Clash Manual: From Basics to Mastery

Clash is a proxy core that routes network traffic based on rules. Apps on your device hand their network requests to Clash, which checks each one against a rule list and decides: connect directly, route through a specific proxy node, or block it outright. Clash isn't a VPN service and doesn't ship with any nodes of its own — nodes come from your subscription, rules decide where traffic goes, and Clash's only job is forwarding and routing. Keep that in mind; every later chapter just fills in the details.

Core vs. Client: Who Does What

"Clash" actually refers to two layers. Underneath is the core: the original Clash core is no longer maintained, and the actively developed one today is Mihomo — formerly known as the Clash Meta core — which powers most of the desktop and mobile clients listed on our download page. On top of that is the GUI client: apps like Clash Plus, Clash Verge Rev, and FlClash wrap the core in an interface, handling node display, mode switching, and system proxy management. Don't overthink the core version when picking a client — mainstream clients all track Mihomo's stable releases.

Nodes, Subscriptions, and Config Files

A node is a proxy server you can connect through, typically using protocols like Shadowsocks, VMess, VLESS, Trojan, or Hysteria2 — the protocol determines how traffic is encrypted and disguised. A subscription is a link your provider gives you; the client periodically fetches the latest node list and recommended settings from it. A config file is a YAML document holding ports, DNS, nodes, proxy groups, and rules — it's the master blueprint Clash runs on. How they connect: the subscription supplies nodes, the config file organizes nodes and rules, and the core follows the config file.

Rule-Based Routing Is the Whole Point

Unlike traditional VPNs that route everything through a tunnel, Clash defaults to smart routing: local sites connect directly for speed, traffic that needs it goes through a node, and ad domains can be blocked outright. This runs on a rule list, with rules written by domain, IP, region, process, and more — covered in full in Chapter 6. Once you understand "rules are checked in order, first match wins," you understand how Clash works.

Each platform has a different lineup of clients, so pick your device first, then choose within that platform. Our download page lists every available client and installer grouped by platform, checked daily against official releases — this chapter is just here to help you decide.

Platform Lineup at a Glance

Top Pick: Clash Plus

Clash Plus is our top pick across every platform: it covers Windows, macOS, Android, and iOS, with the iOS version listed directly on the App Store — no self-signing or profile hassle required. It bundles subscriptions, modes, rules, and logs into one window, so newcomers can handle everyday tasks without learning config file syntax first. Find every platform's download at clashplus.io; iOS users should stick to the official App Store listing.

Picking Alternatives on Each Platform

On Windows and macOS, Clash Verge Rev is a long-standing desktop client that exposes the most settings, ideal if you like editing configs directly; FlClash uses the same interface across desktop and mobile, handy if you run multiple devices and don't want to learn two workflows; Clash Nyanpasu has a more modern look with equally thorough settings. On Android, Clash Meta for Android is the official mobile build maintained alongside the core, while Surfboard supports Surge-format configs. Linux has two paths: desktop users go with Clash Verge Rev or FlClash, while servers and routers run the Mihomo core directly — the download page's core section offers binaries for every architecture, keeping the Clash Linux client and the core cleanly separated.

Installation itself is straightforward on every platform — the details worth watching are the security prompts and permission dialogs each OS throws up. Here's the breakdown by platform; grab installers from the download page.

Windows

Grab the installer from the Windows section of the download page and run through the wizard. On first launch, Windows Firewall will ask whether to allow network access — check both private and public networks, or the local proxy port may get blocked. Once running, the client sits in the system tray, with the main window showing the current mode and node list. If your browser still isn't proxying after enabling the system proxy, check whether another proxy tool is already using the same port.

macOS

macOS has separate installers for Intel and Apple Silicon — check your chip under "About This Mac," then grab the matching build from the macOS section. Open the dmg and drag the app into Applications. If you see "can't verify developer" on first launch, go to System Settings → Privacy & Security and click "Open Anyway." Enabling the system proxy will prompt for your login password — that's the normal authorization for changing network settings.

Linux

Linux desktop users can grab a deb or rpm package from the Linux section and install it with their package manager; servers and routers don't need a GUI at all — just download the Mihomo core binary, set up config.yaml, and run it as a systemd service.

# Debian / Ubuntu: install the downloaded deb package (use the actual filename you downloaded)
sudo apt install ./clash-verge-rev_amd64.deb

# Core route: check Mihomo's running status
systemctl status mihomo

Android

On Android, install the apk from the Android section. When you first tap connect, the system shows a "Connection request" dialog — that's the VpnService authorization; check trust and confirm, and a key icon will appear in the notification bar. Android's proxy runs through the VPN service, so there's no separate system proxy toggle to flip; some manufacturer ROMs aggressively kill background apps, so add the client to autostart and background whitelists to avoid disconnects after the screen locks.

iOS

iOS only has one path: the App Store. From the iOS section of the download page, tap through to Clash Plus's store listing and install it — just approve adding the VPN configuration on first launch. iOS proxying also runs through the system VPN framework, so none of the old tricks like installing profiles or enterprise signing are needed.

