The client sets the system proxy in your OS settings. This snippet doesn't include proxy nodes or proxy groups, so it isn't a complete, standalone configuration.
05Platform download links
mihomoOpen-source proxy core
GPL-3.0Core license
YAMLConfiguration file format
Clients import configurations and control system settings; the core parses rules and establishes connections. Similar names don't guarantee identical settings. Check your platform first, then compare the features you need.
Clash configuration features at a glance
Browse by task, from rule-based routing to traffic interception. These are configuration snippets or setting checklists, not complete configs with proxy nodes. Before merging, check existing fields and proxy group names. Selecting an item pauses the carousel for easier reading.
Rules are matched in order
Rule mode lets different destinations use different outbound routes, which is useful when you need to access LAN devices, direct-connect sites, and proxy services at the same time. The core checks rules from top to bottom, so specific domain and LAN rules usually belong before the catch-all rule. In this example, sample domains and private IP ranges connect directly; all other traffic goes to a proxy group named "Proxy Selection." That group must already exist in your config. Unlike Global mode, Rule mode routes traffic rule by rule. After switching modes, check the matched rule on the Connections page rather than relying only on whether a webpage loads.
# Config snippet: requires an existing "Proxy Selection" proxy group
mode: rule
rules:
- DOMAIN-SUFFIX,example.com,DIRECT
- IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
- MATCH,Proxy Selection
Intercepting traffic doesn't mean routing all of it through a proxy
TUN intercepts traffic through a virtual network interface, making it useful for apps that don't use the system proxy. Once traffic reaches the core, Rule or Global mode still determines its route. Desktop clients typically require service mode or administrator privileges before you enable TUN. This snippet shows the enable, stack, and routing fields; DNS hijacking also requires the core's DNS settings. Compared with the system proxy, TUN affects more traffic and is more likely to conflict with routes from other VPNs. First make sure the regular proxy works, then enable TUN on its own. If the network stops working, turn TUN off and check permissions, routes, and DNS instead of changing several fields at once.
Handle imports, updates, and local overrides separately
Subscription management retrieves and updates configurations; it doesn't provide proxy service. First confirm the link returns Clash YAML or that your client supports its format, then import and activate it from the Profiles page. After an update, check that the intended profile is still selected and that proxy group names haven't changed. Scheduled updates are a client feature, and the controls vary by project; proxy provider subscriptions in the core use a different set of fields. To keep custom rules over time, use the client's override or merge feature when available. Avoid editing files generated from a remote subscription directly, as the next update may overwrite your changes. Treat subscription URLs as sensitive information.
Client settings checklist (not YAML):
Profiles → New / Import → Enter subscription URL
Profiles → Select profile → Activate
Profile menu → Update
Override / merge config → Save local rules
Logs → Check for download and parsing errors
First, confirm DNS requests reach the core
Fake-IP maps domains to synthetic IP addresses so the core can route subsequent connections by domain, reducing interference caused by resolving real IPs upfront in some cases. Enabling enhanced mode alone doesn't mean all system DNS traffic is intercepted. Also check the client's DNS settings, TUN hijacking, and any encrypted DNS built into apps. This snippet shows only the enable setting and mapping range; configure upstream resolvers to match your existing setup. Compared with regular DNS mode, some LAN devices and apps may need to be added to a filter list. When troubleshooting, first check where queries go and which rules match, then decide whether to add exceptions. Avoid copying large filter lists without checking them.
Configs are portable, but permissions and setup paths vary
Choose a client by operating system and CPU architecture first, then check subscription formats, override options, and maintenance status. Desktop clients usually offer a system proxy and service mode; mobile clients use the system VPN interface, so desktop setup instructions won't apply. Whether the same YAML works depends on the core and client implementation, especially for TUN, DNS, and extended rule fields. Before migrating, save your current config, import it, and verify a basic connection before restoring advanced settings. The downloads page lists GUI clients and core downloads by platform. Most users should start with a GUI; servers and routers may be better suited to a standalone core.
