搭建 sing-box TUIC 代理 — 文章总结

来源：https://dashenk.com/2026/05/09/搭建-sing-box-tuic/

本文是一篇实操教程，核心流程为：安装 sing-box → 开启 BBR → 生成自签 TLS 证书 → 生成鉴权信息 → 写入配置 → 启动服务 → 客户端接入。

---

一、安装 sing-box

ARCH=$(dpkg --print-architecture)
VERSION=$(curl -fsSL https://api.github.com/repos/SagerNet/sing-box/releases/latest | grep tag_name | cut -d '"' -f 4 | sed 's/v//')
wget -O /tmp/sing-box.deb "https://github.com/SagerNet/sing-box/releases/download/v${VERSION}/sing-box_${VERSION}_linux_${ARCH}.deb"
dpkg -i /tmp/sing-box.deb
sing-box version

---

二、开启 BBR 加速

echo "net.core.default_qdisc=fq" >> /etc/sysctl.conf
echo "net.ipv4.tcp_congestion_control=bbr" >> /etc/sysctl.conf
sysctl -p
sysctl net.ipv4.tcp_congestion_control

---

三、生成自签名 TLS 证书

mkdir -p /etc/sing-box/cert
openssl ecparam -genkey -name prime256v1 -out /etc/sing-box/cert/private.key
openssl req -new -x509 -days 36500 -key /etc/sing-box/cert/private.key -out /etc/sing-box/cert/cert.pem -subj "/CN=www.bing.com"
chown -R sing-box:sing-box /etc/sing-box/cert

---

四、生成鉴权信息

• 密码：

openssl rand -base64 16

• UUID（推荐）：

sing-box generate uuid

---

五、写入 sing-box 配置

{
  "log": {
    "level": "warn",
    "timestamp": true
  },
  "inbounds": [
    {
      "type": "tuic",
      "tag": "tuic-in",
      "listen": "::",
      "listen_port": 33443,

      "users": [
        {
          "uuid": "06c3548a-7acc-4000-aa4b-51b0b8162ded",
          "password": "A123bing123A"
        }
      ],

      "congestion_control": "bbr",
      "zero_rtt_handshake": false,

      "tls": {
        "enabled": true,
        "server_name": "www.bing.com",
        "certificate_path": "/etc/sing-box/cert/cert.pem",
        "key_path": "/etc/sing-box/cert/private.key",
        "alpn": ["h3"]
      }
    }
  ],
  "outbounds": [
    {
      "type": "direct",
      "tag": "direct"
    }
  ]
}

配置说明

• listen_port：建议改为 10000-65535 之间的随机值
• listen: "::"：同时监听 IPv4 和 IPv6
• 伪装策略：证书 CN 为 www.bing.com，外部探测时会看起来像访问 Bing

---

六、启动与验证

sing-box check -c /etc/sing-box/config.json
systemctl enable --now sing-box
systemctl status sing-box
systemctl restart sing-box
ss -ulnp | grep 33443

---

七、客户端配置

按实际信息拼接 TUIC 链接，注意：

• 密码中的 + 要编码为 %2B
• 密码中的 = 要编码为 %3D

示例：

tuic://06c3548a-7acc-4000-aa4b-51b0b8162ded%[email protected]:33443?sni=bing.com&alpn=h3&insecure=1&allowInsecure=1&congestion_control=bbr#normal-tuic

---

总结

本文教你基于 sing-box + TUIC 部署代理节点，并完成：

1. 服务端安装与 BBR 调优
2. 自签 TLS 证书与伪装域名
3. UUID / 密码鉴权
4. 客户端连接串生成与接入