What a Subscription Link Actually Is

A subscription link is a unique URL your provider assigns you; visiting it through your client fetches a config containing all your nodes. It usually embeds an account identifier, so whoever has the link can use your plan — never paste it into group chats, screenshots, or public repositories.

The General Import Flow

Every client's interface looks different, but the flow is the same four steps:

1. Copy the subscription link your provider gave you.
2. In the client's "Profiles" or "Subscriptions" page, create a new profile, paste the link, name it, and confirm.
3. The client downloads and parses the config — select it from the list as your active profile.
4. On the nodes page, pick a node, confirm the mode is set to "Rule," then turn on the system proxy on desktop or tap connect on mobile.

Right after importing, set the auto-update interval to 12 or 24 hours in the subscription settings — node changes and traffic resets will then sync automatically.

What a Config File Looks Like

What your subscription downloads is essentially a YAML file. Once you understand its skeleton, editing rules or turning on TUN later won't feel intimidating. Here's a minimal skeleton:

# Local listening port: browsers and the system proxy point here
mixed-port: 7890

# Working mode: rule / global / direct
mode: rule

# Log level: info is enough for daily use, switch to debug when troubleshooting
log-level: info

# External controller: the channel the client UI uses to talk to the core
external-controller: 127.0.0.1:9090

# The three main blocks — nodes, proxy groups, rules — get filled in automatically by your subscription
proxies: []
proxy-groups: []
rules: []

proxies lists your nodes, proxy-groups organizes them into switchable groups, and rules decide which group handles each request. A subscription's config usually already has hundreds of lines across these three sections — you don't write them by hand. What you'll actually edit is the rule order and group structure covered in Chapter 6.

The Three Modes Compared

Rule Mode Is the Everyday Default

Rule mode keeps local services fast with a direct connection while sending only the traffic that needs it through a node — it's the most hands-off and bandwidth-efficient setup. Global mode routes even local banking and streaming through the proxy, which is slower and can trigger anti-fraud flags — only use it briefly to check whether something is reachable at all. Direct mode effectively pauses the proxy without closing the client, useful for comparison testing.

The System Proxy Toggle

The desktop "system proxy" toggle does exactly one thing: point the OS's HTTP/HTTPS proxy settings at your local client port, usually 127.0.0.1:7890. Once enabled, any app that respects system proxy settings — most browsers included — automatically routes through Clash; apps that ignore system proxy settings — some command-line tools, games, and UWP apps — still connect directly, which is exactly the gap Chapter 7's TUN mode fills. macOS keeps this toggle in the menu bar, Windows in the tray or main window — same effect either way.

Launch at Startup and Staying Resident

Desktop clients all offer a "launch at startup" option, usually under the general settings tab. Once enabled, the core starts and the system proxy re-engages automatically at boot, no manual clicking needed. Laptop users should also enable "start silently" (if available) to stay resident without popping up a window. Combine startup launch with rule mode and Clash basically disappears into the background.

Match Order: Top to Bottom, First Hit Wins

When the core receives a request, it checks the rules list from the first line down, applies whatever policy the first matching rule specifies, and stops there — later rules are never checked. That makes rule order equivalent to priority: more specific rules go higher up, and the catch-all MATCH rule always sits at the bottom. The hundreds or thousands of rules bundled with your subscription are already ordered correctly; custom rules need to be inserted before them, or they'll never get a chance to fire.

Common Rule Types

A Readable Rule Example

rules:
  # Direct connection for localhost and the LAN
  - DOMAIN,localhost,DIRECT
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

  # Direct connection for known local sites
  - DOMAIN-SUFFIX,baidu.com,DIRECT
  - GEOSITE,CN,DIRECT

  # Direct connection for local IP ranges; no-resolve skips an extra DNS lookup for geolocation checks
  - GEOIP,CN,DIRECT,no-resolve

  # Everything else goes to the proxy group
  - MATCH,PROXY

How to read it: allow localhost and the LAN through first, then local domains and local IPs, and send everything else to the proxy as a catch-all. The no-resolve flag tells the core this rule doesn't need a DNS lookup first, which saves a lot of unnecessary queries.