Client selection checklist (not YAML):
System and architecture → Matching installer
Config format → YAML / subscription formats supported by the client
Traffic interception → System proxy / TUN / system VPN
Local changes → Override / merge mechanism
Migration checks → Proxy group names and DNS fields
Choose a Clash client by platform
This directory is organized by platform, use case, and maintenance status—not by ratings that ignore fit. Desktop and mobile platforms use different permission models, and their installers aren't interchangeable. Check the client and system requirements for your platform before deciding whether you need TUN, subscription overrides, or a standalone core.
The downloads page lists Clash Plus first, followed by Clash Verge Rev, FlClash, and Clash Nyanpasu. For everyday browsing, start with the system proxy. If you need to intercept traffic from other apps, check the client's service mode and TUN permissions. Archived clients are clearly marked and listed separately from actively maintained options.
Check your OS and CPU architecture before installing. On first launch, import a config, select a proxy group, and make sure its local port isn't already in use. Administrator privileges are generally needed for services and virtual network interfaces—not every time you import a subscription.
Choose the right installer for Apple Silicon or Intel, then compare how Clash Plus, Clash Verge Rev, and FlClash manage configurations. ClashX Meta is listed under archived clients for users who need to look up an existing setup. Consider whether you prefer menu bar controls or a full settings window.
If you need to install a helper service, authorize it through macOS. First check that the system proxy is set for the active network service, then decide whether TUN is needed. After switching Wi-Fi networks or quitting the client, check whether macOS still has an old proxy address if the connection stops working.
Compare configuration support in Clash Plus, Clash Meta for Android, FlClash, and Surfboard. Mobile connections usually require permission to create a system VPN; installation and connecting are separate steps. Choose an installer for your device architecture. If you're unsure, check the platform notes instead of choosing based only on file size.
For extended use, check battery management and background restrictions, but don't change every battery setting upfront. First verify that the current config works, then adjust background permissions if you experience disconnects. If you need per-app routing, check what the client supports and avoid running another VPN connection at the same time.
The downloads page links to Clash Plus on the App Store and lists its official website, clashplus.io, so you can verify the product and find more information. After installing, import a supported config and follow the system prompts to allow a VPN configuration. Desktop system proxy instructions don't apply to phones; use the app settings and check the system VPN status instead.
After switching between mobile data and Wi-Fi, test whether you can reach the same destination, then check for config updates and confirm the selected proxy group. Some extended fields from desktop cores may not transfer directly. If an import fails, check which config formats the app supports rather than reinstalling it repeatedly.
Desktop users can compare Clash Verge Rev and FlClash, then choose a package for their distribution. Server and router users can find mihomo in the core downloads section. GUI clients handle tray controls, configuration management, and OS integration; a standalone core suits environments where you manage services and file paths yourself.
Before installing, check the architecture, desktop environment, and dependencies. A browser using the system proxy doesn't mean command-line tools will use it automatically; terminal apps may need proxy environment variables configured separately. Before enabling TUN, check routing permissions and existing network services, and make sure you know how to restore your network settings.
Start with the shortest path to a working connection, then add advanced settings. The client itself doesn't provide subscriptions or proxy service, so you'll need a valid config. The steps below describe a typical GUI workflow; button names vary between clients and platforms.
01
Import and activate a profile
Open the Profiles page and choose New, Import, or Add subscription. Enter an existing URL, or import a local file. Once it downloads, select the profile and confirm it's active. If you add a file to the list but don't activate it, the core may keep using the previous profile.
If import fails, determine whether it's a network download error or a YAML parsing error. For download issues, check that the URL is reachable and hasn't expired. For parsing errors, check the field and line number in the logs. Generic proxy links aren't always complete Clash configs. Don't rename files to a different extension to force an import, and never post subscription URLs containing access credentials publicly.
02
Choose a proxy group and traffic mode
On the Proxies page, select a proxy group from your config and use Rule mode as a starting point. In Rule mode, the config determines whether traffic connects directly or through a proxy. Global mode sends traffic through the global policy; Direct mode bypasses proxies. Switching modes won't fix an expired subscription or restore missing proxy nodes.
