Choose a client for your platform and follow the steps for subscription setup, routing rules, and connection checks.
Desktop clientsConfiguration filesEnglish guides
5 platforms
Kernel: mihomo
Kernel license: GPL-3.0
Clash Verge Rev · Routing rules example
Rules
Search rules
DOMAIN-SUFFIX,github.com,PROXY
DOMAIN-SUFFIX,example.org,DIRECT
GEOIP,CN,DIRECT
MATCH,PROXY
Rules are checked from top to bottom. The first match determines the route.
config.yaml
mode: rulemixed-port: 7890allow-lan: falselog-level: inforules: - DOMAIN-SUFFIX,github.com,PROXY - GEOIP,CN,DIRECT - MATCH,PROXY# PROXY must match a defined policy group
Understand the difference between configuration, rules, and traffic capture before changing settings. The examples below explain how these pieces work together; they are not complete configuration files with policy groups.
Put specific domain rules first, followed by regional rules, and use MATCH as the final fallback. Clash checks rules in order and uses the route for the first match without checking the rest. PROXY in this example is a policy name and must match a policy group defined in your configuration; DIRECT means a direct connection. After making changes, start a new connection and check the matching rule on the Connections page. Unlike global mode, rule mode lets different destinations use different routes, making it useful for everyday browsing alongside local services.
Subscription and configuration workflow
01Import a compatible subscription or YAML file
02Check the update result and configuration for errors
03Select the configuration, then choose a proxy policy
On the Subscriptions page, import a compatible link from your provider. Once the update succeeds, select that configuration. A subscription can include nodes, policy groups, rules, and DNS settings, so a successful import does not mean all connections will automatically use a proxy. If you see an error, first check that the content is a complete YAML file, not a webpage or a format intended for another client. To add personal rules, use the client’s override or merge feature rather than editing the remote subscription directly; a later update may overwrite local changes.
Traffic capture / Start with one method
System proxyApps that follow system proxy settings → local proxy port
Start with the system proxy to check whether your browser can connect, then decide whether you need TUN. The system proxy tells apps to use a local port through the operating system settings, but some apps ignore those settings. TUN uses a virtual network adapter to receive traffic routed to the kernel; it usually requires additional permissions and DNS and routing configuration. These methods determine which traffic is captured; they do not improve node quality or enable global mode. If a specific app is not being captured, follow the TUN setup guide and check for conflicts with other VPNs or virtual adapters.
Check the connection / From entry point to destination
Destination domain → DNS lookup
App request → system proxy or TUN
Rule match → policy group
Selected route → destination service
Make a new web request, then open the Connections page and check the destination, matched rule, and actual route. The main screen’s toggle cannot tell you whether traffic reached the kernel, and a latency test cannot confirm that a website works. If there is no connection record, check traffic capture settings. If an unexpected rule matched, adjust the rule order or policy. If the route is correct but the request still fails, check the node, DNS, and destination service. Change one setting at a time and test again; this keeps troubleshooting clear and makes the cause easier to identify than switching several options at once.
Distinguishing traffic capture from route selection is the starting point for configuration. System proxy and TUN determine which requests reach the client; rule mode and global mode determine how those requests are routed. These are separate settings: TUN can be used with rule-based routing, and global mode does not automatically capture apps that ignore the system proxy. For your first setup, keep the configuration defaults, establish one reproducible connection, and expand from there.
Pay attention to context when using configuration snippets. Referenced policies must already exist, YAML indentation must be valid, and some fields depend on the kernel used by the client. Pasting an entire snippet into a subscription may overwrite its existing structure. See the glossary for field definitions, or the symptom-based troubleshooting guide to pinpoint where a connection fails.
Clients / Choose by platform
Clash downloads for every platform
Check your operating system and processor architecture before choosing an installer. Desktop clients, mobile apps, and command-line kernels work differently, and their configurations may not be interchangeable.
Start with Clash Plus, or choose Clash Verge Rev, FlClash, or Clash Nyanpasu based on your preferences. Check your processor type in system information before choosing a package; don’t confuse x64 installers with ARM builds. After installation, test the system proxy first. Configure service mode and TUN permissions only if you need them.
Clash for Windows is no longer maintained; its download page includes an archive notice. If you’re migrating from an existing installation, back up your subscription and personal rules, then check the new client’s ports and override options. Don’t copy the entire old configuration folder as-is.