Proxy Groups: How Nodes Are Organized

DIRECT, REJECT, and PROXY on the right side of a rule are all policies. DIRECT and REJECT are built-in policies, while names like PROXY come from Clash proxy groups — a proxy group bundles several nodes into one referenceable unit. There are four common types: select lets you pick manually, showing up as a clickable node list in the UI; url-test automatically picks the fastest by latency; fallback tries nodes in order and uses the first one that works; load-balance spreads traffic across multiple nodes. Groups can nest — a "Streaming" group can reference an "Auto-Select" group inside it, and rules only need to point to the outermost name.

proxy-groups:
  # Manual select: the default group — PROXY in the rules refers to this
  - name: PROXY
    type: select
    proxies:
      - AUTO
      - Node 1
      - Node 2
      - DIRECT

  # Auto latency test: checks every 300 seconds, picks nodes with low latency and less than 50ms of jitter
  - name: AUTO
    type: url-test
    proxies:
      - Node 1
      - Node 2
    url: http://www.gstatic.com/generate_204
    interval: 300
    tolerance: 50

In a real subscription, node names are defined by your provider — "Node 1" and "Node 2" above are just placeholders. To understand how latency numbers relate to real-world speed, read our blog post How Clash Latency Testing Works — low latency doesn't automatically mean fast speed, and there are more reliable ways to pick a node.

Layering Your Own Rules on Top of a Subscription

Editing the config downloaded from your subscription directly means it gets overwritten on the next update. There are three correct approaches: use the client's built-in "Override / Mixin" feature to inject your own rules into the config after every update; use a Clash subscription converter, which wraps a template around your subscription link and outputs a new link with your custom rules and groups merged in; or save the subscription config as a local copy and maintain it manually. The first two are low-maintenance; the third gives full freedom but loses auto-updates. For a handful of personal rules — say, direct connection for your office network, or a specific node for one site — overrides are the most practical option.

Where the System Proxy Falls Short

The system proxy only works for apps willing to read the OS-level proxy settings. Command-line tools, most games, some UWP apps, and certain dev-tool downloaders ignore it entirely — they still connect directly even in rule mode. TUN mode uses a virtual network adapter to capture all TCP/UDP traffic at the network layer, so it no longer matters whether an app cooperates — that's exactly why it exists.

How It Works, in One Sentence

Once TUN is enabled, the core creates a virtual network adapter, modifies the routing table, pulls in all system traffic, and routes it through the same rule list. Because it touches routing and networking directly, Windows needs service mode or admin privileges, macOS and Linux need explicit authorization; Android and iOS already handle this at the system level through their VPN frameworks, so the concept doesn't really apply to mobile.

How to Enable It, With a Reference Config

Mainstream desktop clients have a TUN toggle in settings — flip it on and follow the authorization prompt. If you're editing the config by hand, here are the relevant fields:

tun:
  enable: true
  stack: mixed            # Protocol stack: mixed offers the best compatibility
  auto-route: true        # Automatically update the routing table
  auto-detect-interface: true
  dns-hijack:
    - any:53              # Capture all DNS queries to prevent leaks

Things to Watch Out For

• TUN and the system proxy can run at the same time, but in most cases one is enough — running both won't double-proxy your traffic; it's still only processed once.
• Once enabled, all system DNS queries go through the core — pair it with proper dns settings to get the full benefit, as covered in Chapter 9's advanced topics.
• Some security software watches for routing table changes — add the client to its trusted list if you hit a conflict.
• Turn TUN off when you don't need full takeover — it saves power and removes one more potential point of failure.

Updating the Client

Client updates matter mostly because of the core underneath: new protocol support, routing fixes, and security patches all ship with core updates. Our download page checks official releases daily, and version numbers on each client card are pulled live from the release list — check back every few months and install whatever's new. Installing over the top won't wipe your subscriptions or settings, but back up your config before jumping across major versions.

Updating Your Subscription

A subscription is a living resource: nodes come and go, and traffic quotas reset. Set the auto-update interval to 12–24 hours and let the client handle the rest. If nodes suddenly stop working en masse, the first move is to manually refresh the subscription — providers often switch endpoints, which leaves every node in your old config timing out.

Testing Speed and Picking Nodes

The latency number in your client is a single handshake's round-trip time — it tells you "how far," not "how wide the pipe is." A more reliable way to pick a node: first check whether latency is stable across a few tests, then actually open the site you want to use and judge the real experience, checking peak and off-peak hours separately. Our blog post How Clash Latency Testing Works breaks this topic down in full.

Follow a Fixed Checklist When Something Breaks

"Clash won't connect" is the single most common issue — work through this order and you'll pin it down nine times out of ten:

1. Is the system proxy or VPN actually enabled, and is the port taken by another proxy tool?
2. Is the current mode set to Rule, and did global or direct mode get switched on by mistake?
3. Is the current node actually working — try switching to a different one.
4. Manually refresh the subscription to rule out mass node failure.
5. Has the DNS configuration gotten messed up — try restoring the subscription's default DNS settings.

