再见！校园网🔨Goodbye! Campus Network🔨

注意：这篇文章上次更新于1721天前，文章内容可能已经过时。

This article was last updated1721 days ago, the content may be outdated.

前言

室友：校园网的收费标准是每月免费使用 8GB 流量，超出 8GB 起每 GB 流量 1 块钱，超过 38GB 后免费使用。

我：那就是…一个月 30 块钱呗。

室友：对，可以这么理解。

Roommate: The campus network gives you 8GB of free traffic per month. Beyond 8GB, each GB costs 1 yuan, and it becomes free again after 38GB.

Me: So… that’s 30 yuan a month then.

Roommate: Yes, you can think of it that way.

这是我研一刚来时和室友的对话，因为我本人很喜欢玩电脑，网络质量就是我的生活质量，所以研一刚来当天就咨询了这个问题。听完之后对比一下家里的收费标准，结论就是一个字：贵！

奈何当时的我还小，知识面太窄，只能任其剥削压迫。

现在可不一样了😏

This was the conversation I had with my roommate when I first arrived as a first-year graduate student. Since I really enjoy playing with computers, network quality is my quality of life, so I asked about this on my very first day. After hearing it and comparing it with the pricing at home, the conclusion was one word: expensive!

But I back then was still young and knew too little, so I could only let it exploit and oppress me.

Now it’s a different story😏

好歹也是国内 211 大学计算机专业的研究生，不但每天要苦苦填报形式主义的信仰不息，承受精神上的洗礼；还要每月交 30 块钱网费，接受物质上的摧残。我就想说，码农何苦为难码农啊。

好在，信仰不息半年前已经有了破解之法了。关于白嫖校园网事宜，我坚信在互联网的某个角落绝对有某些大佬已经有方法了。于是我开始广泛查阅资料，其实也就是翻翻大家的博客😂。

起初我用的搜索词条是：如何绕过校园网登录认证

查到的都是下面这种。

这些方法的总体思路是利用 UDP 53 端口或者 67 68 端口与外界互联网进行通讯，他们说，在还没有登录的状态下，这些端口也是开放着的，比如 53 端口他要留着用来进行 DNS 解析 。看完之后我觉得这些方法说的很有道理啊！于是就按照教程说的进行一步一步的操作，在远程服务器上搭建 VPN 服务，用自己的电脑通过 53 端口与远程代理服务器通信。这些博客有一个共同的特点，就是经常出现图片凉凉掉的情况，有些步骤只能看文字自己摸索，废了很大力气，终于成功搭建了一次。然而 却没有实现绕过登录认证，我哭了。

我不信邪！我觉得这个思路是可行的，于是继续查找这种方法的其他博客，直到看见了这个大佬的这篇博客：利用openVPN实现udp53,67,68端口绕过校园网认证上网, 他在博客的结尾这样说：

这时我才知道，原来这是个 漏洞 ！还是个可以修复的漏洞。

我也没法保证 DLMU 的网络系统存在这个漏洞，所以就只能放弃折腾了。

11月20日，一个普通的周六下午，我依然和每天一样在网络里冲浪，已经不记得是什么契机让我看到了这篇文章：拯救我们的校园网——校园网ipv6搭配VPS免流上网教程, 看完标题的那一刻，我就意识到，免流上网又要有新的转机了😎。这位博主是隔壁大工的，他提供的方案是利用 ipv6 流量进行上网，在远程服务器上搭建一个 ipv6 的代理，然后就和正常科学上网一样就行了。听完之后我觉得很有道理啊！因为我很早就知道 东北大学的六维空间 以及 西工大的蒲公英PT站，这些网站使用的就是ipv6，而且只有ipv6，原因就是校园网的ipv6流量是免费的，这样大家利用种子传递资源才可以不花网费。既然这些网站可以不花钱访问，那我也搭建一个可以不花钱访问的网站(用来伪装)不就行了嘛。那位大工的同学搭建的是 Shadowsocks 代理，用的本地客户端软件我也没听过，由于我对 v2ray 比较熟悉，而且 v2ray+ws+tls 也是目前为止技术安全性比较高的科学上网手段。所以这篇博客就记录一下使用甲骨文云 VPS 搭建 ipv6 v2ray 代理的过程。

After all, I’m a graduate student in computer science at a domestic 211 university. Not only do I have to painstakingly fill in the formalistic “Faith Never Dies” (信仰不息) form every day, enduring a spiritual baptism; I also have to pay 30 yuan a month in network fees, suffering material torment. I just want to say, coders, why make life hard for fellow coders?

