[{"data":1,"prerenderedAt":773},["ShallowReactive",2],{"content:\u002Fposts\u002Fubuntu-server-clash-setup":3,"surround:\u002Fposts\u002Fubuntu-server-clash-setup":761},{"id":4,"title":5,"body":6,"categories":733,"date":735,"description":736,"draft":737,"extension":738,"image":739,"meta":740,"navigation":742,"path":743,"permalink":739,"pinned":737,"published":739,"readingTime":744,"recommend":739,"references":739,"seo":749,"sitemap":750,"stem":751,"tags":752,"type":759,"updated":735,"__hash__":760},"content\u002Fposts\u002Fposts\u002Fubuntu-server-clash-setup.md","如何在 Ubuntu Server 上快速部署 Clash",{"type":7,"value":8,"toc":703},"minimark",[9,19,27,33,38,41,52,76,80,87,93,97,108,113,116,122,141,145,148,169,173,180,186,204,230,247,251,257,261,267,271,274,280,313,317,327,333,336,340,354,358,364,368,378,384,391,395,398,408,414,436,440,445,449,455,459,465,473,477,483,494,498,501,507,510,514,647,650,680,697],[10,11,15],"alert",{"type":12,"title":13,"icon":14},"info","AI 迁移提示","tabler:robot",[16,17,18],"p",{},"本文由 AI 协助从旧站迁移，尚未完成逐篇人工审校；内容如有疏漏，将在复核后修订。",[16,20,21,22,26],{},"在维护 Linux 服务器时，经常会遇到下载 GitHub 资源缓慢或无法访问外网 API 的情况。本文介绍一种",[23,24,25],"strong",{},"轻量、临时、可随时清理","的代理方案。",[10,28,30],{"type":12,"title":29},"关于内核",[16,31,32],{},"本文使用的 Mihomo 是原 Clash.Meta 的后继项目。自 2023 年原版 Clash (clash-premium) 停止更新后，Mihomo 接手了 Meta 分支的维护，是目前社区最主流的 Clash 内核实现。下文中为了书写方便，仍统一称其为 \"Clash\"。",[34,35,37],"h2",{"id":36},"_1-环境准备","1. 环境准备",[16,39,40],{},"首先，确认你的服务器 CPU 架构：",[42,43,49],"pre",{"className":44,"code":46,"language":47,"meta":48},[45],"language-bash","uname -m\n","bash","",[50,51,46],"code",{"__ignoreMap":48},[53,54,55,67],"ul",{},[56,57,58,59,62,63,66],"li",{},"如果是 ",[50,60,61],{"code":61},"x86_64","，下载 ",[23,64,65],{},"amd64"," 版本。",[56,68,58,69,72,73,66],{},[50,70,71],{"code":71},"aarch64","（如树莓派、甲骨文 ARM），下载 ",[23,74,75],{},"arm64",[34,77,79],{"id":78},"_2-下载并解压","2. 下载并解压",[16,81,82,83,86],{},"以最新的 ",[23,84,85],{},"Mihomo (Clash Meta)"," 内核为例，执行以下命令：",[42,88,91],{"className":89,"code":90,"language":47,"meta":48},[45],"# 下载二进制文件（以 amd64 为例）\nwget https:\u002F\u002Fgithub.com\u002FMetaCubeX\u002Fmihomo\u002Freleases\u002Fdownload\u002Fv1.18.1\u002Fmihomo-linux-amd64-v1.18.1.gz\n\n# 解压并重命名\ngunzip mihomo-linux-amd64-v1.18.1.gz\nmv mihomo-linux-amd64-v1.18.1 clash\nchmod +x clash\n",[50,92,90],{"__ignoreMap":48},[34,94,96],{"id":95},"_3-配置-clash-运行环境","3. 