메뉴
在任意VPS上搭建完整的Clash订阅服务 — 包含HTTPS订阅、Let's Encrypt证书、域名配置、安全策略、国内分流规则、自动续期
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | vps-clash-subscription |
| description | 在任意VPS上搭建完整的Clash订阅服务 — 包含HTTPS订阅、Let's Encrypt证书、域名配置、安全策略、国内分流规则、自动续期 |
| triggers | ["在VPS上搭建VPN订阅服务","搭建clash订阅","VPS科学上网","自建订阅节点","Let's Encrypt证书配置","翻墙 机场 自建"] |
English: A complete guide to building a Clash subscription service on any VPS — covering HTTPS subscription, Let's Encrypt certificates, domain configuration, security policies, China mainland direct routing rules, and automatic certificate renewal.
中文： 在任意 Linux VPS 上搭建 Clash 订阅服务的完整指南。包含 HTTPS 订阅下载、正式 TLS 证书、国内网站直连分流、订阅防探测等核心内容。
┌─────────────────┐ HTTPS (443) ┌──────────────────┐ HTTP (65534) ┌────────────────┐
│ Clash Client │ ──────────────────→ │ nginx │ ───────────────→ │ Python Sub │
│ (Clash Verge) │ TLS Termination │ Reverse Proxy │ │ Service │
└─────────────────┘ └──────────────────┘ │ (127.0.0.1) │
└───────┬────────┘
│
↓
┌────────────────────────┐
│ Clash YAML Config │
│ - Proxy Node Info │
│ - Routing Rules │
│ - rule-providers │
└────────────────────────┘
┌─────────────────┐ SS Encrypted (8388) ┌──────────────────┐
│ Clash Client │ ←────────────────────── │ Shadowsocks │ ←── Internet
│ (Actual Traffic)│ TCP+UDP │ ss-server │ Target Sites
└─────────────────┘ └──────────────────┘
| 层级 | 说明 / Description | 安全要点 / Security Notes |
|---|---|---|
| HTTPS 订阅下载 | Only used for subscription config download (one-time) | TLS encrypted, prevents eavesdropping |
| 实际代理流量 Actual Proxy Traffic | Goes directly through Shadowsocks, NOT through nginx | SS protocol encryption (chacha20/aes) |
| nginx | TLS termination, listens on public 0.0.0.0:443 | Python sub service only on 127.0.0.1 |
| Python Sub Service | Generates and serves Clash YAML | Token-based path auth, no auth bypass |
Traffic flow / 流量走向：
Clash Client → HTTPS → nginx:443 → HTTP → Python:65534 → Clash YAMLClash Client → SS encrypted → VPS:8388 → Target Website| 要求 / Requirement | 说明 / Description | 推荐 / Recommended |
|---|---|---|
| VPS | 任意 Linux，Ubuntu 24.04 验证通过 Any Linux, Ubuntu 24.04 tested | Ubuntu 20.04+ / Debian 12+ / CentOS 8+ |
| 公网IP / Public IP | VPS 必须有公网 IPv4 VPS must have public IPv4 | 记下 IP 地址，例如 43.155.161.178 |
