登录
首页/技术

树莓派 sing-box 家庭网关配置方案

383
  • jqx
    jqxUID 10768Lv.3 初识社区 编辑于

    使用树莓派安装sing-box，作为旁路由，实现以下功能：

    • DNS 分流 (国内直连 + 国外走代理)
    • 广告过滤
    • FakeIP 加速
    • 全屋设备透明代理

    网络规划:

    • 主路由：192.168.1.1
    • 树莓派：192.168.1.120（静态 IP）
    • 局域网：192.168.1.0/24

    基础系统设置

    #更新系统
bbq@raspi2b:~ $sudo apt update && sudo apt upgrade -y

#安装必要工具
bbq@raspi2b:~ $sudo apt install -y curl wget git vim

#设置静态IP
#查询网络接口
bbq@raspi2b:~ $ nmcli con show
NAME           UUID                                  TYPE      DEVICE 
有线连接 1     f2f41e48-104e-3128-be62-a5910333934f  ethernet  eth0   
preconfigured  546c7480-7574-4054-87cc-cd7c6f9f1c92  wifi      wlan0  
lo             8c6efa28-ebb4-40a5-88c5-9fd83013c1d4  loopback  lo     
#修改ip为192.168.1.120
bbq@raspi2b:~ $sudo nmcli con mod "有线连接 1" ipv4.addresses 192.168.1.120/24
#修改网关为192.168.1.1
bbq@raspi2b:~ $sudo nmcli con mod "有线连接 1" ipv4.gateway 192.168.1.1
#修改dns为192.168.1.1
bbq@raspi2b:~ $sudo nmcli con mod "有线连接 1" ipv4.dns 192.168.1.1
#修改为手动IP
bbq@raspi2b:~ $sudo nmcli con mod "有线连接 1" ipv4.method manual
#重启连接
bbq@raspi2b:~ $sudo nmcli con up "有线连接 1"

#开启IP转发
bbq@raspi2b:~ $sudo echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
bbq@raspi2b:~ $sudo sysctl -p

#重启树莓派
bbq@raspi2b:~ $sudo reboot

    安装 sing-box

    # 官方安装
bbq@raspi2b:~ $ curl -fsSL https://sing-box.app/install.sh | sh
Downloading https://github.com/SagerNet/sing-box/releases/download/v1.14.0/sing-box_1.14.0_linux_armhf.deb
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:--  0:00:01 --:--:--     0
100 28.2M  100 28.2M    0     0   758k      0  0:00:38  0:00:38 --:--:-- 2050k
sudo dpkg -i sing-box_1.14.0_linux_armhf.deb
正在选中未选择的软件包 sing-box。
(正在读取数据库 ... 系统当前共安装有 68288 个文件和目录。)
准备解压 sing-box_1.14.0_linux_armhf.deb  ...
正在解压 sing-box (1.14.0) ...
正在设置 sing-box (1.14.0) ...
Creating group 'sing-box' with GID 985.
Creating user 'sing-box' (sing-box Service) with UID 985 and GID 985.
正在处理用于 dbus (1.16.2-2) 的触发器 ...

# 验证
bbq@raspi2b:~ $ sing-box version
sing-box version 1.14.0

Environment: go1.26.7 linux/arm
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,with_cloudflared,with_naive_outbound,with_usbip,with_openvpn,with_openconnect,badlinkname,tfogo_checklinkname0,with_musl
Revision: 0b8995879f29a9b98ee027bc17b75e101445b238
CGO: enabled

    配置 sing-box

    sudo mkdir -p /etc/sing-box
sudo mkdir -p /var/lib/sing-box
sudo touch /etc/sing-box/config.json