For detailed steps on each check and more edge cases, see the Troubleshooting section of the FAQ and the blog post Clash Not Connecting: A Troubleshooting Checklist — a step-by-step guide you can work through top to bottom.

Reading the Logs

If you're still stuck after step three, the logs are your best evidence. Temporarily bump the log level to info (leave it on warning normally — debug generates too much noise, so only turn it on briefly while reproducing the issue), and watch for three common patterns: dial tcp ... i/o timeout means the node can't be reached — switch nodes and refresh your subscription; lines pairing match with use proxy spell out exactly which rule a request hit and which exit it took — when routing doesn't behave as expected, the answer is almost always in one of these lines; and port already in use means another app has already claimed the listening port — go back to step one of the checklist and resolve the port conflict.

• Clear the log before reproducing the issue — mixing old and new entries is the easiest way to misdiagnose things.
• Filter active connections by domain in the client's connection panel to see exactly which app is using which link.
• Cross-check the node names in the logs against your subscription page to confirm the matched proxy group is the one you expected.

One last habit worth building: a monthly checkup. Pick a spare few minutes once a month and confirm the client has no pending update, check your subscription's expiry date and remaining traffic, verify that rule matches still line up with how you actually use things (especially for newly installed apps that might be exiting through the wrong path), and make sure TUN mode and startup launch are still set the way you expect. The whole thing takes under ten minutes but heads off almost every "it suddenly broke" moment before it happens — after all, any single link failing quietly in the proxy chain shows up the same way: "no internet." While you're at it, export a copy of your config to local storage or the cloud — version number, subscription URL, and custom rules are all in there, so switching devices or reinstalling takes about ten minutes to get back to a familiar setup.

By the end of Chapter 8, everyday use should be frictionless. The four directions below go deeper, in recommended order, each backed by more material on this site.

DNS Deep Dive

DNS decides which IP a domain resolves to, which in turn affects GEOIP rule matching; get it wrong and you risk a DNS leak — proxy on, but queries slipping out through your local ISP's resolver in plain sight. Mihomo's dns section supports dual nameserver/fallback paths, fake-ip acceleration, and DNS hijack listening — not many fields, but the combinations matter. Our blog post Clash DNS Configuration Explained breaks down each field with two ready-to-use examples, and Clash DNS Leak Testing and Fixes walks through the full detection and hardening process.

Multi-Device Setup and Config Sync

Using Clash across phone, laptop, and tablet at once is the norm. The subscription link itself syncs naturally — each device just pulls its own copy; what actually needs syncing are your custom bits: personal rules, group preferences, override templates. There are two workable approaches — private config hosting or manual export/import — and our blog post Syncing Clash Config Across Multiple Devices covers the trade-offs and pitfalls of each.

Rule Sets and the Community Ecosystem

Once hand-written rules stretch past a few hundred lines, it's time for a different approach: RULE-SET turns grouped rules — like "Streaming" or "Ad Domains" — into referenceable external files, while GEOSITE databases provide ready-made domain lists by category. Subscription conversion tools can wrap a template around your subscription, unifying output across multiple providers and devices. All of these components live in the open-source community, and the release pages of clients and cores remain the most reliable source of information.

Ports, LAN Sharing, and Remote Control

A few global fields near the top of the config file are worth understanding. mixed-port is the combined HTTP/SOCKS listening port that the system proxy points to — if you change it, remember to update the system proxy setting too, or you'll get the confusing symptom of "the client's running but no traffic is coming through." With allow-lan enabled, other devices on the same network — phones, TVs, game consoles — can point their proxy settings at this machine and share the same nodes and rules; be sure to pair it with bind-address to restrict it to your local subnet, and never enable it on public networks like a café or hotel. external-controller exposes a local control API that, paired with a web dashboard, lets you switch nodes, view connections, and change modes remotely — nearly a must-have when running the core on a router or NAS. Always set a secret password when enabling it, and keep the listening range restricted to a trusted subnet. All three fields control your exposure surface: open ports only to devices that need them, keep control interfaces to yourself — this is just as important a security habit as writing good routing rules.

Keep Reading on This Site

Stuck on a concept? Check the glossary for short definitions of terms like proxy groups, fake-ip, and TUN; stuck on a task? Check the FAQ, organized into four categories from installation to troubleshooting; want deep dives on specific topics? Browse the blog. Haven't installed a client yet? Head back to the download page, grab the right build for your platform, and revisit Chapter 2 to find your fit.