| 域名 / Domain | duckdns.org 免费子域名 Free subdomain at duckdns.org | 也支持 Cloudflare / 阿里云 / 腾讯云等其他域名 |
| 防火墙 / Firewall | VPS 防火墙（如 ufw/iptables）+ 云服务商安全组 VPS firewall + cloud security group | 需要同时配置 |
| Clash Client | Clash Verge / Clash for Windows / ClashX | Clash Verge 下载 |
| 端口 Port | 协议 Protocol | 用途 Purpose | 暴露公网？ Public? | 备注 |
|---|---|---|---|---|
| 80 | TCP | Let's Encrypt 证书申请（临时） Certificate verification (temporary) | 是 / Yes | 申请后可以关闭 |
| 443 | TCP | HTTPS 订阅访问 HTTPS subscription access | 是 / Yes | 主要访问端口 |
| 8388 | TCP+UDP | Shadowsocks 代理端口 SS proxy port | 是 / Yes | 实际流量入口 |
| 65534 | TCP | Python 订阅服务（仅本地） Python sub service (local only) | 否 / No | nginx 反代后间接访问 |
| 9090 | TCP | Clash 管理 API（仅本地） Clash management API (local only) | 否 / No | 用于控制器 |
| 51820 | UDP | WireGuard 备用隧道（可选） WireGuard backup tunnel (optional) | 是 / Yes | 如需备用方案 |
⚠️ 云服务商安全组注意 / Cloud Security Group Note: 如果使用云服务商（AWS / 阿里云 / 腾讯云 / Vultr / DigitalOcean 等），防火墙有两层：
- VPS 内部防火墙（ufw / iptables）：用
sudo ufw allow 443/tcp开放- 云控制台安全组（Security Group）：需要在云服务商网页手动添加入站规则 两层都要开，否则端口不通。
| 配置项 / Config | 危险后果（不设置会怎样） Risk if not set | 推荐值 / Recommended |
|---|---|---|
allow-lan: false | 全球任何人都能用你的 VPS 代理流量，账单爆炸 | false |
bind-address: "127.0.0.1" | SS 代理端口暴露公网，任何人可直连你的翻墙节点 | "127.0.0.1" |
external-controller: 127.0.0.1 | 任何人可远程控制你的 Clash 配置，修改规则、添加代理 | 127.0.0.1:9090 |
| DNS 8.8.8.8 / 1.1.1.1 | DNS 查询经过国内服务器，隐私泄露，可被审查 | 境外 DNS |
| Let's Encrypt 证书 | 自签证书需要客户端忽略警告，且密码明文传输有 MITM 风险 | Let's Encrypt |
| 订阅路径 32 位随机 token | 订阅路径被猜测，配置泄露，被蹭网或审查 | 32 位 hex |
| nginx 反代 | Python 服务不直接暴露公网，只通过 nginx 访问 | 必须配置 |
# 生成强密码 / Generate strong password
openssl rand -base64 32
# 示例输出 / Example: YmVvcmT5c2VjcmV0a2V5ISEhMzIuLi4=
# 生成订阅路径 token / Generate subscription token
openssl rand -hex 32
# 示例输出 / Example: 819aa2e8bbf0e8df81325b8f14c8d919532feff1fb56b5aa55de45e77016ca58
密码强度建议 / Password Strength Recommendations:
为什么需要域名？/ Why domain is required:
myvps），系统自动生成 myvps.duckdns.org43.155.161.178）nslookup myvps.duckdns.org 8.8.8.8
# 应返回 / Should return: Address: 43.155.161.178
⚠️ 注意事项 / Note: duckdns 免费域名有效期无限，但 30 天不登录会被删除。建议收藏保存登录状态。
⚠️ 两层防火墙都要开！/ BOTH firewall layers need configuration!