On desktop, enable the system proxy. On mobile, allow the VPN connection when prompted. Consider TUN only if an app doesn't use the system proxy. Avoid running multiple proxy or VPN tools at once during testing, as they can conflict over ports and routes. Even if the client says the connection is active, verify that you can actually reach your destination.
03
Verify access and matched rules
Visit one destination that should connect directly and another that should use a proxy, then check the corresponding policy and rule on the Connections page. Verify two things: did the request reach the core, and did it use the expected outbound route? A single speed test is just one data point; it doesn't replace testing the site you need to access.
If you can't connect, check these in order: active profile, proxy group, system proxy or VPN, DNS, and logs. Change one setting at a time and note the result. If LAN access works but domains don't, focus on DNS resolution. Once the first connection is verified, configure startup, scheduled updates, or local overrides to avoid troubleshooting several new variables at once.
Comparisons are based on project features, platform support, and publicly available maintenance information—not made-up star counts or download figures. Understanding the difference between a core and its interface helps you judge which projects support a configuration and avoids mistaking this site's information for a commitment from the software developers.
The Clash ecosystem includes more than one client
Clash appears in both core names and the product names of several GUI clients. The original Clash projects and later ecosystem projects have different maintenance histories. An older client being discontinued doesn't mean every compatible config has stopped evolving. This site lists download links by project and separates archived software from current options. If you're migrating an existing setup, check the core and config fields you're actually using—not just whether the app name includes Clash.
mihomo handles rules; the client handles controls
mihomo is an open-source proxy core. Its public source code and documentation help you check rule, proxy group, DNS, and TUN fields. GUI clients such as Clash Verge Rev add configuration management, tray controls, and OS integration. A switch in the interface might update the core config or only change an OS network setting. For example, the client sets the system proxy in the OS, while mixed-port is a local listening port in the core. They're related, but they're not the same setting.
Licenses and feature guarantees are separate
The mihomo project is licensed under GPL-3.0. Check the project's license file for the specific terms governing use and distribution. Each client has its own source code, license, and release process; the core's license doesn't automatically apply to every app. Open source makes it easier to inspect implementations and issue discussions, but real-world results still depend on your configuration, network, and platform permissions. This site describes use cases and doesn't treat an open-source license as a guarantee that software will work in every environment.
Keep a restorable copy of your config before updating
Cores and clients may update on different schedules, and a GUI update doesn't necessarily change support for every config field. Before updating, save your current config and local overrides, then check release notes for compatibility changes. After updating, test existing rules, DNS, and TUN before adding new fields. Keep remote subscription updates separate from software updates: the former may change nodes and proxy groups, while the latter may change parsing support. Updating both at once makes issues harder to diagnose.
If config parsing fails, note the field, error line, and relevant environment details. Before reporting the issue, redact subscription URLs, credentials, and sensitive connection logs; include the smallest config that reproduces the problem. Existing discussions in public repositories can help identify whether an issue comes from the client interface or the core. Similar symptoms can have different causes, so confirm them against the actual logs.
Clash configuration articles
The three latest articles are listed by publication date, newest first. The tutorial page covers basic tasks; format conversion, rule design, and traffic interception are covered in dedicated articles. Check each snippet's prerequisites, and don't paste it over a complete config that's in use.
Compare the structure of Clash YAML, Base64 subscriptions, and individual ss, vmess, and trojan links. Learn how to convert between formats and what to check when importing them into a client.
Using GEOIP, GEOSITE, DOMAIN-SUFFIX, and RULE-SET, this guide covers rule order and common mistakes for direct connections in mainland China, proxies for overseas services, and bypassing proxies on LAN traffic.
Learn how TUN differs from the system proxy, then follow platform-specific instructions for permissions, the stack option, and auto-route. Includes a troubleshooting checklist for connection issues after enabling TUN.