配置 Clash 运行环境",[16,98,99,100,103,104,107],{},"Clash 运行至少需要两个文件：执行程序 ",[50,101,102],{"code":102},"clash"," 和配置文件 ",[50,105,106],{"code":106},"config.yaml","。",[109,110,112],"h3",{"id":111},"_31-准备配置文件","3.1 准备配置文件",[16,114,115],{},"订阅链接返回的本身就是一个 YAML 文档，直接把内容下载到当前目录即可：",[42,117,120],{"className":118,"code":119,"language":47,"meta":48},[45],"curl -o config.yaml '你的订阅 URL'\n",[50,121,119],{"__ignoreMap":48},[10,123,126],{"type":124,"title":125},"warning","订阅 URL 必须用单引号",[16,127,128,129,132,133,136,137,140],{},"务必用",[23,130,131],{},"单引号","包裹订阅 URL，否则其中的 ",[50,134,135],{"code":135},"&","、",[50,138,139],{"code":139},"?"," 等特殊字符会被 shell 解析，导致参数截断或后台执行。",[109,142,144],{"id":143},"_32-确认端口信息","3.2 确认端口信息",[16,146,147],{},"在你的配置中，关键参数如下：",[53,149,150,160],{},[56,151,152,155,156,159],{},[23,153,154],{},"混合代理端口 (Mixed Port)","：",[50,157,158],{"code":158},"7890","（同时支持 HTTP \u002F SOCKS）",[56,161,162,155,165,168],{},[23,163,164],{},"API 访问密钥 (Secret)",[50,166,167],{"code":167},"603705","（用于 Clash REST API 的 Bearer 鉴权，不是网页登录密码）",[34,170,172],{"id":171},"_4-启动运行","4. 启动运行",[16,174,175,176,179],{},"建议使用 ",[50,177,178],{"code":178},"nohup"," 让其在后台运行，即便断开 SSH 也不会停止：",[42,181,184],{"className":182,"code":183,"language":47,"meta":48},[45],"# 在当前目录下启动，指定配置文件\nnohup .\u002Fclash -f config.yaml -d . > clash.log 2>&1 &\n",[50,185,183],{"__ignoreMap":48},[53,187,188,196],{},[56,189,190,155,193],{},[23,191,192],{},"查看运行日志",[50,194,195],{"code":195},"tail -f clash.log",[56,197,198,155,201],{},[23,199,200],{},"停止运行",[50,202,203],{"code":203},"pkill -f 'clash -f config.yaml'",[10,205,208],{"type":206,"title":207},"tip","为什么不用 pkill clash",[16,209,210,211,213,214,217,218,221,222,225,226,229],{},"如果系统里还有其他含 ",[50,212,102],{"code":102}," 字样的进程（如 ",[50,215,216],{"code":216},"clash-verge","、旧版 ",[50,219,220],{"code":220},"clash-premium","），",[50,223,224],{"code":224},"pkill clash"," 会一并误杀。通过 ",[50,227,228],{"code":228},"-f"," 精确匹配启动参数更安全。",[10,231,233],{"type":124,"title":232},"日志会无限增长",[16,234,235,236,239,240,242,243,246],{},"上面的命令会让 ",[50,237,238],{"code":238},"clash.log"," 一直追加写入，长期运行可能吃光磁盘。临时使用场景下用完清理即可；长期运行请使用下面第 7 节的 systemd 方案（交给 journald 自动管理），或给 ",[50,241,238],{"code":238}," 配一条 ",[50,244,245],{"code":245},"logrotate"," 规则。",[34,248,250],{"id":249},"_5-激活服务器代理","5. 激活服务器代理",[16,252,253,254,256],{},"Clash 运行后，你需要告诉系统将流量转发到 ",[50,255,158],{"code":158}," 端口。",[109,258,260],{"id":259},"_51-临时激活当前会话有效","5.1 临时激活（当前会话有效）",[42,262,265],{"className":263,"code":264,"language":47,"meta":48},[45],"export http_proxy=http:\u002F\u002F127.0.0.1:7890\nexport https_proxy=http:\u002F\u002F127.0.0.1:7890\n",[50,266,264],{"__ignoreMap":48},[109,268,270],{"id":269},"_52-配置-no_proxy-白名单","5.2 配置 no_proxy 白名单",[16,272,273],{},"配完代理后，访问本机或内网服务也会被转发到 Clash，轻则走外网绕一圈，重则超时失败。