# 查看防火墙状态 / Check firewall status
sudo ufw status
# 如果是关闭状态 / If disabled:
sudo ufw enable
# 开放必要端口 / Open required ports
sudo ufw allow 80/tcp # 证书申请 / Certificate verification
sudo ufw allow 443/tcp # HTTPS 订阅 / HTTPS subscription
sudo ufw allow 8388/tcp # Shadowsocks TCP
sudo ufw allow 8388/udp # Shadowsocks UDP
# 验证规则 / Verify rules
sudo ufw status numbered
需要在云服务商控制台手动添加入站规则（不是 Linux 内部防火墙）：
| 协议 Protocol | 端口 Port | 来源 Source | 说明 Description |
|---|---|---|---|
| TCP | 80 | 0.0.0.0/0 | 证书申请临时开放 |
| TCP | 443 | 0.0.0.0/0 | HTTPS 订阅访问 |
| TCP | 8388 | 0.0.0.0/0 | SS 代理 TCP |
| UDP | 8388 | 0.0.0.0/0 | SS 代理 UDP |
常见云服务商安全组入口：
验证端口是否通 / Verify port is reachable:
nc -zv 你的VPS_IP 443 # Connection succeeded 说明通了
# 更新系统 / Update system
sudo apt-get update && sudo apt-get upgrade -y
# 安装核心软件 / Install core packages
sudo apt-get install -y \
shadowsocks-libev \ # SS 服务器
nginx \ # 反向代理
certbot \ # Let's Encrypt 证书工具
python3-certbot-nginx # certbot nginx 插件
# 验证安装 / Verify installation
ss-server --version # 应显示版本号 / should show version
nginx -v # 应显示版本号 / should show version
certbot --version # 应显示版本号 / should show version
sudo nano /etc/systemd/system/shadowsocks.service
内容 / Content:
[Unit]
Description=Shadowsocks Libev Server
After=network.target
[Service]
Type=simple
ExecStart=/usr/bin/ss-server -s 0.0.0.0 -p 8388 -k 你的SS密码 -m chacha20-ietf-poly1305 -u
Restart=on-abort
RestartSec=5
User=root
[Install]
WantedBy=multi-user.target
sudo systemctl daemon-reload
sudo systemctl enable shadowsocks
sudo systemctl start shadowsocks
# 验证运行状态 / Verify status
sudo systemctl status shadowsocks
ss -tlnp | grep 8388 # 应显示 0.0.0.0:8388 LISTEN
| 加密方式 | 推荐度 | 说明 |
|---|---|---|
chacha20-ietf-poly1305 | ⭐⭐⭐⭐⭐ | 推荐，抗审查，性能好，省电 |
aes-256-gcm | ⭐⭐⭐⭐ | 也支持，部分设备性能较好 |
aes-128-gcm | ⭐⭐⭐ | 可用，但强度稍低 |
rc4-md5 | ⭐ | 不推荐，已被破解 |
openssl rand -hex 32
# 记录输出，例如 / Note output: 819aa2e8bbf0e8df81325b8f14c8d919532feff1fb56b5aa55de45e77016ca58
sudo nano /tmp/sub_server.py
⚠️ 重要：修改下面三处 / IMPORTANT: Modify these 3 places:
你的VPS公网IP → 替换为你的实际 VPS IP你的SS密码 → 替换为你的 SS 密码上面openssl生成的32位token → 替换为上一步生成的 token#!/usr/bin/env python3
"""
Clash Subscription Service / Clash 订阅服务
Holds the complete Clash YAML config and serves it via HTTP.
"""
import http.server
import socketserver
import json
from datetime import datetime
# ========== 配置 / CONFIGURATION ==========
VPS_IP = "你的VPS公网IP" # 例如 / e.g. "43.155.161.178"
SS_PASSWORD = "你的SS密码" # 例如 / e.g. "MyStr0ngP@ss!"
SS_PORT = 8388
SS_METHOD = "chacha20-ietf-poly1305"
SUBSCRIPTION_TOKEN = "上面openssl生成的32位token" # 例如 / e.g. "819aa2e8bbf0e8df81325b8f14c8d919532feff1fb56b5aa55de45e77016ca58"
# ========== Clash YAML 配置 / Clash YAML Config ==========
CLASH_YAML = f"""port: 7890
socks-port: 7891
mixed-port: 7892
redir-port: 7893
allow-lan: false
bind-address: "127.0.0.1"