    /etc/sing-box/config.json内容如下：

    {
  "log": {
    "level": "info",
    "timestamp": true
  },
  "dns": {
    "servers": [
      {
        "tag": "dns-remote",
        "type": "https",
        "server": "1.1.1.1",
        "detour": "proxy"
      },
      {
        "tag": "dns-direct",
        "type": "https",
        "server": "223.5.5.5"
      },
      {
        "tag": "dns-fakeip",
        "type": "fakeip",
        "inet4_range": "198.18.0.0/15",
        "inet6_range": "fc00::/18"
      }
    ],
    "rules": [
      {
        "rule_set": "geosite-category-ads-all",
        "action": "reject"
      },
      {
        "rule_set": [
          "geosite-cn",
          "geosite-apple"
        ],
        "server": "dns-direct"
      },
      {
        "query_type": ["A", "AAAA"],
        "server": "dns-fakeip"
      }
    ],
    "final": "dns-remote",
    "strategy": "prefer_ipv4",
    "independent_cache": true
  },
  "inbounds": [
    {
      "type": "tun",
      "tag": "tun-in",
      "interface_name": "singbox",
      "address": [
        "172.19.0.1/30",
        "fdfe:dcba:9876::1/126"
      ],
      "mtu": 1500,
      "auto_route": true,
      "strict_route": true,
      "stack": "system"
    }
  ],
  "outbounds": [
    {
      "type": "hysteria2",
      "tag": "proxy",
      "server": "服务IP",
      "server_port": 服务端口号,
      "password": "密码",
      "up_mbps": 80,
      "down_mbps": 500,
      "tls": {
        "enabled": true,
        "server_name": "证书签发域名",
        "insecure": false
      }
    },
    {
      "type": "direct",
      "tag": "direct"
    },
    {
      "type": "block",
      "tag": "block"
    }
  ],
  "route": {
    "rules": [
      {
        "action": "sniff"
      },
      {
        "protocol": "dns",
        "action": "hijack-dns"
      },
      {
        "ip_is_private": true,
        "outbound": "direct"
      },
      {
        "ip_cidr": [
          "198.18.0.0/15",
          "fc00::/18"
        ],
        "outbound": "proxy"
      },
      {
        "rule_set": "geosite-category-ads-all",
        "outbound": "block"
      },
      {
        "rule_set": [
          "geosite-cn",
          "geoip-cn",
          "geosite-apple"
        ],
        "outbound": "direct"
      },
      {
        "rule_set": "geosite-geolocation-!cn",
        "outbound": "proxy"
      }
    ],
    "rule_set": [
      {
        "type": "remote",
        "tag": "geosite-cn",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-cn.srs",
        "download_detour": "direct",
        "update_interval": "1d"
      },
      {
        "type": "remote",
        "tag": "geosite-geolocation-!cn",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-geolocation-!cn.srs",
        "download_detour": "direct",
        "update_interval": "1d"
      },
      {
        "type": "remote",
        "tag": "geoip-cn",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs",
        "download_detour": "direct",
        "update_interval": "1d"
      },
      {
        "type": "remote",
        "tag": "geosite-category-ads-all",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-category-ads-all.srs",
        "download_detour": "direct",
        "update_interval": "1d"
      },
      {
        "type": "remote",
        "tag": "geosite-apple",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-apple.srs",
        "download_detour": "direct",
        "update_interval": "1d"
      }
    ],
    "final": "proxy",
    "auto_detect_interface": true,
    "default_domain_resolver": "dns-remote"
  },
  "experimental": {
    "cache_file": {
      "enabled": true,
      "path": "/var/lib/sing-box/cache.db",
      "store_fakeip": true
    },
    "clash_api": {
      "external_controller": "0.0.0.0:9090",
      "external_ui": "ui",
      "secret": ""
    }
  }
}

    如果无法下载以上五个srs文件，可用以下链接替代。

    http://rn.jqx.me:1234/singbox/geoip-cn.srs
http://rn.jqx.me:1234/singbox/geosite-apple.srs
http://rn.jqx.me:1234/singbox/geosite-category-ads-all.srs
http://rn.jqx.me:1234/singbox/geosite-cn.srs
http://rn.jqx.me:1234/singbox/geosite-geolocation-!cn.srs

    启动 sing-box 服务

    # 检查配置是否正确
sudo sing-box check -c /etc/sing-box/config.json
# 没有输出就是正确的，有错误输出找deepseek问问

# 设置权限
bbq@raspi2b:~ $ sudo chown -R sing-box:sing-box /var/lib/sing-box

# 启动并设置开机自启
bbq@raspi2b:~ $ sudo systemctl enable --now sing-box
Created symlink /etc/systemd/system/multi-user.target.wants/sing-box.service → /lib/systemd/system/sing-box.service.

