Choose a client for your platform, then set up subscription import, rule-based routing, and proxy settings.
The settings interface is an illustration. Port values depend on your local client settings. Clash Verge Rev is for desktop systems; use a compatible client on mobile.
Separate how traffic enters the core from how it is routed afterward. System Proxy and TUN control traffic capture; Rule, Global, and Direct determine how captured traffic is handled. These are separate settings.
mode: rule
rules:
- DOMAIN-SUFFIX,example.com,DIRECT
- IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
- MATCH,PROXYPROXY is an example policy group name. It must be defined in the configuration.
Rule-based routing chooses an outbound connection based on conditions such as the domain or destination address. It works well when you need to access local services alongside sites that require a proxy. Select Rule in the client's proxy mode, then check the active order on the Rules page. The core evaluates rules from top to bottom and stops at the first match; LAN direct rules usually belong above the final catch-all. The example's PROXY must refer to an existing policy group—copying the rule without defining the group is not enough. Global mode sends traffic through one global policy instead of applying this rule list. TUN changes how traffic is captured; it does not replace the rules.
See how to choose a mode →TUN captures traffic through a virtual network interface, including traffic from apps that ignore the system proxy. Install the required service or grant permissions as prompted by your client, then enable TUN in settings. Choose mixed, system, or gvisor for stack if supported by your core. auto-route configures routes; dns-hijack captures matching DNS requests, so enabling a virtual adapter alone may leave DNS traffic unhandled. Unlike the system proxy, TUN changes system routing and can conflict with other VPNs. For troubleshooting, disable other traffic-capture tools first, then check rule matches while keeping Rule mode enabled.
Troubleshoot TUN and routing →This URL illustrates the format only; it is not a working subscription.
Subscription management fetches a remote configuration and saves it locally; it does not turn on proxying. Paste the full URL from your provider on the Subscriptions page, import it, select the configuration, and set an update interval. The example updates once a day; follow your provider's limits. Subscription URLs may contain credentials, so don't include them in screenshots or public logs. If an update fails, check whether the response is a configuration file rather than a login or error page. A configuration that still works locally does not mean its remote URL is valid. Save custom rules using an override or merge feature to avoid losing manual changes on the next update.
See the auto-update guide →The format for bypass addresses varies by operating system.
System Proxy writes the local proxy address to your operating system settings, allowing apps such as browsers that honor those settings to connect to the mixed port. After enabling it in the client, check that the address and port shown by the system match the core's listening settings. The operating system uses bypass addresses to decide which destinations skip the proxy; these are separate from the core's direct-routing rules. Command-line tools, games, and apps with their own proxy settings may ignore the system proxy, so configure them separately or use TUN. Before closing the client, exit normally and confirm the system proxy has been restored to avoid apps connecting to a local port that is no longer listening.
System proxy FAQ →The mixed port is where apps connect to the proxy; the external controller address is for managing the core from the client interface. They are not interchangeable. After changing the mixed port, check browser extensions, terminal environment variables, and any apps with manually configured proxy addresses. The switches shown in the settings illustration explain what each option does; they do not indicate that it is enabled on your device.
If a site won't load, first confirm that a configuration is selected and the core starts successfully. Then check whether System Proxy or TUN is capturing traffic. Next, inspect the connection's matched rule and policy group, then check DNS. Change one setting at a time and retest to identify what made a difference. Switching to Global mode can help isolate a routing issue, but it won't fix a port conflict, invalid subscription, or system DNS problem.
Open the download center for your operating system, then check the CPU architecture and system requirements. The client provides the interface; the core handles connections and rules. Whether a configuration can be transferred also depends on the fields and features supported by the target client.
Start with Clash Plus, or choose Clash Verge Rev, FlClash, or Clash Nyanpasu. Check your system architecture before installing. For first-time setup, configure the standard system proxy first, then enable the TUN service if needed.
Clash for Windows is no longer maintained. When migrating an old configuration, keep the original subscription URL and custom rules, then check the port and service mode. Don't overwrite the new client's entire configuration directory.
Go to DownloadsChoose the right installer for Apple Silicon or Intel. The download center lists Clash Plus, Clash Verge Rev, and FlClash, and notes the maintenance status of ClashX Meta to help with migration from older clients.
If first launch requires system permissions, verify the installation source before following the system prompts. System Proxy applies to a network service; after switching between wired and Wi-Fi, check in Network settings that the proxy still matches the client.
Go to DownloadsChoose Clash Plus, Clash Meta for Android, FlClash, or Surfboard based on your needs. Check configuration compatibility: a subscription URL opening successfully does not mean every client can use it.
The first connection usually requires VPN permission. If the connection drops when the screen locks, check battery optimization and background activity restrictions. If another VPN is running, stop it before testing traffic capture in the current client.
