kernelModeHint": "このインバウンドを内蔵のユーザースペーススタックではなく AmneziaWG カーネルモジュールで実行します。特に遅延の大きい回線では通常高速ですが、Xray のルーティング、スニッフィング、IPv6、ポート転送はそのピアに適用されません。ホストに AmneziaWG カーネルモジュールと amneziawg-tools が必要です。"
|
||||
},
|
||||
"tuic": {
|
||||
"congestionControl": "輻輳制御",
|
||||
|
||||
@@ -2236,7 +2236,19 @@
|
||||
"disableCookiesHint": "Nunca enviar cookie replies — remove uma impressão digital de DPI, mas enfraquece a mitigação de inundações.",
|
||||
"listenPort": "Listen Port (optional)",
|
||||
"listenPortHint": "Fixed local UDP source port. Leave 0 to pick one automatically.",
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters."
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters.",
|
||||
"kernelUnavailable": "Este host ainda não pode executar o modo kernel",
|
||||
"kernelBlocker": {
|
||||
"root": "O painel não está rodando como root, então não pode criar uma interface de rede",
|
||||
"tools": "Falta um comando necessário; instale amneziawg-tools e iproute2",
|
||||
"module": "O módulo de kernel amneziawg não está instalado",
|
||||
"nft": "nftables não está instalado; ele é necessário para as regras NAT do túnel",
|
||||
"ipv6": "Saída IPv6 por peer ainda não é suportada no modo kernel",
|
||||
"portForwarding": "Encaminhamento de portas por cliente ainda não é suportado no modo kernel",
|
||||
"routeThroughXray": "routeThroughXray não tem implementação no modo kernel; deixaria o túnel sem rota de saída"
|
||||
},
|
||||
"kernelMode": "Modo kernel",
|
||||
"kernelModeHint": "Executa este inbound no módulo de kernel do AmneziaWG em vez da pilha embutida em espaço de usuário. Geralmente mais rápido, principalmente em links de alta latência, mas o roteamento do Xray, o sniffing, IPv6 e o encaminhamento de portas não se aplicam aos seus peers. Requer o módulo de kernel do AmneziaWG e o amneziawg-tools no host."
|
||||
},
|
||||
"tuic": {
|
||||
"congestionControl": "Controle de congestionamento",
|
||||
|
||||
@@ -2236,7 +2236,19 @@
|
||||
"disableCookiesHint": "Не отправлять cookie reply — убирает сигнатуру для DPI, но ослабляет защиту от флуда.",
|
||||
"listenPort": "Listen Port (optional)",
|
||||
"listenPortHint": "Fixed local UDP source port. Leave 0 to pick one automatically.",
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters."
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters.",
|
||||
"kernelUnavailable": "Этот сервер пока не может работать в режиме ядра",
|
||||
"kernelBlocker": {
|
||||
"root": "Панель запущена не от root, поэтому не может создать сетевой интерфейс",
|
||||
"tools": "Не найдена нужная команда; установите amneziawg-tools и iproute2",
|
||||
"module": "Модуль ядра amneziawg не установлен",
|
||||
"nft": "nftables не установлен; он нужен для правил NAT туннеля",
|
||||
"ipv6": "Выход по IPv6 для отдельных пиров в режиме ядра пока не поддерживается",
|
||||
"portForwarding": "Проброс портов для клиентов в режиме ядра пока не поддерживается",
|
||||
"routeThroughXray": "routeThroughXray не реализован в режиме ядра: у туннеля не останется пути наружу"
|
||||
},
|
||||
"kernelMode": "Режим ядра",
|
||||
"kernelModeHint": "Запускать этот inbound на модуле ядра AmneziaWG вместо встроенного стека в пространстве пользователя. Обычно быстрее, особенно на каналах с большой задержкой, но маршрутизация Xray, sniffing, IPv6 и проброс портов к его пирам не применяются. Требуются модуль ядра AmneziaWG и amneziawg-tools на сервере."
