Choose a Clash client for your device. Start by importing a subscription, then configure routing rules and TUN mode. Find basic connection help and advanced setup guidance separately.
For desktop use, start with a graphical client that is still maintained. On mobile, check system permissions and subscription format first. The download page lists clients, architectures, and installation requirements by platform. Use it to find the right option without mixing installers for different systems.
For everyday desktop use, consider Clash Plus or Clash Verge Rev. Before installing, check your system type under “Settings → System → About” and compare it with the download requirements. On first launch, import a subscription and enable the system proxy. Use TUN mode only if some apps ignore the system proxy; avoid changing permissions, routes, and DNS all at once.
Check your chip under “About This Mac”: Apple silicon and Intel Macs require different installers. After installation, follow the system prompts to authorize network features. When switching clients, quit the old one and disable its system proxy before launching the new one. If both clients change proxy settings, browsers may work while other apps lose connectivity.
Most recent devices use ARM64, but check the processor architecture on older devices. Clash Plus, Clash Meta for Android, and FlClash have different settings menus, but subscription import comes first in each. Approve the system VPN request when connecting. If the connection drops when the screen locks, check battery optimization and background restrictions before assuming the subscription has expired.
The download page links to Clash Plus on the App Store and to its official site at clashplus.io. After installing, add your existing subscription and allow the VPN configuration when prompted on first connect. A VPN icon in the status bar only means the network extension is running; also check the selected policy and test a website. Other VPN apps can interfere with the connection.
For desktop use, choose Clash Verge Rev or FlClash, then select the package for your distribution. Server and router users can find the mihomo core on the download page. A graphical client and a command-line core install differently. Desktop proxy variables, browser proxy settings, and TUN routing also work independently, so after installation confirm which network path the app is using.
Already have a client but can't connect? Note its name, operating mode, and log errors before checking the help center. Avoid reinstalling repeatedly.
Look up settings as needed. The YAML below consists of functional snippets, not complete, standalone configurations. Any PROXY policy name shown must be defined in your configuration. Menu names vary between clients; check the effective configuration and core logs to confirm what is actually applied.
Rules are evaluated from top to bottom, and the first match determines which policy handles the connection. Domain rules work well for specific websites; IP rules are suited to known address ranges. Put MATCH last as a fallback. To send a website direct, check its actual domain and matched rule in the connection log, then place a more specific rule before broader ones. Unlike global mode, rule mode can route each connection through a different policy instead of sending all traffic to one group. Put lasting changes in a local override so subscription updates don't erase them.
mode: rule
rules:
- DOMAIN-SUFFIX,github.com,PROXY
- GEOIP,CN,DIRECT
- MATCH,PROXYTUN creates a virtual network interface so apps that ignore system proxy settings can still be processed by the rules. Desktop clients usually need service mode or administrator privileges; mobile clients use the system VPN interface. Before enabling it, close other network tools of the same kind and keep a working configuration as a backup. auto-route affects routing, while DNS hijacking changes the resolution path—an enabled toggle alone doesn't prove the connection works. If the network goes down, turn TUN off to verify basic connectivity, then check permissions, the default route, and DNS logs.
tun:
enable: true
stack: mixed
auto-route: true
auto-detect-interface: true
dns-hijack:
- any:53A subscription URL may return a complete Clash YAML file or just a list of nodes, so check the provider's format before importing it. A graphical client's subscription importer downloads and switches configurations; proxy-providers manages proxy collections inside a configuration. They are different features. Back up local rules and overrides before updating, then check that the intended configuration is still selected. Treat the token in a subscription URL like a password: redact it from screenshots, logs, and support requests. Don't submit the real URL to an unfamiliar online converter.
proxy-providers:
local-nodes:
type: file
path: ./providers/nodes.yaml
proxy-groups:
- name: PROXY
type: select
use:
- local-nodesIf a website won't load but a proxy connection is established, distinguish DNS resolution failures from an unreachable node or a mismatched rule. Fake-IP maps domain names to reserved addresses so the core can retain domain information during a connection; those addresses aren't real server IPs and don't mean DNS is broken. With encrypted DNS, also consider how the resolver's own domain name is resolved. Keep one working upstream, then add routing policies gradually. If LAN device names, printers, or specific apps have issues, use the logs to assess fake-ip-filter rather than disabling all DNS features.
dns:
enable: true
enhanced-mode: fake-ip
fake-ip-range: 198.18.0.1/16
nameserver:
- https://1.1.1.1/dns-queryAllowing LAN connections lets devices on the same trusted network try to use this computer's proxy port. Enabling allow-lan alone isn't enough: the listening address, system firewall, and network isolation all affect connectivity. Other devices must use this computer's LAN address, not their own loopback address. Check again after the computer sleeps or its address changes. Limit the listening address to the interface you actually use, and restrict source networks in the firewall. Don't expose a proxy port on a public network, and don't use the external controller port as a proxy port.
mixed-port: 7890
allow-lan: true
# Set the listening address to this machine's actual LAN address
bind-address: 192.168.1.10external-controller provides a management API for dashboards to read connections, switch proxy groups, and change some runtime settings. It doesn't forward browser requests and can't replace mixed-port. For local use, bind it to a loopback address and set a separate access secret. Remote management requires its own authentication and network access controls. If an external dashboard can't connect, first check that the address, port, and secret match, then check browser cross-origin and secure-context restrictions. Whether changes made in the client UI persist depends on how it generates configurations and handles overrides.
external-controller: 127.0.0.1:9090
# Example only; replace with a unique, random secret before use
secret: "your-controller-secret"First, distinguish the core that routes traffic, the graphical interface used to manage it, and the subscription that supplies connection details. They are maintained separately and updated on different schedules. This site organizes download links and setup guides; it doesn't provide proxy subscriptions or represent any client development team.
