The Clash Ecosystem · Clients & Configuration
Choose your platform and explore subscription setup, routing rules, and DNS configuration.
CONFIGURATION / GUIDES
Understand subscriptions, proxy groups, and rules before deciding how app traffic reaches the core.
The client handles the interface, subscription storage, and system integration; the core parses configuration, establishes connections, and routes traffic. Each snippet below covers one area and is not a complete, standalone configuration. Before using it, add valid proxy definitions and make sure proxy group names match the rules that reference them.
A subscription URL retrieves remote configuration; it is neither a client installer nor proof that your connection works. Paste the URL into the client's subscription page, download the configuration, select it, then check that proxies appear in the proxy list. Treat full-configuration subscriptions separately from proxy-provider subscriptions: the latter use proxy-providers and also need to be referenced by a proxy group. Remote updates may overwrite the local file, so put persistent rules in the client's override or merge configuration instead of reapplying them after every update. Subscription URLs contain access credentials; redact them before sharing screenshots or logs.
Clash Vergeproxy-providers:
remote:
type: http
url: "https://example.com/sub?token=xxxx"
path: ./providers/remote.yaml
interval: 3600Proxy groups organize multiple exits into targets that rules can reference. Use select to pin a route manually, url-test to choose a candidate based on checks against a specified URL, and fallback to try exits in priority order. Test times reflect only a particular URL and network conditions at that moment; they are not download speeds. Start with a manual group to verify each route, then add an automatic group. This makes it easier to tell a route failure from a switching issue. The use field below references the remote collection defined in the subscription panel. Keep names consistent when merging configurations to avoid creating an empty group.
proxy-groups:
- name: Auto Select
type: url-test
use:
- remote
url: https://www.gstatic.com/generate_204
interval: 300
tolerance: 50Rule mode checks connections from top to bottom. After a match, it applies the specified policy and stops; later rules are not checked. Put exact domains, local network ranges, and app-specific rules before general ones, then use MATCH as the final catch-all. DOMAIN-SUFFIX matches a domain and its subdomains; IP-CIDR matches an address range, so each relies on different information. If the configuration looks right but traffic behaves unexpectedly, check the matched rule and target policy on the Connections page rather than looking only at the selected proxy. Reconnect after making changes; existing long-lived connections may not switch immediately.
rules:
- DOMAIN-SUFFIX,example.com,Auto Select
- IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
- IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
- MATCH,Auto SelectFake-IP returns a reserved address for a domain. The core restores the domain on subsequent connections and applies the relevant rules, preserving domain-based routing information. It is not a standalone DNS leak-prevention switch: check whether apps use the core's DNS, how system routes are handled, and which exit carries upstream DNS queries. Some local services that require real DNS responses may need exceptions; keep these as narrow as possible. After enabling Fake-IP, test with new connections and check DNS queries and application traffic separately. Seeing a reserved address alone does not prove that all traffic goes through the proxy.
dns:
enable: true
enhanced-mode: fake-ip
fake-ip-range: 198.18.0.1/16
fake-ip-filter:
- "*.lan"
- "localhost"
nameserver:
- https://dns.alidns.com/dns-queryTUN receives traffic through a virtual network interface and can cover apps that ignore system proxy settings, but it depends on client permissions, drivers, or a system network extension. First verify the configuration with the system proxy, then enable TUN routing once the proxy route works. When running alongside another VPN, a virtual machine, or a corporate network, check for route conflicts and excluded subnets. Avoid repeatedly switching between multiple traffic-capture tools. The DNS hijack in this example applies to ordinary DNS requests entering TUN; handle encrypted DNS built into apps separately. Network stack support and authorization steps vary by platform, so follow the relevant client documentation.
tun:
enable: true
stack: mixed
auto-route: true
auto-detect-interface: true
dns-hijack:
- any:53The system proxy directs app requests to a local listening port; only apps that follow this setting will use it. mixed-port accepts both HTTP and SOCKS requests. After changing it, make sure the system proxy address shown in the client matches. Launch at startup is a GUI client feature, not a core field from the configuration below. Launching the client, starting the core, and enabling the proxy automatically may also be separate options. Restart once after setup and check that the tray icon, core status, and system proxy agree. Turn off the system proxy before quitting the client to avoid leaving the system pointed at a local port that is no longer listening.
mixed-port: 7890
allow-lan: false
bind-address: "127.0.0.1"
mode: rule
log-level: infoRead the installation and configuration guides for all platforms →
PACKAGES / CHOOSE A PLATFORM
Check your operating system and processor architecture before choosing a client.
