CLASH / CONFIGURATION INDEX
Choose a client for your platform, then explore YAML configuration, DNS resolution, and proxy group routing.
FIELD REFERENCE
The client imports, switches, and displays configurations; the core handles connections based on those settings. First, distinguish the listening endpoint, DNS behavior, and outbound target, then edit the relevant fields. Each snippet below illustrates one setting and should not be combined into a complete subscription. The example proxy group references only the built-in DIRECT outbound; proxy nodes must be configured separately.
mixed-port accepts both HTTP and SOCKS requests on the same port. It works well with browsers, command-line tools, and apps where you enter a proxy address manually. For local use, set the address to the loopback interface and make sure the port matches the running configuration. allow-lan controls whether devices on your local network can connect, but you must also check the listening address and system firewall. System proxy settings are written to the OS by the client; they do not guarantee that every app will use this port. To route other traffic, consider TUN mode as described in the guide.
mixed-port: 7890
allow-lan: false
mode: rule
log-level: infodns.enable controls the built-in DNS service, while enhanced-mode selects its enhanced resolution method. Fake-IP assigns virtual addresses to maintain the link between a domain and its connections, allowing rules to route traffic by domain. nameserver lists the upstream DNS servers. Enabling built-in DNS does not automatically send system queries to it; check TUN DNS hijacking or system DNS settings as well. To troubleshoot Clash DNS leaks, examine where requests actually go rather than relying on a toggle. For local domain issues, configure filtering or resolution policies for the affected domains.
dns:
enable: true
enhanced-mode: fake-ip
fake-ip-range: 198.18.0.1/16
nameserver:
- https://dns.alidns.com/dns-queryproxies is a list of node definitions. Each entry has a name that can be referenced elsewhere and a type that specifies the protocol. The server, port, and authentication fields must match the server configuration; one password field cannot replace protocol-specific parameters. Subscriptions usually include the node details, so you do not need to rewrite them manually to get started. The reserved example domain and sample password below illustrate the structure only and cannot be used to connect. Protocol availability depends on the core's supported features; a name appearing in the client UI does not mean the core has validated the configuration.
proxies:
- name: Example node
type: ss
server: proxy.example.com
port: 443
cipher: aes-128-gcm
password: "your-password"proxy-groups organizes nodes or other proxy groups into outbound targets. select lets you choose manually, url-test selects based on test results, and fallback switches according to availability; these options are not interchangeable just because their names sound similar. Rules reference group names, not their position in the UI. After changing a name, update references in rules and other groups, and avoid creating circular group references. The example keeps DIRECT as a valid reference. Once you import a subscription, add node names from that subscription to the list.
proxy-groups:
- name: Outbound selection
type: select
proxies:
- DIRECT
rules:
- MATCH,Outbound selectionrules are matched in list order, and the first match determines the connection's outbound target. DOMAIN matches an exact domain, DOMAIN-SUFFIX matches a domain and its subdomains, IP-CIDR matches destination address ranges, and MATCH usually catches everything else at the end. Put more specific rules before broader ones; otherwise, later conditions may never be reached. After editing, check the matched rule and actual proxy group in the connection details. Routing follows this list only in rule mode. In global mode, do not expect the same match results.
rules:
- DOMAIN,example.com,DIRECT
- DOMAIN-SUFFIX,example.org,DIRECT
- IP-CIDR,192.168.0.0/16,DIRECT
- MATCH,Outbound selectionUnder profile, store-selected saves proxy group selections, while store-fake-ip persists Fake-IP mappings. These settings manage runtime state; they do not download subscriptions or control update intervals. If a subscription update changes group names, saved selections may no longer match. Check the proxy groups again instead of repeatedly clearing all settings. Before editing subscription content, check whether the client supports overrides or merging. Direct edits to a downloaded file may be replaced the next time it updates.
profile:
store-selected: true
store-fake-ip: trueThe original subscription saved by the client, user override files, and the final configuration loaded by the core may all be different files. Before editing, confirm which subscription is active and check the runtime configuration or merged result shown by the client. This helps you avoid editing an unused copy.
See the configuration reference for field types, rule syntax, and merge order. To import a subscription for the first time, start with the quick start guide—there's no need to write a complete configuration by hand.
CLIENT / PLATFORM
Match your operating system and processor architecture first, then compare how each client manages configurations. Desktop apps make it easier to manage subscriptions and inspect connections. Servers and routers can run the core directly, but you will need to manage configuration paths, services, and network permissions yourself. When moving between systems, YAML fields may be the same, but system proxy settings, TUN permissions, and override locations must be configured separately.
Clash Plus is our top pick, with Clash Verge Rev, FlClash, and Clash Nyanpasu as alternatives. Check your system information to confirm the architecture, then choose the matching installer on the download page. If you're replacing Clash for Windows, focus on migrating subscriptions, rules, and proxy selections rather than overwriting the old program folder. After launch, make sure the mixed port matches the system proxy address.
Go to downloadsCheck About This Mac to see whether your Mac has Apple silicon or an Intel processor, then choose the matching installer. Clash Plus is our top pick, with Clash Verge Rev and FlClash as alternatives. When enabling network routing for the first time, grant the requested permissions. Seeing the app running in the menu bar does not mean the system proxy is enabled; verify it in the app settings and connection logs.
