Choose a client for your operating system, import subscription settings, and configure routing rules and TUN.
Using Clash comes down to three things: choosing a client, importing a subscription, and checking your routing. The client provides the configuration interface; the core handles proxies, rules, and DNS. System proxy and TUN settings determine how connections reach the core, while policy groups determine where they go.
A subscription is not a client installer, and installing the client does not provide working proxy nodes. First, make sure you have an authorized subscription or your own configuration, then check its format and compatibility with your client. For your first connection, keep the default network settings and test in Rule mode. If you need to handle traffic from apps that ignore system proxy settings, consult the TUN and DNS guides.
Check your operating system first, then your processor architecture. On desktop, check the installer format and service permissions. On mobile, review VPN authorization and background settings. These links take you to the relevant platform section of the download page; they do not start a direct download.
A good fit for desktop users who want tray controls, system proxy support, and easy rule switching. The download page offers options including Clash Plus and Clash Verge Rev. Check system requirements before choosing an installer. If you plan to use TUN, follow the client’s service installation prompts and grant administrator permissions as needed. Avoid running multiple proxy services at once.
In About This Mac, check whether your device uses Apple silicon or Intel, then choose the matching build. The first time you launch the app, follow the system prompts to grant network extension or helper permissions. System proxy settings mainly affect apps that honor them; for other traffic, consider routing, DNS, and the client’s TUN support together.
The first time you connect, approve the system VPN prompt. If the connection drops when the screen locks, check battery optimization, background activity, and the manufacturer’s auto-start settings before changing subscriptions. Per-app proxy settings control which apps use the VPN. If another app also uses a VPN tunnel, check how the system handles competing VPN connections.
Check Clash Plus compatibility and app details in the App Store. The official website is clashplus.io. After adding a subscription, follow the app prompts to authorize the VPN configuration, then choose a policy and connect. Desktop instructions for installing services, setting listening ports, and configuring system proxies do not necessarily apply to iOS. Follow the app’s own interface.
Desktop users can choose between Clash Verge Rev and FlClash, checking package format and desktop environment requirements before installing. For headless devices such as servers and routers, visit the core section to learn about mihomo. Running from the command line means managing configuration directories, service permissions, logs, and startup yourself; desktop toggles are not a substitute.
Before switching clients, back up your configuration and local overrides. The same subscription can be imported into different clients, but policy group names, supported protocol fields, and network permissions may vary. Local settings from the old client may not transfer with the subscription, so check the active mode and default policies after importing.
View all clients →Use these configuration snippets to understand what each setting does. They illustrate individual fields and are not a complete subscription with proxy nodes and policy groups. Before adding them to an existing configuration, check core support and how your client handles overrides.
The theme changes every eight seconds. It pauses on click, keyboard input, or focus.
Clash Plusmixed-port: 7890
allow-lan: false
mode: rule
log-level: info
# A complete configuration also needs proxies and policy groups
# Keep local overrides before updating remote configurationA subscription URL may return a complete YAML configuration or just a list of nodes. After importing, check that usable policy groups are available and confirm which configuration is active. Remote updates usually reload the content from the server, so edits made directly to a downloaded file can be lost on the next update. For rules, ports, or DNS changes you want to keep, use the override feature provided by your client. Override syntax and merge order vary between clients; check each setting when migrating rather than simply copying the subscription URL.
See how to import a subscription →rules:
- DOMAIN-SUFFIX,github.com,Proxy
- DOMAIN-KEYWORD,ads,REJECT
- GEOIP,CN,DIRECT
- MATCH,Proxy
# Proxy must match an existing policy or policy group
# Broad keyword rules can cause false matchesIn Rule mode, connections are checked against rules in list order and sent to the policy specified by the first match. Domain suffix rules work well for clearly defined site groups; IP rules match destination addresses. Put MATCH last to catch anything that did not match earlier rules. Proxy in this example is a custom policy name and must match a name already in your configuration. If a specific site has a problem, check the connection log to see which rule matched, then move a more specific rule above the general one. This preserves direct connections for other traffic and makes changes easier to trace than switching to Global mode.
Learn about managing rule sets →proxy-groups:
- name: Default
type: select
proxies:
- DIRECT
- REJECT
rules:
- MATCH,DefaultPolicy groups separate rule matching from the choice of exit. Rules refer to a group name; within the group, choose nodes, other policy groups, or built-in policies. This lets you change the exit without editing every rule. select is for manual selection; url-test and fallback also require a test URL and behavior settings. Group names must be unique, and references must not form a loop. This example uses built-in policies to show the structure and includes no proxy nodes. In practice, reference nodes or providers already available in your subscription, and check that automatic selection suits the sites you need to access.
Read the policy group guide →dns:
enable: true
enhanced-mode: fake-ip
fake-ip-range: 198.18.0.1/16
fake-ip-filter:
- "*.lan"
# Configure upstream resolvers for your network
# Coordinate DNS interception with routing settingsFake-IP uses synthetic addresses to associate domains with connections, helping the core retain domain information when it receives a connection. It is not a standalone speed-boost switch; configure it alongside DNS interception, upstream resolvers, and routing. If LAN services or apps that rely on real addresses stop working, review the filter list and DNS resolution path. Remember that system and app caches may also affect results after DNS changes. Reachable upstream resolvers vary by network, so check availability and how proxy server domains are resolved before copying resolver addresses.