需要把这些流量排除掉：",[42,275,278],{"className":276,"code":277,"language":47,"meta":48},[45],"export no_proxy=\"localhost,127.0.0.1,::1\"\n# 如果还有内网服务、K8s Service，按需追加域名后缀或显式 IP\nexport no_proxy=\"$no_proxy,.svc,.cluster.local,192.168.1.100\"\n",[50,279,277],{"__ignoreMap":48},[10,281,283],{"type":206,"title":282},"关于 CIDR",[16,284,285,286,289,290,293,294,297,298,301,302,136,305,308,309,312],{},"不同工具对 ",[50,287,288],{"code":288},"no_proxy"," 中 CIDR 网段的支持差异较大（如 ",[50,291,292],{"code":292},"curl"," 不支持 ",[50,295,296],{"code":296},"10.0.0.0\u002F8"," 这种写法），推荐使用",[23,299,300],{},"域名后缀","（",[50,303,304],{"code":304},".internal",[50,306,307],{"code":307},".svc","）或",[23,310,311],{},"显式 IP"," 更可靠。",[109,314,316],{"id":315},"_53-验证代理是否真正生效","5.3 验证代理是否真正生效",[16,318,319,320,323,324,155],{},"仅凭 ",[50,321,322],{"code":322},"curl https:\u002F\u002Fwww.google.com"," 返回 200 并不能证明代理生效——某些地区裸连 Google 也能通。可靠的做法是",[23,325,326],{},"比对出口 IP",[42,328,331],{"className":329,"code":330,"language":47,"meta":48},[45],"# 不走代理\nunset http_proxy https_proxy\ncurl -s https:\u002F\u002Fipinfo.io\u002Fip\n\n# 走代理\nexport http_proxy=http:\u002F\u002F127.0.0.1:7890\nexport https_proxy=http:\u002F\u002F127.0.0.1:7890\ncurl -s https:\u002F\u002Fipinfo.io\u002Fip\n",[50,332,330],{"__ignoreMap":48},[16,334,335],{},"两次返回的 IP 应当不同，且第二次应为你订阅节点所在地的 IP。若两次一致，说明流量没走 Clash，回头检查端口监听和进程状态。",[34,337,339],{"id":338},"_6-常用工具的代理配置","6. 常用工具的代理配置",[16,341,342,345,346,349,350,353],{},[50,343,344],{"code":344},"http_proxy"," \u002F ",[50,347,348],{"code":348},"https_proxy"," 环境变量只对",[23,351,352],{},"显式读取环境变量","的程序生效（curl、wget、pip、npm 等）。下面这些工具需要单独配置。",[109,355,357],{"id":356},"_61-git","6.1 Git",[42,359,362],{"className":360,"code":361,"language":47,"meta":48},[45],"# 推荐：仅对 GitHub 走代理，避免访问国内 Git 仓库（Gitee、Coding）时误走代理\ngit config --global http.https:\u002F\u002Fgithub.com.proxy http:\u002F\u002F127.0.0.1:7890\n\n# 或全局代理\ngit config --global http.proxy http:\u002F\u002F127.0.0.1:7890\ngit config --global https.proxy http:\u002F\u002F127.0.0.1:7890\n\n# 取消代理\ngit config --global --unset http.proxy\ngit config --global --unset https.proxy\n",[50,363,361],{"__ignoreMap":48},[109,365,367],{"id":366},"_62-apt","6.2 APT",[16,369,370,371,374,375,377],{},"APT ",[23,372,373],{},"不读"," ",[50,376,344],{"code":344}," 环境变量，需要写配置文件：",[42,379,382],{"className":380,"code":381,"language":47,"meta":48},[45],"sudo tee \u002Fetc\u002Fapt\u002Fapt.conf.d\u002F99proxy \u003C\u003CEOF\nAcquire::http::Proxy \"http:\u002F\u002F127.0.0.1:7890\";\nAcquire::https::Proxy \"http:\u002F\u002F127.0.0.1:7890\";\nEOF\n",[50,383,381],{"__ignoreMap":48},[16,385,386,387,390],{},"不用时直接 ",[50,388,389],{"code":389},"sudo rm \u002Fetc\u002Fapt\u002Fapt.conf.d\u002F99proxy"," 即可恢复。",[109,392,394],{"id":393},"_63-docker","6.3 