Trojan

You will need to provide a TLS certificate and private key for Trojan servers to work. You can either apply for a free certificate with some automation tools like Acme.sh from Let's Encrypt or generate a self-signed one as shown in OpenSSL#Generate a self-signed certificate. Then, set the cert, , and (not necessarily) fields in the configuration file accordingly. Note that you should pin the certificate by setting cert on the client if you generate a self-signed certificate. Also, make sure that trojan on a server has enough permission to access the certificate and key file.

For TCP Fast Open on servers to work, you will need to turn it on in your OS:

# echo 3 > /proc/sys/net/ipv4/tcp_fastopen

Trojan servers can be disguised as other services over TLS to prevent active probing. This can be done by, for example, running a web server with nginx and pointing and fields to the server address and port.

Trojan can be controlled with trojan.service and . For example, start/enable the instance to run Trojan with the configuration file. Trojan can be similarly ran with /etc/trojan/config.json by starting/enabling trojan.service.

Trojan can also start in a shell, by running:

$ trojan /etc/trojan/config.json

You can replace /etc/trojan/config.json with any other configuration files. Note that Trojan outputs its log to stderr, so you will have to redirect it to a file if you want to keep the log.