Trojan

Trojan is a proxy server, client and protocol, designed to bypass the Great Firewall of China by imitating HTTPS. Trojan claims to be unidentifiable.

Warning: Trojan has not undergone proper degrees of security auditing. Use it with caution!

Installation

For the official Trojan implementation in C++, Install the trojan package or trojan-git^AUR for the development version. However the offical development has long been stalled. Various alternative implementations exist. For Go implementation with features such as multiplexing, AEAD and routering based on destination IP, install trojan-go-bin^AUR or trojan-go-git^AUR. For Rust implementation with an emphasis on high performace and low memory usage, install trojan-r-git^AUR.

Configuration

Trojan cannot run without proper configuration. It uses JSON as its configuration format. All configuration work is done in /etc/trojan/. Detailed explanations of each field of the configuration file can be found on the GitHub repository.

Examples of configuration files are at /usr/share/doc/trojan/examples/.

TLS certificate

You will need to provide a TLS certificate and private key for Trojan servers to work. You can either apply for a free certificate with some automation tools like Acme.sh from Let's Encrypt or generate a self-signed one as shown in OpenSSL#Generate a self-signed certificate. Then, set the cert, key, and key_password(not necessarily) fields in the configuration file accordingly. Note that you should pin the certificate by setting cert on the client if you generate a self-signed certificate. Also, make sure that trojan on a server has enough permission to access the certificate and key file.

TCP Fast Open

For TCP Fast Open on servers to work, you will need to turn it on in your OS:

# echo 3 > /proc/sys/net/ipv4/tcp_fastopen

Disguise

Trojan servers can be disguised as other services over TLS to prevent active probing. This can be done by, for example, running a web server with nginx and pointing remote_addr and remote_port fields to the server address and port.

Running

Systemd services

Trojan can be controlled with trojan.service and trojan@.service. For example, start/enable the trojan@conf.service instance to run Trojan with the /etc/trojan/conf.json configuration file. Trojan can be similarly ran with /etc/trojan/config.json by starting/enabling trojan.service.

Manually

Trojan can also start in a shell, by running:

$ trojan /etc/trojan/config.json

You can replace /etc/trojan/config.json with any other configuration files. Note that Trojan outputs its log to stderr, so you will have to redirect it to a file if you want to keep the log.