Windows
Ideal for everyday desktop use. Confirm the system architecture before downloading. After installation, open the main interface from the tray menu and enable the system proxy in Settings.
Go to downloads
Clients and setup guides updated regularly
Clash Toolbox Clients & Setup Guides
Find the right client for each platform and follow step-by-step instructions for importing subscriptions, routing traffic by rules, and configuring TUN mode. Downloads and instructions are organized separately, making both first-time setup and advanced reference easy to navigate.
Free forever
Open source
English documentation
mihomo ecosystem
Configuration essentials
Clash core features organized by task
Start by choosing the problem you need to solve, then review the relevant settings. Each guide focuses on where to find the option, what it changes, and which similar settings are easy to confuse.
Step 1 · Configuration source
Import subscriptions and update configurations
The subscription page reads the configuration URL provided by your service provider and loads nodes, proxy groups, and rules into the client. For the first import, make sure the link is complete and give the configuration a recognizable name. Importing a configuration does not route traffic by itself; select it as the active configuration, then enable the system proxy or TUN mode. When you update a subscription, the client fetches the remote content again, so local temporary edits may be overwritten. Rules that must persist belong in an override configuration. Compared with adding nodes one by one, subscription management is better for setups that need regular synchronization and makes migration between clients easier.
Configuration name
Daily use
Selected
Subscription URL
https://example.com/subscription
Match order · Policy selection
Clash rule-based routing matches from top to bottom
Rule mode checks domains, IPs, processes, or rule sets in the order defined by the configuration, then sends each connection to the specified proxy group. More specific rules usually come first, with a fallback rule at the end. When troubleshooting incorrect routing, check the connection log to see which rule matched the target domain, then inspect that rule’s proxy group instead of repeatedly switching nodes. Global mode sends most traffic through the current proxy policy, while Direct bypasses the proxy. Both modes are useful for temporary testing, but neither should replace a lasting routing configuration. Keeping operating modes, rules, and proxy groups distinct helps prevent situations where a connection succeeds but an application takes an unexpected route.
DOMAIN-SUFFIX,example.com,代理
GEOIP,CN,直连
MATCH,代理
Domain request
Rule match
Proxy group
Traffic capture · Mode selection
TUN mode and system proxy
The system proxy works well for browsers and applications that actively read the operating system proxy settings. It is simple to enable and useful for quickly confirming that the client can connect. Some games, command-line tools, and software with its own network stack do not read the system proxy; TUN mode may be appropriate in those cases. TUN creates a virtual network interface and sends more traffic through the mihomo core. It usually requires system permissions and may conflict with other VPNs, virtual adapters, or security software. Start with the system proxy for basic verification. Once the subscription, nodes, and rules work, decide whether TUN is needed for the applications involved. If the network stops working, turn off TUN first, then check the virtual adapter, DNS, and routing settings.
DNS resolution · Rule matching
DNS configuration and Fake-IP
Clash’s DNS module brings domain resolution into the rule evaluation process. Fake-IP mode first returns a local mapped address, then restores the original domain when the connection is established, allowing the rule engine to route traffic accurately by domain. It is not the real address of a remote server and should not be used to judge DNS results directly. For issues involving LAN devices, game logins, or compatibility with specific applications, check the Fake-IP filter list first, then verify that the upstream DNS server is reachable. Save the current configuration before changing DNS and change one option at a time so you can tell whether the problem comes from the resolver, enhanced mode, or TUN capture. For complex setups, prioritize fields supported by the core used by the client.
dns:
enable: true
enhanced-mode: fake-ip
respect-rules: true
Platform guides
Choose a Clash client by operating system
The download page lists the available clients for each platform. Confirm your operating system first, then choose an installer based on processor architecture, interface preferences, and maintenance status.
macOS
Separate options are available for Apple silicon and Intel processors. On first launch, follow the system prompts to authorize the network extension or helper service, then import your subscription.
Go to downloadsAndroid
Designed for phones and tablets. After installation, allow the client to establish a VPN connection and retain the permissions required to run under your device manufacturer’s background restrictions.
Go to downloadsiOS
Browse available clients through the App Store. After installation, import the subscription in the app and add the VPN configuration when prompted by the system.
Go to downloadsLinux
Suitable for desktop Linux, development environments, and users comfortable with system services. Graphical clients and the mihomo core serve different purposes, so choose based on whether you need interface-based management.
Go to downloads
Quick start
Three steps from installation to a working connection
This section covers only the essential first-run path. For permission, DNS, or routing issues, open the full guide for the relevant checks.
-
01
Install the client and confirm system permissions
Open the download page and select your operating system, then choose a maintained client that matches your processor architecture. Windows usually runs the installer directly. On macOS, check whether you have Apple silicon or an Intel processor, then follow System Settings prompts to allow the network extension or helper service. Android and iOS request VPN permission when the first connection is established. After installation, open the main interface and confirm that Settings, Configuration, or Subscription is accessible. Do not run another proxy tool or VPN at the same time, as they can override ports, virtual adapters, and system proxy status.