# 查看状态
bbq@raspi2b:~ $ sudo systemctl status sing-box.service 
● sing-box.service - sing-box service
     Loaded: loaded (/lib/systemd/system/sing-box.service; enabled; preset: enabled)
     Active: active (running) since Wed 2026-08-19 10:28:00 CST; 4s ago
       Docs: https://sing-box.sagernet.org
   Main PID: 25579 (sing-box)
      Tasks: 9 (limit: 1579)
        CPU: 385ms
     CGroup: /system.slice/sing-box.service
             └─25579 /usr/bin/sing-box -D /var/lib/sing-box -C /etc/sing-box run

8月 19 10:28:00 raspi2b systemd[1]: Started sing-box.service - sing-box service.
8月 19 10:28:00 raspi2b sing-box[25579]: +0800 2026-08-19 10:28:00 INFO network: updated default in>
8月 19 10:28:00 raspi2b sing-box[25579]: +0800 2026-08-19 10:28:00 INFO outbound/direct[direct]: ou>
8月 19 10:28:00 raspi2b sing-box[25579]: +0800 2026-08-19 10:28:00 INFO outbound/direct[direct]: ou>
8月 19 10:28:00 raspi2b sing-box[25579]: +0800 2026-08-19 10:28:00 INFO outbound/direct[direct]: ou>
8月 19 10:28:00 raspi2b sing-box[25579]: +0800 2026-08-19 10:28:00 INFO outbound/direct[direct]: ou>
8月 19 10:28:00 raspi2b sing-box[25579]: +0800 2026-08-19 10:28:00 INFO outbound/direct[direct]: ou>
bbq@raspi2b:~ $ 

# 实时日志
journalctl -u sing-box -f

    验证是否成功

    树莓派直接运行以下命令进行效果验证

    测试 FakeIP 是否生效，应返回 198.18.x.x 的地址

    bbq@raspi2b:~ $ dig google.com

; <<>> DiG 9.18.49-1~deb12u2-Raspbian <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55368
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;google.com.                    IN      A

;; ANSWER SECTION:
google.com.             600     IN      A       198.18.0.4

;; Query time: 0 msec
;; SERVER: 192.168.1.1#53(192.168.1.1) (UDP)
;; WHEN: Wed Aug 19 11:21:41 CST 2026
;; MSG SIZE  rcvd: 54

    测试国内网站是否直连，应返回真实国内 IP

    bbq@raspi2b:~ $ dig baidu.com

; <<>> DiG 9.18.49-1~deb12u2-Raspbian <<>> baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49956
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;baidu.com.                     IN      A

;; ANSWER SECTION:
baidu.com.              404     IN      A       124.237.177.164
baidu.com.              404     IN      A       110.242.74.102
baidu.com.              404     IN      A       111.63.65.103
baidu.com.              404     IN      A       111.63.65.247

;; Query time: 10 msec
;; SERVER: 192.168.1.1#53(192.168.1.1) (UDP)
;; WHEN: Wed Aug 19 11:23:12 CST 2026
;; MSG SIZE  rcvd: 138