Docker",[16,396,397],{},"Docker 代理分两层：",[16,399,400,407],{},[23,401,402,403,406],{},"让 ",[50,404,405],{"code":405},"docker pull"," 走代理","（作用于 Docker daemon）：",[42,409,412],{"className":410,"code":411,"language":47,"meta":48},[45],"sudo mkdir -p \u002Fetc\u002Fsystemd\u002Fsystem\u002Fdocker.service.d\nsudo tee \u002Fetc\u002Fsystemd\u002Fsystem\u002Fdocker.service.d\u002Fhttp-proxy.conf \u003C\u003CEOF\n[Service]\nEnvironment=\"HTTP_PROXY=http:\u002F\u002F127.0.0.1:7890\"\nEnvironment=\"HTTPS_PROXY=http:\u002F\u002F127.0.0.1:7890\"\nEnvironment=\"NO_PROXY=localhost,127.0.0.1\"\nEOF\nsudo systemctl daemon-reload\nsudo systemctl restart docker\n",[50,413,411],{"__ignoreMap":48},[16,415,416,419,420,423,424,427,428,431,432,435],{},[23,417,418],{},"让容器内进程走代理","：需要配置 ",[50,421,422],{"code":422},"~\u002F.docker\u002Fconfig.json"," 的 ",[50,425,426],{"code":426},"proxies"," 段，或在 ",[50,429,430],{"code":430},"docker run"," 时通过 ",[50,433,434],{"code":434},"-e HTTP_PROXY=..."," 传入。",[34,437,439],{"id":438},"_7-进阶注册为-systemd-服务","7. 进阶：注册为 systemd 服务",[16,441,442,444],{},[50,443,178],{"code":178}," 适合临时验证，长期运行推荐托管给 systemd：开机自启、崩溃自拉、日志统一交给 journald。",[109,446,448],{"id":447},"_71-移动文件到标准位置","7.1 移动文件到标准位置",[42,450,453],{"className":451,"code":452,"language":47,"meta":48},[45],"sudo mkdir -p \u002Fetc\u002Fclash\nsudo mv clash \u002Fusr\u002Flocal\u002Fbin\u002Fclash\nsudo mv config.yaml \u002Fetc\u002Fclash\u002F\n",[50,454,452],{"__ignoreMap":48},[109,456,458],{"id":457},"_72-创建-systemd-单元","7.2 创建 systemd 单元",[16,460,461,462,155],{},"新建 ",[50,463,464],{"code":464},"\u002Fetc\u002Fsystemd\u002Fsystem\u002Fclash.service",[42,466,471],{"className":467,"code":469,"language":470,"meta":48},[468],"language-ini","[Unit]\nDescription=Clash (Mihomo) Proxy Service\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=simple\nExecStart=\u002Fusr\u002Flocal\u002Fbin\u002Fclash -f \u002Fetc\u002Fclash\u002Fconfig.yaml -d \u002Fetc\u002Fclash\nRestart=on-failure\nRestartSec=5s\nLimitNOFILE=1048576\n\n[Install]\nWantedBy=multi-user.target\n","ini",[50,472,469],{"__ignoreMap":48},[109,474,476],{"id":475},"_73-启用并管理","7.3 启用并管理",[42,478,481],{"className":479,"code":480,"language":47,"meta":48},[45],"sudo systemctl daemon-reload\nsudo systemctl enable --now clash      # 开机自启 + 立即启动\n\nsudo systemctl status clash            # 查看状态\nsudo systemctl restart clash           # 重启\nsudo journalctl -u clash -f            # 实时日志\n",[50,482,480],{"__ignoreMap":48},[10,484,485],{"type":206},[16,486,487,488,136,490,493],{},"用 systemd 管理后，",[50,489,178],{"code":178},[50,491,492],{"code":492},"pkill"," 相关命令都可以忘掉了。日志由 journald 自动轮转，不用担心磁盘被写满。",[34,495,497],{"id":496},"_8-版本升级","8. 