Clash is an ecosystem, not a single installer shared across every platform. Clients differ in interface, core update cadence, and system integration; configuration fields depend on the core actually in use. The download page lists installers, maintenance status, and setup guides by platform. For a side-by-side comparison, see client comparisons.
Recommended: Clash Plus. You can also choose Clash Verge Rev, FlClash, or Clash Nyanpasu. Check your system architecture and runtime requirements before installing; TUN service permissions are separate from normal launch permissions.
When moving from an older client, export your subscriptions and custom rules first, then check the mixed port and startup settings. Don't let two clients change the system proxy at the same time.
Go to DownloadsChoose Clash Plus, Clash Verge Rev, or FlClash for Apple Silicon or Intel. After installing, grant the required permissions requested by macOS, then check the menu bar status and proxy port.
System proxy access and network extension permissions cover different things. If your network stops working, check whether another VPN or an older client is still running before changing DNS or TUN settings.
Go to DownloadsRecommended: Clash Plus, with Clash Meta for Android, FlClash, and Surfboard also available. Choose an installer for your device's ABI and approve the system VPN prompt when you connect for the first time.
If background connections drop, check battery optimization, background activity, and the manufacturer's power-saving restrictions. Surfboard uses a different configuration format from Clash YAML, so verify the subscription type before importing it.
Go to DownloadsChoose Clash Plus through the download page to open the App Store. Find product details on the official site, clashplus.io. Add the VPN configuration when prompted by iOS before connecting.
After importing a subscription, select a configuration and proxy group before starting the connection. Desktop features such as service mode and launch at startup do not apply directly to mobile systems.
Go to DownloadsFor a graphical desktop, choose Clash Verge Rev or FlClash and download the package format for your distribution. Server and router users can find mihomo in the core section of the download page.
A desktop session's system proxy settings are not automatically passed to every terminal process. Check environment variables for command-line apps. For services, specify the run user, configuration directory, and log location.
Go to DownloadsSOURCE / CORES & CLIENTS
The original Clash laid the foundation for this ecosystem with rule-based proxying and YAML configuration. Later client and core forks retained many similar interface labels. mihomo, formerly known as Clash.Meta, extends the existing configuration system with additional protocols, rule sets, and network handling capabilities. When installers have similar names, check the project maintainer and bundled core rather than relying on an icon or filename to judge compatibility. This site provides download links and English-language resources; it is not affiliated with the development teams behind individual clients.
mihomo listens on ports, handles DNS, parses rules, and establishes proxy connections. Graphical clients such as Clash Verge Rev and FlClash provide subscription management, tray controls, and system proxy integration. The two layers can be updated separately, so switching clients may change where settings live and how they take effect, even with the same subscription URL. When troubleshooting, note the client name and core in use, then inspect the final runtime configuration. Don't assume an interface toggle is a standard YAML field.
mihomo is maintained in a public repository under the GPL-3.0 license. Source code, commit history, and issue discussions can help explain how it works and why it changed, but open source does not guarantee that every configuration will behave as expected. Graphical clients have their own licenses, dependencies, and release notes; the core's license does not automatically cover the entire installer. Before building or redistributing, read the relevant project's license, retain required notices, and check the terms for its dependencies.
Before updating, save your subscription URLs, override files, and custom rules, and note the current listening ports and traffic-capture method. After updating, load the configuration and check the startup logs, proxy groups, and a new connection. Restore TUN and launch-at-startup settings last. Updating a subscription fetches configuration again; updating a client changes the interface and bundled core. They are not the same thing. A discontinued client can be useful as a migration reference, but don't rely on it to support future systems or protocols. See alternatives after Clash for Windows was discontinued for migration steps.
NOTES / FIELD GUIDES
For a configuration to work, the client must support it, the core fields must be valid, and the network path must be correct. These articles cover specific symptoms and migration scenarios, and are useful after your first successful connection. Change one variable at a time and keep a restorable copy of your configuration so you can identify what actually changed the outcome.
Review alternatives to discontinued clients and compare platform support and core differences. Start migration by backing up subscriptions, rules, and custom configuration, then verify ports, system proxy, and startup settings to prevent old settings from interfering with the new client.
Check configuration syntax, port conflicts, core file permissions, and WebView components for your platform. Save the logs and roll back recent changes first. Reset the data directory only as a last resort, so you don't lose subscriptions and override files before finding the cause.
Check app-level DNS resolution, the core's upstream DNS, and application traffic exits separately. Use Fake-IP, nameserver-policy, respect-rules, and TUN to trace the request path. Interpret test results in context; one result from one page is not enough to draw a conclusion.