Luckily, half a year ago there was already a way to crack it for the “Faith Never Dies” system. When it came to freeloading off the campus network, I firmly believed that somewhere on the Internet, some expert must already have a method. So I began searching far and wide, which really just meant browsing everyone’s blogs😂.

At first, my search term was: how to bypass campus network login authentication

Everything I found was like the ones below.

The general idea of these methods is to use UDP port 53 or ports 67 and 68 to communicate with the outside Internet. They said these ports are still open when you haven’t logged in — port 53, for instance, is kept for DNS resolution. After reading them, I thought these methods made a lot of sense! So I followed the tutorials step by step, set up a VPN service on a remote server, and made my computer communicate with the remote proxy server through port 53. These blogs share a common trait: images often go dead, so for some steps you can only fumble your way through the text. After a lot of effort, I finally managed to set one up successfully. However, it did not bypass the login authentication, and I cried.

I wouldn’t take no for an answer! I believed this approach was feasible, so I kept looking for other blogs on this method, until I came across this expert’s post: Using OpenVPN to bypass campus network authentication via UDP ports 53, 67, 68. He said this at the end of his post:

Only then did I realize that this was actually a vulnerability! And a fixable one at that.

I also couldn’t guarantee that DLMU’s network system had this vulnerability, so I could only give up tinkering.

On November 20, an ordinary Saturday afternoon, I was surfing the web as usual, and I can’t remember what exactly led me to this article: Save Our Campus Network — Campus Network IPv6 + VPS Free Traffic Tutorial. The moment I saw the title, I realized there was new hope for free traffic access😎. This blogger was from Dalian University of Technology, the school next door. His solution was to use IPv6 traffic for Internet access: set up an IPv6 proxy on a remote server, and then it works just like normal circumvention. After reading it, I thought it made a lot of sense! Because I had known for a long time about Northeastern University’s Six Dimensional Space and Northwestern Polytechnical University’s Dandelion PT. Those sites use IPv6, and only IPv6, because campus network IPv6 traffic is free, so people can share resources via torrents without spending network fees. Since those sites can be accessed for free, I could just set up a site (as a disguise) that can also be accessed for free, right? The student from DUT set up a Shadowsocks proxy with a local client I’d never heard of. Since I’m familiar with v2ray, and v2ray+ws+tls is currently one of the more technically secure circumvention methods, this blog post records the process of setting up an IPv6 v2ray proxy on an Oracle Cloud VPS.

必要条件

这年头想要白嫖 几片肉 容易，想要白嫖 几叶菜 也容易，难的是如何能把白嫖到的肉和菜有机结合到一起，煮炖 火锅 吃。就像我以前跟同学说，搭建一个不花钱的网站容易，在网站里放视频资源也容易，如何能在不花钱的网站上放视频资源就没那么容易了。

所以，要想吃到今天这顿白嫖火锅，需要靠曾经白嫖到的 肉 和 菜 做基础。主要有：

Prerequisites

These days, it’s easy to freeload a few slices of meat and easy to freeload a few leaves of vegetables. The hard part is organically combining the freeloaded meat and vegetables to cook a hot pot and eat it. Just like I once told my classmates: building a website that costs nothing is easy, putting video resources on a website is easy too, but putting video resources on a website that costs nothing is not so easy.

So, to enjoy today’s freeloaded hot pot, you need the meat and vegetables freeloaded in the past as the foundation. Mainly:

1. 支持 ipv6 的 VPS 一台。（白嫖甲骨文云）
2. 域名一个。（白嫖 freenom）

1. A VPS with IPv6 support (freeloaded from Oracle Cloud).
2. A domain name (freeloaded from Freenom).

其实，域名不是一定要有，但是 VPS 必须要有，如果你没有白嫖的条件，可能就得自掏腰包了。

VPS 也不一定要有😂

你只需要一个支持 IPv6 的梯子就行了。

Actually, a domain name isn’t strictly necessary, but a VPS is a must; if you don’t have the conditions for freeloading, you may have to pay out of pocket.

