Trojan - ArchWiki

Jump to content

# Trojan

From ArchWiki

Related articles

- Shadowsocks
- V2Ray
- WireGuard

Trojan is a proxy server, client and protocol, designed to bypass the Great Firewall of China by imitating HTTPS. Trojan claims to be unidentifiable.

Warning: Trojan has not undergone proper degrees of security auditing. Use it with caution!

## Installation

Install the trojan package or trojan-gitAUR for the development version.

## Configuration

Trojan cannot run without proper configuration. It uses JSON as its configuration format. All configuration work is done in `/etc/trojan/`. Detailed explanations of each field of the configuration file can be found on the GitHub repository.

Examples of configuration files are at `/usr/share/doc/trojan/examples/`.

### TLS certificate

You will need to provide a TLS certificate and private key for Trojan servers to work. You can either apply for a free certificate with some automation tools like Acme.sh from Let's Encrypt or generate a self-signed one as shown in OpenSSL#Generate a self-signed certificate. Then, set the `cert`, `key`, and `key_password`(not necessarily) fields in the configuration file accordingly. Note that you should pin the certificate by setting `cert` on the client if you generate a self-signed certificate. Also, make sure that trojan on a server has enough permission to access the certificate and key file.

### TCP Fast Open

For TCP Fast Open on servers to work, you will need to turn it on in your OS:

    # echo 3 > /proc/sys/net/ipv4/tcp_fastopen

### Disguise

Trojan servers can be disguised as other services over TLS to prevent active probing. This can be done by, for example, running a web server with nginx and pointing `remote_addr` and `remote_port` fields to the server address and port.

## Running

### Systemd services

Trojan can be controlled with `trojan.service` and `trojan@.service`. For example, start/enable the `trojan@conf.service` instance to run Trojan with the `/etc/trojan/conf.json` configuration file. Trojan can be similarly ran with `/etc/trojan/config.json` by starting/enabling `trojan.service`.

### Manually

Trojan can also start in a shell, by running:

    $ trojan /etc/trojan/config.json

You can replace `/etc/trojan/config.json` with any other configuration files. Note that Trojan outputs its log to stderr, so you will have to redirect it to a file if you want to keep the log.

## See also

GitHub Project

Category:

- Proxy servers