Choose a client for your device, then work through subscription imports, rule-based routing, and connection settings.
Check your operating system and processor architecture first, then choose a desktop client. The downloads page lists installers, supported platforms, and maintenance status. You don't need to start with a command-line core.
For desktop browsers, developer tools, and everyday work, start with Clash Plus, then compare the interface and settings in Clash Verge Rev, FlClash, and other clients. If you're looking for a Clash for Windows alternative, export your existing configuration and note any custom rules and ports before switching. Avoid overwriting the current directory.
Go to downloadsCheck your chip under About This Mac to choose the right Apple Silicon or Intel installer. On first launch, macOS may ask you to authorize a network extension or helper service. For browser traffic, start with the system proxy. To route traffic from other apps, configure TUN and grant the required permissions as described by the client.
Go to downloadsMobile clients typically route traffic through the system VPN interface. After installing, import your configuration and approve the VPN permission prompt. If another VPN is already connected, check for interface conflicts. If the connection drops when the screen locks, check battery optimization, background activity, and auto-start permissions instead of repeatedly reimporting the subscription.
Go to downloadsOpen the Clash Plus App Store page from the downloads page, or visit the official site at clashplus.io. The first connection requires permission to add a VPN configuration. After importing, select an available proxy group. Whether the configuration works depends on the subscription, proxy protocols, and client support.
Go to downloadsFor desktop Linux, choose Clash Verge Rev or FlClash and install the package for your distribution. Server and router users can explore the Mihomo core. Command-line deployments also require decisions about configuration paths, service permissions, and process management. Installing the software alone does not route traffic through a proxy.
Go to downloadsThese examples illustrate how settings relate to one another, using mihomo configuration semantics as a reference. They are snippets, not complete, ready-to-use configurations. Check which fields your graphical client supports and how it handles overrides.
Rule mode checks connections in list order and applies the matching policy without checking later rules. Domain-suffix rules can cover a site and its subdomains; use keyword rules carefully because their scope may be broad. Put specific rules first, then IP-based conditions, and finish with MATCH as the fallback. Unlike global mode, rule mode allows direct and proxied connections side by side. PROXY in this example must match an existing proxy group or proxy name in your configuration. A rule without an available outbound still results in a failed connection.
rules:
- DOMAIN-SUFFIX,google.com,PROXY
- DOMAIN-KEYWORD,github,PROXY
- GEOIP,CN,DIRECT
- MATCH,PROXYProxy groups separate which connections should use a proxy from the choice of outbound. Rules refer to the group name, so you can change the group's selection without editing each rule. Use select for manual choice and url-test to choose based on test results; a reachable test endpoint doesn't guarantee access to every site. DIRECT and REJECT illustrate the group structure here. In practice, add proxy names that exist in your configuration. Group names must match the names used in rules exactly; changes to capitalization, spaces, or names can break references.
proxy-groups:
- name: PROXY
type: select
proxies:
- DIRECT
- REJECTTUN receives traffic through a virtual network interface, making it useful for apps that can't be configured with a proxy address. It is not a fix for every network problem. Before enabling it, make sure the configuration and outbound work, then grant the client the required permissions. Automatic routing changes the traffic path and may conflict with other VPNs, virtual machine adapters, or security software. The snippet below shows common fields; whether they apply depends on your system and client. If connections fail, turn off TUN as a comparison, then check routing and DNS. Avoid changing several settings at once.
tun:
enable: true
stack: mixed
auto-route: true
auto-detect-interface: true
dns-hijack:
- any:53A subscription link retrieves a remote configuration. After importing it, select the corresponding profile so the client loads it. Updates usually replace subscription-generated content, so direct edits to the downloaded file may be lost on the next refresh. For rules you want to keep, use an override or merge feature supported by the client, then check the effective configuration. The example URL only demonstrates the import field; it does not provide a proxy service. If import fails, first check whether the response uses a supported configuration format, then distinguish network errors from expired authorization or YAML parsing errors.
Import method: Import from URL
Subscription URL: https://example.com/profile.yaml
After importing: Select profile → Check parsing results → Apply
Local rules: Save separately using the client's override featureIn Fake-IP mode, the client first returns a mapped address to the app. When the core receives the connection, it restores the domain name and selects an outbound. This preserves domain information for rule matching, provided DNS resolution and the connection follow the expected path. LAN services, some games, and apps that rely on real resolved addresses may need exceptions. fake-ip-filter lists domains that should not receive fake addresses; it is not a proxy rules list. If problems persist after changing DNS mode, check system and app caches, and whether another encrypted DNS service is bypassing the client's resolution path.
dns:
enable: true
enhanced-mode: fake-ip
fake-ip-range: 198.18.0.1/16
fake-ip-filter:
- "*.lan"
- "localhost"
nameserver:
- https://dns.alidns.com/dns-querySelect a setting on the left, then read the snippet on the right. Manual selection stops automatic rotation. See the glossary for full definitions, or visit troubleshooting to diagnose a specific issue.
Start with a basic working connection, then add rules and advanced features. Check the result at each step so you can return to the right stage if something goes wrong, rather than repeating the installation process.
In the client's Subscription or Profiles page, choose Import from URL, paste the full link, and save. Once the download and parsing finish, select the imported profile. Confirm that proxy groups or rules appear in the interface, not just a new subscription entry. If the response is a login page or an error, switching clients usually won't fix the source link.
