mihomo / Clash：裸核部署、规则进阶与订阅管理

graph LR
subgraph 客户端
B[浏览器 / app] -->|HTTP / SOCKS5| L[本机 7890/7891]
end
L --> M[mihomo 进程
裸核]
M --> D{DNS / 规则匹配}
D -->|国内站| DR[DIRECT 直连]
D -->|国外站| P[代理节点
VLESS / VMess / SS]
M --> U[external-controller
9090 面板 API]
U --> UI[zashboard / metacubexd
Web UI]

https://github.com/MetaCubeX/mihomo/releases

sudo dpkg -i mihomo-*.deb
sudo apt -f install -y

# 确认安装结果
which mihomo
mihomo -v

port: 7890           # HTTP
socks-port: 7891     # SOCKS5
mixed-port: 7893     # 混合（推荐应用都走这个）
tproxy-port: 7894    # 透明代理（TUN 用）

allow-lan: false             # 是否允许局域网设备使用
bind-address: "127.0.0.1"    # 只监听本机
authentication:
  - "username:password"      # HTTP/SOCKS 代理需要认证

lan-allowed-ips:
  - "127.0.0.1/8"
  - "::1/128"
  - "172.16.0.0/12"          # Docker 桥接子网

# 监听端口
port: 7890           # HTTP 代理
socks-port: 7891     # SOCKS5
mixed-port: 7893     # 混合（HTTP/SOCKS5）

allow-lan: false
bind-address: "127.0.0.1"

# Web 面板
external-controller: 0.0.0.0:9090
secret: "your_strong_secret_here"
external-ui: /root/.config/mihomo/ui

mode: rule
log-level: info

proxies: []
proxy-groups:
  - name: PROXY
    type: select
    proxies: [DIRECT]
rules:
  - MATCH,PROXY

sudo cp config.yaml /etc/mihomo/config.yaml

# 订阅链接里通常带 token，配置权限设成 600
sudo chmod 600 /etc/mihomo/config.yaml

cd /root/.config/mihomo/

# 先清旧的
sudo rm -f GeoSite.dat GeoIP.dat Country.mmdb GeoLite2-ASN.mmdb

sudo curl -L --retry 5 --connect-timeout 20 \
  -o GeoSite.dat \
  https://github.com/MetaCubeX/meta-rules-dat/releases/download/latest/geosite.dat

sudo curl -L --retry 5 --connect-timeout 20 \
  -o GeoIP.dat \
  https://github.com/MetaCubeX/meta-rules-dat/releases/download/latest/geoip.dat

sudo curl -L --retry 5 --connect-timeout 20 \
  -o Country.mmdb \
  https://github.com/MetaCubeX/meta-rules-dat/releases/download/latest/country.mmdb

geox-url:
  geoip: https://testingcf.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geoip.dat
  geosite: https://testingcf.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geosite.dat
  mmdb: https://testingcf.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/country.mmdb
  asn: https://testingcf.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/GeoLite2-ASN.mmdb

sudo mihomo -f /etc/mihomo/config.yaml

http://<你的服务器 IP>:9090/ui/

sudo tee /etc/systemd/system/mihomo.service >/dev/null <<'EOF'
[Unit]
Description=Mihomo Proxy Service
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/bin/mihomo -f /etc/mihomo/config.yaml
Restart=on-failure
RestartSec=2
LimitNOFILE=1048576

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable mihomo
sudo systemctl start mihomo
sudo systemctl status mihomo

journalctl -u mihomo -f

sudo ufw allow 9090
sudo ufw status

export http_proxy=http://127.0.0.1:7890
export https_proxy=http://127.0.0.1:7890
export all_proxy=socks5://127.0.0.1:7891

# 测试
curl https://www.google.com -I

unset http_proxy https_proxy all_proxy

# 1. 下载 mihomo-windows-amd64.zip 解压到 C:\mihomo
# 2. 配置文件放到 C:\Users\<你的用户>\.config\mihomo\config.yaml
# 3. 前台运行
cd C:\mihomo
.\mihomo.exe -d $env:USERPROFILE\.config\mihomo

proxy-providers:
  Airport1:
    url: "https://your-subscription-link"
    type: http
    interval: 86400
    health-check: { enable: true, url: https://www.gstatic.com/generate_204, interval: 300 }
    override: { udp: true, additional-prefix: "[A1]" }

graph LR
A1[机场 A 订阅] --> SS[Sub-Store
聚合/筛选/改名]
A2[机场 B 订阅] --> SS
A3[自建节点] --> SS
SS --> O1[Clash 客户端]
SS --> O2[Shadowrocket]
SS --> O3[Surge / Loon]
SS --> O4[V2rayN]
N[Nginx 反代
HTTPS] --> SS

mkdir -p /opt/sub-store/data

services:
  sub-store:
    image: xream/sub-store:http-meta
    container_name: sub-store
    restart: always
    environment:
      # 定时备份到自定义存储（可选）
      - SUB_STORE_BACKEND_UPLOAD_CRON=55 23 * * *
      # 自定义后端路径（关键，防扫）
      - SUB_STORE_FRONTEND_BACKEND_PATH=/your_secret_path
    volumes:
      - /opt/sub-store/data:/opt/app/data
    ports:
      - "127.0.0.1:3001:3001"        # 只绑本机，外网走 nginx 反代

cd /opt/sub-store
docker compose up -d

# 看日志确认启动
docker compose logs -f

server {
    listen 443 ssl http2;
    server_name substore.your-domain.com;

    ssl_certificate     /path/to/fullchain.pem;
    ssl_certificate_key /path/to/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:3001;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 86400;
    }
}

server {
    listen 80;
    server_name substore.your-domain.com;
    return 301 https://$host$request_uri;
}