Even a VPS isn’t strictly necessary😂

All you need is a proxy that supports IPv6.

经过我的测试，利用 Heroku 搭建的梯子是支持 IPv6 的！！！

详情参考Heroku搭建V2ray教程

Based on my testing, the proxy built with Heroku supports IPv6!!!

See the Heroku V2ray Tutorial for details

甲骨文云开启 ipv6

关于注册和创建实例的过程可以参考我的这篇博客，小鸡折腾日记。

点击虚拟云网络。

可以看到，IPv6 CIDR 块默认是空的。我们需要添加一个 ipv6 的 CIDR 块。点击名称的超链接。

接下来点击 CIDR 块，点击 添加 ipv6 CIDR 块。

接下来点击 子网 ，此时 ipv6 CIDR 块还没有出来，需要继续编辑子网，勾选启用 ipv6，按提示填入两个 16 进制字符保存即可。

我的网站没有图片放大查看的功能，如果图片看不清，可以右键选择在新标签页打开，或者下载到本地查看

接下来添加路由规则，点击路由规则，点击 名称超链接，在跳转页面点击 添加路由规则，协议版本 选择 ipv6 ，目标类型 选择 internet 网关，目的地 CIDR 块填写 ::/0，选择 internet 网关使用弹出的默认就好。填写好点击下方的添加路由规则。

接下来，点击 安全列表，设置允许的出入站规则。由于我这个小鸡也没有部署什么重要项目，所以也不怕别人攻击，就选择开放所有端口所有流量了，防止部署过程中出现奇奇怪怪的问题。

点击安全列表，点击 名称超链接，在新的页面中点击 添加入站规则，勾选无状态，IP 协议选择所有协议，源 CIDR 填写::/0,最后点击添加入站规按钮。

接下来再添加一个 ipv6 的出站规则。

最后为我们的 VPS 实例添加 ipv6 地址。

点击实例详细信息，再左下角资源处点击 附加的 VNIC ，点击名称超链接，在新弹出的页面中点击左下角的 ipv6 地址，点击分配 ipv6 地址，随便填:****即可，最好不要用 0000 和 ffff 这样特殊的字符。

ping 一下这个 IP ，可以成功 ping 通。

利用 finalshell ipv6地址连接 VPS。

可以成功连接。

至此，甲骨文云的 ipv6 配置完成。

Enabling IPv6 on Oracle Cloud

For the process of registering and creating an instance, refer to my blog post Chick’s Tinkering Diary.

Click “Virtual Cloud Networks”.

You can see that the IPv6 CIDR block is empty by default. We need to add an IPv6 CIDR block. Click the hyperlink of the name.

Next, click “CIDR Blocks”, then click “Add IPv6 CIDR Block”.

Next, click “Subnets”. The IPv6 CIDR block isn’t shown yet; you need to continue to edit the subnet, check “Enable IPv6”, fill in two hexadecimal characters as prompted, and save.

My website doesn’t have an image zoom feature. If you can’t see the image clearly, right-click and open it in a new tab, or download it locally

Next, add route rules: click “Route Tables”, click the hyperlink of the name, on the page you land on click “Add Route Rules”, select IPv6 as the protocol version, choose “Internet Gateway” as the target type, fill in ::/0 for the destination CIDR block, and use the default popped-up Internet Gateway. Once filled in, click “Add Route Rules” below.

Next, click “Security Lists” and configure the allowed ingress/egress rules. Since this little chick of mine doesn’t host any important projects, I’m not afraid of being attacked, so I chose to open all ports and all traffic to avoid weird issues during deployment.

Click “Security Lists”, click the hyperlink of the name, on the new page click “Add Ingress Rules”, check “Stateless”, select “All Protocols” for the IP protocol, fill in ::/0 for the source CIDR, and finally click the “Add Ingress Rules” button.

Next, add an IPv6 egress rule as well.

