Commercial proxy subscriptions are convenient, but they require you to trust an outside provider with your connection data, account information, and browsing metadata. Running your own private proxy server gives you substantially more control. You select the hosting company, choose the server location, manage the encryption password, and decide who can connect.
A self-hosted proxy can also provide a stable IP address for remote work, secure browsing on public Wi-Fi, testing websites from another country, or safely accessing services on your home or business network. Unlike a shared proxy, its bandwidth is not divided among hundreds of unknown users.
The setup is easier than it sounds. A small virtual private server, or VPS, is usually sufficient, and lightweight protocols such as Shadowsocks can run comfortably with 1GB of memory.
One important warning before beginning: the original Clash for Windows is no longer actively maintained. Existing installations may still work, but downloading unofficial “revived” packages from random websites is risky. For a new installation, consider an actively maintained, Mihomo-based client such as Clash Verge Rev. Its configuration format is largely compatible with traditional Clash profiles, and the application supports Windows, macOS, and Linux.
Use a private proxy only for lawful purposes and make sure that operating one complies with the rules of your VPS provider and the laws that apply in your location.
Choosing a VPS Provider for Your Private Proxy
Your proxy is only as good as the server hosting it. A premium processor in the wrong location can still feel slower than an inexpensive VPS located close to you.
Several established providers are suitable:
- DigitalOcean offers a straightforward interface, predictable billing, and data centers in North America, Europe, Asia, and Australia. The official Shadowsocks documentation also lists DigitalOcean as a recommended option.
- Vultr has a wide choice of locations and makes it easy to deploy inexpensive servers for testing.
- Akamai Cloud, formerly Linode, combines reliable networking with good documentation and an uncomplicated management panel.
- Hetzner Cloud is frequently attractive for European users because of its pricing and strong connectivity in Germany and Finland.
- Amazon Lightsail provides simple virtual servers within the larger AWS ecosystem, although its management experience can feel more complicated than that of smaller VPS specialists.
A server with one virtual CPU, 1GB of RAM, and 10GB to 25GB of storage is normally enough for one or several users. Choose Ubuntu 24.04 LTS or another currently supported Linux distribution. The official Shadowsocks deployment guide recommends Ubuntu 22.04 or later.
Location matters more than raw specifications. Select a data center geographically close to you or close to the services you intend to use. A shorter network route generally produces lower latency. If possible, deploy a temporary server first and test its IP address with ping and traceroute before committing to a longer billing period.
Also examine the provider’s monthly transfer allowance. Browsing uses relatively little bandwidth, but video streaming, game downloads, and cloud backups can consume hundreds of gigabytes surprisingly quickly.
Preparing and Securing the VPS
After creating the VPS, connect from Windows Terminal or PowerShell:
ssh root@YOUR_SERVER_IPUpdate the operating system immediately:
apt update
apt full-upgrade -yCreate a normal administrative account instead of using root for everyday maintenance:
adduser proxyadmin
usermod -aG sudo proxyadminCopy your SSH public key to the new account, confirm that key-based login works, and then consider disabling password authentication and direct root login in /etc/ssh/sshd_config:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yesCheck the configuration before restarting SSH:
sshd -t
systemctl restart sshDo not close your existing session until you have successfully opened a second connection as proxyadmin. A typographical error in the SSH configuration can otherwise lock you out of the server.
Enable a basic firewall and expose only SSH and the port used by your proxy. This example uses TCP port 8388:
ufw allow OpenSSH
ufw allow 8388/tcp
ufw allow 8388/udp
ufw enableUsing an unusual port does not provide meaningful encryption, but it can reduce the amount of automated noise appearing in your logs.
Installing a Shadowsocks Proxy Server
Shadowsocks is the most practical starting point for Clash users. It is lightweight, fast, easy to configure, and supported directly by Clash-compatible clients. The project offers several server implementations, including shadowsocks-libev and Outline’s Shadowsocks server.
On Ubuntu, install shadowsocks-libev with:
sudo apt update
sudo apt install shadowsocks-libev -yCreate a secure password:
openssl rand -base64 32Save the result in a password manager. Do not reuse an email, VPS, or banking password.
Open the server configuration:
sudo nano /etc/shadowsocks-libev/config.jsonEnter the following configuration, replacing the sample password:
{
"server": ["0.0.0.0", "::0"],
"mode": "tcp_and_udp",
"server_port": 8388,
"password": "REPLACE_WITH_YOUR_RANDOM_PASSWORD",
"timeout": 300,
"method": "chacha20-ietf-poly1305",
"fast_open": false
}Enable and restart the service:
sudo systemctl enable shadowsocks-libev-server@config
sudo systemctl restart shadowsocks-libev-server@config
sudo systemctl status shadowsocks-libev-server@configThe status should report that the service is active. You can confirm that the server is listening with:
sudo ss -tulpn | grep 8388The Shadowsocks documentation also provides an official Docker deployment option. Containers can make upgrades and removal cleaner, but the native Ubuntu package is easier for a first installation and introduces fewer moving parts.
What About V2Ray and WireGuard?