mode: rule
log-level: info
external-controller: 127.0.0.1:9090
dns:
enable: true
listen: 127.0.0.1:1053
enhanced-mode: fake-ip
fake-ip-range: 198.18.0.1/16
nameserver:
- 8.8.8.8
- 1.1.1.1
fallback:
- 8.8.8.8
- 1.1.1.1
fallback-filter:
geoip: true
geoip-code: CN
proxies:
- name: "VPS-SS"
type: ss
server: {VPS_IP}
port: {SS_PORT}
cipher: {SS_METHOD}
password: "{SS_PASSWORD}"
udp: true
proxy-groups:
- name: "Auto"
type: select
proxies:
- "VPS-SS"
rule-providers:
chinamax:
type: http
behavior: classical
url: "https://raw.githubusercontent.com/blackmatrix7/ios_rule_script/master/rule/Clash/ChinaMax/ChinaMax_Classical.yaml"
path: ./chinamax.yaml
interval: 86400
rules:
# === 中国大陆域名直连 / China domain direct ===
- DOMAIN-SUFFIX,cq.cn,DIRECT
- DOMAIN-SUFFIX,cn,DIRECT
- DOMAIN-SUFFIX,baidu.com,DIRECT
- DOMAIN-SUFFIX,baidubcr.com,DIRECT
- DOMAIN-SUFFIX,bdstatic.com,DIRECT
- DOMAIN-SUFFIX,qq.com,DIRECT
- DOMAIN-SUFFIX,weixin.com,DIRECT
- DOMAIN-SUFFIX,tencent.com,DIRECT
- DOMAIN-SUFFIX,tencent-cloud.com,DIRECT
- DOMAIN-SUFFIX,taobao.com,DIRECT
- DOMAIN-SUFFIX,tmall.com,DIRECT
- DOMAIN-SUFFIX,alipay.com,DIRECT
- DOMAIN-SUFFIX,alibaba.com,DIRECT
- DOMAIN-SUFFIX,alicdn.com,DIRECT
- DOMAIN-SUFFIX,aliyun.com,DIRECT
- DOMAIN-SUFFIX,aliyuncs.com,DIRECT
- DOMAIN-SUFFIX,dingtalk.com,DIRECT
- DOMAIN-SUFFIX,dingtalk.org,DIRECT
- DOMAIN-SUFFIX,ele.me,DIRECT
- DOMAIN-SUFFIX,meituan.com,DIRECT
- DOMAIN-SUFFIX,meituan-ec.com,DIRECT
- DOMAIN-SUFFIX,163.com,DIRECT
- DOMAIN-SUFFIX,126.com,DIRECT
- DOMAIN-SUFFIX,youku.com,DIRECT
- DOMAIN-SUFFIX,iqiyi.com,DIRECT
- DOMAIN-SUFFIX,bilibili.com,DIRECT
- DOMAIN-SUFFIX,bilivideo.com,DIRECT
- DOMAIN-SUFFIX,douyin.com,DIRECT
- DOMAIN-SUFFIX,bytedance.com,DIRECT
- DOMAIN-SUFFIX,byted.org,DIRECT
- DOMAIN-SUFFIX,toutiao.com,DIRECT
- DOMAIN-SUFFIX,zhihu.com,DIRECT
- DOMAIN-SUFFIX,csdn.net,DIRECT
- DOMAIN-SUFFIX,jd.com,DIRECT
- DOMAIN-SUFFIX,360.cn,DIRECT
- DOMAIN-SUFFIX,360cdn.com,DIRECT
- DOMAIN-SUFFIX,sina.com,DIRECT
- DOMAIN-SUFFIX,weibo.com,DIRECT
- DOMAIN-SUFFIX,redian.cn,DIRECT
- DOMAIN-SUFFIX,gov.cn,DIRECT
- DOMAIN-SUFFIX,miit.gov.cn,DIRECT
- DOMAIN-SUFFIX,10086.cn,DIRECT
- DOMAIN-SUFFIX,chinatelecom.com,DIRECT
- DOMAIN-SUFFIX,189.cn,DIRECT
- DOMAIN-SUFFIX,10010.com,DIRECT
- DOMAIN-SUFFIX,10086.cn,DIRECT
- DOMAIN-SUFFIX,cucc.com,DIRECT
- DOMAIN-SUFFIX,suning.com,DIRECT
- DOMAIN-SUFFIX,gome.com,DIRECT
- DOMAIN-SUFFIX,vip.com,DIRECT
- DOMAIN-SUFFIX,pinduoduo.com,DIRECT
- DOMAIN-SUFFIX,xianyu.com,DIRECT
- DOMAIN-SUFFIX,huawei.com,DIRECT
- DOMAIN-SUFFIX,huaweiwei.com,DIRECT
- DOMAIN-SUFFIX,honor.cn,DIRECT
- DOMAIN-SUFFIX,xiaomi.com,DIRECT
- DOMAIN-SUFFIX,mi.com,DIRECT
- DOMAIN-SUFFIX,redmi.com,DIRECT
- DOMAIN-SUFFIX,oppo.com,DIRECT
- DOMAIN-SUFFIX,vivo.com,DIRECT
- DOMAIN-SUFFIX,oneplus.com,DIRECT
- DOMAIN-SUFFIX,zte.com,DIRECT
- DOMAIN-SUFFIX,lenovo.com,DIRECT
