From choosing a client to putting rules into practice, find downloads for every platform, configuration guidance, and rule routing methods in one place. Start with a working connection, then learn how proxy modes, proxy groups, and configuration files fit together.
Using Clash is not about repeatedly flipping switches. It is about organizing subscriptions, proxy groups, rules, and system takeover into one explainable processing chain. The resource links below provide an overview; the longer chapters that follow unpack the details.
Domains, destination IPs, processes, and geographic data can each serve as matching conditions. Once a request matches the first applicable rule, it is passed to the corresponding proxy group. Specific rules should therefore come before broader ones, with MATCH handling traffic that matches nothing else. Once the order is clear, direct connections in mainland China, proxying for specific services outside China, and LAN bypasses can be expressed as clear, maintainable configuration.
rules:
- DOMAIN-SUFFIX,example.com,Proxy
- GEOIP,CN,DIRECT
- MATCH,ProxyA subscription update usually replaces content generated from the remote configuration, so editing the original subscription file directly can cause changes to disappear at the next refresh. A safer approach is to keep the subscription as the upstream source and place local rules, DNS settings, and proxy-group adjustments in an override or merge layer. Record the currently working configuration before updating, then check whether proxy-group names changed afterward before applying it.
A proxy group sits between rules and individual proxy nodes. Rules only need to specify which group should handle a traffic category; the group then chooses an egress through manual selection, health checks, or failover. This lets you replace nodes without editing rules and use different selection logic for video, development services, and ordinary web pages.
A system proxy mainly covers applications that follow the operating system's proxy settings. It is simple to configure and suits browsers and most desktop software. TUN mode uses a virtual network device to take over a broader range of connections, making it more effective for command-line tools, some games, and programs that ignore system proxies. The two modes do not need to be enabled together: start with the system proxy, then check TUN permissions and routes if coverage is insufficient.
Rule mode reads the rule list in the configuration and checks the current connection in written order. For example, DOMAIN-SUFFIX is suited to a site and its subdomains; use DOMAIN when you need to match one exact domain; when the destination is an IP address, combine IP-CIDR or GEOIP as appropriate. Rules do not create connections themselves—they pass requests to DIRECT, REJECT, or a proxy group.
When arranging rules, put LAN addresses, dedicated services, and exact domains first, followed by broader geographic matches, and keep MATCH last. If a broad rule comes first, later specific conditions cannot take effect. During troubleshooting, open the client logs to see which rule and proxy group matched the request instead of guessing from whether a webpage opens.
rules:
- IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
- DOMAIN-SUFFIX,example.cn,DIRECT
- DOMAIN-SUFFIX,example.com,Proxy
- GEOIP,CN,DIRECT
- MATCH,ProxyProxy-group names must exactly match the names in proxy-groups. After making changes, run a configuration check before having the client reload it.
Subscription links are usually maintained by the service provider and may contain proxy nodes, proxy groups, and base rules together. Updating means fetching the upstream content again, so long-term customizations should not be written directly into a file that will be replaced. Clients with override or merge support can store local settings alongside the subscription; in command-line environments, separate files and automation scripts provide the same layering.
Before updating, confirm that the current configuration loads correctly and note which proxy group is in use. Afterward, check the parse result, proxy-group names, rule-provider status, and DNS fields in that order. If the upstream changed a group name while local rules still point to the old one, the configuration may pass syntax checks yet route traffic incorrectly. Separating the update from the switch makes problems easier to locate.
A typical Clash configuration consists of general ports, operating mode, DNS, proxy nodes, proxy groups, and rules. When reading it, you do not need to follow every line from top to bottom. First check mode, mixed-port, and DNS; then verify that proxies are referenced by proxy groups; finally confirm that rule targets exist. Checking references is more effective than searching line by line for indentation errors.
YAML is sensitive to indentation, so list items, object fields, and strings need a clear structure. Quote proxy-group names that contain special characters, write ports as numbers, and use the boolean format accepted by the configuration. For complex setups, split rule-providers and proxy-providers into separate sources, keeping only the references in the main file so rule sets can be updated without rewriting the entire configuration.
View the complete configuration reference →Installation methods, permission models, and background restrictions vary by operating system. Start by finding the download page for your device here; platform-specific client differences, system requirements, and package types are explained under the corresponding platform tabs.
Best for desktop users who need a graphical interface, a system-proxy switch, and configuration management. Before downloading, confirm the CPU architecture and package format. After the first launch, import a subscription and enable the system proxy.
Go to downloadsSuitable for Intel and Apple Silicon devices. During installation, follow the system prompts to approve the required app permissions. If you use TUN, also check authorization for the network extension or virtual network device.