    测试代理是否通，应能正常返回

    bbq@raspi2b:~ $ curl -I https://www.google.com
HTTP/2 200 
content-type: text/html; charset=ISO-8859-1
content-security-policy-report-only: object-src 'none';base-uri 'self';script-src 'nonce-_mNvUY7AfwF3jaLz8f2FFw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
accept-ch: Sec-CH-Prefers-Color-Scheme
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
date: Wed, 19 Aug 2026 03:34:31 GMT
server: gws
x-xss-protection: 0
x-frame-options: SAMEORIGIN
expires: Wed, 19 Aug 2026 03:34:31 GMT
cache-control: private
set-cookie: __Secure-STRP=ANmZwa2Y-7OORPHtNOhKvgp4C7yY6TKCtrh4noCxhHznjce3_IapdUF737MsdxDbhbabAl70FfYvQvqmHbFG13F4PKx6YrPwzQ; expires=Wed, 19-Aug-2026 03:39:31 GMT; path=/; domain=.google.com; Secure; SameSite=strict
set-cookie: AEC=AdJVEavTPa2adirqwbZx7YLfp3zaHR24uE1NhnITpZG4RNcXkGiBxRqRqQ; expires=Mon, 15-Feb-2027 03:34:31 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
set-cookie: NID=534=ImayDwBGHKUhurxwkJGWGP1EJ_k0WC3fCZfYo1ptk1cprvbHIYEPT3VDckLYv6KRWk2SjaRjdCwLAjannUOi76DOCD0vl2w-LQ4yvrotq-imi1a8mWbBJRGZcBxzYIm7iACuSCY51St6tvd8msKGH_dN6Rd5dFrLhYHbRKgY3v2k5Hd525FZmTchqzMGvli_eiwbnZ1PshXlEAfHP7ux; expires=Thu, 18-Feb-2027 03:34:31 GMT; path=/; domain=.google.com; HttpOnly
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

    如果有验证不通过的，检查 sing-box 日志journalctl -u sing-box -f，找 deepseek 问问。

    其他设备使用树莓派网关

    局域网中其他设备将默认网关和DNS设置为树莓派 IP192.168.1.120即可。

    增加 tailscale 节点配置

    sing-box 已经支持连接 tailscale，以下为增加 tailscale 的配置示例

    在dns的rules中增加 ts 域名走直连

          {
        "domain_suffix": [".ts.net"],
        "server": "dns-direct"
      }

    增加tailscale endpoints配置

      "endpoints": [
    {
      "type": "tailscale",
      "tag": "tailscale-endpoint",
      // auth_key在tailscale后台setting的key中生成
      "auth_key": "tskey-auth-khfsdafQffdsafQSfdsaf", 
      "hostname": "raspi2b",
      "accept_routes": true,
      "advertise_routes": ["192.168.1.0/24"],
      "state_directory": "/var/lib/sing-box/tailscale"
    }
  ]

    新建目录修改权限

    sudo mkdir -p /var/lib/sing-box/tailscale
sudo chown -R sing-box:sing-box /var/lib/sing-box/tailscale

    在 route 规则中增加 tailscale ip 和域名走直连

      {
        "ip_cidr": [
          "100.64.0.0/10"
        ],
        "outbound": "direct"
  },	
        {
        "domain_suffix": [".ts.net"],
        "outbound": "direct"
      }

    完整配置文件在这里/singbox/config.json.bak.ts，下载后自行修改。

    这样以树莓派为网关的设备即可访问 tailscale 组网中的其他设备。

    重点来了，但树莓派不能访问 tailscale 组网中的其他设备，树莓派要访问得自己安装 tailscale 再tailscale up加入才行。

    -_-! 神逻辑!

    https://0x8.net/post/installing_syncthing_on_raspberry_pi_and_systemd_startup_management/

  • 收藏支持反对打赏

3 条回复

  • jqx
    jqxUID 10768Lv.3 初识社区楼主
    #1

    image.webp

    当前系统负荷

  • xuhengxin
    xuhengxinUID 9223Lv.6 经常露面
    #2

    都在水帖, 只有你在认真搞技术, 而且还是如此之详细的文档! 很棒

  • guest
    guest63Lv.19
    #3

    顶一个，支持

发表回复