版本升级",[16,499,500],{},"Mihomo 迭代频繁，升级只需替换二进制：",[42,502,505],{"className":503,"code":504,"language":47,"meta":48},[45],"# 1. 在 https:\u002F\u002Fgithub.com\u002FMetaCubeX\u002Fmihomo\u002Freleases 查看最新版本\n# 2. 下载并覆盖\nwget https:\u002F\u002Fgithub.com\u002FMetaCubeX\u002Fmihomo\u002Freleases\u002Fdownload\u002Fv1.19.0\u002Fmihomo-linux-amd64-v1.19.0.gz\ngunzip mihomo-linux-amd64-v1.19.0.gz\nsudo mv mihomo-linux-amd64-v1.19.0 \u002Fusr\u002Flocal\u002Fbin\u002Fclash\nsudo chmod +x \u002Fusr\u002Flocal\u002Fbin\u002Fclash\n\n# 3. 重启服务（systemd 方案）\nsudo systemctl restart clash\n",[50,506,504],{"__ignoreMap":48},[16,508,509],{},"升级前建议备份一份旧二进制，方便回滚。",[34,511,513],{"id":512},"_9-常见故障排查","9. 常见故障排查",[515,516,517,533],"table",{},[518,519,520],"thead",{},[521,522,523,527,530],"tr",{},[524,525,526],"th",{},"现象",[524,528,529],{},"可能原因",[524,531,532],{},"对策",[534,535,536,560,581,598,615,629],"tbody",{},[521,537,538,544,547],{},[539,540,541],"td",{},[50,542,543],{"code":543},"curl: (7) Failed to connect to 127.0.0.1:7890",[539,545,546],{},"Clash 进程没起来",[539,548,549,552,553,555,556,559],{},[50,550,551],{"code":551},"ps aux | grep clash"," 确认进程；查看 ",[50,554,238],{"code":238}," 或 ",[50,557,558],{"code":558},"journalctl -u clash"," 是否有报错",[521,561,562,568,571],{},[539,563,564,565],{},"日志反复刷 ",[50,566,567],{"code":567},"no available proxies",[539,569,570],{},"订阅节点全部失联，或策略组未选中节点",[539,572,573,574,576,577,580],{},"更新订阅；检查 ",[50,575,106],{"code":106}," 中 ",[50,578,579],{"code":579},"proxy-groups"," 配置",[521,582,583,586,589],{},[539,584,585],{},"代理后仍访问不通境外站点",[539,587,588],{},"DNS 污染（本地解析到被污染 IP 后再走代理）",[539,590,591,592,594,595],{},"在 ",[50,593,106],{"code":106}," 启用 ",[50,596,597],{"code":597},"dns.enhanced-mode: fake-ip",[521,599,600,606,609],{},[539,601,602,603],{},"启动报 ",[50,604,605],{"code":605},"bind: address already in use",[539,607,608],{},"7890 \u002F 9090 端口被其他进程占用",[539,610,611,614],{},[50,612,613],{"code":613},"ss -lntp | grep 7890"," 定位占用进程并释放",[521,616,617,620,626],{},[539,618,619],{},"apt \u002F docker 不走代理",[539,621,622,623,625],{},"这两者不读 ",[50,624,344],{"code":344}," 环境变量",[539,627,628],{},"按本文第 6 节配置对应的代理方式",[521,630,631,637,640],{},[539,632,633,636],{},[50,634,635],{"code":635},"curl -s https:\u002F\u002Fipinfo.io\u002Fip"," 两次返回相同",[539,638,639],{},"流量没走 Clash",[539,641,642,643,646],{},"检查环境变量是否生效（",[50,644,645],{"code":645},"echo $http_proxy","）、Clash 是否在监听 7890",[34,648,649],{"id":649},"安全小贴士",[10,651,653,666],{"type":124,"title":652},"端口暴露风险",[16,654,655,656,659,660,107],{},"真正决定 7890 端口是否\"裸奔\"的，不是配置里的 ",[50,657,658],{"code":658},"allow-lan","，而是 ",[23,661,662,665],{},[50,663,664],{"code":664},"bind-address"," 的监听地址 + 云厂商安全组规则",[16,667,668,669,672,673,675,676,679],{},"如果 Clash 监听在 ",[50,670,671],{"code":671},"0.0.0.0:7890"," 且云安全组对公网放行，任何人都能拿你这台机器当免费跳板。