Go to downloadsAndroid clients use the system VpnService to take over connections. The first activation shows a system authorization prompt. If the app is frequently stopped in the background, add it to the battery-saver allowlist and permit background activity.
Go to downloadsOn iPhone and iPad, proxy tools run through the system network extension. The download page provides the App Store link and covers the basics of importing subscriptions, approving network permissions, and enabling on-demand connections.
Go to downloadsDesktop environments can use a graphical client, while servers and routers are better suited to running the Mihomo core directly. Before deployment, confirm the architecture, file permissions, service manager, and TUN support.
Go to downloadsYou do not need to edit complex rules right away. First load a valid configuration and complete system takeover, then decide whether DNS, TUN, or custom routing needs adjustment based on actual access results.
Go to the download page and choose a client that matches your operating system and CPU architecture. After installation, open subscription management, paste the subscription URL provided by your service provider, and download or update it. Once the configuration loads successfully, the client will usually show available proxy groups. If parsing fails immediately, check that the URL is complete, the network is reachable, and the configuration follows YAML structure.
For everyday use, start with rule mode so the configuration can choose direct or proxied connections based on domain and IP conditions. Open the proxy or strategy page and select an available egress for the main proxy group. Avoid changing many rules at once: a failed connection may come from the node, system proxy, DNS, or permissions. Fewer variables make troubleshooting more direct.
On desktop, enable the system proxy first. On mobile, grant the requested system network permissions, then visit several types of websites to verify the result. If the browser works but command-line tools bypass the proxy, the program may ignore system proxy settings. Configure environment variables manually, or switch to TUN after confirming permissions. Set launch-at-startup and automatic updates only after verification.
Clash established a workflow built around YAML configuration, proxy groups, and rule lists, followed by multiple client projects for desktop, mobile, and command-line environments. Projects may share similar configuration concepts, but their interfaces, core selection, release cadence, and system integration can differ considerably. When choosing a client, consider the target platform, maintenance status, and required capabilities—not just its appearance.
Mihomo continues and extends the Clash core ecosystem. Common graphical clients expose core capabilities through subscription management, proxy switching, system proxy, TUN, logs, and configuration overrides. The core parses configuration and processes traffic; the graphical client handles system integration and interaction. When something fails, first determine whether the cause is configuration parsing, core operation, or client permissions and operating-system network settings.
Open-source repositories provide direct access to commit history, release notes, issue discussions, and configuration documentation. Pay attention to the project name and maintained branch: fields in older tutorials may have changed, and some clients may have switched core implementations. This site organizes stable concepts and workflows by topic, puts package and platform differences on the download page, and keeps detailed field explanations in the configuration reference.
Updates also need to be understood in layers: client updates address interface and system compatibility, core updates add protocol, rule, and networking capabilities, while subscription updates replace nodes or provider configuration. These three update types are independent. Keep a configuration that loads correctly before making changes, then check the configuration, proxy groups, and system takeover status in order after updating.
Installation, configuration, system takeover, and the destination website can all affect one another. Checking each layer is more likely to reveal the cause than repeatedly changing nodes or reinstalling the client.
First confirm that the subscription update succeeded, then check the configuration parse result in the client logs. If YAML cannot be loaded, proxy groups will not appear. If the configuration is valid but the groups are empty, check whether the proxy provider was fetched successfully. See the Troubleshooting page under “Installation and configuration” for the complete process.
View installation and configuration issues →Rule mode evaluates the configuration one rule at a time and suits everyday use. Global mode sends connections to one specified proxy group for temporary egress testing. Direct mode bypasses the proxy and helps determine whether a problem is related to the proxy path. Reconnect after switching; existing connections may not change routes immediately.
View basic concepts →Some programs ignore system proxy settings or use an independent network stack. Check first whether the program supports HTTP, HTTPS, or SOCKS proxies. If you need to cover more traffic, check TUN permissions, routes, and DNS settings. Do not enable multiple proxy tools at once before the cause is clear.
View troubleshooting issues →A remote subscription update may replace the original configuration, so long-term rules should live in the client's overrides, merged configuration, or a separate rule provider. Before restoring them, compare the current configuration with a backup and confirm that the proxy-group names still exist. Add local changes section by section to avoid load failures caused by stale references.
View usage tips →Explore practical details beyond the main guides, starting with specific devices, proxy modes, and routing scenarios.
Using the common pattern of direct connections in mainland China and proxying traffic outside China, learn how rule order, proxy-group targets, and the MATCH fallback work together.
Read the full articleExplains how network permissions, background restrictions, and battery optimization interact, with a practical order for checking common interruptions.
Read the full articleCompare everyday browsing, temporary troubleshooting, and full-traffic testing to understand how the three modes forward connections.
Read the full article