|
||||
},
|
||||
"tuic": {
|
||||
"congestionControl": "Контроль перегрузок",
|
||||
|
||||
@@ -2357,7 +2357,19 @@
|
||||
"disableCookiesHint": "Nikdy neposielať odpovede cookie. Odstráni rozpoznateľný znak pre DPI, ale oslabí ochranu pred zahltením.",
|
||||
"listenPort": "Port na počúvanie (voliteľné)",
|
||||
"listenPortHint": "Pevný miestny zdrojový port UDP. Hodnota 0 vyberie port automaticky.",
|
||||
"outboundObfuscationHint": "Musia sa presne zhodovať s parametrami servera."
|
||||
"outboundObfuscationHint": "Musia sa presne zhodovať s parametrami servera.",
|
||||
"kernelUnavailable": "Tento server zatiaľ nemôže spustiť režim jadra",
|
||||
"kernelBlocker": {
|
||||
"root": "Panel nebeží ako root, preto nemôže vytvoriť sieťové rozhranie",
|
||||
"tools": "Chýba potrebný príkaz; nainštalujte amneziawg-tools a iproute2",
|
||||
"module": "Modul jadra amneziawg nie je nainštalovaný",
|
||||
"nft": "nftables nie je nainštalovaný; je potrebný pre pravidlá NAT tunela",
|
||||
"ipv6": "Výstup IPv6 pre jednotlivé peery režim jadra zatiaľ nepodporuje",
|
||||
"portForwarding": "Presmerovanie portov pre jednotlivých klientov režim jadra zatiaľ nepodporuje",
|
||||
"routeThroughXray": "routeThroughXray nemá implementáciu v režime jadra; tunel by zostal bez výstupnej cesty"
|
||||
},
|
||||
"kernelMode": "Režim jadra",
|
||||
"kernelModeHint": "Spustí tento inbound na module jadra AmneziaWG namiesto vstavaného zásobníka v používateľskom priestore. Zvyčajne je rýchlejší, najmä na linkách s vysokou latenciou, ale smerovanie Xray, sniffing, IPv6 a presmerovanie portov sa na jeho peery neuplatňujú. Vyžaduje modul jadra AmneziaWG a amneziawg-tools na serveri."
|
||||
},
|
||||
"tuic": {
|
||||
"congestionControl": "Riadenie zahltenia",
|
||||
|
||||
@@ -2236,7 +2236,19 @@
|
||||
"disableCookiesHint": "Cookie reply asla gönderilmez — bir DPI parmak izini kaldırır ancak taşma korumasını zayıflatır.",
|
||||
"listenPort": "Listen Port (optional)",
|
||||
"listenPortHint": "Fixed local UDP source port. Leave 0 to pick one automatically.",
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters."
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters.",
|
||||
"kernelUnavailable": "Bu sunucu henüz çekirdek modunu çalıştıramıyor",
|
||||
"kernelBlocker": {
|
||||
"root": "Panel root olarak çalışmıyor, bu yüzden ağ arayüzü oluşturamıyor",
|
||||
"tools": "Gerekli bir komut eksik; amneziawg-tools ve iproute2'yi kurun",
|
||||
"module": "amneziawg çekirdek modülü kurulu değil",
|
||||
"nft": "nftables kurulu değil; tünelin NAT kuralları için gerekli",
|
||||
"ipv6": "Eş başına IPv6 çıkışı çekirdek modunda henüz desteklenmiyor",
|
||||
"portForwarding": "İstemci başına port yönlendirme çekirdek modunda henüz desteklenmiyor",
|
||||
"routeThroughXray": "routeThroughXray'in çekirdek modunda bir uygulaması yok; tüneli çıkış yolu olmadan bırakır"
|
||||
},
|
||||
"kernelMode": "Çekirdek modu",
|
||||
"kernelModeHint": "Bu inbound'u yerleşik kullanıcı alanı yığını yerine AmneziaWG çekirdek modülünde çalıştırır. Özellikle yüksek gecikmeli bağlantılarda genellikle daha hızlıdır, ancak Xray yönlendirmesi, sniffing, IPv6 ve port yönlendirme eşlerine uygulanmaz. Sunucuda AmneziaWG çekirdek modülü ve amneziawg-tools gerekir."