- DOMAIN-SUFFIX,chinacache.com,DIRECT
# === 中国大陆关键词直连 / China keyword direct ===
- DOMAIN-KEYWORD,cq.cn,DIRECT
- DOMAIN-KEYWORD,baidu,DIRECT
- DOMAIN-KEYWORD,alibaba,DIRECT
- DOMAIN-KEYWORD,taobao,DIRECT
- DOMAIN-KEYWORD,tencent,DIRECT
- DOMAIN-KEYWORD,bytedance,DIRECT
- DOMAIN-KEYWORD,zhihu,DIRECT
- DOMAIN-KEYWORD,csdn,DIRECT
- DOMAIN-KEYWORD,aliyun,DIRECT
- DOMAIN-KEYWORD,dingtalk,DIRECT
- DOMAIN-KEYWORD,ele.me,DIRECT
# === 中国大陆 IP 段直连 / China IP ranges direct ===
- IP-CIDR,10.0.0.0/8,DIRECT
- IP-CIDR,172.16.0.0/12,DIRECT
- IP-CIDR,192.168.0.0/16,DIRECT
- IP-CIDR,127.0.0.0/8,DIRECT
- IP-CIDR,224.0.0.0/4,DIRECT
- IP-CIDR,240.0.0.0/4,DIRECT
# === rule-providers: ChinaMax 规则集 / ChinaMax rule set ===
- RULE-SET,chinamax,DIRECT
# === GEOIP: 中国大陆 IP 走直连 / GEOIP CN direct ===
- GEOIP,CN,DIRECT
# === 默认走代理 / Default: use proxy ===
- MATCH,Auto
"""
# ========== HTTP 服务 / HTTP Server ==========
class SubHandler(http.server.BaseHTTPRequestHandler):
"""订阅处理器 / Subscription request handler"""
def do_GET(self):
# 验证订阅路径 / Validate subscription path
expected_path = f"/ssone/{SUBSCRIPTION_TOKEN}"
if self.path.startswith(expected_path):
config = CLASH_YAML.encode("utf-8")
self.send_response(200)
self.send_header("Content-Type", "text/plain; charset=utf-8")
self.send_header("Content-Length", len(config))
self.send_header("Cache-Control", "no-cache, no-store, must-revalidate")
# 订阅用户信息（可选）/ Subscription userinfo (optional)
self.send_header(
"Subscription-Userinfo",
"upload=0; download=0; total=107374182400000; expire=4102444800"
)
self.end_headers()
self.wfile.write(config)
else:
self.send_error(404)
def log_message(self, format, *args):
print(f"[订阅/Sub] {args[0]}")
# ========== 启动服务 / Start Service ==========
PORT = 65534
socketserver.TCPServer.allow_reuse_address = True
server = socketserver.TCPServer(("0.0.0.0", PORT), SubHandler)
print(f"订阅服务启动 / Subscription service started: http://0.0.0.0:{PORT}/ssone/{SUBSCRIPTION_TOKEN}")
print(f"订阅地址 / Subscription URL: https://你的域名/ssone/{SUBSCRIPTION_TOKEN}")
server.serve_forever()
# 后台运行 / Run in background
nohup python3 /tmp/sub_server.py > /tmp/sub_server.log 2>&1 &
# 验证监听 / Verify listening
sleep 2 && ss -tlnp | grep 65534
# 应显示 / should show: 0.0.0.0:65534 LISTEN
# 测试本地访问 / Test local access
curl -s http://127.0.0.1:65534/ssone/你的TOKEN | head -5
| 证书类型 | 优点 | 缺点 |
|---|---|---|
| 自签证书 | 快速，无域名要求 | Clash 每次导入都要点"忽略警告"，有 MITM 风险 |
| Let's Encrypt | 正式 CA 签发，浏览器/Clash 信任，90 天自动续期 | 需要域名，需要 80 端口验证 |
sudo certbot certonly --nginx \
-d 你的duckdns域名 \
--non-interactive \
--agree-tos \
--register-unsafely-without-email
成功输出示例 / Success output example:
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/你的域名/fullchain.pem
Key is saved at: /etc/letsencrypt/live/你的域名/privkey.pem
This certificate expires on 2026-10-13.
