Accessing Your Home Server Remotely with SSH and Clash for Traffic Proxying

I recently ran into a small problem. At home, it was super convenient to access my server directly using its internal network IP. But when I'm out and about, I only have SSH access. After thinking it over, using SSH to set up a Socks5 proxy and routing traffic through Clash seemed like a pretty good solution.

Solution Design

I decided to set up a Socks5 proxy over SSH, giving my client a tunnel to access the home server. Then, I'd use Clash to intelligently manage traffic, checking if the Socks5 proxy is active to decide whether to route traffic through it. The steps aren't that complicated, let's take a look.

1. Setting Up a Socks5 Proxy with SSH

First, I connect to the remote server via SSH and set up a Socks5 proxy.

ssh -o ServerAliveInterval=60 -o ServerAliveCountMax=3 -o TCPKeepAlive=yes -o ForwardAgent=no -o ForwardX11=no -N -D 127.0.0.1:8080 -p 221 root@*******.cn

Here's what the command parameters mean:

• -D 127.0.0.1:8080: Starts a dynamic port forward on local port 8080, acting as a Socks5 proxy.
• -o ServerAliveInterval=60: Sends a keep-alive packet every 60 seconds to maintain the connection.
• -o ServerAliveCountMax=3: Retries up to 3 times if the connection doesn't respond.
• -o TCPKeepAlive=yes: Enables TCP keep-alive mechanism.
• -N: Only forwards ports, doesn't execute remote commands.
• -p 221: Specifies the SSH port (you need to specify this if your server isn't using the default port 22).

This way, all traffic going through local 127.0.0.1:8080 will be forwarded to the remote server.

2. Configuring Clash for Traffic Management

Next, I set up proxy rules in Clash to decide whether to use this Socks5 proxy. Clash's fallback feature helps us achieve automatic traffic switching.

Nodes:

append:
  - name: 'SSH Tunnel'
    type: 'socks5'
    server: '127.0.0.1'
    port: 8080
    username: ''
    password: ''

Rules:

prepend:
  - 'IP-CIDR,192.168.10.0/24,Proxy-local,no-resolve'

Proxy Group:

prepend:
  - type: 'fallback'
    name: 'Proxy-local'
    interval: 5
    timeout: 5000
    max-failed-times: 1
    lazy: false
    proxies:
      - 'SSH Tunnel'
      - 'DIRECT'

What this configuration does:

• Defines a Socks5 proxy in Clash pointing to 127.0.0.1:8080.
• Uses the fallback proxy group: when the Socks5 proxy is detected as active, traffic automatically goes through it; otherwise, it connects directly.
• Make sure to turn off lazy! As the name suggests, it's lazy—it won't automatically check if the proxy is working.

You want to use the SSH Tunnel as the preferred proxy. When the SSH tunnel is unavailable, traffic automatically switches to DIRECT. By configuring interval and timeout, you can control the detection frequency and timeout tolerance.

A Little Secret

The beauty of this setup is that when I'm away from home, as long as I keep the SSH connection alive, all other traffic automatically goes through the proxy. It's convenient and doesn't get in the way of work. Plus, Clash's automatic switching ensures that when the proxy is unavailable, traffic falls back to a direct connection, preventing lag or connection failures.

For someone like me who enjoys tinkering with tech, this "remote work" approach definitely makes life and work more flexible and efficient. If you have a similar need, why not give this method a try?