Finally, add an IPv6 address to our VPS instance.

Click “Instance Details”, then click “Attached VNICs” under Resources at the bottom left, click the hyperlink of the name, and on the newly opened page click “IPv6 Addresses” at the bottom left, then click “Assign IPv6 Address”. Just fill in anything like :**** — it’s better not to use special values such as 0000 or ffff.

Ping this IP, and it can be pinged successfully.

Use FinalShell to connect to the VPS with the IPv6 address.

It connects successfully.

At this point, the IPv6 configuration on Oracle Cloud is complete.

域名解析

我曾经白嫖了好多 freenom 的域名，包括这个博客的域名，都是白嫖的。随便从其中拿出一个来解析到服务器上。关于如何白嫖 freenom 的域名，我觉得只要你注册账户时候填写的资料，尤其是位置信息，和你注册域名时候用的 ip 地址对应上，应该就没问题。

之前都是用的 CloudFlare 做域名解析，几个月前突然 CloudFlare 添加不了 freenom 的域名了，所以后来就都转向使用 阿里云 做域名解析了。

首先登录阿里云国际站，没有账号就注册。

点击控制台。

在菜单栏中搜索 DNS ，在搜索结果中点击 云解析DNS。

添加新的域名。

添加域名后会有如下提示。

接下来我们应该到 freenom 后台修改域名的 NameServers，修改成图中提示的地址。

修改完成后，在阿里云域名解析控制台点击解析设置。

点击添加记录。

记录类型选择 AAAA ，主机记录填写 @ ，记录值填写 VPS 的 ipv6 地址。

添加成功后，我们 ping 这个域名，就会显示域名对应的 ip 地址。

至此，准备工作已经全部完成。

Domain Resolution

I’ve freeloaded a lot of Freenom domains over the years, including this blog’s domain — all freeloaded. Just pick one and resolve it to the server. As for how to freeload Freenom domains, I think as long as the info you fill in when registering the account, especially the location info, matches the IP address you use when registering the domain, it should be fine.

I used to use CloudFlare for DNS resolution, but a few months ago CloudFlare suddenly stopped accepting Freenom domains, so I’ve since switched to Aliyun (Alibaba Cloud) for DNS resolution.

First, log in to Aliyun International; register if you don’t have an account.

Click “Console”.

Search for DNS in the menu bar, and click “Cloud DNS” (云解析DNS) in the search results.

Add a new domain.

After adding the domain, you’ll see a prompt like this.

Next, we should go to the Freenom backend and change the domain’s NameServers to the address shown in the prompt.

After the change, click “Resolution Settings” in the Aliyun DNS console.

Click “Add Record”.

Select AAAA as the record type, fill in @ for the host record, and fill in the VPS’s IPv6 address for the record value.

After adding it successfully, when we ping this domain, it will show the IP address corresponding to the domain.

At this point, all the preparatory work is done.

搭建 ipv6 v2ray 服务器代理

这里使用mack-a/v2ray-agent的一键安装脚本，我用这个脚本搭建了很多个 v2ray 服务了。目前感觉很好用。

在执行脚本之前，首先开启 VPS 的 BBR 加速，以及开放所有端口。

开放所有端口。

Setting Up the IPv6 v2ray Server Proxy

Here I use the one-click installation script from mack-a/v2ray-agent; I’ve built many v2ray services with this script, and so far it works very well.

Before running the script, first enable BBR acceleration on the VPS and open all ports.

Open all ports.

sudo -s
apt-get update
apt-get install iptables
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -F
iptables-save
apt-get install iptables-persistent
netfilter-persistent save
netfilter-persistent reload

开启 BBR 加速。

Enable BBR acceleration.

sudo -s
echo "net.core.default_qdisc=fq" >> /etc/sysctl.conf
echo "net.ipv4.tcp_congestion_control=bbr" >> /etc/sysctl.conf
sysctl -p

reboot 

重启之后执行

After rebooting, run

sudo -s
lsmod | grep bbr

出现类似如下内容代表开启成功。

执行安装脚本，

If you see something like the following, it means it was enabled successfully.

