「轉載」降低hysteria伺服器被封鎖的幾點建議

[mkevinstever]

以下內容轉載自Telegram一個Group Chat，應作者要求轉載保持匿名，原始內容爲簡體字：

自建的hysteria代理服务器请务必做好以下安全措施，以降低被封的的几率：

1.需要确保服务器上设置的客户端认证密码足够长（大小写字母和数字，长于10位）且难猜
因为审查者可以通过将怀疑IP地址拉清单，然后伪装成客户端去尝试连接的方式来主动探测目标是否为指定的服务器，如果密码被猜中了，那服务器IP就”完犊子了”。如果不明白为什么能做到的话可以先去了解一下其他协议当年是怎么被封锁的。

2.开启服务端的伪装功能并进行得当设定
就算是放个空白的index.html在上面也比看见程序自身的404 not found好。

3.除非混淆模式在本地工作的更好又或者本地不允许QUIC协议经过，否则都尽量不要使用混淆
hysteria所使用的salamander混淆算法是开源的。并且在开启混淆功能后，数据包会变为无明显协议特征的随机数据包。基于这两个原因，混淆后的浏览反而会成为人海之中“黑夜里的一盏明灯”。反而还起不到隐藏自己的作用。

4.处于稳定性考虑，服务器端上下行带宽不要设置过高
对于4G以下内存的VPS来说，通常情况下hysteria的带宽设置为最高200mbps即可。
hysteria不同于其他代理协议，其单连接对内存的使用量要求较高，如果带宽设置的过高且本地的RAM不足以支持这么高的带宽或者这么高的连接总数的话，会经常出现hysteria服务端因为主机OOM（内存耗尽）被结束，甚至是Linux主机系统崩溃的情况。在客户端的表现就是测个网速没测完就连不上了，又或者只要一旦网速上升到某个水平就断开的现象。
此外运营商限速的算法也并不是一味地以高带宽发包就可以缓解的，如果速度过高，反而还可能会被运营商直接掐掉连接一段时间。

---

Some suggestions to reduce the possibility of Hysteria server being blocked

English Version, original text is simplified Chinese:

For self-setup hysteria proxy servers, please be sure to take the following security measures to reduce the chance of being blocked:

1. You need to ensure that the client authentication password set on the server is long enough (conditions are: uppercase and lowercase letters and numbers, longer than 10 digits) and difficult to guess.
   Because network censors can actively detect whether the target is a designated server by putting the suspected IP address in a list, and then pretending to be a client to try to connect. If the password is guessed, the server IP will be blocked. If you don’t understand why this is possible, you can first find out how other proxy protocols were blocked in China.

2. Turn on the masquerade function of the server and make appropriate settings
   Even putting a blank index.html above is better than seeing 404 not found.

3. Unless the obfuscation mode works better locally, or the QUIC protocol is not allowed to pass locally, try not to use obfuscation.
   The salamander obfuscation algorithm used by hysteria is open source. And after the obfuscation function is turned on, the data packets will become random data packets with no obvious protocol characteristics. For these two reasons, the confused traffic will become "a bright light in the dark night" in the sea of ​​people. On the contrary, it does not serve the purpose of hiding oneself.

4. For stability reasons, the server-side bandwidth value should not be set too high.
   For VPS with memory below 4G, usually the bandwidth of hysteria can be set to a maximum of 200mbps.
   Hysteria is different from other proxy protocols in that its single connection requires high memory usage. If the bandwidth is set too high and the local RAM is not enough to support such a high bandwidth or such a high total number of connections, hysteria servers will often appear. Because the host OOM (out of memory) is ended, or the Linux host system crashes.
   On the client side, you can see that the connection fails before the network speed test is completed, or that it is disconnected as soon as the network speed rises to a certain level.
   In addition, the operator's speed limit algorithm cannot be alleviated by simply sending packets with high bandwidth. If the speed is too high, the operator may directly cut off the connection for a period of time.