Go to downloadsClash Plus is our top pick. Other options include Clash Meta for Android, FlClash, and Surfboard, depending on your configuration format. Confirm your device architecture before installing, then approve the system VPN request when you connect for the first time. Per-app routing and Android VPN settings affect which apps use the proxy. If a connection works briefly but stops in the background, check battery optimization and background activity restrictions.
Go to downloadsThe download page links to Clash Plus on the App Store and its official site at clashplus.io. After installing, import a compatible subscription and allow the VPN configuration when prompted by iOS, then choose a proxy group in the client. If you have connection issues, first check which configuration is active and whether another network extension is enabled.
Go to downloadsFor a Linux desktop, consider the recommended Clash Verge Rev or FlClash and choose the package format for your distribution. System proxy settings usually depend on the desktop environment, and terminal apps may need proxy environment variables set separately. On a headless host, see the core section on the download page and configure the service manager, working directory, and permissions manually. Do not apply desktop client installation steps to a router.
Go to downloadsBrowse all clients →Compare clients and configuration management →
QUICK START / THREE STEPS
01 / IMPORT
Get a configuration link compatible with your client from your subscription provider. In the client's subscription or configuration page, add it as a remote configuration. Once it downloads, set it as the active configuration. Seeing it in the list is only the first step—make sure the core loads it successfully. Links may contain credentials, so redact the full URL in troubleshooting screenshots. If you see a format error, check whether you have a YAML configuration or a single-node link; changing the file extension alone will not fix it.
02 / ROUTE
Set the operating mode to Rule, then open the Proxies or proxy groups page and choose an outbound for groups that require manual selection. Group names depend on the configuration and vary between subscriptions. Selecting a node does not automatically route system traffic through the client. On desktop, enable the system proxy or TUN as needed; on mobile, complete the system VPN authorization. Keep the initial setup simple and avoid changing DNS and routing rules at the same time.
03 / VERIFY
Open the site you want to access, then check the client's connection list for the destination domain, matched rule, and outbound policy. A successful latency test only confirms that the test request completed; it does not verify traffic from the app you want to use. If there are no connection entries, check the traffic entry point first. If entries appear but fail, check the rule target, node status, and DNS results. Once everything works, set a subscription update interval if needed and note where custom overrides are stored.
SOURCE / CORE / CONFIGURATION
The Clash ecosystem includes a range of YAML-based configurations, routing rules, and desktop clients. As the maintenance status of early projects changed, newer cores and clients continued to evolve. As a result, “Clash” does not refer to a single installer. Before downloading, check the specific project name, supported platforms, and maintenance status. A filename containing Clash does not guarantee full compatibility with your existing configuration. This site provides documentation and download links; it is not affiliated with every client project or its developers.
mihomo is a proxy core in the Clash ecosystem. It handles protocol connections, rule matching, DNS, and other functions. Graphical clients such as Clash Verge Rev provide configuration management and a user interface on top of the core. UI menus do not map one-to-one to YAML fields; some settings are generated or overridden by the client. When troubleshooting, first confirm which fields the core actually loaded, then check the UI settings. This helps avoid assuming a change failed just because editing the file did not change the behavior.
You can find mihomo's source code, license, issue discussions, and release history in its project repository, which is licensed under GPL-3.0. Check licensing and packaging separately for each open-source project; the core's license does not automatically cover every client, subscription service, or third-party configuration. To reproduce an issue, record the client, core version, and steps that trigger it. When reporting it, include only the necessary snippets and remove subscription URLs, passwords, and other credentials.
Updating the client, updating the core, and refreshing a subscription are separate operations. A client update changes the UI or integrated features; a core update may change supported fields or behavior; a subscription update replaces remote configuration content. If a configuration fails to load, check the error location and field type instead of repeatedly switching programs. Older clients may not recognize newer configuration fields. Before migrating, see the client selection guide.
For long-term custom rules, use an override or merge mechanism supported by the client, and confirm at which stage subscription processing applies it. Lists may be replaced or appended according to client-specific rules; you cannot infer the behavior from YAML nesting alone. After each update, check that key proxy group names, the final MATCH rule, and DNS settings still behave as expected. See the configuration reference for examples and supported use cases, or start with the project repository to explore the source code.
CONFIGURATION NOTES
Each article focuses on a specific task: check the listening endpoint when sharing a proxy, distinguish test results from billing policies when choosing a node, and verify the configuration structure when converting a subscription. For general fields, cross-reference the configuration guide rather than applying one article's isolated settings directly to your existing configuration.
Learn how mixed-port and allow-lan work, how to share a computer's proxy with phones, TVs, and game consoles on the same LAN, and what to check in your firewall.
Read the configuration guide →Understand what latency test results can and cannot tell you, how traffic multipliers affect usage, and how to weigh regions and protocols for different needs when choosing a node.
Read the configuration guide →Compare the structure of Clash YAML subscriptions, Base64-encoded links, and single-node URIs. Learn how fields map during conversion and what to check afterward.
Read the configuration guide →