ClashX、Clash Verge 与 Shadowsocks：原理深入解析与横向对比

Client ←→ SS-Local ←→ SS-Server ←→ Target Server

{
  "server": "example.com",
  "server_port": 8388,
  "local_address": "127.0.0.1",
  "local_port": 1080,
  "password": "password",
  "method": "aes-256-gcm",
  "timeout": 300
}

Application ←→ Clash Core ←→ Rule Engine ←→ Proxy Providers ←→ Target

# Clash 配置示例
port: 7890
socks-port: 7891
allow-lan: true
mode: rule
log-level: info

external-controller: 127.0.0.1:9090

proxies:
  - name: "ss1"
    type: ss
    server: server1.com
    port: 443
    cipher: aes-256-gcm
    password: "password"

proxy-groups:
  - name: "PROXY"
    type: select
    proxies:
      - ss1
      - DIRECT

rules:
  - DOMAIN-SUFFIX,google.com,PROXY
  - DOMAIN-KEYWORD,github,PROXY
  - GEOIP,CN,DIRECT
  - MATCH,PROXY

# 基础的全局代理或直连模式
# 不支持复杂规则分流
PAC 文件支持（有限）

# 强大的规则引擎
rules:
  # 域名规则
  - DOMAIN,example.com,PROXY
  - DOMAIN-SUFFIX,google.com,PROXY
  - DOMAIN-KEYWORD,github,PROXY

  # IP 规则
  - IP-CIDR,192.168.1.0/24,DIRECT
  - IP-CIDR6,::1/128,DIRECT

  # 地理位置规则
  - GEOIP,CN,DIRECT
  - GEOIP,US,PROXY

  # 进程规则（部分客户端支持）
  - PROCESS-NAME,telegram,PROXY

  # 最终规则
  - MATCH,PROXY

# 基准测试环境：同一服务器，相同网络条件

Shadowsocks (AES-256-GCM):
- 平均延迟：+2-5ms
- 吞吐量：95-98% 原始带宽
- 连接建立：50-100ms

ClashX (相同 SS 节点):
- 平均延迟：+3-8ms  
- 吞吐量：90-95% 原始带宽
- 连接建立：100-200ms

Clash Verge (相同 SS 节点):
- 平均延迟：+4-10ms
- 吞吐量：88-93% 原始带宽
- 连接建立：150-250ms

# Ubuntu/Debian
apt update
apt install shadowsocks-libev

# 配置文件 /etc/shadowsocks-libev/config.json
{
    "server": "0.0.0.0",
    "server_port": 8388,
    "password": "your-password",
    "method": "aes-256-gcm",
    "timeout": 300,
    "fast_open": true
}

# 启动服务
systemctl enable shadowsocks-libev
systemctl start shadowsocks-libev

{
    "server": "your-server.com",
    "server_port": 8388,
    "local_address": "127.0.0.1",
    "local_port": 1080,
    "password": "your-password",
    "method": "aes-256-gcm",
    "timeout": 300
}

# ~/.config/clash/config.yaml
port: 7890
socks-port: 7891
allow-lan: false
mode: rule
log-level: info

dns:
  enable: true
  listen: 0.0.0.0:53
  enhanced-mode: fake-ip
  nameserver:
    - 223.5.5.5
    - 114.114.114.114
  fallback:
    - 8.8.8.8
    - 1.1.1.1

proxies:
  - name: "节点1"
    type: ss
    server: server1.com
    port: 443
    cipher: aes-256-gcm
    password: "password1"

proxy-groups:
  - name: "手动选择"
    type: select
    proxies:
      - 节点1
      - DIRECT

rules:
  - DOMAIN-SUFFIX,google.com,手动选择
  - GEOIP,CN,DIRECT
  - MATCH,手动选择

# Clash Verge 使用相同的 Clash 配置格式
# 但提供图形界面配置

# 高级配置示例
experimental:
  interface-name: en0

tun:
  enable: true
  stack: system
  dns-hijack:
    - 198.18.0.2:53
  auto-route: true
  auto-detect-interface: true

profile:
  store-selected: true
  store-fake-ip: true

# 订阅配置
proxy-providers:
  provider1:
    type: http
    url: "https://example.com/clash-config"
    interval: 3600
    path: ./provider1.yaml
    health-check:
      enable: true
      url: http://www.gstatic.com/generate_204
      interval: 300

