Use a desktop client to manage subscriptions, the system proxy, and TUN. Check your device architecture and system requirements before installing. Browsers may use the system proxy, but terminals and some games may not. For broader traffic routing, check TUN permissions and routes. Clash for Windows is no longer maintained and is listed separately as an archived option on the download page.
mihomo Core · Clients for Every Platform
Clash Official Site Client Downloads & Routing Rules
From subscription imports to routing rules, choose a client for your platform and check settings along the traffic path.
Open-Source Core
English Guides
Step-by-Step Troubleshooting
CLIENT SELECTION
Clash Downloads by Platform
Check your operating system and processor architecture, then choose a client. The download page lists installation links, system requirements, and maintenance status.
Desktop and mobile clients have different interfaces, but the setup process is similar: import a working subscription, enable the profile, choose a proxy group, and set how traffic is routed. New users can start with the Clash Plus platform links; Linux users can compare Clash Verge Rev and FlClash. If your current client works, there’s no need to migrate just because another one has a different name.
Choose the installer for your Apple Silicon or Intel processor. On first launch, grant the permissions required by macOS, then import your subscription. This helps distinguish permission issues from node problems. When using the system proxy, check whether your network location or another network utility is overriding the setting. After closing the client, confirm that the system proxy has been restored. ClashX Meta is no longer maintained, so consider future compatibility when choosing a client.
Check your processor architecture before installing, and allow the VPN connection when prompted on first launch. Android typically routes traffic through a VPN service, so desktop system-proxy instructions do not apply. If the connection drops when the screen locks, check battery optimization, background activity permissions, and conflicts with other VPN apps before switching nodes. If you need per-app routing, first confirm that your client supports it.
Open the Clash Plus App Store listing from the download page, and visit the official site at clashplus.io. After installing, follow the system prompt to allow a VPN configuration, then import a subscription compatible with the client. Apps may support different rule syntax, so a configuration file’s extension alone doesn’t guarantee compatibility. If an import fails, check the subscription format and the exact error first.
On desktop, start with a graphical client. For servers and routers, consider running mihomo directly. During installation, check the distribution package format, processor architecture, and permission requirements. Command-line programs may not use the desktop system proxy. When managed by systemd, the configuration directory, service user, and logs also differ from a desktop launch; troubleshoot the actual service environment.
RULE ENGINE
Clash Routing Rules
Start with specific domain rules, followed by regional and fallback rules. mihomo typically checks rules in order and sends matching traffic to the specified policy. Put specific domains before broader rules to prevent them from being matched too early. Policy names in the configuration must match defined proxy groups; otherwise, the configuration may fail to load even if its YAML syntax is valid.
Keep a working configuration for everyday use and change only what you need. After editing, check the connection log for the matched rule and final outbound route instead of relying on the mode toggle. Fake-IP uses synthetic addresses to maintain domain mappings; it does not force every request through a proxy. The route depends on rules, DNS, and the scope of traffic capture. The snippet on the right illustrates rule order only; add it to your existing complete configuration.
View the routing rules guide →config.yaml / rules
# PROXY must be defined in the full configuration
rules:
- DOMAIN-SUFFIX,example.com,PROXY
- GEOIP,CN,DIRECT
- MATCH,PROXYDomain rules → Regional rules → Fallback policy
PROXY GROUPS
Proxy Groups and Node Selection
Rules decide which group receives traffic; proxy groups decide which outbound route to use. A manual group works well for a fixed region or sessions that need a consistent route. A URL-test group chooses based on test results, while a fallback group checks configured routes in order for an available option. Each automatic strategy has its own criteria; none guarantees the fastest download speed in every situation.
Test that a node works with a manual group before setting up automatic selection. This helps separate configuration errors from speed-test issues. Compare nodes by exit region, traffic multiplier, access to the services you need, and real-world performance. A single latency reading depends on the test endpoint and network conditions, so it can’t represent every website. For apps with sensitive login sessions, a stable route is often better than constantly chasing the lowest latency. Keep a tested backup option, too.
Compare three automatic proxy group types →Test one outbound route before setting up automatic selection.
TRAFFIC CAPTURE
TUN and System Proxy Settings
The system proxy is easy to configure and works with apps that honor system proxy settings. It also makes it easier to see how requests enter the core. TUN uses a virtual network interface to route traffic covered by its routes. It can handle apps that ignore the system proxy, but requires attention to permissions, DNS, routing, and other network software. These are traffic entry methods, not modes equivalent to rules or global routing.
Start by testing a browser with the system proxy, then enable TUN if needed. If the browser works but the terminal connects directly, check whether the terminal uses proxy environment variables before changing the subscription or reinstalling the client. If TUN disrupts local network access, check route exclusions and DNS rather than repeatedly switching nodes. The static settings mockup on the right illustrates traffic capture options; it does not show the current state of your device.
Troubleshoot the system proxy →TRAFFIC / Settings Preview
System ProxyShown as On
TUN ModeShown as Off
Routing Moderule
First confirm that traffic reaches the core, then check which rules match.
PROFILE MAINTENANCE
Subscription Updates and Configuration Maintenance
After importing a subscription, confirm that the profile is selected and that its nodes and proxy groups appear. A successful update means the content was fetched and processed; it doesn’t mean every node can connect. Select a node and test access to your target. Set an update interval that balances your provider’s requirements with battery use and network conditions; avoid repeated refreshes just to get the latest content.
Remote profiles, local overrides, and rule sets may update independently. Keep important changes in the client’s persistent override feature, if available, so a subscription refresh won’t overwrite manual edits. If an update introduces unknown fields or missing policies, save the error and your last working backup, then check compatibility one item at a time. The four options below explain different operating modes: the first three control routing policy, while TUN changes the traffic entry method. Clients usually configure these separately.