Choose the right package for Apple Silicon or Intel, then select Clash Plus, Clash Verge Rev, or FlClash. Check your chip under About This Mac rather than guessing from the computer’s appearance. On first launch, complete any permissions requested by macOS, then import your configuration and check the proxy status in the client.
Proxy settings left by an old client can interfere with a new one. Before switching, quit the old process and make sure two apps aren’t changing the system proxy at the same time. The download page lists the archived ClashX Meta release and its maintenance status separately.
See which devices are supported by Clash Plus, Clash Meta for Android, FlClash, and Surfboard. Most recent devices use ARM64, but check your device specifications to be sure. After installing, import a compatible configuration and review the system VPN permission prompt on the first connection. Running another VPN app at the same time may cause conflicts.
If you need a persistent background connection, check battery optimization and background activity permissions in your phone’s settings. If the connection drops only when the screen is off, check whether the system is suspending the app before trying a different subscription. Surfboard uses a different configuration format from Clash YAML, so confirm compatibility before importing.
Use the download page to open Clash Plus in the App Store and check device compatibility and app details. The client’s official website is clashplus.io. After installing, import a configuration in the app and approve the VPN configuration prompt from iOS. Check both the in-app connection status and actual access to confirm it’s working.
After switching between Wi-Fi and cellular data, test the same destination again. If the results differ, note the network, error, and policy in use, then follow the mobile troubleshooting guide. The client handles the connection; your subscription provider and available routes must be checked separately.
On desktop Linux, install Clash Verge Rev or FlClash using the package format for your distribution. For headless servers, routers, or environments that need a background service, you can deploy the mihomo kernel separately. GUI clients usually include configuration management; the command-line kernel requires you to manage its configuration directory, startup options, and service permissions yourself.
Desktop proxy settings may not affect terminal programs. Command-line download tools may need proxy environment variables set separately, and background services do not automatically inherit the environment of an interactive shell. Identify which process needs network access before choosing an app-level proxy, system proxy, or TUN. Keep settings for different scopes separate.
Downloading a client does not provide proxy routes. Before importing a subscription, make sure it comes from a trusted provider, is compatible with your client, and is stored securely. Links may contain access credentials; don’t post them in public comments, screenshots, or unfamiliar conversion tools. After updating the configuration, check that the expected policy group is still selected.
Import a subscription, choose a mode, and verify the connection
First, make one connection with the default configuration, then add custom rules. This is a preview of the steps; menu names may vary between clients.
01
Import and select a subscription
Open the client’s Subscriptions or Profiles section, paste a compatible subscription link, and download or update it. Once the configuration appears, select it and check that its policy groups are listed on the Proxies page. If import fails, check that the link is complete and hasn’t expired, and that the returned content is in a format your client supports. Don’t keep changing system proxy settings before the configuration has loaded.
You can also use a local file as a configuration source, but it needs valid proxies or proxy providers and the policies they use. A demo snippet containing only a few rules cannot provide a connection on its own. Keep a working configuration as a fallback.
02
Choose rule mode and a policy
Switch to rule mode, then choose a route in the policy group referenced by your rules. Rule mode lets you handle local destinations separately from other services. Global mode can help you compare routing behavior temporarily; direct mode does not use a proxy route. Similarly named policy groups may serve different purposes, so check where your rules point before changing a group—don’t just change the first one in the list.
You don’t need to enable every advanced option for your first connection. Keep the default DNS and routing settings, then confirm the basic connection works. To send a specific domain direct, add a narrowly scoped rule and make sure it appears before broader rules.
03
Enable traffic capture and check a new connection
On desktop, enable the system proxy; on mobile, follow the prompt to start the VPN connection. Open a test page, then check the destination and route on the client’s Connections page. Existing long-lived connections may keep using their original route, so close and reopen the relevant app if needed. A repeatable access test is more reliable than checking whether a toggle is on.
If you still can’t connect after closing the client, check whether the system proxy still points to a local port. If only certain apps have no connection records, check app proxy settings, TUN, or VPN exclusions. If records appear but connections fail, troubleshoot the rule, policy, DNS, and route in order.
Set the client to launch at startup only after verifying the connection. Make sure it can exit and reconnect normally before enabling auto-start, auto-connect, or a background service. Starting the app and capturing network traffic are separate settings. After a restart, check that the configuration loaded, the kernel is running, and the proxy port is available.
Open-source ecosystem / Know what each project does
Clash, mihomo, and GUI clients
Check source code, release notes, and configuration docs to confirm how features work. The client interface manages settings, the kernel handles connections, and the subscription provides configuration; each has its own update cycle.