| 文件 | 用途 | 说明 |
|---|---|---|
fullchain.pem | nginx ssl_certificate | 包含完整证书链 |
privkey.pem | nginx ssl_certificate_key | 私钥，切勿泄露 |
sudo nano /etc/nginx/sites-available/sub_https
内容 / Content:
server {
listen 443 ssl;
server_name 你的duckdns域名;
# Let's Encrypt 证书 / Let's Encrypt certificate
ssl_certificate /etc/letsencrypt/live/你的duckdns域名/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/你的duckdns域名/privkey.pem;
# TLS 安全配置 / TLS security hardening
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
ssl_session_tickets off;
# HSTS 可选启用 / Optional HSTS
# add_header Strict-Transport-Security "max-age=63072000" always;
# 订阅路径反代 / Subscription path reverse proxy
location /ssone/你的TOKEN {
proxy_pass http://127.0.0.1:65534/ssone/你的TOKEN;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# 反代超时 / Proxy timeout
proxy_connect_timeout 60s;
proxy_read_timeout 60s;
}
# 禁止访问其他路径 / Deny all other paths
location / {
return 403;
}
}
# 删除默认配置防止冲突 / Remove default config to avoid conflicts
sudo rm -f /etc/nginx/sites-enabled/default
# 启用我们的配置 / Enable our config
sudo ln -sf /etc/nginx/sites-available/sub_https /etc/nginx/sites-enabled/sub_https
# 测试语法 / Test syntax
sudo nginx -t
# 重载 nginx / Reload nginx
sudo systemctl reload nginx
# 1. 检查端口监听 / Check port listening
ss -tlnp | grep -E '443|80|8388|65534'
# 2. 测试本地订阅 / Test local subscription
curl -sk https://127.0.0.1/ssone/你的TOKEN | head -10
# 3. 测试域名订阅 / Test domain subscription
curl -sk https://你的域名/ssone/你的TOKEN | head -10
# 4. 验证证书信息 / Verify certificate
echo | openssl s_client -connect 你的域名:443 -servername 你的域名 2>/dev/null | openssl x509 -no_out -issuer -dates
# 5. 检查 Shadowsocks 运行 / Check Shadowsocks
sudo systemctl status shadowsocks
ss -tlnp | grep 8388
预期结果 / Expected results:
ss -tlnp 显示 0.0.0.0:443, 0.0.0.0:80, 0.0.0.0:8388, 127.0.0.1:65534 监听中curl 返回完整 Clash YAML 配置openssl x509 显示 issuer=Let's Encrypt, notAfter 为 90 天后日期https://你的域名/ssone/你的TOKEN
Auto 节点，点击 Set as System ProxyClash Client
↓ HTTPS (TLS 1.3 encrypted, MITM-proof)
nginx (TLS termination on port 443)
↓ HTTP (localhost only, cannot be accessed externally)
Python Subscription Service
↓
Clash YAML (contains SS password)
安全要点：
0.0.0.0:443，Python 只监听 127.0.0.1:65534Clash Client
↓ SS protocol (chacha20-ietf-poly1305 encryption)
Shadowsocks Server (VPS)
↓ Decrypted, direct connection
Internet Target
# 基础配置 / Basic config
allow-lan: false # 不允许局域网设备连接 / Disallow LAN devices
bind-address: "127.0.0.1" # 只监听本地 / Listen on localhost only
# 管理 API / Management API
external-controller: 127.0.0.1:9090 # 仅本地访问 / Local access only
# DNS 配置 / DNS config (prevent DNS leak)
dns:
enable: true
listen: 127.0.0.1:1053
enhanced-mode: fake-ip
fake-ip-range: 198.18.0.1/16
nameserver:
- 8.8.8.8 # Google DNS
- 1.1.1.1 # Cloudflare DNS
fallback:
- 8.8.8.8
- 1.1.1.1
fallback-filter:
geoip: true
geoip-code: CN
Let's Encrypt 证书有效期 90 天，certbot 自动配置定时任务续期。
# 测试续期（dry run）/ Test renewal
sudo certbot renew --dry-run
# 预期输出 / Expected: "Congratulations, all renewals succeeded."
# 查看定时任务 / Check timer
sudo systemctl list-timers | grep certbot
# 预期 / Expected: certbot.timer active
# 查看续期脚本 / Check renewal script
sudo cat /etc/cron.d/certbot
sudo certbot renew
sudo systemctl reload nginx
certbot 安装时会自动添加定时任务：
certbot renew排查步骤 / Troubleshooting:
# 1. 域名是否解析 / Check DNS resolution
nslookup 你的域名 8.8.8.8
# 2. 443 端口是否通 / Check port 443
nc -zv 你的域名 443
# 3. 证书是否有效 / Check certificate
curl -sk https://你的域名 | head -3
# 4. 检查 nginx 日志 / Check nginx logs
sudo tail -20 /var/log/nginx/error.log
排查步骤 / Troubleshooting:
# 1. 检查 GEOIP 规则 / Check GEOIP rule
# 确保配置中有: - GEOIP,CN,DIRECT
# 2. 检查 rule-providers 是否下载成功 / Check if rule-providers downloaded
# Clash 首次启动会自动下载 ChinaMax 规则集
# 查看日志: sudo journalctl -u shadowsocks 或 检查 /tmp/sub_server.log
# 3. 确认规则顺序 / Verify rule order
# GEOIP,CN 必须在 MATCH 之前
排查步骤 / Troubleshooting:
# 1. 检查 Shadowsocks 是否运行 / Check SS status
sudo systemctl status shadowsocks
ss -tlnp | grep 8388
# 2. 检查密码和加密方式是否正确 / Check password and method
# ss://base64encoded@43.155.161.178:8388
# 3. 检查云安全组是否同时开放 TCP 和 UDP 8388
# 两者都要开放！
# 1. 修改 /tmp/sub_server.py 中的 SS_PASSWORD
sudo nano /tmp/sub_server.py
# 2. 重启订阅服务 / Restart subscription service
pkill -f sub_server.py
nohup python3 /tmp/sub_server.py > /tmp/sub_server.log 2>&1 &
# 3. 完成！用户下次更新订阅自动生效 / Done! Users auto-update on next refresh
# 1. 登录 duckdns.org 重新设置 IP
# 2. 等待 5 分钟生效
# 3. 验证 / Verify:
nslookup 你的域名 8.8.8.8
# 自动续期（推荐）/ Auto-renew (recommended)
sudo certbot renew
# 手动续期 + 重载 / Manual renew + reload
sudo certbot renew && sudo systemctl reload nginx
openssl rand -hex 32 生成新 tokenVPS_IP 为新 VPS IP# 1. 注册 duckdns 域名 / Register duckdns domain
# → https://www.duckdns.org
# 2. 开放防火墙端口 / Open firewall ports
# VPS: sudo ufw allow 80,443,8388/tcp + 8388/udp
# 云控制台: 安全组添加入站规则
# 3. 安装依赖 / Install deps
sudo apt-get update && sudo apt-get install -y \
shadowsocks-libev nginx certbot python3-certbot-nginx
# 4. 配置并启动 Shadowsocks / Configure SS
# → 参考第四步 / See Step 4
# 5. 申请证书 / Apply certificate
sudo certbot certonly --nginx -d 你的域名 --non-interactive --agree-tos --register-unsafely-without-email