Run the installation script,

wget -P /root -N --no-check-certificate "https://raw.githubusercontent.com/mack-a/v2ray-agent/master/install.sh" && chmod 700 /root/install.sh && /root/install.sh

选择 1 安装，再选择 2 安装 v2ray-core。

接下来填写域名，路径回车直接随机生成就行。

还剩两个选项，分别是 Cloudflare 优化和是否自定义 UUID，前者选择不使用，后者填写 n 回车即可。

最后出现一堆长长的字符串，就代表你搭建成功了。

我习惯使用 vmess + ws + tls 的格式。

Choose 1 to install, then choose 2 to install v2ray-core.

Next, fill in the domain name; for the path, just press Enter to let it be randomly generated.

There are two more options: Cloudflare optimization and whether to customize the UUID. Choose not to use the former, and enter n for the latter, then press Enter.

Finally, a bunch of long strings will appear, which means you’ve successfully set it up.

I’m used to the vmess + ws + tls format.

题外话：v2rayN 客户端的基本使用方法

作为计算机专业的学生，上 GitHub 是基本的需求，但是由于某些原因，能不能连上 GitHub 经常是一个概率问题，这表面上看起来是网站服务器的问题，然而实际上…

当别人问我怎么才能上 GitHub 时，我往往推荐使用科学上网的方法，所以这里介绍一下Windows平台科学上网的重要工具 v2rayN 的基本使用方法。

对于初次接触科学上网的小伙伴，可能根本不知道 v2rayN 是什么，v2ray 是什么，为什么需要翻墙，翻的是哪座墙？如果你不知道这些，那么…

但是为了能让你有所了解，我还是去维基百科打印了两个词条：

1. 防火长城
2. V2Ray

v2rayN 的 GitHub 地址是：https://github.com/2dust/v2rayN

现在客户端版本已经更新到 4.20 了。从 4 开头的版本客户端取消了 PAC 模式，至于为什么取消我不知道，好久都没有关注了。

我个人还是比较喜欢 PAC 模式因为觉得简单，所以我是用的客户端版本是 3.29，这应该是支持 PAC 模式的最后一个版本了。大家可以在 GitHub 的 releases 里进行下载 ，如果觉得慢，也可以~~点击这里下载。~~ 试试我提供的代理服务：

1. https://github.dijk.eu.org/2dust/v2rayN
2. https://ghporxy.dijk.eu.org

下面介绍初学者在软件使用过程中的常见问题。

Q1：打开软件，导入节点之后，设置好代理模式后还是不能科学上网。

运行软件最好通过 右键 ==> 以管理员的身份运行，防止一些权限问题。在确保使用正确的代理模式（PAC模式或者全局模式）的前提下，浏览器还是不能打开Google学术的话，那么可以尝试以下几种操做：

1. 关闭软件，重新打开。
2. 关闭浏览器，重新打开。
3. 关闭电脑，重新打开。

Q2：如何选择代理模式。

3.29 版本的HTTP代理模式有 7 种之多，而我常用的也只有前三种。

1. 关闭HTTP代理（蓝色图标）：就是相当于没开翻墙软件。
2. 全局模式（红色图标）：这种模式下，你的所有流量都会经过代理服务器中转。
3. PAC模式（紫色图标）：软件目录下有一个pac.txt的文件，按那个文件中指定的规则进行代理设置。你可以把它理解为自动模式，就是需要翻墙的网站他就会走代理服务器进行中转，不需要翻墙的网站会直连。

不建议日常使用一直开着全局模式，有两个缺点，首先是代理服务器的速度问题，想想你的数据包从上海的服务器直接发到你的电脑里和从上海发送到美国你的VPS上，再从美国发回你的电脑的区别。其次是成本问题，翻墙所需的 VPS 基本都是要花钱的，而且你与VPS通信的流量也是花钱的，你说你刷个 b 站都要花 VPS 的流量费用，多难受啊。

关于PAC模式，我觉得可以作为日常使用的代理状态，首先看 b 站不用花额外的 VPS 流量费，想上谷歌学术的时候也可以随时就开，省事。但是这个模式也有缺点，就是不那么智能，它的pac列表里认为 GitHub 不属于被墙的网站，仍然进行直连。这时候就需要用到用户pac设置了。