建议把 ",[50,674,664],{"code":664}," 显式设为 ",[50,677,678],{"code":678},"127.0.0.1","，或在云安全组里把 7890 锁死为仅本机 \u002F 可信 IP 可访问。",[10,681,683],{"type":206,"title":682},"任务结束后的清理",[16,684,685,686,689,690,692,693,696],{},"临时使用完毕后，别忘了执行 ",[50,687,688],{"code":688},"unset http_proxy https_proxy no_proxy"," 取消环境变量，并用 ",[50,691,203],{"code":203},"（或 ",[50,694,695],{"code":695},"sudo systemctl stop clash","）彻底关闭程序，避免遗留代理影响后续操作。",[10,698,700],{"type":12,"title":699},"作者注",[16,701,702],{},"本教程适用于 Ubuntu Server 20.04 \u002F 22.04 \u002F 24.04 等主流 Linux 发行版。",{"title":48,"searchDepth":704,"depth":704,"links":705},4,[706,708,709,714,715,720,725,730,731,732],{"id":36,"depth":707,"text":37},2,{"id":78,"depth":707,"text":79},{"id":95,"depth":707,"text":96,"children":710},[711,713],{"id":111,"depth":712,"text":112},3,{"id":143,"depth":712,"text":144},{"id":171,"depth":707,"text":172},{"id":249,"depth":707,"text":250,"children":716},[717,718,719],{"id":259,"depth":712,"text":260},{"id":269,"depth":712,"text":270},{"id":315,"depth":712,"text":316},{"id":338,"depth":707,"text":339,"children":721},[722,723,724],{"id":356,"depth":712,"text":357},{"id":366,"depth":712,"text":367},{"id":393,"depth":712,"text":394},{"id":438,"depth":707,"text":439,"children":726},[727,728,729],{"id":447,"depth":712,"text":448},{"id":457,"depth":712,"text":458},{"id":475,"depth":712,"text":476},{"id":496,"depth":707,"text":497},{"id":512,"depth":707,"text":513},{"id":649,"depth":707,"text":649},[734],"网络","2026-03-10","在没有图形界面的 Ubuntu Server 下，通过 Mihomo (Clash Meta) 二进制快速搭建代理，临时解决 GitHub 下载慢、外网 API 不通的问题。",false,"md",null,{"slots":741},{},true,"\u002Fposts\u002Fubuntu-server-clash-setup",{"text":745,"minutes":746,"time":747,"words":748},"9 min read",8.11,486600,1622,{"title":5,"description":736},{"loc":743},"posts\u002Fposts\u002Fubuntu-server-clash-setup",[753,754,755,756,757,758],"Ubuntu","Clash","Clash Meta","Mihomo","Proxy","Linux","tech","GZX8URZt-p22Wptntd9p26_IAPZeVdiJVRrDxbNikMQ",[762,767],{"title":763,"path":764,"stem":765,"date":766,"type":759,"children":-1},"TrueNAS 全方位监控实战：Prometheus + Grafana 方案","\u002Fposts\u002Ftruenas-prometheus-grafana-monitoring","posts\u002Fposts\u002Ftruenas-prometheus-grafana-monitoring","2026-03-08",{"title":768,"path":769,"stem":770,"date":771,"type":772,"children":-1},"《地球 Online》：这破游戏我是一天也待不下去了","\u002Fposts\u002Farth-online-1-star-review","posts\u002Fposts\u002Farth-online-1-star-review","2026-03-29","story",1788712223033]