Shadowsocks is not the only option. V2Ray supports transports and protocols such as VMess and can be useful when you need more elaborate routing or transport settings. However, it also has a larger configuration surface, which means more opportunities for an innocent-looking JSON error to stop the service.
If you choose V2Ray, use only the current installation instructions and signed releases from the project. Avoid copying unreviewed “one-click” shell scripts from forums. Installation scripts can modify your firewall, create administrative users, or download components from sources you have never inspected.
WireGuard is another excellent technology, but it is technically a VPN tunnel rather than a conventional application proxy. It is fast, lean, and well suited to routing all device traffic or connecting to private networks. The official WireGuard quick-start guide explains key generation, interfaces, peer configuration, and NAT keepalives.
Clash-compatible Mihomo cores can represent WireGuard peers in their configurations, but an old Clash for Windows build may not support every modern WireGuard field. If your main objective is simple compatibility with Clash, Shadowsocks remains the least complicated choice.
Configuring Clash to Use Your Private Proxy
A Clash profile is a YAML file containing proxy nodes, groups, and routing rules. Indentation matters, so use spaces rather than tabs.
Create a file named private-proxy.yaml with the following contents:
mixed-port: 7890
allow-lan: false
mode: rule
log-level: info
proxies:
- name: "My Private Proxy"
type: ss
server: YOUR_SERVER_IP
port: 8388
cipher: chacha20-ietf-poly1305
password: "YOUR_SHADOWSOCKS_PASSWORD"
udp: true
proxy-groups:
- name: "Proxy"
type: select
proxies:
- "My Private Proxy"
- DIRECT
rules:
- GEOIP,LAN,DIRECT
- MATCH,ProxyThe server address, port, cipher, and password must exactly match the values on the VPS. If one character is wrong, the connection will fail.
In Clash for Windows, open Profiles and import the local YAML file. Select the imported profile, open Proxies, choose the Proxy group, and select My Private Proxy. Finally, enable System Proxy from the General screen.
In Clash Verge Rev, import the file through the subscriptions or profiles section, activate it, and enable the system proxy. The interface names can vary between releases, but the underlying process is the same.
Visit an IP-checking website before and after activating the proxy. Once connected, the displayed public IP address should match the address of your VPS.
System Proxy mode handles applications that follow Windows proxy settings, including most browsers. Applications that ignore those settings may require TUN mode. TUN captures traffic at the network level, but it also requires elevated privileges and should be enabled only after the ordinary proxy connection works.
Optimizing Your Proxy for Speed and Security
Encryption choice can affect performance, particularly on inexpensive servers. chacha20-ietf-poly1305 is an authenticated encryption method that generally performs well across both low-powered and modern hardware. aes-128-gcm is another good option, especially on processors with hardware-accelerated AES instructions.
Avoid obsolete stream ciphers such as RC4-MD5 and unauthenticated AES-CFB configurations. Modern Clash-compatible cores support authenticated AEAD methods, and Mihomo also supports newer Shadowsocks 2022 ciphers. However, the same cipher must be supported by both the server and client. The Mihomo documentation lists supported Shadowsocks methods and their password requirements.
For the best performance:
- Place the VPS near the intended user.
- Test several providers or data-center locations.
- Keep UDP enabled if you need it for DNS, voice chat, or other real-time traffic.
- Avoid routing local-network devices through the proxy.
- Use direct-routing rules for services that do not need the proxy.
- Do not enable experimental congestion-control tweaks without measuring the result.
A private proxy encrypts traffic between your computer and the VPS. Beyond the VPS, ordinary HTTP traffic remains unencrypted, while HTTPS retains its normal end-to-end protection. The VPS provider can also associate the server with your account, so self-hosting provides control—not anonymity by magic.
Monitoring and Maintaining Your Proxy
A proxy server is an internet-facing system and should not be treated as a “set it and forget it” appliance. Install security updates regularly:
sudo apt update
sudo apt full-upgrade -yUbuntu can install important patches automatically through unattended-upgrades:
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure unattended-upgradesReview the proxy service and recent logs when troubleshooting:
sudo systemctl status shadowsocks-libev-server@config
sudo journalctl -u shadowsocks-libev-server@config --since todayCheck resource consumption and disk space:
top
free -h
df -hYour VPS provider’s dashboard may offer bandwidth graphs and email alerts. Set a transfer warning if the provider supports one; an unexpected spike can indicate that a password has leaked or the server is being abused.
Change the Shadowsocks password immediately if you accidentally publish the configuration, share a screenshot containing credentials, or notice unexplained traffic. Restrict the firewall to known client IP addresses when practical, and remove the server entirely when it is no longer needed.
Building a private proxy for Clash requires only a modest VPS, a supported Linux installation, and a carefully matched client configuration. Shadowsocks offers the easiest balance of speed, security, and compatibility, while V2Ray is better suited to complex transports and WireGuard excels when you need a full VPN tunnel.
Choose a reputable host, select a nearby data center, use a modern authenticated cipher, secure SSH with keys, and keep both the operating system and proxy software updated. Most importantly, use an actively maintained Clash-compatible client whenever possible. Owning the server gives you more control, but maintaining that control requires regular updates, secure credentials, and a little attention to the logs.