Q3：我已经开了全局代理了，但是某某软件还是不能翻墙。

这种情况大概率是你的这个软件需要单独设置代理，一般需要再设置中找。

比如电报这个软件，你需要这样设置代理。

设置完成之后，你只需要开启 PAC 模式，这个软件就可以科学上网了。

类似的使用场景包括，git 的 clone 和 push。

Aside: Basic Usage of the v2rayN Client

As a computer science student, accessing GitHub is a basic need, but for certain reasons, whether you can connect to GitHub is often a matter of probability. On the surface, it looks like a problem with the website’s servers, but in reality…

When people ask me how to get on GitHub, I usually recommend circumvention tools, so here I’ll introduce the basic usage of v2rayN, an important tool for circumvention on the Windows platform.

For those who are new to circumvention, you may have no idea what v2rayN is, what v2ray is, why you need to climb the wall, and which wall you’re climbing. If you don’t know these things, then…

But to give you some understanding, I went to Wikipedia and printed out two entries:

1. Great Firewall
2. V2Ray

v2rayN’s GitHub address is: https://github.com/2dust/v2rayN

The client version has now been updated to 4.20. Starting from versions beginning with 4, the client removed PAC mode. I don’t know why it was removed — I haven’t paid attention to it for a long time.

Personally, I still prefer PAC mode because it feels simple, so the client version I use is 3.29, which should be the last version supporting PAC mode. You can download it from GitHub’s releases; if it feels slow, you can also click here to download. try the proxy service I provide:

1. https://github.dijk.eu.org/2dust/v2rayN
2. https://ghporxy.dijk.eu.org

Below I’ll introduce common problems beginners encounter while using the software.

Q1: After opening the software, importing nodes, and setting up the proxy mode, I still can’t access blocked websites.

It’s best to run the software via Right-click ==> Run as administrator to avoid some permission issues. If you’ve made sure you’re using the correct proxy mode (PAC mode or global mode) but the browser still can’t open GoogleScholar, then you can try the following operations:

1. Close the software and reopen it.
2. Close the browser and reopen it.
3. Shut down the computer and turn it back on.

Q2: How to choose the proxy mode.

Version 3.29 has as many as 7 HTTP proxy modes, and I only regularly use the first three.

1. Disable HTTP proxy (blue icon): it’s equivalent to not running the circumvention software.
2. Global mode (red icon): in this mode, all your traffic goes through the proxy server.
3. PAC mode (purple icon): there’s a pac.txt file in the software directory, and the proxy is configured according to the rules specified in that file. You can think of it as auto mode: sites that need circumvention go through the proxy server, while sites that don’t need it connect directly.

I don’t recommend keeping global mode on all the time for daily use; there are two drawbacks. First, the speed of the proxy server — imagine the difference between your data packets going directly from a server in Shanghai to your computer, versus going from Shanghai to your VPS in the US and then from the US back to your computer. Second, the cost — the VPSes needed for circumvention basically all cost money, and the traffic between you and the VPS costs money too. Just think: even scrolling Bilibili would burn your VPS traffic quota. How uncomfortable is that?

As for PAC mode, I think it can be used as the daily proxy state. First, watching Bilibili doesn’t cost extra VPS traffic, and when you want to get on GoogleScholar, you can switch it on anytime — convenient. But this mode also has a drawback: it’s not that smart. Its PAC list considers GitHub a site that isn’t blocked and still connects directly. This is where the user PAC settings come in.

Q3: I’ve enabled the global proxy, but some software still can’t get through.

This is most likely because the software needs its own proxy settings, which you usually find in its settings.

For example, for Telegram, you need to configure the proxy like this.

After the configuration, you just need to turn on PAC mode and this software can access the Internet freely.

Similar use cases include git clone and push.

使用 ipv6 v2ray 代理实现校园网免流

导入节点后，把代理模式选择成全局模式，无需登录校园网，享受你的免费冲浪时光吧。

Free Campus Network Traffic with the IPv6 v2ray Proxy

After importing the node, set the proxy mode to global mode. No need to log in to the campus network — enjoy your free surfing time.