Windows
Start by comparing Clash Plus, Clash Verge Rev, FlClash, and Clash Nyanpasu. After installing, import your configuration and enable the system proxy. TUN may require additional services and permissions.
Clash Meta · Mihomo Core
Mihomo Downloads
Choose a client by platform and learn about subscription setup, routing rules, and network settings.
Open SourceDocumentationYAML Configuration
Configuration Reference
Proxy Modes and Rule Configuration
First, understand how traffic enters the core; then choose its outbound route. These interface examples illustrate settings and do not change your device.
Rule, Global, and Direct
Proxy mode determines how connections handled by the core choose an outbound route. For everyday use, Rule is usually the right choice: rules route services in mainland China, services outside mainland China, and custom domains separately. Global sends connections through the global policy, which can help diagnose whether routing rules are affecting access. Direct uses a direct connection. Changing modes does not enable the system proxy or automatically route every app through the core. First make sure the client is handling traffic from the app you want, then check the matched rule and proxy group in the connection list. Controls vary between clients, but the modes work the same way.
mode: rule
RuleGlobalDirect
Rules are checked from top to bottom; the first match wins
Routing rules map domains, destination addresses, or process conditions to a policy. Mihomo checks rules in order and uses the corresponding outbound route as soon as one matches. Put specific custom rules before broader ones, and place the fallback MATCH rule last. DOMAIN-SUFFIX matches domain suffixes; GEOSITE and GEOIP rely on their respective data sets; RULE-SET references a rule provider. Policy names in rules must exactly match the names of configured proxy groups. To troubleshoot, check the matched rule in the connection log, then verify data updates and rule order. A website loading—or failing to load—does not by itself prove that a rule is working.
rules:
- DOMAIN-SUFFIX,example.com,PROXY
- GEOIP,CN,DIRECT
- MATCH,PROXYRule target and actual outbound route
Proxy groups sit between rules and proxy nodes, so rules do not need to point to a specific node. A select group lets you choose manually; a url-test group chooses an outbound route based on configured probes; a fallback group checks availability in order. Start with select groups to create a clear path, then add automatic selection if needed. Every referenced node or proxy group must exist, and its name must match exactly. If an outbound route disappears after a subscription update, check where the group gets its members. Automated probe results apply only to the test target and do not represent performance across all sites or services.
proxy-groups:
- name: PROXY
type: select
proxies:
- DIRECTThis example shows only the group structure. In practice, add outbound routes defined in your configuration.
Handle apps that ignore the system proxy
TUN routes traffic through a virtual network interface, making it useful for apps that cannot be configured to use an HTTP or SOCKS proxy directly. Before enabling it, make sure the client has administrator privileges or the required service installed, and check whether another virtual interface, VPN, or routing tool is already managing network traffic. TUN handles traffic entry; modes such as Rule still determine the outbound route. They are not alternatives to each other. If LAN services become unreachable, check route exclusions and DNS instead of routing all traffic through a proxy. First confirm that the system proxy works, then enable TUN separately to make new issues easier to isolate.
tun.enable: true
tun.auto-route: true
DNS Resolution and Connection Mapping
DNS settings affect how domains resolve and whether the core can retain domain information for routing. Fake-IP returns a mapped address from a reserved range to the app, then the core uses that mapping to handle the actual connection. redir-host returns the resolved IP address. Some LAN, gaming, or address-dependent services may need separate settings; use fake-ip-filter to exclude their domains. When choosing upstream resolvers, also consider the outbound route for DNS requests and bootstrap resolution to avoid circular dependencies. Enabling Fake-IP alone does not guarantee the DNS path behaves as expected; check system settings and logs as well.
dns:
enable: true
enhanced-mode: fake-ip
fake-ip-filter:
- "*.lan"
- "localhost"Manage Remote Subscriptions Separately from Local Changes
A subscription URL may return a complete YAML configuration or just proxy nodes. Check that your client supports the format before importing it. A complete configuration usually includes proxies, proxy groups, rules, and DNS; a node-only subscription needs to be used with a client template or proxy provider. Updating a remote subscription can overwrite local changes, so use the client's override, merge, or custom-rule features where available. If import fails, first verify the URL, then check the response content and the parse location in the logs. Subscription URLs often grant access to an account; keep them secure and redact sensitive parameters when reporting issues.
# Common configuration sections; actual content comes from the subscription and overrides
proxies: []
proxy-groups: []
rules:
- MATCH,DIRECTMihomo is the core; the client provides the interface. Clients organize configuration management, startup options, system proxy controls, and log viewing, while the integrated core handles rule parsing and connection forwarding. When using the same configuration in different clients, check core support, configuration directories, and client-specific overrides.
Read the complete guide, from basics to advanced topics →
Platform Downloads
Clash Client Downloads
Choose your operating system first, then check your processor architecture. The download center lists available clients, installation options, and maintenance status; installers are not hosted directly on the homepage.
macOS
Choose the installer for Apple Silicon or Intel. First launch may involve macOS security prompts, helper services, or network permissions. Follow the client's instructions and avoid repeatedly installing builds for different architectures.
