# 抛弃旁路由，使用 clash 作为透明网关

众所周知使用 clash 配置透明网关非常复杂，最近疯狂搜文终于找到了一个简便的工具：

[https://github.com/mritd/tpclash](https://github.com/mritd/tpclash)

使用起来也非常简单。

1. 首先[先把它下载下来](https://github.com/mritd/tpclash/releases/latest)，重命名为 `/usr/local/bin/clash`
    
2. 创建 clash 的工作目录，可以是任何目录，我放在了 /etc/clash
    
3. 增加配置文件 config.yaml
    
    ```yaml
    interface-name: ens18 # 请指定自己实际的接口名称(ip a 获取)
    
    port: 7890
    socks-port: 7891
    redir-port: 7892
    tproxy-port: 7893
    allow-lan: true
    bind-address: "*"
    mode: Rule
    log-level: info
    external-controller: 0.0.0.0:9090
    secret: ""
    external-ui: /opt/clash-dashboard
    
    dns:
      enable: true
      ipv6: false
      listen: 0.0.0.0:1053
      enhanced-mode: fake-ip
      fake-ip-range: 198.18.0.1/16
      default-nameserver:
        - 114.114.114.114
        - 1.1.1.1
      nameserver:
        - 114.114.114.114
        - 223.6.6.6
    
    tun:
      enable: true
      stack: system
      auto-route: true
      auto-detect-interface: true
      dns-hijack:
        - any:53
    
    proxies:
      - {
          name: hk,
          udp: true,
        }
    
    rule-providers:
      reject:
        type: http
        behavior: domain
        url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/reject.txt"
        path: ./ruleset/reject.yaml
        interval: 86400
    
      icloud:
        type: http
        behavior: domain
        url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/icloud.txt"
        path: ./ruleset/icloud.yaml
        interval: 86400
    
      apple:
        type: http
        behavior: domain
        url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/apple.txt"
        path: ./ruleset/apple.yaml
        interval: 86400
    
      google:
        type: http
        behavior: domain
        url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/google.txt"
        path: ./ruleset/google.yaml
        interval: 86400
    
      proxy:
        type: http
        behavior: domain
        url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/proxy.txt"
        path: ./ruleset/proxy.yaml
        interval: 86400
    
      direct:
        type: http
        behavior: domain
        url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/direct.txt"
        path: ./ruleset/direct.yaml
        interval: 86400
    
      private:
        type: http
        behavior: domain
        url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/private.txt"
        path: ./ruleset/private.yaml
        interval: 86400
    
      gfw:
        type: http
        behavior: domain
        url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/gfw.txt"
        path: ./ruleset/gfw.yaml
        interval: 86400
    
      greatfire:
        type: http
        behavior: domain
        url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/greatfire.txt"
        path: ./ruleset/greatfire.yaml
        interval: 86400
    
      tld-not-cn:
        type: http
        behavior: domain
        url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/tld-not-cn.txt"
        path: ./ruleset/tld-not-cn.yaml
        interval: 86400
    
      telegramcidr:
        type: http
        behavior: ipcidr
        url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/telegramcidr.txt"
        path: ./ruleset/telegramcidr.yaml
        interval: 86400
    
      cncidr:
        type: http
        behavior: ipcidr
        url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/cncidr.txt"
        path: ./ruleset/cncidr.yaml
        interval: 86400
    
      lancidr:
        type: http
        behavior: ipcidr
        url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/lancidr.txt"
        path: ./ruleset/lancidr.yaml
        interval: 86400
    
      applications:
        type: http
        behavior: classical
        url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/applications.txt"
        path: ./ruleset/applications.yaml
        interval: 86400
    
    rules:
      - RULE-SET,applications,DIRECT
      - DOMAIN-SUFFIX,hashnode.com,hk
      - DOMAIN-KEYWORD,taobao,DIRECT
      - DOMAIN-KEYWORD,github,hk
      - DOMAIN,clash.razord.top,DIRECT
      - DOMAIN,yacd.haishan.me,DIRECT
      - RULE-SET,private,DIRECT
      - RULE-SET,reject,REJECT
      - RULE-SET,icloud,DIRECT
      - RULE-SET,apple,DIRECT
      - RULE-SET,google,DIRECT
      - RULE-SET,proxy,hk
      - RULE-SET,direct,DIRECT
      - RULE-SET,lancidr,DIRECT
      - RULE-SET,cncidr,DIRECT
      - RULE-SET,telegramcidr,hk
      - GEOIP,LAN,DIRECT
      - GEOIP,CN,DIRECT
      - MATCH,DIRECT # 处理漏网之鱼，可按需调整为默认走 proxy 或像我一样默认 direct
    ```
    
4. 启动测试，看下配置是否有误
    
    ```bash
    clash --test
    ```
    
5. 注册为服务，方便使用 `systemctl` 控制
    
    ```plaintext
    # /etc/systemd/system/clash.service
    [Unit]
    Description=Clash TProxy
    After=network.target
    
    [Service]
    User=root
    Group=clash
    Restart=on-failure
    ExecStart=/usr/local/bin/clash -d /etc/clash
    
    [Install]
    WantedBy=multi-user.target
    ```
    
6. 启动服务，并配置开机自启
    
    ```bash
    systemctl start clash
    systemctl enable clash
    ```
    
7. 将自己的设备网关设置为运行服务的机器 ip, Over
    

---

PS. tpclash 作者同样提供了 [docker 配置方案](https://github.com/mritd/tpclash#26%E5%9C%A8docker%E5%AE%B9%E5%99%A8%E4%B8%AD%E4%BD%BF%E7%94%A8)