|
||||
},
|
||||
"tuic": {
|
||||
"congestionControl": "Tıkanıklık Kontrolü",
|
||||
|
||||
@@ -2236,7 +2236,19 @@
|
||||
"disableCookiesHint": "Ніколи не надсилати cookie reply — прибирає відбиток для DPI, але послаблює захист від флуду.",
|
||||
"listenPort": "Listen Port (optional)",
|
||||
"listenPortHint": "Fixed local UDP source port. Leave 0 to pick one automatically.",
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters."
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters.",
|
||||
"kernelUnavailable": "Цей сервер поки не може працювати в режимі ядра",
|
||||
"kernelBlocker": {
|
||||
"root": "Панель запущена не від root, тому не може створити мережевий інтерфейс",
|
||||
"tools": "Не знайдено потрібну команду; встановіть amneziawg-tools та iproute2",
|
||||
"module": "Модуль ядра amneziawg не встановлено",
|
||||
"nft": "nftables не встановлено; він потрібен для правил NAT тунелю",
|
||||
"ipv6": "Вихід через IPv6 для окремих пірів у режимі ядра поки не підтримується",
|
||||
"portForwarding": "Переадресація портів для клієнтів у режимі ядра поки не підтримується",
|
||||
"routeThroughXray": "routeThroughXray не реалізовано в режимі ядра: тунель залишиться без шляху назовні"
|
||||
},
|
||||
"kernelMode": "Режим ядра",
|
||||
"kernelModeHint": "Запускати цей inbound на модулі ядра AmneziaWG замість вбудованого стеку в просторі користувача. Зазвичай швидше, особливо на каналах із великою затримкою, але маршрутизація Xray, sniffing, IPv6 та переадресація портів до його пірів не застосовуються. Потрібні модуль ядра AmneziaWG та amneziawg-tools на сервері."
|
||||
},
|
||||
"tuic": {
|
||||
"congestionControl": "Контроль перевантаження",
|
||||
|
||||
@@ -2236,7 +2236,19 @@
|
||||
"disableCookiesHint": "Không bao giờ gửi cookie reply — xóa một dấu vết DPI nhưng làm yếu khả năng chống flood.",
|
||||
"listenPort": "Listen Port (optional)",
|
||||
"listenPortHint": "Fixed local UDP source port. Leave 0 to pick one automatically.",
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters."
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters.",
|
||||
"kernelUnavailable": "Máy chủ này chưa thể chạy chế độ kernel",
|
||||
"kernelBlocker": {
|
||||
"root": "Bảng điều khiển không chạy với quyền root nên không thể tạo giao diện mạng",
|
||||
"tools": "Thiếu một lệnh cần thiết; hãy cài amneziawg-tools và iproute2",
|
||||
"module": "Chưa cài mô-đun kernel amneziawg",
|
||||
"nft": "Chưa cài nftables; cần cho các quy tắc NAT của đường hầm",
|
||||
"ipv6": "Chế độ kernel chưa hỗ trợ đầu ra IPv6 theo từng peer",
|
||||
"portForwarding": "Chế độ kernel chưa hỗ trợ chuyển tiếp cổng theo từng client",
|
||||
"routeThroughXray": "routeThroughXray chưa có triển khai cho chế độ kernel; đường hầm sẽ không có đường ra"
|
||||
},
|
||||
"kernelMode": "Chế độ kernel",
|
||||
"kernelModeHint": "Chạy inbound này trên mô-đun kernel AmneziaWG thay cho ngăn xếp userspace tích hợp. Thường nhanh hơn, nhất là trên đường truyền có độ trễ cao, nhưng định tuyến Xray, sniffing, IPv6 và chuyển tiếp cổng không áp dụng cho các peer của nó. Cần mô-đun kernel AmneziaWG và amneziawg-tools trên máy chủ."