Learn how to import a subscription and test connections →PROFILE / Settings Guide
Auto-Update IntervalSet as Needed
Local OverrideManaged Separately
Rule: Route Traffic by Policy
Requests match the configured rules in order, then go to the corresponding proxy group or use a direct connection. This works well for everyday use when some services should connect directly and specific destinations should use a proxy. To verify the route, check the connection log for the rule type, policy name, and final node. If a request never reaches the core, changing rules won’t help. Compared with global mode, rule mode lets you route destinations separately but depends more on rule order and domain information. Keep the subscription’s default rules at first, then add custom rules only as needed to make changes easier to trace.
Global: Test One Outbound Route
All requests that reach the core are handled by the global policy. Use this mode temporarily to check whether routing rules are causing a problem. Confirm which outbound route the global group uses; global mode does not automatically capture traffic from every app on your device. If global mode works but rule mode doesn’t, compare the matched rules and proxy groups. If both fail, check the node, subscription, and network. Restore rule mode after testing to avoid routing local-network or normally direct traffic through a proxy long-term.
Direct: Check the Base Network
Requests that reach the core connect directly. Use this mode to check whether the base network works or to compare access through the local network with access through a proxy. Direct mode doesn’t mean the client is closed or that its virtual network interface is disabled. DNS requests may still be affected by the core’s configuration. If the connection works after closing the client but fails in direct mode, check DNS and routing rather than only checking the node. Test a destination that should be accessible on your local network, then restore the previous mode.
TUN: Capture More Traffic
TUN provides a virtual network interface that can be used with rule mode; it is not a fourth routing policy. It can capture traffic from apps covered by its routes, depending on system permissions, automatic routing, DNS interception, and exclusions. Before enabling it, verify that a regular proxy connection works. Afterward, test websites, terminal traffic, and local network devices separately. If there’s a conflict, disable other VPNs or similar traffic-capture tools first. Follow the client’s instructions if administrator access is required; not every network issue is caused by the subscription.
OPEN SOURCE / MIHOMO CORE
Open-Source Core and Client Ecosystem
Separate the client, core, and service provider to understand which component controls a feature and what an update may affect.
Clash Official Site
Client downloads and technical guides
Clash, mihomo, and Graphical Clients
The Clash ecosystem includes legacy projects, actively developed core forks, and graphical clients built around those cores. mihomo is an open-source proxy core that handles network connections, rule matching, DNS, and policy processing. Clients such as Clash Verge Rev add subscription management, tray controls, system proxy settings, and permission integration. Different interface labels don’t necessarily mean the underlying rules work differently, and similar-looking interfaces don’t guarantee support for the same features.
When reading a guide, first check whether it covers core fields or client controls. The client must pass supported core parameters correctly for them to take effect; convenience options in a client may exist only in its own settings. Platforms such as iOS also have platform-specific networking APIs and implementation limits, so desktop feature lists don’t necessarily apply everywhere. Our client comparisons focus on these differences rather than simply listing software names.
Use Public Source Code to Understand Feature Support
Track how open-source projects evolve through their code, documentation, issues, and change history. If a new field won’t load, check which core your current client uses and consult the relevant documentation before deciding whether to upgrade. This site doesn’t base recommendations on unverifiable download counts or ratings. Maintenance status, platform support, configuration compatibility, and practical setup steps are more useful when choosing a client.
The command below downloads the mihomo source code for users who want to read or study its implementation; it isn’t required to install a client. Cloning the repository won’t configure your network or create a working subscription. Most users can go straight to the download page. If you plan to develop or build from source, check the repository’s build requirements and license.
Keep a Recoverable Configuration Before Updating
Clients, cores, subscriptions, and rule sets follow different update schedules. Client updates address interface and system integration issues; core updates affect protocols and rule behavior; subscription updates change nodes and policies; rule-set updates change which destinations match. Change one layer at a time and record what you test afterward. This makes problems easier to trace than reinstalling software, resetting DNS, and changing subscriptions all at once.
Before upgrading, save your working configuration and local overrides, and note the selected proxy group and whether the system proxy or TUN is enabled. After updating, first verify that the configuration loads, then test common destinations and local network access. When reporting an issue, include your operating system, client name, reproduction steps, and redacted logs. Remove subscription URLs, credentials, personal domains, and other sensitive information. Don’t publish your full configuration or leave verbose logging enabled longer than necessary.
Compare clients by use case →CONFIGURATION NOTES
Clash Configuration and Deployment Guides
Continue with guides on proxy groups, node selection, and Linux deployment.
Get a basic connection working before setting up automatic switching or running a client in the background. Configuration snippets in these guides explain how parameters work together. Adapt them to your existing proxy group names, system paths, and permissions; don’t replace your entire remote configuration without reviewing it.
Clash Proxy Groups: url-test, fallback, and load-balance Explained
Compare how the three automatic proxy group types switch routes, their test settings, and when to use each. Includes a proxy-groups configuration example you can adapt.
Read the proxy group guide →How to Choose a Clash Node: Latency, Traffic Multipliers, Regions, and Protocols
Low test latency doesn’t always mean a node will work well. Compare traffic multipliers, exit regions, protocols, and use cases to choose reliable everyday and backup nodes.
Learn how to choose a node →Deploy mihomo on Linux: Desktop Clients and systemd Command-Line Setup
Install a graphical client on Ubuntu, Debian, or Arch, or use systemd to run mihomo at startup. Includes directory layout and permissions guidance.
Read the Linux deployment guide →