Go to DownloadsUse the download center to open the Clash Plus App Store page, or visit clashplus.io for product details. After installing, import a compatible configuration and allow the VPN configuration when prompted by the system.
Mobile traffic capture is constrained by the operating system's network extension model, so desktop steps for installing services, setting mixed ports, and launching at startup do not apply. Before connecting, check the active configuration and policy, then confirm that the app can reach its destination.
Go to DownloadsFor desktop use, choose Clash Verge Rev or FlClash and select the package format for your distribution. Servers and routers typically run the mihomo core directly, so you'll need to manage the configuration directory, startup service, and forwarding rules yourself.
Enabling System Proxy in a desktop client does not guarantee that command-line tools will use it. Configure proxy environment variables for terminal programs that support them. With TUN, also check permissions, routes, and DNS to avoid conflicts with existing network management services.
Go to DownloadsNot sure which client to choose? Start with your platform, configuration format, and whether you need TUN, then compare the interface and configuration tools. Don't confuse an older client name with the core: apps in the Clash ecosystem may use different core implementations and update schedules.
View all clients → Read the client selection guide →For your first setup, establish a connection path you can test and repeat before adding auto-updates, launch-at-startup settings, or custom rules. Installing a client does not provide a usable configuration, and this site does not offer proxy subscriptions.
Open the Subscriptions or Configurations page, paste the full URL from your provider, and select the configuration after import completes. For a local YAML file, check that its encoding and indentation are valid. Seeing the configuration name is not enough—make sure the core loads it successfully. A parse error or missing policy group reference won't be fixed by toggling System Proxy.
For everyday use, start with Rule mode, choose an outbound in the appropriate policy group, then enable System Proxy. Configure TUN only if an app ignores the system proxy. Global mode and TUN are separate features; you don't need to enable both. If multiple proxy clients are running, disable System Proxy and virtual adapters in the others to reduce port and routing conflicts.
Test both sites that require a proxy and local network services, then check connection logs to confirm the matched rule and policy. If only one app fails, check its own proxy settings first. If all apps fail, troubleshoot in this order: port, traffic capture, rules, then DNS. Once everything works, set the subscription update interval and save any custom overrides so you can restore them after an update or migration.
Distinguishing project names, core implementations, and client interfaces helps you assess configuration compatibility and update scope. The repository command below downloads mihomo source code; it does not install a client or provide a subscription.
The Clash ecosystem includes cores, desktop interfaces, and mobile apps—not one installer for every operating system. Although some earlier clients are no longer maintained, the community continues to develop other interfaces and core implementations. The end of updates for Clash for Windows does not mean the entire ecosystem has stopped evolving, nor does it give the old client automatic support for new protocols. Check a project's current maintenance status when choosing a client, rather than relying on a familiar name.
mihomo handles configuration parsing, protocol connections, rule matching, and DNS. Graphical clients such as Clash Verge Rev add subscription management, settings, and system integration. A feature's availability depends both on core support and on whether the client exposes the relevant setting. A button's location in one desktop interface is not a configuration standard. When following a guide for another client, match the meaning of each field instead of looking for an identical menu.
Open-source repositories let you inspect implementations, commit history, and known issues, helping determine whether a behavior is caused by a configuration error or a feature limitation. When reading issue discussions, distinguish the operating system, core, and client. For a useful report, include the error type, reproduction steps, and a redacted configuration—but remove subscription URLs, credentials, and personal network details. Share only the log excerpts needed to diagnose the issue, not the full configuration.
A client update can change the interface, system integration, or bundled core. A subscription update fetches remote configuration from your provider. They have different update paths and failure causes. Before switching clients, note your current mixed port, TUN settings, and custom rules. Before updating a subscription, make sure local changes are saved in a merge or override configuration. After an update, check what is actually active; a success message alone does not confirm a complete migration.
Choose what to check based on the symptoms, then follow the relevant settings path. Subscription parsing failures, DNS issues, and “connected but can't load websites” happen at different stages; reinstalling the client repeatedly won't solve them all.
Start by checking the URL format and response, then verify YAML syntax and server status. Distinguish an empty response, a login page, and unsupported fields to avoid mistaking a subscription content issue for a client installation failure.
Read article →Learn how DNS upstreams, fallback behavior, and enhanced modes work. Understand DNS hijacking in the context of traffic capture, confirm which resolver receives requests, then decide whether to change the relevant configuration fields.
Read article →Narrow down the cause in this order: System Proxy, port conflicts, proxy mode, rule matching, and DNS. Change one condition at a time, retest against the same destination, and keep only the log details needed to explain the issue.
Read article →For a step-by-step diagnosis, see the Troubleshooting manual. For your first connection, follow the subscription import guide. The Help Center covers core concepts and common settings, so you can check terminology before changing your configuration.