|
||||
},
|
||||
"tuic": {
|
||||
"congestionControl": "Kiểm soát tắc nghẽn",
|
||||
|
||||
@@ -2236,7 +2236,19 @@
|
||||
"disableCookiesHint": "从不发送 cookie reply——消除一个 DPI 指纹，但会削弱抗洪泛能力。",
|
||||
"listenPort": "Listen Port (optional)",
|
||||
"listenPortHint": "Fixed local UDP source port. Leave 0 to pick one automatically.",
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters."
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters.",
|
||||
"kernelUnavailable": "此主机暂时无法运行内核模式",
|
||||
"kernelBlocker": {
|
||||
"root": "面板未以 root 身份运行，无法创建网络接口",
|
||||
"tools": "缺少必需的命令；请安装 amneziawg-tools 和 iproute2",
|
||||
"module": "未安装 amneziawg 内核模块",
|
||||
"nft": "未安装 nftables；隧道的 NAT 规则需要它",
|
||||
"ipv6": "内核模式暂不支持按对等端的 IPv6 出站",
|
||||
"portForwarding": "内核模式暂不支持按客户端的端口转发",
|
||||
"routeThroughXray": "routeThroughXray 没有内核模式实现，会使隧道没有出站路径"
|
||||
},
|
||||
"kernelMode": "内核模式",
|
||||
"kernelModeHint": "使用 AmneziaWG 内核模块而非内置用户态协议栈运行此入站。通常更快，尤其在高延迟链路上，但 Xray 路由、嗅探、IPv6 和端口转发不适用于其对等端。需要主机上安装 AmneziaWG 内核模块和 amneziawg-tools。"
|
||||
},
|
||||
"tuic": {
|
||||
"congestionControl": "拥塞控制算法",
|
||||
|
||||
@@ -2236,7 +2236,19 @@
|
||||
"disableCookiesHint": "永不傳送 cookie reply——消除一個 DPI 指紋，但會削弱抗洪泛能力。",
|
||||
"listenPort": "Listen Port (optional)",
|
||||
"listenPortHint": "Fixed local UDP source port. Leave 0 to pick one automatically.",
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters."
|
||||
"outboundObfuscationHint": "Must exactly match the server side parameters.",
|
||||
"kernelUnavailable": "此主機暫時無法執行核心模式",
|
||||
"kernelBlocker": {
|
||||
"root": "面板未以 root 身分執行，無法建立網路介面",
|
||||
"tools": "缺少必要的指令；請安裝 amneziawg-tools 與 iproute2",
|
||||
"module": "未安裝 amneziawg 核心模組",
|
||||
"nft": "未安裝 nftables；通道的 NAT 規則需要它",
|
||||
"ipv6": "核心模式尚不支援每個對等端的 IPv6 出口",
|
||||
"portForwarding": "核心模式尚不支援每個用戶端的連接埠轉發",
|
||||
"routeThroughXray": "routeThroughXray 沒有核心模式實作，會讓通道沒有出口路徑"
|
||||
},
|
||||
"kernelMode": "核心模式",
|
||||
"kernelModeHint": "以 AmneziaWG 核心模組取代內建的使用者空間堆疊來執行此入站。通常更快，尤其是在高延遲連線上，但 Xray 路由、嗅探、IPv6 與連接埠轉發不適用於其對等端。主機需安裝 AmneziaWG 核心模組與 amneziawg-tools。"
|
||||
},
|
||||
"tuic": {
|
||||
"congestionControl": "壅塞控制演算法",
|
||||
|
||||
Reference in New Issue
Block a user