Explore clients for every platform, the mihomo core, and configuration guides in one place. Start with subscription imports, then set up rule mode, system proxy, DNS, and TUN step by step.
5 desktop and mobile platformsMIT open-source ecosystemmihomo actively developed coreYAML configuration and rules
Scattered setup
Where manual proxy settings fall apart
When browsers, command-line tools, and desktop apps each store proxy settings separately, changing networks, updating endpoints, or troubleshooting connections means repeating the same work. Rules scattered across different apps also make it difficult to see where a request ultimately goes.
×
Configure each app separately After a port or network change, every old setting must be checked.
×
No single entry point for rule order Domains, address ranges, and fallback policies are difficult to maintain centrally.
×
Maintain a separate config on every device Changes are hard to sync, and troubleshooting steps vary between devices.
Centralized setup
Manage rules, subscriptions, and system access in one place
Clash clients read a common YAML-based configuration structure, bringing proxy groups, rules, DNS, and network access into one control panel. Daily switching centers on configuration files and operating modes, without repeatedly editing every application.
✓
Rules route traffic automatically in order Matching domains, processes, and address ranges enter the assigned policy.
✓
Use one subscription across platforms Import the same subscription into compatible clients and enable it separately.
✓
Switch system proxy and TUN as needed Choose the takeover method based on whether an app follows the system proxy.
From subscription import to rule matches see every layer of the setup
Start with the capability index, then use the four interface examples below to understand the related settings. Examples use real fields and rule syntax, without node information or speed-test results.
Proxy groups determine the exit used after a rule matches.
Choose between automatic selection, failover, and manual selection based on your needs; rules only reference the proxy-group name.
Rules are evaluated from top to bottom, stopping at the first match.
Put specific domains first, followed by broader GEOSITE, GEOIP, and MATCH rules.
TUN takes over programs that do not read the system proxy.
Before enabling it, confirm system permissions, DNS settings, and network interfaces to avoid conflicts with other network tools.
Subscriptions update remote configuration; overrides preserve local changes.
Back up your changes before updating so the next refresh does not overwrite edits made directly to the remote configuration.
01 · PROXY-GROUPS
Proxy-group selector: separate rules from specific exits
Proxy groups sit between rules and proxy configuration. Rules can reference PROXY, Auto, or a custom group name; after a match, the group decides which selection method to use. This means you can change the policy without rewriting the entire rule set. For daily use, keep one manual selection group and add url-test, fallback, or select groups as needed. After changing the configuration, verify that group names exactly match their rule references. Names containing spaces or Chinese characters must remain unchanged to prevent traffic from falling through to the final fallback.
Compared with writing a specific exit into every rule, proxy groups are easier to maintain over time. One group can be referenced by domain, process, and address-range rules, so changing it once affects all related traffic.
Proxy grouptype: select
PROXY
Default rule policy
Selected
DIRECT
Direct connection
Select
Auto
type: url-test
Select
proxy-groups:
- name: PROXY
type: select
proxies:
- Auto
- DIRECT
02 · RULES
Rule list: match specifics first, then ranges and the fallback
Clash checks rules one by one in the order they appear in the configuration file and stops at the first match. Put individual domains, process names, and LAN addresses near the top; place broad GEOSITE and GEOIP rules later, then use MATCH to catch connections that match nothing else. no-resolve can prevent some IP rules from triggering an extra DNS lookup for matching, but it is not a universal suffix—use it according to the field type and DNS design.
When troubleshooting routing, do not look only at the proxy group’s current selection. Check the matched rule in the connection details as well. If the result is unexpected, first check whether a broader rule above it intercepted the request.
RulesMatch top to bottom
DOMAIN-SUFFIX,github.com,PROXYcustom
IP-CIDR,192.168.0.0/16,DIRECT,no-resolvelan
GEOSITE,cn,DIRECTgeosite
GEOIP,CN,DIRECT,no-resolvegeoip
MATCH,PROXYfallback
03 · TUN
TUN mode: handle connections that bypass the system proxy
The system proxy works well for browsers and apps that actively read the operating system’s proxy settings; game launchers, some command-line programs, and software with its own network stack may bypass it. TUN mode uses a virtual network interface to take over a broader range of traffic before passing it to the rule engine. On first enablement, desktop systems may request administrator access or installation of a network component. Close other tools that intercept network traffic, then verify DNS and routing settings to reduce interface conflicts and forwarding loops.
TUN does not need to stay enabled in every situation. If you only use browsers and standard desktop apps, the system proxy is usually clearer. Switch to TUN when a specific program cannot connect through Clash, then use the logs to confirm that its traffic was captured.
Subscription updates: separate remote config from local overrides
Subscription links are usually generated by a service provider, while the client downloads and saves the result as a configuration file. After importing, confirm that the config parses correctly and that proxy groups, rules, and DNS fields are complete. Direct edits to a generated subscription file may be replaced at the next update. Long-term rules, DNS parameters, and proxy-group changes are better kept in the client’s supported overrides, merged configuration, or a separate local file; recheck references after each update.