# 6. 创建订阅服务 / Create subscription service
# → 参考第五步 / See Step 5
# 7. 配置 nginx / Configure nginx
# → 参考第七步 / See Step 7
# 8. 验证 / Verify
curl -sk https://你的域名/ssone/你的TOKEN | head -5
| 文件 | 路径 |
|---|---|
| SS 配置 / SS config | /etc/systemd/system/shadowsocks.service |
| 订阅脚本 / Sub script | /tmp/sub_server.py |
| nginx HTTPS 配置 | /etc/nginx/sites-available/sub_https |
| Let's Encrypt 证书 | /etc/letsencrypt/live/你的域名/ |
| nginx 日志 | /var/log/nginx/access.log |
| 订阅日志 | /tmp/sub_server.log |
Clash 按照规则从上到下逐条匹配，遇到第一条匹配的规则就执行，不会继续往下看。所以规则的顺序非常重要。
| 规则目标 | 含义 | 适用场景 |
|---|---|---|
| DIRECT | 国内流量直连，不走代理 | 中国大陆网站和服务 |
| Auto | 通过 Shadowsocks 代理访问 | 海外网站和服务 |
本订阅内置四层分流体系，确保国内外流量各走各的：
- DOMAIN-SUFFIX,baidu.com,DIRECT # 百度
- DOMAIN-SUFFIX,taobao.com,DIRECT # 淘宝
- DOMAIN-SUFFIX,qq.com,DIRECT # QQ
- DOMAIN-SUFFIX,alipay.com,DIRECT # 支付宝
- DOMAIN-SUFFIX,bilibili.com,DIRECT # B站
- DOMAIN-SUFFIX,weixin.com,DIRECT # 微信
- DOMAIN-SUFFIX,jd.com,DIRECT # 京东
...（共50条国内主流域名）
- DOMAIN-KEYWORD,baidu,DIRECT # 包含"baidu"的域名
- DOMAIN-KEYWORD,alibaba,DIRECT # 包含"alibaba"的域名
- DOMAIN-KEYWORD,tencent,DIRECT # 包含"tencent"的域名
...（共5条关键词规则）
- IP-CIDR,10.0.0.0/8,DIRECT # 10.x.x.x 私有网段
- IP-CIDR,172.16.0.0/12,DIRECT # 172.16.x.x 私有网段
- IP-CIDR,192.168.0.0/16,DIRECT # 192.168.x.x 局域网段
- IP-CIDR,127.0.0.0/8,DIRECT # 本地回环
- RULE-SET,chinamax,DIRECT # 自动匹配国内已知域名
- GEOIP,CN,DIRECT # 所有中国IP段走直连
- MATCH,Auto # 以上都没命中 → 走代理
| 访问目标 | 匹配规则 | 走向 |
|---|---|---|
baidu.com | DOMAIN-SUFFIX,baidu.com,DIRECT | 直连，不走代理 |
google.com | 无匹配 → MATCH,Auto | 走 Shadowsocks 代理 |
twitter.com | 无匹配 → MATCH,Auto | 走 Shadowsocks 代理 |
bilibili.com | DOMAIN-SUFFIX,bilibili.com,DIRECT | 直连 |
amazon.com | 无匹配 → MATCH,Auto | 走 Shadowsocks 代理 |
| 中国大陆 IP | GEOIP,CN,DIRECT | 直连 |
| 资源 | 链接 |
|---|---|
| Shadowsocks 官网 | https://shadowsocks.org/ |
| Let's Encrypt | https://letsencrypt.org/ |
| Clash 规则集合 (ChinaMax) | https://github.com/blackmatrix7/ios_rule_script |
| Clash Verge 下载 | https://github.com/clash-verge-rev/clash-verge-rev |
| duckdns 注册 | https://www.duckdns.org/ |
| nginx 文档 | https://nginx.org/en/docs/ |
| Certbot 文档 | https://certbot.eff.org/ |
Last updated / 最后更新: 2026-07-16