Android
Choose a client such as Clash Plus, Clash Meta for Android, or FlClash for your device architecture. Confirm the system VPN permission when connecting. If the connection drops in the background, check battery optimization and background activity restrictions.
iOS
Go to the Clash Plus App Store page through the download center, or visit the official site at clashplus.io. After importing your subscription, follow the system prompt to allow a VPN configuration. Features vary by client; see its documentation for details.
Linux
Desktop users can compare Clash Verge Rev and FlClash, then choose a package for their distribution. For servers or routers, see the Mihomo core section and manage configuration directories, service startup, and network permissions yourself.
Installer compatibility and configuration compatibility are separate concerns. Processor architecture determines whether an app can run; configuration format and core capabilities determine whether it can load a subscription correctly. Archived clients are useful for compatibility reference, but are not recommended as the default for long-term use. If you haven't chosen a client yet, read the selection guide before downloading for your platform.
Setup Steps
Import a Subscription and Verify the Connection
For your first setup, follow the shortest path to a working connection. Check the result after each step; don't change proxy mode, DNS, and routing all at once.
Install a Client and Import a Subscription
Install a client that matches your device, then add the subscription URL from its configuration or subscription screen. Once the download and parsing are complete, select the configuration for use. If you see a format error, check the subscription type before troubleshooting the network.
Subscription import guide →Choose a Policy and Traffic Entry Point
Select Rule mode and choose an available outbound route in the main proxy group. On desktop, enable the system proxy; on mobile, grant VPN permission when prompted. Once your browser connects successfully, enable TUN if you need to handle apps that ignore the system proxy.
System proxy setup →Check Connection Logs
Visit sites that should use a direct connection and sites that should use a proxy. In the connection list, check the domain, matched rule, and outbound route. If there is no record, check the traffic entry point first. If a record exists but access fails, check the selected outbound route, DNS results, and error logs.
Connection verification guide →Before closing the client, check whether the system proxy has been restored. Changing networks, waking from sleep, or switching between wired and wireless connections can affect routing and DNS state. Keep a working configuration and any necessary local overrides. When something goes wrong, check the traffic entry point, rules, outbound route, and DNS in that order; this is usually easier than reinstalling.
View the complete guide →
Open-Source Projects
The Mihomo Core and Client Ecosystem
Refer to project source code, configuration docs, and release notes. Similar client names do not necessarily mean the same maintainers, core implementation, or feature set.
How Clash Meta and Mihomo Are Related
The Mihomo project was previously known as Clash Meta, so older guides, subscription notes, and client descriptions may still use the name Clash Meta. When reading them, distinguish the project's name history from the configuration features available today. Check the current core documentation to confirm whether a field is supported rather than relying on the client name.
The Core and GUI Clients: Different Roles
Mihomo is written in Go and released under the GPL-3.0 license. GUI clients add interfaces for subscription management, proxy selection, and system integration. This site brings together download links and configuration guides; each project maintains its own source code and release history. Client app store listings and core repositories are separate sources.
Release Notes and Bug Reports
The core, clients, and rule data each have their own release schedule. Before upgrading, read the relevant project's changelog, save your current configuration, and note your client settings and local overrides. When reporting a regression, include your operating system, reproduction steps, relevant redacted configuration, and error logs. This makes it easier to identify the affected layer than simply saying the connection doesn't work.
Trust Boundaries for Configurations and Subscriptions
Open-source code makes implementations available for review, but does not replace evaluating where a configuration comes from. Subscriptions may include proxies, rules, resolvers, and remote resource URLs; understand their source and purpose before importing them. When sharing logs, hide subscription URLs, account details, and internal network addresses. Share only the configuration fields needed to reproduce the issue.
Guides and Tips
Configuration Concepts and Troubleshooting
Go beyond the basics with guides to DNS modes, subscription parsing, and platform permissions. First identify which step is failing, then adjust the relevant setting.
Fake-IP vs. redir-host: Mihomo DNS Enhanced Modes Explained
Learn how Fake-IP uses reserved address ranges to speed up connection setup and what fake-ip-filter does, so you can choose the right mode for games, LAN, and internal network services.
Read article → Fake-IP vs. redir-hostSubscription Parse Errors: Check Expired Links, Invalid Formats, and Network Issues
Break down subscription import errors into three causes: an invalid link, a response that isn't YAML, or a blocked request. Follow the checks for browser verification, log inspection, and changing the User-Agent.
Read article → Subscription parsing troubleshootingmacOS Clash Client Permissions: Network Extension Access and Keychain Prompts
A guide to macOS first-launch security alerts, helper installation, network extension approval, and Keychain password prompts, with the relevant System Settings locations and steps to recover if access is denied.
Read article → macOS client permissionsFor rule syntax and complete routing examples, see the dedicated guides. To quickly look up configuration terms, start with proxy groups and subscription formats in the glossary, then compare them with your connection logs. This helps distinguish traffic interception issues from rule errors.
View all articles →