Article
vpn vs clash
On this page 7
Background
My computer had become sluggish, so after returning home I cleaned out the dust, replaced the thermal paste, and reinstalled the operating system.
While rebuilding the environment, however, the network was unusually slow. The same node worked perfectly at school, so I investigated and learned a few things, mainly about proxies and VPNs.
I have an Azure Japan server with a public IP and an SJTU server,
issue-server, with a campus-network IP. Previously, Clash sent packets directly to the Japanese server.
****dddddfasafasdfasdfasdfasdfass dfadfasdfasdfasdfadsfasdfadfad
Experiment
Design
To recover the smooth experience I had at school, I asked Claude to run the following tests:
- Connect directly from home to the Japanese node with Clash Verge.
- clash + sjtuVPN
- Build a tunnel and connect to SJTU from home.
Results
| Metric | Path 1: Direct | Path 2: VPN + Campus Network | Path 3: Self-Built Tunnel |
|---|---|---|---|
| Latency to JP node | ~119 ms | Low (20 ms domestic segment + commercial link) | ~220 ms (home → campus 20 ms + CERNET → Japan 200 ms) |
| Bandwidth to JP node | GitHub 0 B/s (reset) | GitHub 7.7 MB/s | GitHub 2.4 / Cloudflare 4.6 MB/s |
| 3.8s | 0.66s | — | |
| YouTube | Failed | HTTP 200 | — |
| Exit IP | 20.89.213.127 | 20.89.213.127 | 20.89.213.127 |
| Verdict | ❌ Direct connection is slow; GitHub unusable | ✅ Best | ⚠️ Better than direct, worse than path 2; abandoned |
Note: All three paths ultimately exit through the same Japanese IP (
20.89.213.127). The difference comes entirely from the intermediate route to the Japanese node.
Conclusions
The tests lead to the following conclusions.
1. The Bottleneck Is the Route, Not the Node
The Japanese server itself has very fast outbound connectivity—180 MB/s to Cloudflare and 9.6 MB/s to GitHub. Performance therefore depends entirely on how traffic travels from home to Japan.
2. Why Path 1 Is Slow
Home broadband uses a consumer-grade international gateway: limited capacity, peak-hour congestion, frequent carrier throttling or QoS on international traffic, and interference from the GFW. In testing, a direct GitHub connection was reset at 0 B/s. Even when Clash wraps the traffic, it must still cross the home connection’s international route to reach Japan, where the carrier throttles it almost to the point of failure.
3. Why Path 2 Is Fast
It moves the international segment from the poor home route to the campus network’s better route:
- Home → campus network is domestic traffic within Shanghai: fast, stable, and uncongested.
- Campus network → Japan uses a commercial international line purchased by the university: high bandwidth, direct peering, and little peak congestion, exiting through Shanghai Unicom at
27.115.123.250. - The only cost is one additional hop, but the bottleneck is gateway quality rather than hop count. Detouring onto an uncongested route is faster.
4. Why Is the Server Tunnel Slow but the VPN Fast?
Both machines are on the SJTU campus network, but they use different upstream international routes.
issue-serveris on the academic network and exits through CERNET (AS4538).- The VPN gateway uses a commercial route through Shanghai Unicom (AS17621, exit
27.115.123.250), which performs better than CERNET.
VPNs and Proxies
VPN stands for Virtual Private Network.
⚖️ Proxy vs. VPN
| Dimension | Clash (Proxy) | SJTU VPN (a true VPN) |
|---|---|---|
| Full name | Proxy | Virtual Private Network |
| Layer | Application layer (Layer 7); handles traffic only from configured applications such as browsers and Telegram | Network layer (Layer 3); handles all traffic, including updates, games, UDP, and ping |
| Encryption | Not guaranteed; depends on the protocol, such as VLESS | Always encrypted using protocols such as IPsec or OpenVPN |
| IP assignment | ❌ Does not assign an IP; only forwards requests | ✅ Assigns a virtual IP, making the device a member of the remote network |
| Traffic scope | Only applications configured to use the proxy, e.g. a browser using 127.0.0.1:7897 | System-wide; captures every program, including terminals, games, and WeChat |
| Visibility to applications | Applications must explicitly choose the proxy | Transparent at the operating-system level; applications do not know the VPN exists |