An automatic update interval should not replace manual checks. When the network changes, a subscription URL expires, or the remote format is invalid, review the update time and runtime logs. If necessary, switch back to the last working configuration before determining whether the failure occurred during download or parsing.
Local override config
Preserve rule and DNS changes
Enabled
Platform access
Choose a Clash client for your device
Client interfaces and core integrations vary slightly, but the basic workflow is the same: install the app, import a subscription, choose a proxy group, then enable the system proxy or TUN. The download center lists clients, supported architectures, and installation notes by platform.
Windows
A good fit for everyday desktop use. After installation, switch the system proxy from the tray menu and manage startup, TUN, and subscription updates in Settings. Before downloading, confirm that the device uses the common x64 architecture.
Builds are available for both Apple Silicon and Intel devices. On first launch, you may need to approve app permissions in System Settings; enabling TUN also requires approval for the relevant network extension.
Designed for phones and tablets. After importing a subscription, allow the system to create a VPN connection. Battery-saving settings may restrict background activity, so allow the client to keep handling network connections in the device’s system settings.
Get a Clash-compatible client from the App Store. On the first connection, follow the system prompts to add a VPN configuration, then import the subscription and choose a rule mode. The same configuration can be used on both mobile and Wi-Fi networks.
Choose a graphical client or run the mihomo core directly. GUI clients are preferable on desktops; servers and routers require deployment based on processor architecture, service management, and configuration paths.
For the first setup, follow the shortest path and avoid changing DNS, overrides, or complex rules right away. Once the basic connection works, add settings one at a time so it is easier to identify where a problem starts.
01
Import a subscription or YAML file
Open the client’s Config, Subscription, or Profiles page, paste the subscription URL, and download it—or select a local YAML file. After importing, confirm that a config name and proxy groups appear. If parsing fails, check that the link is complete, then inspect the field location in the logs; do not repeatedly import the same URL.
02
Choose rule mode and a proxy group
Switch the operating mode to Rule, then open the proxy page and choose the primary proxy group. Rule mode evaluates connections in the order listed under rules; Global sends most traffic through one policy, while Direct connects without a proxy. Rule is usually the best starting point for daily use because it preserves direct-connection rules for LAN resources and selected sites.
03
Enable the system proxy and verify the match
On desktop, enable the system proxy first; on mobile, follow the system prompts to allow the VPN connection. Open a site you need to reach, then check the Connections or Logs page to see whether the request appears, which rule matched, and which proxy group handled it. If the target program produces no connection record, consider enabling TUN instead of changing several network options at once.
Clash established a widely adopted YAML configuration structure built around proxies, proxy groups, rules, DNS, and operating modes. After the original project stopped being maintained, the community continued developing compatible configurations, while desktop and mobile clients gradually adopted newer core branches. Understanding the configuration structure matters more than memorizing a particular interface: when changing clients, rule order, proxy-group references, and DNS logic can still carry over.
mihomo is the core name used by Clash Meta’s successor, extending the original rule model with additional protocol, rule-set, DNS, and TUN capabilities. GUI clients handle configuration management, system permissions, tray controls, and update entry points; the core parses configuration, creates connections, and applies routing. Their responsibilities differ, so troubleshooting should first determine whether the interface failed to write the configuration correctly or the core failed to parse or run it.
Open-source repositories make configuration fields, change histories, and issue discussions publicly available. When an unfamiliar field appears, consult the documentation for the current core first, confirm its configuration layer, accepted values, and platform limits, and only then add it locally. Copying isolated snippets often misses indentation, dependencies, or prerequisite settings; TUN, DNS, and rule-set providers especially require the full context.
Client and core release schedules do not always align. The download page organizes platform entry points, the guides focus on stable workflows, and the technical notes record rule syntax, logs, and core differences. Before upgrading, preserve the current working configuration. Afterward, verify subscription loading, proxy groups, and basic connectivity before checking new features, keeping the scope of change clear.
Technical notes
Rules, platforms, and core guides
The articles below start with specific problems and add syntax details, platform installation steps, and core differences not expanded on the homepage. Read them alongside your configuration file and client logs, checking each item as you go.
Rules
How to write custom Clash rules: DOMAIN, IP-CIDR, GEOSITE syntax and match order
Breaks down Clash rule fields by type and use case, explaining top-to-bottom evaluation, the first-match-wins principle, and the practical effects of no-resolve, MATCH fallbacks, and rule-set ordering on routing results.
Using Clash on iPhone: complete steps for getting a client from the App Store and importing a subscription
A complete iOS walkthrough covering how to get a compatible client from the store, import a subscription, allow the VPN configuration, and verify rule matches, plus the troubleshooting order for authorization failures, unloaded configs, and inactive connections.
Clash core versions compared: how Premium, Clash Meta, and mihomo differ
Maps the relationships between core branches, compares protocol support, rule-field extensions, GEOSITE, and TUN capabilities, and explains the division of responsibilities between GUI clients and cores to help you choose for your platform and configuration needs.