0 4 * * 0 tar -czf /backup/sub-store-$(date +\%Y\%m\%d).tar.gz \
  /opt/sub-store/data

graph LR
B[浏览器] -.加密代理.-> P[国外节点]
B -.明文 DNS.-> L[本地 ISP DNS]
L -.被劫持/记录.-> ISP[运营商]
P --> T[目标网站]

dns:
  fake-ip-filter:
    - "+.lan"
    - "+.local"
    - "geosite:private"
    - "geosite:connectivity-check"   # 微软/安卓的网络连通性检测
    - "geosite:cn"                   # 国内域名走真实 IP

dns:
  nameserver-policy:
    "geosite:cn,private":
      - https://223.5.5.5/dns-query
      - https://doh.pub/dns-query
    "geosite:geolocation-!cn":
      - https://1.1.1.1/dns-query
      - https://dns.google/dns-query

graph TD
Q[查询域名] --> F{命中 fake-ip-filter?}
F -->|是 国内域名| R{命中 nameserver-policy?}
F -->|否 国外域名| FK[返回假 IP
真实解析延后到节点]
R -->|geosite:cn| RD[阿里/腾讯 DoH]
R -->|geosite:!cn| RD2[Cloudflare/Google DoH]

rules:
  - RULE-SET, youtube, PROXY
  - GEOIP, CN, DIRECT
  - MATCH, PROXY

rules:
  - RULE-SET, youtube, PROXY
  - GEOIP, CN, DIRECT, no-resolve
  - MATCH, PROXY

dns:
  enable: true
  ipv6: false
  listen: 0.0.0.0:1053
  prefer-h3: false
  respect-rules: true              # 让 DNS 解析参考分流规则
  cache-algorithm: arc
  cache-size: 2048
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16

  # Fake-IP 过滤：返回真实 IP 的域名
  fake-ip-filter:
    - "+.lan"
    - "+.local"
    - "geosite:private"
    - "geosite:connectivity-check"
    - "geosite:cn"

  # 用于解析 DoH 域名自身（先有 IP 才能访问 DoH）
  default-nameserver:
    - 223.5.5.5
    - 119.29.29.29
    - 1.1.1.1
    - 8.8.8.8

  # 代理节点的 DNS（必须国外，防止节点域名被污染连不上）
  proxy-server-nameserver:
    - https://1.1.1.1/dns-query
    - https://dns.google/dns-query

  # 默认 nameserver（视为国外/未知流量，走国外加密 DNS）
  nameserver:
    - https://1.1.1.1/dns-query
    - https://dns.google/dns-query

  # 备用 fallback
  fallback:
    - https://1.1.1.1/dns-query
    - https://8.8.8.8/dns-query

  # 分流策略（核心）
  nameserver-policy:
    "geosite:cn,private":
      - https://223.5.5.5/dns-query
      - https://doh.pub/dns-query
    "geosite:geolocation-!cn":
      - https://1.1.1.1/dns-query
      - https://dns.google/dns-query

rules:
  # 域名规则（不需要 no-resolve）
  - DOMAIN-SUFFIX,google.com,PROXY
  - GEOSITE,youtube,PROXY
  - GEOSITE,cn,DIRECT

  # IP 规则（必须加 no-resolve）
  - GEOIP,CN,DIRECT,no-resolve
  - GEOIP,private,DIRECT,no-resolve

  - MATCH,PROXY

proxy-groups:
  - name: 香港智能
    type: smart
    url: https://www.gstatic.com/generate_204
    interval: 300
    tolerance: 50
    include-all: true
    filter: "(?=.*(港|HK|(?i)Hong))^((?!(台|日|韩|新|深|美|英)).)*$"

listeners:
  - name: port-hk
    type: mixed
    port: 42000
    udp: true
  - name: port-jp
    type: mixed
    port: 42002
    udp: true

rules:
  - "IN-PORT,42000,香港智能"
  - "IN-PORT,42002,日本手动"

https://dnsleaktest.com
https://browserleaks.com/dns
https://ipleak.net

# 创建 UI 目录
sudo mkdir -p /root/.config/mihomo/ui

cd /tmp
curl -L -o metacubexd.zip \
  https://github.com/MetaCubeX/metacubexd/archive/refs/heads/gh-pages.zip
unzip -q metacubexd.zip

sudo rm -rf /root/.config/mihomo/ui/*
sudo cp -a metacubexd-gh-pages/. /root/.config/mihomo/ui/

# 确认
test -f /root/.config/mihomo/ui/index.html && echo "UI OK"

sudo systemctl restart mihomo

http://<你的服务器 IP>:9090/ui/