The Clash ecosystem grew from a rule-based proxy core, with graphical clients adding features such as configuration selection, system proxy controls, and connection views. After the original project and some early desktop clients stopped being maintained, the community developed separate forks. mihomo continues the development direction of Clash Meta, supporting rules, DNS, TUN, and multiple proxy protocols. Similar names don't mean two products are the same, or that a button from an old tutorial still exists in a current client.
When looking up guidance, note which graphical client you're using and which core it includes, then consult the relevant documentation. A matching menu label isn't enough: some clients generate configurations, some merge override files, and some restrict which fields you can edit. Replacing a client’s entire configuration with one from another client may bypass subscription management or overwrite controller and listener settings. Before migrating, keep the old configuration and local changes. Confirm the new app starts before moving settings across one at a time.
Clash clients typically manage the tray menu, startup behavior, system proxy, subscription downloads, and configuration editing. The core handles connections, DNS resolution, and rule matching. A “running” status only means the process is active; it doesn't confirm that the subscription is valid or that every destination is reachable. Troubleshoot in stages: can the client start, can it load the configuration, can a node connect, do rules select the expected policy, and does DNS resolve the domain?
System proxy and TUN operate at different layers. The system proxy tells apps that honor the setting to connect to a local port; some command-line tools need proxy environment variables set separately. TUN uses a virtual interface and routing to capture more traffic, but is more sensitive to permissions and network conditions. A website working in your browser while a particular app fails doesn't mean the node is down. Check whether the app appears in the connection list, then decide whether to investigate its proxy path or the matching rule. That's more effective than enabling every option at once.
After installation, you'll still need an existing subscription or your own connection details. A subscription may include nodes, proxy groups, rules, and DNS settings—or just a proxy list. If import fails with a format error, check whether the response is actually Clash YAML. If opening the URL in a browser shows a login page or an error, the client can't read it as a configuration either. An empty list, authentication failure, or timeout usually calls for checking the service, URL, and download path—not changing the local proxy port.
Treat tokens in subscription URLs as credentials. Hide the full URL in screenshots, remove account details before exporting a configuration, and share only the necessary redacted snippets when asking for help. Third-party subscription converters send the original URL to another service; understand where your data goes before using one. Updating a subscription doesn't necessarily update local settings: a client may regenerate rules. Put personal routing changes in a supported override mechanism, then verify what's actually applied after an update.
mihomo is licensed under GPL-3.0, and its source code and development history are available in its repository. Each graphical client has its own project, license, and release notes, so check those separately. Open source makes implementations and changes available for review and helps locate discussions about compatibility issues; it doesn't guarantee that a particular network, subscription, or configuration combination will work. This site doesn't substitute verifiable information with unsubstantiated download counts, ratings, or speed-test figures.
When reporting an issue, include your operating system, client name, relevant settings, and steps to reproduce it. Share only the necessary log lines around the error, and redact subscriptions, keys, and personal destinations. “address already in use” points to a port conflict; “connection refused” means the destination port rejected the connection. A resolution failure calls for checking the DNS path. The exact error is more useful than “can't connect” and helps distinguish client, configuration, and server issues.
The client, core, subscription, and GeoIP database are separate update targets. Updating the client may change its interface or service components; a core update may affect protocols or fields; a subscription update changes connection details and rules; a GeoIP update changes matches that rely on regional data. Change one category at a time and record the previous state. If something breaks, reverting the latest change usually makes the cause easier to find than resetting everything.
For a first-time setup, start with rule mode and verify browser access, then test other apps, and only then consider TUN, LAN sharing, or an external dashboard. Don't just check whether a website loads: confirm that the connection list shows the expected domain, matched rule, and final policy. A successful connection with the wrong policy still needs fixing. Save custom configurations in a separate file. Use spaces for YAML indentation and avoid duplicate top-level keys. After applying changes in the client, check the logs and confirm the configuration loaded before moving on.
For your first setup, start with the subscription import steps. Follow the sequence: import, select a configuration, switch to rule mode, then enable the proxy. If it already works and you want to change how sites are routed, see advanced configuration for proxy groups, rule sets, and overrides. If a term is unfamiliar, check the glossary instead of guessing from the field name. This keeps setup on a clear path and helps avoid conflicts from copying scattered snippets.
If you lose all access after enabling the client, quit other proxy tools, confirm your regular network works, then check the subscription, selected configuration, proxy group, and DNS logs in order. If only certain websites fail, check that connection's rule and destination before reinstalling. If access still fails after quitting the client, check for a leftover system proxy setting and make sure the original network settings were restored. The Help Center has answers organized by symptom. This page keeps to a troubleshooting sequence rather than treating every problem as a toggle issue.
Subscription formats, certificate errors, and mobile background behavior involve different settings and layers. Choose an article for your specific symptom, identify where the problem occurs, then change the relevant setting. Here are the three latest articles.
Start by checking background activity, frequent health checks, and DNS queries. Distinguish normal network usage from extra drain caused by the system repeatedly stopping the service. Review your device's battery management settings, then adjust the client instead of disabling battery optimization for every issue.
Read article →A complete configuration, an encoded list of nodes, and a single protocol link aren't interchangeable. Learn how each format is structured, what clients can accept, and what information conversion services can access. If import fails, identify the format before troubleshooting fields or configuration merging.
Read article →Check system time, DNS resolution, capture certificates, and suspicious nodes one by one. Fake-IP doesn't issue certificates for websites, and certificate warnings shouldn't be ignored. Note the browser error and certificate subject first, then trace which part of the network path changed.
Read article →