Read the Fake-IP and DNS glossary →tun:
enable: true
stack: mixed
auto-route: true
auto-detect-interface: true
dns-hijack:
- any:53
# Requires appropriate system permissions and routing supportTUN uses a virtual network interface to handle connections covered by its routes, including traffic from apps that ignore system proxy settings. Before enabling it, check the client’s service permissions and how other VPNs, virtual interfaces, and security software may affect routing. TUN does not automatically send all traffic through a proxy; the mode, rules, and policy groups still determine the exit. If LAN access or DNS stops working, save the logs and revert to the previous settings to test. Mobile clients generally use the system VPN interface to capture traffic, so their options do not map exactly to desktop TUN settings.
Read about TUN and routing →mixed-port: 7890
external-controller: 127.0.0.1:9090
secret: "your-controller-secret"
# mixed-port: proxy entry point for apps
# external-controller: management API
# Replace the example password with your ownThe external controller lets a client interface or dashboard read status and switch policies. It serves a different purpose from the mixed proxy port used by apps, and the two should not listen on the same port. If you only need local access, bind to the loopback address and set a separate password. Do not expose the management endpoint directly to your LAN or the public internet. If the interface reports a connection failure, check the address, port, and authorization before checking whether the core is running. Subscriptions and logs may contain sensitive information; remove personal URLs and credentials before sharing screenshots or configurations.
Read about the external controller API →Client names, core capabilities, and subscription content are separate layers. When choosing software, check its maintenance status, supported fields, and configuration source independently. A familiar interface name is not proof of compatibility.
The Clash ecosystem includes a range of clients built around configuration, rules, and proxy protocols. mihomo continues and extends related core capabilities; the project was previously known as Clash Meta, so guides may use both Meta and mihomo. GUI clients add subscription management, policy selection, system proxy controls, and logs on top of the core. The core bundled with a client may also change as that client is maintained. When comparing software, check both the client’s documentation and the core documentation.
You can verify how open-source projects work through their source code, configuration docs, and issue discussions. This site provides download links and usage guides, but does not present third-party clients as products from the same development team or treat every interface feature as a capability shared across the ecosystem. For field definitions, consult the documentation for the core you use. For button locations, check the client’s own guide. Together, these sources help identify whether an issue comes from configuration, system traffic capture, or an interface setting.
Subscription providers may change node names, policy groups, or rules during updates. Client selections depend on those names, so you may need to choose again if they change. Before updating, save a known-working configuration. Afterward, check that Rule mode is still active, policy groups have a working exit, and important domains match the expected rules. If the configuration manager has multiple subscriptions, confirm which one is active instead of assuming the most recently imported one is in use.
Subscription URLs often contain access credentials and should be treated as private. Do not post a full URL in a public support forum or commit a configuration containing your personal subscription to a public repository. Conversion services can access the input URL and configuration, so review how they handle your data before using one. When possible, convert configurations in a controlled environment. Node lists, share links, and full YAML configurations contain different information; a successful conversion does not automatically add rules and policy groups suited to your needs.
Updating a client is not the same as updating a subscription. A client update may change the core, permission prompts, or configuration parsing; a subscription update primarily changes remote configuration content. If something breaks after an update, note which layer changed and check the logs for a specific error. For a port conflict, identify the process listening on the port. For a parsing failure, check the field and indentation. For problems with certain sites, inspect matched rules and DNS. Following the error type makes troubleshooting more effective than repeatedly reinstalling.
When moving to a new client, first turn off the old client’s system proxy and background service, then import the configuration and test it. Enable startup on boot only after testing, to prevent two clients from repeatedly changing proxy and routing settings. Test with specific websites and apps, including a regular browser, an app that ignores system proxy settings, and a LAN service. Connection records can explain routing results, but one successful test does not prove that every app’s traffic is being captured.
You need an authorized subscription or a proxy configuration of your own. The client loads and runs the configuration; it does not provide proxy access. Check that the subscription returns a compatible format, then import it and select a policy. If you only see nodes and no rules, you may have imported a node list rather than a complete configuration. Add policies and rules using a method supported by your client. Follow the complete setup guide →
For your first setup, start in Rule mode and confirm that the subscription and policies work. Global mode changes the selected exit; it does not mean every app’s traffic reaches the core. TUN captures traffic, but rules can still decide how it is routed. First distinguish between “is the connection reaching the client?” and “which exit does it use once it gets there?” Then choose what to change. Read about modes and network stack terminology →
When remote configuration is reloaded, a subscription file edited directly may be overwritten. Put changes you want to keep in an override, script, or merge feature explicitly supported by your client, and check the order in which settings are applied. Apps may append or replace lists differently, especially rules and policy group references; a “saved” message alone does not confirm the result. Read about local overrides and merging →
Include your operating system, client name, current mode, whether TUN is enabled, and the first relevant error in the logs. Say whether all connections fail or just one app, and note what changed between the previous and current settings. Before sharing screenshots, remove subscription URLs, proxy credentials, and controller passwords. Do not post a full configuration containing personal information. Visit the help center →
Explore configuration file structure, LAN proxy sharing, and subscription formats. These articles explain how the fields fit together and where the boundaries of each setting lie. Read them after your first import when you have a specific question.
Breaks down a complete config.yaml, explaining the purpose and order of top-level fields, dns, proxies, proxy-groups, rule-providers, and rules. Learn what each section does before deciding where a change belongs.
Read article →Covers how the mixed port works, how to configure allow-lan and bind-address, firewall access, and the steps other devices need to enter the proxy address. Learn the difference between a shared proxy endpoint and a management API, and what your network needs for devices to connect.
Read article →Explains common subscription formats, which ones mihomo can read directly, which need conversion, and what to consider when setting up your own converter, rules, and policy groups. Identify the content type before importing to avoid repeated attempts caused by format incompatibility.
Read article →