Find Windows, macOS, Android, iOS, and Linux clients in one place, then explore guides to the mihomo core, configuration files, rule-based routing, and troubleshooting.
Clash clients turn core capabilities into an interface you can operate. The four sections below cover the areas checked most often in daily use and highlight the boundaries that matter when configuring them.
01 · RULES
Match domains, IPs, and fallback rules in order
In rule mode, the key factor is not the number of rules but their order. Domain rules usually come before IP-based rules; ad categories, specific domains, and local-network addresses should be handled first, with MATCH catching connections that match nothing else. The client’s rules page helps confirm which rules are loaded and which policy group ultimately receives each connection.
When editing a configuration, check that rule names and policy-group names match exactly. A rule pointing to a nonexistent policy group can prevent the configuration from loading, while an overly broad rule placed too early may make later rules ineffective. Unlike basic proxy tools that only offer an on/off switch, Clash rule chains can combine domains, geographic data, and process conditions into a clear, auditable traffic path.
A system proxy writes the local proxy address to the operating system settings, making it suitable for browsers and desktop apps that actively read those settings. Terminal programs, some games, and software that manages its own connections may ignore them. If a browser works but the command line does not, first check whether the application follows the system proxy, then decide whether to configure environment variables or use TUN mode for broader coverage.
TUN mode takes over traffic through a virtual network interface, making it suitable when more applications need unified handling, but it also depends more heavily on permissions, routing, and DNS settings. There is no need to keep switching both modes on and off. Start with the system proxy, verify that the configuration and nodes work, then enable TUN when broader application coverage is needed. This makes troubleshooting easier.
System ProxyWrites to operating system proxy settings
TUN ModeHandles connections through a virtual network interface
Allow LAN ConnectionsAllows devices on the same network to connect
Mixed PortShared HTTP and SOCKS entry point7890
IPv6Depends on the current network environment
03 · DNS
Bring domain resolution into the same routing chain
When rules use domains as conditions, DNS handling directly affects the result. The client can let the core handle queries and choose a resolution path according to the rules. If the operating system, browser, and client use different resolution methods, domains may match unexpectedly, connections may bypass the proxy, or cached results may remain stale.
When troubleshooting a Clash DNS leak, do not rely on a single test page. First check the current mode, DNS switches in the configuration, the browser’s Secure DNS settings, and the system cache; then look for the corresponding queries in the logs. After changing nameserver, fallback, or fake-ip settings, reload the configuration and close existing connections before testing again. This helps distinguish stale caches, browser-level resolution, and core configuration issues.
Resolution must be checked together with rule mode, network conditions, and application behavior.
04 · LOGS
Use logs to trace connection flow
The logs should answer three questions: did the request enter the core, which rule matched it, and which policy was ultimately used? During troubleshooting, keep the log level at normal informational output and reproduce the issue once. More debug lines do not automatically produce clearer answers and may bury important connections. Narrowing the view by time, domain, and error keywords is usually more effective.
If the target connection is completely absent from the logs, the problem likely occurred before traffic reached Clash. Check the system proxy, TUN permissions, or the application’s own proxy settings. If the logs show the correct rule match but the connection fails, check the policy-group selection, subscription status, and target network. Reviewing the entry point, matching, and exit separately is more reliable than repeatedly changing nodes.
Installation formats, permission models, and system proxy behavior differ across platforms. The downloads page lists available clients, maintenance status, and system requirements for each platform; the homepage keeps only the quick links.
Windows
Ideal for everyday desktop use, with graphical clients such as Clash Plus, Clash Verge Rev, and FlClash. Import your configuration after installation, then enable the system proxy.
Choose the package for an Intel or Apple Silicon processor. On first launch, follow the system prompts to grant network-extension or proxy-setting permissions.
Mobile clients take over connections through the system VPN interface. After importing a subscription, keep the required background permissions enabled so the system does not stop the service prematurely.