-
02
Import the subscription and select the active configuration
On the subscription or configuration page, paste the complete URL, give it a recognizable name, and run the import or update. After a successful import, the new entry should appear in the configuration list; select it manually as the active configuration. Open the proxy or policy page and check that the proxy groups contain available options. If parsing fails, make sure no characters are missing and that you have not used a web-sharing URL instead of a subscription URL. If the import succeeds but the list is empty, ask the service provider to verify the subscription content rather than reinstalling the client repeatedly. Save a copy of the original configuration before editing rules so you can restore it after a subscription update.
-
03
Enable traffic capture and verify the routing result
For the first test, choose Rule mode and enable the system proxy, then open a browser and visit a familiar site. Once it connects, review the client’s connection log to confirm that the domain matched the expected rule and proxy group. If the browser works but an application generates no traffic, it may not read the system proxy; test TUN mode if needed. Do not change nodes, DNS, TUN, and rules all at once, because changing several variables makes the cause difficult to isolate. The most reliable order is to confirm the configuration, verify the node, check the rules, and only then adjust traffic capture for a specific application.
Check these four places when connections fail
First, confirm that the intended configuration is actually selected. Second, check whether the system proxy or TUN is enabled. Third, verify that the proxy group has a usable option selected. Fourth, look for requests from the target application in the connection log. If the browser produces no log entries at all, traffic probably has not reached the client. If entries exist but are rejected, inspect the rules and policy. If every request times out, try an available option first and confirm the local network. Following this path is more likely to reveal the cause than repeatedly reinstalling the client.
View the complete guide →
Open-source ecosystem
From Clash configuration to the mihomo core
Clash established a widely used configuration structure: proxy entries describe connection methods, proxy groups choose among multiple options, and rules determine which policy handles each type of traffic. After the original project stopped being maintained, the community continued developing compatible implementations around established configuration practices, with mihomo becoming the core used by many newer clients. The graphical interfaces on desktop and mobile are not the core itself. They handle installation, configuration management, system permissions, and interaction, while the core performs rule matching, DNS processing, and connection forwarding.
Understanding the relationship between a graphical client and its core helps identify which layer contains a problem. An interface that will not start, a missing tray icon, or a failed system-service installation usually belongs to the client layer. Unrecognized configuration fields, changed rule behavior, or an unexpected DNS mode are more likely related to core capabilities or configuration syntax. When switching clients, subscriptions and most rules can continue to work as long as both clients support the same fields. However, the controls for TUN, scripts, overrides, and external controllers may differ, so verify each one after migration.
Open-source projects are typically updated through code commits, issue discussions, and release notes. Rather than compressing every change into a vague “updated” label, this site organizes information around downloads, basic guides, advanced configuration, and troubleshooting. Before updating a client, read the release notes to check for configuration migrations, permission changes, or a core switch. Preserve local overrides when updating configurations. If rule matches change after updating rule data, review the connection log to confirm the matched rule again. This maintenance order keeps client files, core behavior, and subscription content separate.
For everyday use, a graphical client already provides common controls for subscription updates, mode switching, proxy selection, and log viewing, so there is no need to run core commands directly. Servers, routers, and automated deployments are better suited to running mihomo directly and managing it through configuration files and an external control interface. The two approaches share many concepts, but their installation paths, permission models, and troubleshooting methods differ. Identify the device type and management approach first; that is more useful than comparing interface appearance alone.
Selected FAQs
Identify the problem layer before changing installation or configuration
Why do some apps have no connection logs even though the system proxy is enabled?
Some applications do not read the operating system proxy settings. First confirm that a browser generates connection logs normally, then determine whether the target application needs TUN mode. Before enabling TUN, close other VPN or virtual-adapter tools to avoid conflicts in the traffic path. See the FAQ page for more checks.
Why did my locally added rules disappear after a subscription update?
A subscription update usually writes the remote configuration again, which can overwrite content edited locally. Rules that must persist should go in the client’s supported override feature or be maintained as a separate configuration fragment. Save a restorable copy before making changes.
How should I choose between Rule, Global, and Direct mode?
For everyday use, start with Rule mode so different traffic follows the configuration. Global mode is useful for temporarily confirming the proxy path, while Direct mode helps determine whether the proxy path is causing the problem. Return to the mode that matches your actual use after testing.
Why is a Fake-IP address different from the real resolved address?
Fake-IP is a local mapping generated by the client’s DNS module. It preserves domain information for rule evaluation and is not the real address of a remote server. For compatibility issues with a particular application, check the filter list and DNS settings instead of treating the mapped address as a DNS failure.
Technical notes
Recent Clash configuration and troubleshooting articles
Actionable checks covering migration, system permissions, traffic capture, and background restrictions on mobile devices.
How to troubleshoot excessive battery drain when running Clash on Android: background restrictions and battery-saving checklist
Trace mobile battery usage one factor at a time, from latency-test frequency and rule complexity to persistent TUN sessions and manufacturer background restrictions, while preserving the permissions required for stable connections.
Read the full article →Clash client permission issues on macOS: network extension and Keychain steps
Work through installation blocks, network-extension authorization, helper services, and Keychain prompts, including where to check for leftovers when pop-ups continue after uninstalling.
Read the full article →TUN mode vs. system proxy: how traffic capture works and when to use each mode
Explain both modes by tracing how traffic enters the client, distinguish apps that follow system proxy settings from those requiring a virtual adapter, and provide a recommended switching order.
Read the full article →