How the kernel evolved
Clash introduced a configuration model where rules determine the route. Clash Meta expanded this ecosystem, and related kernel projects are now maintained under the name mihomo. Older guides may still refer to Clash Meta. When reading, check whether the subject is a kernel, GUI client, or configuration format: the same name doesn’t imply the same maintenance status.
Clash for Windows is the name of a GUI client, not the entire Clash ecosystem. Although it is no longer maintained, other clients and the mihomo kernel have their own release cycles. When migrating, you may be able to keep a compatible subscription source, but check configuration support, default ports, service mode, and personal override options again.
Understand client features by role
GUI clients typically offer subscription management, policy switching, log viewing, and a system proxy toggle. The kernel parses configuration and handles DNS, rule matching, and proxy connections. Whether a protocol or field works depends both on kernel support and on the client passing the configuration through correctly. A toggle in the interface alone doesn’t confirm that every setting has taken effect.
When comparing clients, prioritize OS support, configuration management, and troubleshooting tools—not just appearance. For devices that need to run in the background, service management and permission recovery also matter. Use the platform notes on the download page to guide your choice, and check the kernel documentation if fields behave differently.
Manage client and subscription updates separately
A client update may change the kernel, interface, or permission handling. A subscription update mainly replaces configuration provided by its source; one does not replace the other. Before updating, save your personal rules and a working configuration, then review release notes for changes relevant to your system. After updating, verify that the subscription loaded, the right policy is selected, and traffic follows the expected route. Pay particular attention to whether service mode or TUN needs new permissions.
Leave remote subscription content to its provider where possible. Manage personal changes through the client’s supported overrides, merges, or separate rule files. Merge order varies between clients, so test a specific domain after migrating and confirm your personal rule made it into the final configuration. Saving a file successfully does not mean the running kernel has reloaded it.
Keep enough detail to reproduce an issue
When troubleshooting, note the operating system, client, traffic capture method, time of the error, and steps to reproduce it. Subscription links, server addresses, and authentication fields in logs may contain sensitive information; remove them before posting publicly. Reporting that a specific app has no connection records on a particular network is more useful than simply saying it doesn’t work, and helps avoid mistaking a DNS issue for a rule problem.
Clash Guide collects download links and setup instructions. It is not the official maintainer of the kernel projects or every client, and it does not provide proxy routes. For client-specific issues, check the project’s release notes and support channels. For subscription access or content, contact the subscription provider. Always follow local laws, network policies, and the terms of relevant services.
Does rule mode send every request through a proxy?
No. Rule mode chooses a direct or proxy route based on the matching rule, provided the request reaches the kernel. Check traffic capture first, then the matched rule. See the glossary for related terms.
Do I still need to choose a policy with TUN enabled?
Yes. TUN receives traffic routed through the virtual network adapter, while policy groups still determine the route. Check DNS, routing, and possible interference from other VPNs too. See the glossary to distinguish network stack and policy concepts.
Why won’t a website load even though the latency test succeeds?
A test only shows how a specific address responded under the conditions at that time. It doesn’t confirm that the destination website, DNS, or app traffic capture is working. Check the connection record for an actual request and troubleshoot each step. See the glossary for basic terms.
Articles / Featured guides
Clash configuration and deployment guides
Once your basic connection works, choose a guide that matches the issue. These three articles cover running mihomo as a Linux background service, understanding latency tests, and ordering custom rules. They’re most useful when you have specific configuration behavior to investigate.
Covers GUI clients on desktop distributions and headless servers, including mihomo installation, configuration directories, systemd services, and terminal proxy variables.
Learn how interactive shells differ from background services. Useful if a manually started client works but the service fails after a restart, or terminal tools aren’t using the expected proxy.
Learn what client latency tests measure, how test addresses and timeouts affect results, and why packet loss, bandwidth, and network congestion don’t show up in milliseconds.
Standardize test conditions before comparing real-world performance. Useful when test results look fine but downloads, video, or web browsing are noticeably slower.
Breaks down the syntax of common rule types, explains first-match order from top to bottom, and shows how to use rule-providers and resolve rule conflicts.
Start with a single domain rule, then check rule-set references and the fallback position. Useful if the correct policy is selected but a website still takes an unexpected route. Save the original configuration before editing, then check the match on a new connection to avoid being misled by a browser reusing an existing connection.