Deploying a Linux Bypass Gateway Using Alpine PVE LXC Container

July 14, 2025 Halo Archive (Outdated)

Alpine is a lightweight Linux distribution. If you don’t need a comprehensive router system like OpenWrt, or don’t want to change your home network topology too much (and don’t want to spend more money):

• You can try this solution with extremely low resource footprint! Directly deploy an Alpine container on Proxmox VE!

According to my testing, it only consumes 11% of one J4125 CPU core under a 100Mbps network. By deduction, it can easily handle up to a gigabit environment.

Pre-configuration of PVE

First, if you have issues with your network environment (which is likely, since you need a bypass gateway), run the following commands in the shell of your PVE host to change the source for CT templates:

cp /usr/share/perl5/PVE/APLInfo.pm /usr/share/perl5/PVE/APLInfo.pm_backsed -i 's|http://download.proxmox.com|https://mirrors.tuna.tsinghua.edu.cn/proxmox|g' /usr/share/perl5/PVE/APLInfo.pm

Then restart the PVE service:

systemctl restart pvedaemon.service

After restarting, the web UI may disconnect temporarily; just wait a bit and refresh.

We will use tproxy for proxying, which has a lower CPU load compared to the tun mode. If you have advanced needs, please search for tun mode configuration yourself:

Input the following in the host’s terminal, and then restart the PVE host or type modprobe nft_tproxy:

echo 'nft_tproxy' > /etc/modules-load.d/tproxy.conf

Download Alpine LXC Image

In the local storage pool (varies by your setup), choose CT Templates - Templates:

Download the latest Alpine release:

Click “Create CT” in the top-right corner:

In the General tab, uncheck “Unprivileged container”, enter the password and hostname:

Select the alpine template:

If you are only using it as a bypass gateway, 500MB of disk space is more than enough:

1 CPU core is enough. My PVE host is J4125, which is sufficient in a 100Mbps environment:

Give it 128MB RAM, no swap:

Configure the network according to your environment. The gateway must point to the primary router:

DNS should also point to the primary router:

All set! But don’t select “Start after created”, as we still need some configuration:

Go to Options, change Console Mode to shell, and enable “Start at boot”:

Configure Alpine

Start the Alpine container and enter its console:

Change repositories source:

vi /etc/apk/repositories

In vi editor, press i to start editing:

Set the official repositories to any third-party mirrors. You can choose USTC mirrors.ustc.edu.cn or Tsinghua mirrors.tuna.tsinghua.edu.cn.

Just replace the original dl-cdn.alpinelinux.org with one of the two links above.

I have synced the Alpine repository on my NAS, so I will use the solution that is faster for me.

After editing, press ESC, type (in English input mode), and press Enter to save.

Run apk update:

apk upgrade:

Install bash, wget, curl, and sudo (I forgot to install sudo in the screenshot):

apk add bash wget curl sudo nftables

Configure ShellCrash

We will choose ShellCrash to configure our bypass gateway.

ShellCrash/README_CN.md

Use the recommended standard Linux device installation method:

sudo -i bash export url='https://fastly.jsdelivr.net/gh/juewuy/ShellCrash@master' && wget -q --no-check-certificate -O /tmp/install.sh $url/install.sh && bash /tmp/install.sh && source /etc/profile &> /dev/null

Enter 1:

Also 1:

Confirm installation, enter 1:

Installed successfully. Run crash to start:

Choose 1:

1

1

1

1

Enter your subscription link:

1

0

1

Depending on your network environment, you might need to wait a bit longer here:

Initialization completed:

Optimize Configuration

It is not usable yet. We need to configure tproxy. Enter 3 to stop the kernel service, then enter 2:

Enter 1

Enter 3

Then enter 0 twice

Enter 9, then 4, to install local dashboard:

This is up to you. I chose 4:

Similarly, you need to wait for a while

Enter

In

Done

Next, you just need to configure rules yourself and set the gateway of your devices to point to this software router.