Desktop users can choose a graphical client, while servers and router environments can deploy the mihomo core directly. Before use, confirm the architecture, service permissions, and configuration path.
There is no need to change complex parameters on your first run. Keep the default configuration, confirm the subscription contents and connection path, complete one verifiable basic connection, then adjust rules, DNS, or TUN as needed.
On the configuration page, paste a subscription URL or import a local YAML file. After the update completes, select that configuration and confirm that the client shows no loading errors. If the update fails, first check the link and network reachability; do not repeatedly add the same subscription.
02
Choose a Policy
Open the proxy page to review the policy groups provided by the configuration. Select a group manually to specify the exit directly; automatic-selection and failover groups use the testing logic defined in the configuration. Node names and counts come from the subscription—the client only reads and displays them.
03
Connect and Verify
Enable the system proxy first, then visit a target that clearly requires a proxy while watching the connections and logs pages. The basic connection is complete only after confirming that the request entered the core, matched the expected rule, and used the correct policy. Terminal programs require a separate check of proxy environment variables.
Open-Source Ecosystem
Cores, clients, and configuration formats
Clash is not the name of a single installer but a group of open-source projects built around rule-based routing, policy groups, and proxy protocols. Understanding how these projects relate helps keep the client interface, core capabilities, and subscription contents distinct.
Project Evolution
Early Clash established the basic workflow for configuration files, policy groups, and rule chains. Since then, community projects have continued developing desktop interfaces, mobile support, and core capabilities. Today’s clients may use different technology stacks, but many settings still share familiar concepts such as configuration, proxies, rules, connections, logs, and system proxies.
The mihomo Core
mihomo continues the feature direction of Clash Meta and is one of the most widely used compatible cores today. It reads Clash-style configurations and provides broader support for protocols, rule types, DNS behavior, and TUN options. The client downloads configurations, starts the core, and displays its status; the core performs the actual rule matching and connection handling. Whether a feature works depends on the client exposing an entry point, the core supporting it, and the configuration enabling it correctly.
Subscriptions and clients are independent
Subscriptions are usually generated by service providers and contain proxy information, policy groups, and rules. A client does not automatically fill in missing content, nor can it guarantee that every subscription format will load directly. When changing clients, focus on configuration compatibility, policy-group names, and provider-specific fields rather than comparing the interface alone. Configurations involving scripts, rule sets, and geographic data also require accessible resource paths.
Update Cycles
Graphical clients, the mihomo core, subscription contents, and geographic databases each follow separate update cycles. Updating the client does not update the subscription, and refreshing a subscription does not automatically change the core. When behavior differs, first identify which layer changed. Stable configurations do not need frequent edits; before upgrading, read the project release notes and keep a recoverable copy of the configuration.
Get mihomo source codegit clone https://github.com/MetaCubeX/mihomo.git
Choose a Client
Prioritize support for your current system, the core’s update process, configuration compatibility, and everyday workflow. Projects that are no longer maintained can help explain legacy configurations but should not be the default choice for a new installation.
Read the Configuration
YAML is sensitive to indentation and data types. Before editing, separate the port, DNS, policy-group, and rule sections. Reload the configuration afterward and check the error message.
Locate the Problem
Break the issue into four checks: whether the configuration loads, whether traffic enters, whether a rule matches, and whether the exit is available. Change only one variable at a time for more reliable conclusions.
Practical Notes
Recent Configuration and Troubleshooting Articles
Go beyond interface operations to core data, subscription refreshes, and first-connection verification. Each article starts with a specific problem and explains what to observe at every step.
Common Causes of Clash Subscription Update Failures and Automatic Update Intervals
Check link status, access paths, request identification, and configuration format step by step, with guidance on automatic update intervals and proxy selection during updates.
First Clash Connection: Choose a Node, Test Latency, and Verify the Proxy in Three Steps
Starting with the first connection after importing a subscription, this guide explains how to choose a policy, interpret test results, and confirm the traffic path through the connections and logs pages.