Total configuration about Personal VPS Proxy Server and Home Broadband in America

Ensure you have connected to the Debian 12 server as the root user via FinalShell.

Phase 1: Environment Cleanup and Network Preparation

Step 1: Allow Firewall Ports

• Operation Risk Level: High (Must be executed strictly in order, ensure SSH port is open)
• Operation Method: Execute the following commands sequentially to ensure SSH (22) and Web/Proxy ports are accessible.

apt update
apt install ufw -y

# 【Extremely Important】The SSH port must be allowed first, otherwise you will lose connection to the server once the firewall is enabled!
ufw allow ssh

# Allow ports for certificate application and Hysteria 2 proxy
ufw allow 80/tcp
ufw allow 443/tcp
ufw allow 443/udp

# Enable the firewall (If prompted "Command may disrupt existing ssh connections...", type y and press Enter)
ufw enable

Phase 2: Hysteria 2 Server Deployment

Step 1: Execute the Official Installation Script

• Operation Risk Level: Low
• Operation Method: Execute the following command and wait for the prompt “Installed successfully”.

bash <(curl -fsSL https://get.hy2.sh/)

Step 2: Configure the Server Core File

• Operation Risk Level: High (YAML format is extremely sensitive to indentation; one extra or missing space will cause the program to crash)
• File Path: /etc/hysteria/config.yaml
• Text Encoding Requirement: UTF-8
• Operation Method: In the file manager at the bottom of FinalShell, locate this file and double-click to open it. Clear the original content and paste the following code. You must modify the values inside the double quotes.

listen: :443

acme:
  domains:
    - "your_domain.com"
  email: "your_email@example.com"

auth:
  type: password
  password: "your_secure_password"

# New: HTTP/3 Webpage Masquerade (Core mechanism for anti-blocking)
masquerade:
  type: proxy
  proxy:
    url: https://bing.com/
    rewriteHost: true

• Replacement Instructions:
  • “your_domain.com”: Replace with the real domain name resolved to this VPS IP (keep the double quotes).
  • “your_email@example.com“: Replace with a random email address (keep the double quotes).
  • “your_secure_password”: Replace with a custom complex connection password (keep the double quotes).

Step 3: Start and Enable Auto-Start on Boot

• Operation Risk Level: Low
• Operation Method: Execute the following commands sequentially.

systemctl start hysteria-server.service
systemctl enable hysteria-server.service
systemctl status hysteria-server.service

• Verification Standard: After executing the last command, the output must contain the green text active (running). Press q to exit the status view.

Phase 3: Configure Proxy Chain on Client (Clash Verge Rev)

No further operations are performed on the server. All configurations are done in the Clash Verge Rev software on your local Windows computer.
Step 1: Write the Local YAML Configuration File

• Operation Risk Level: High (Must strictly adhere to YAML indentation rules)
• Text Encoding Requirement: UTF-8
• Operation Method: In the Clash Verge Rev software, click “Profiles” -> “New” -> select “Local” as the type. Paste the following code into the text box.

mode: rule
log-level: info
allow-lan: true
dns:
  enable: true
  ipv6: false
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  nameserver:
    - 223.5.5.5
    - 114.114.114.114
  fallback:
    - 8.8.8.8
    - 1.1.1.1

proxies:
  - name: "VPS-Direct"
    type: hysteria2
    server: "your_domain.com"
    port: 443
    password: "your_secure_password"
    sni: "your_domain.com"
    skip-cert-verify: false

  - name: "WebShare-HomeIP"
    type: socks5
    server: "proxy_address.webshare.io"
    port: 1080
    username: "webshare_username"
    password: "webshare_password"
    dialer-proxy: "VPS-Direct" 
proxy-groups:
  - name: "Proxy"
    type: select
    proxies:
      - "VPS-Direct"
      - "WebShare-HomeIP"

rules:
  - GEOIP,lan,DIRECT,no-resolve
  - GEOSITE,cn,DIRECT
  - GEOIP,cn,DIRECT
  - MATCH,Proxy

• Replacement Instructions:
  • “your_domain.com” (two occurrences): Replace with the domain name used in the server configuration (keep the double quotes).
  • “your_secure_password”: Replace with the password set in the server configuration (keep the double quotes).
  • “proxy_address.webshare.io”: Replace with the proxy server address or IP provided by WebShare (keep the double quotes).
  • 1080: Replace with the specific port number provided by WebShare (numeric, no double quotes).
  • “webshare_username”: Replace with the proxy authentication username provided by WebShare (keep the double quotes).
  • “webshare_password”: Replace with the proxy authentication password provided by WebShare (keep the double quotes).

Step 2: Activate and Verify

1. Click the save button in the top right corner to save this profile.
2. In the profile list, right-click on this profile and select “Use”.
3. Turn on the “System Proxy” toggle in Clash Verge Rev.
4. Go to the “Proxies” interface in the software. In the Proxy policy group, you can seamlessly switch between VPS-Direct (using only the VPS) and WebShare-HomeIP (forwarding through the VPS to the proxy IP) by clicking with your mouse.