优化后的安全特性：
- 重放攻击防护
- 时间戳验证
- 改进的密钥派生
- 会话密钥轮换

安全特性：
- 支持最新 SS 2022 协议
- TLS 证书验证
- 多协议安全支持
- 配置文件加密存储

优先级排序：
1. ClashX - 原生体验最佳
2. Clash Verge - 现代化界面
3. Shadowsocks - 简单场景

优先级排序：
1. Clash Verge - 综合体验最佳
2. Clash for Windows - 功能丰富
3. Shadowsocks - 轻量选择

优先级排序：
1. Clash Core + Web UI - 最灵活
2. Clash Verge - 图形界面
3. Shadowsocks - 命令行友好

# TCP 优化
echo 'net.core.default_qdisc = fq' >> /etc/sysctl.conf
echo 'net.ipv4.tcp_congestion_control = bbr' >> /etc/sysctl.conf
sysctl -p

# 连接数优化
echo '* soft nofile 65536' >> /etc/security/limits.conf
echo '* hard nofile 65536' >> /etc/security/limits.conf

# Shadowsocks 配置优化
{
    "server": "0.0.0.0",
    "server_port": 8388,
    "password": "your-password",
    "method": "aes-256-gcm",
    "timeout": 60,
    "fast_open": true,
    "workers": 4,
    "prefer_ipv6": false,
    "no_delay": true,
    "reuse_port": true
}

{
    "local_address": "127.0.0.1",
    "local_port": 1080,
    "timeout": 60,
    "workers": 1,
    "prefer_ipv6": false
}

# 性能相关配置
dns:
  enable: true
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  nameserver:
    - 223.5.5.5
    - 114.114.114.114
  cache-size: 4096

# 代理组优化
proxy-groups:
  - name: "自动选择"
    type: url-test
    proxies:
      - 节点1
      - 节点2
    url: 'http://www.gstatic.com/generate_204'
    interval: 300
    tolerance: 50

# 规则优化（按匹配频率排序）
rules:
  - GEOIP,CN,DIRECT
  - DOMAIN-SUFFIX,cn,DIRECT
  - DOMAIN-KEYWORD,google,PROXY
  - MATCH,PROXY

# 增加文件描述符限制
sudo launchctl limit maxfiles 65536 65536

# 网络缓冲区优化
sudo sysctl -w net.inet.tcp.sendbuf_max=16777216
sudo sysctl -w net.inet.tcp.recvbuf_max=16777216

# TCP BBR 启用
modprobe tcp_bbr
echo 'tcp_bbr' >> /etc/modules-load.d/modules.conf
echo 'net.core.default_qdisc=fq' >> /etc/sysctl.d/99-shadowsocks.conf
echo 'net.ipv4.tcp_congestion_control=bbr' >> /etc/sysctl.d/99-shadowsocks.conf
sysctl --system

# 检查网络连通性
ping your-server.com
telnet your-server.com 8388

# 检查本地端口
netstat -an | grep 1080
lsof -i :1080

# 检查 DNS 解析
nslookup google.com
dig @8.8.8.8 google.com

# 测试延迟
ping -c 10 your-server.com

# 测试带宽
# 使用 iperf3 或在线速度测试

# 检查路由
traceroute your-server.com
mtr your-server.com

# 启用详细日志
ss-local -c config.json -v

# 常见错误信息
# "connection timeout" - 网络连接问题
# "invalid password" - 密码错误  
# "method not supported" - 加密方法不支持

# 配置文件中启用日志
log-level: debug

# 日志位置
# macOS: ~/Library/Logs/ClashX/
# Windows: %APPDATA%/clash/
# Linux: ~/.config/clash/

#!/bin/bash
# 代理性能监控脚本

check_proxy() {
    local proxy_url="socks5://127.0.0.1:1080"
    local test_url="http://www.google.com"

    # 测试连接时间
    time curl --proxy $proxy_url -s $test_url > /dev/null

    # 测试延迟
    curl --proxy $proxy_url -w "@curl-format.txt" -s $test_url
}

# 定期检查
while true; do
    echo "$(date): 检查代理状态"
    check_proxy
    sleep 300
done

代理工具选择流程：

是否需要复杂规则分流？
├─ 否 → Shadowsocks
└─ 是 → 使用什么平台？
    ├─ macOS → ClashX
    ├─ Windows/Linux → Clash Verge
    └─ 服务器/无界面 → Clash Core