When importing a local file, check its extension and text encoding; don't mistake a saved web page for YAML. Note the profile name before applying it for the first time. If you have multiple subscriptions, check which one is selected and make sure later updates target the same profile.
Set the proxy mode to Rule, open a main proxy group in your configuration, and select an available outbound. On desktop, enable the system proxy; on mobile, approve the VPN permission prompt. Global mode can help with a temporary comparison, but it won't fix a dead proxy. Direct mode also doesn't mean the client process has exited.
Don't run multiple proxy apps during your first connection test. If your browser has a proxy-switching extension, make sure it isn't overriding system settings. Wait until basic access works before configuring TUN, LAN sharing, or custom DNS to reduce permission and routing variables.
Open a website, then look for its domain in the Connections or Logs page. Check the matched rule, proxy group, and actual outbound. If a connection appears in the log but the site won't load, check the outbound and DNS. If there's no log entry, first check whether the app follows the system proxy and whether its traffic reaches the client.
Use a familiar site that connects directly as a comparison; don't judge your entire network by one page. Change one setting at a time and start a new connection after each change. When reporting a problem, include your operating system, client name, steps to reproduce, and the exact error message. This is more useful than simply saying “the internet doesn't work.”
Knowing the difference between a core, a graphical client, and a subscription service helps you identify who provides a feature and where to troubleshoot an issue. This site provides download links and guides; it does not replace upstream release notes or configuration documentation.
Clash was an important starting point for this category of rule-based proxy tools, and its configuration format gave rise to a wider ecosystem of clients and rules. Clash Meta extended that foundation; the subsequent core is maintained under the name mihomo. Search results may use these names for different programs. A filename alone does not tell you which features are supported.
Fields, startup arguments, and protocol support from older guides may not apply to current clients. If a field isn't recognized, first identify the core actually in use and check its documentation before editing the configuration or switching clients. Keeping a working backup is safer than migrating every advanced option at once.
Graphical clients provide tray menus, subscription management, proxy selection, and system integration. The core parses configuration, matches rules, and handles network connections. Even two clients using the same core may differ in override order, permission setup, and configuration storage. Similar-looking switches in their interfaces don't guarantee identical generated configurations.
When migrating, check the configuration and system settings separately. Ports, auto-start, system proxy settings, and TUN permissions usually aren't transferred just by copying a subscription. The downloads page summarizes maintenance status and platform links. Archived labels help identify clients that are no longer maintained and may appear in older guides.
The mihomo core is licensed under GPL-3.0. Its source code, issues, and release history can help explain configuration behavior and changes. Open-source licenses govern how code may be used and distributed; they don't guarantee the quality of any subscription service or replace checking the source of a configuration. Check each graphical client's project documentation for its own license.
To verify a feature, start with the field documentation, then check for related issues and reproduction steps. When reporting a problem, include a minimal configuration snippet and redacted logs, with enough context to understand the issue. Don't upload a complete subscription or account credentials. A screenshot without steps to reproduce is usually not enough to distinguish a configuration issue from a software bug.
A client update may change the interface, core, or system helper components. Before updating, save custom rules, overrides, and the currently working configuration, then check the release notes for breaking changes. Afterward, test a connection that worked before, then enable new features gradually. Don't change DNS, switch TUN, and replace the configuration in the same test.
Treat subscription updates and client updates separately. The former changes remote configuration; the latter changes program behavior. If a problem starts after a subscription refresh, check group names, rule references, and service status. If it starts after a client update, check the release notes and permissions. Establishing the order of events usually narrows down the cause.
The command below only clones the source code; it doesn't install a client or start a proxy service. Git must be installed on your machine first. Most users can simply read the repository documentation.
Open the mihomo source repository ↗git clone https://github.com/MetaCubeX/mihomo.gitA successful import only means the client retrieved and parsed the content. Make sure the profile is applied, a working outbound is selected in the proxy group, and app traffic is reaching the client. Check the connection log first, then distinguish proxy, rule, and system proxy issues. See subscription and configuration terms.
Not as a general rule. The system proxy works with apps that follow that setting; TUN routes traffic through a virtual interface, with coverage depending on routing and the client implementation. Start with one method and establish a baseline before deciding whether to use the other. See network stack terms for definitions.
A test only reflects the specified test address and connection conditions at that moment. A destination may use different DNS resolution, routing rules, protocols, or access restrictions. Test the actual request instead of relying on the probe alone. See proxy and proxy group terms for details.
If you edited the file downloaded from a subscription, a refresh may regenerate and overwrite its contents. Use an override or merge feature explicitly supported by the client, then check the final rule order. See configuration file terms for the difference between local rules and remote configuration.
The three latest articles cover mobile background permissions, Fake-IP resolution, and syncing configurations across devices. Once your basic connection works, look up the scenario you need rather than applying steps for one platform to another device.
Learn about the VpnService permission prompt, the always-on VPN option, and battery optimization and auto-start settings across Android brands to prevent the system from stopping connections when the screen locks.
Read article →Follow the Fake-IP process from assigning a fake address to restoring the connection, learn how it can speed up the first request, and find out which LAN, gaming, and verification domains may need to be excluded.
Read article →Compare shared subscription links, configurations hosted in private repositories, and export-and-import workflows. Learn how to handle update intervals, overrides, and differences in supported fields across platforms.
Read article →