Choose an installer for your device, then set up subscription import, rule-based routing, and the system proxy. For kernel options, continue to the advanced configuration guide.
Config files, listening ports, and routing rules each handle a different part of your traffic. Identify which layer is causing the issue before changing settings; it’s often easier to pinpoint the cause than to keep switching nodes.
When building nodes, policy groups, and rules from scratch, indentation and field names must match the kernel’s syntax. A failed config load doesn’t necessarily mean the subscription URL is invalid. Check the client’s error message, then inspect the file structure.
If mixed-port is set in your config but the system proxy points to a different port, your browser may connect directly or fail. When changing the listening port, update the proxy address in your operating system too.
Rule mode checks rules in order, so a broad rule near the top can match requests too early. Also check that each rule points to an existing policy group and that the client is currently in Rule mode.
Use the interface for everyday toggles and the config file for reusable rules. Start by connecting through the client, then edit YAML as needed instead of changing every option at once.
Paste the subscription URL from your provider and confirm the config loads. Then open Proxies and choose a policy group. A successful import only means the client has read the config; it doesn’t mean system traffic is routed through the proxy.
Keep the configured mixed port to start, then enable the client’s system proxy. If another program is using that port, change it and update the proxy address too, so the client and system use the same value.
Switch to Rule mode and check the connection log to see which rule matched each domain and which policy group handled it. If only a specific app has no traffic, then consider whether you need TUN mode.
mixed-port: 7890
mode: rule
proxy-groups:
- name: Manual Select
type: select
proxies:
- DIRECTChoose a topic on the left for specific steps. The snippets below show how fields relate; use your own config for node and subscription details.
In the client’s Config page, paste the subscription URL and import it. Wait for the config to appear in the list, then set it as the active profile. A complete YAML config usually includes nodes, policy groups, and rules; a link containing only a node list may need to be converted to a Clash-compatible format by your provider. Before updating a subscription, note which profile is selected. After the update, check that the policy groups still appear as expected. Subscription URLs are private: don’t include them in public log screenshots or support posts. Once the config is imported, enable the system proxy so you can troubleshoot config issues separately from traffic routing.
Config → Import subscription URL → Set as active profile
Proxies → Choose a policy groupRule mode checks requests from top to bottom and sends each match to its assigned policy group. Domain rules target specific sites; IP rules handle resolved addresses; a final fallback rule catches requests that haven’t matched earlier rules. Before editing, make sure the referenced policy group exists, and place more specific rules above broad ones. You can briefly switch to Global mode to compare results while troubleshooting, but switch back to Rule mode for everyday use. Check the connection log to see which rule actually matched—it’s more reliable than judging by whether a page loads.
mode: rule
rules:
- DOMAIN-SUFFIX,example.com,Manual Select
- MATCH,DIRECTRules refer to policy group names, so you don’t need to specify a node in every rule. select lets you choose a route manually; url-test tests candidates periodically and selects an available one; fallback tries candidates in order. Start with a manual group to confirm the config connects, then consider automatic selection. This helps keep subscription, rule, and test-URL issues separate. When renaming a group, update every rule that refers to it. If one group references another, check those names too. For full parameter details, see the advanced configuration guide.
proxy-groups:
- name: Manual Select
type: select
proxies:
- DIRECTThe system proxy mainly works with apps that follow your operating system’s proxy settings. Some apps make connections directly and bypass it. TUN uses a virtual network interface to capture a wider range of traffic and usually requires operating system permission. Start with the system proxy, then enable TUN only if your apps need it. Keep routing interactions with your local network, other VPNs, and firewall in mind. If an app works again after you turn TUN off, check DNS and routing before replacing the subscription. Authorization steps vary by platform; follow the prompts in your client.
System proxy → Basic connection
TUN mode → Enable if needed
Check → Permissions / Routing / DNSWhether domain rules work as expected depends on the domain and resolution results seen by the client. DNS overrides set how the kernel resolves names, while Fake-IP assigns virtual addresses to domains so connections can be intercepted. Save your current config first, then note your system DNS, client DNS, and TUN status. Change one setting at a time, then review the logs and connection history. Local domains, internal services, and apps that require real IPs may need special handling. Don’t replace your entire config with a copied DNS snippet; first check how it fits with your existing rules.
dns:
enable: true
enhanced-mode: fake-ipThe external controller API lets the client interface or a standalone dashboard read kernel status and switch policy groups. It is not a proxy traffic listening port. For local use, bind it to the loopback address where possible. If you need LAN access, consider the listening address, access controls, and network boundaries between devices; don’t copy public examples without adapting them. If a dashboard won’t connect, check separately that the kernel is running, the controller address is correct, and the access credentials match. The proxy may still work, so don’t mistake an unavailable dashboard for a failed subscription.
external-controller: 127.0.0.1:9090
secret: "your-password"For parameter details, read the Advanced Config guide →. It covers rule providers, policy groups, DNS, TUN, and local overrides—you don’t need to configure everything on your first run.
Choose your operating system, then compare clients for that platform on the download page. Check installer type, processor architecture, and permissions against your device. If you only need the kernel for a server or router, see the mihomo section on the download page.
Check your device architecture and system requirements, then choose an installer from the client list. After installing, import a subscription from Config and check that the system proxy is enabled. If some apps still connect directly, first check whether they follow the system proxy.
Download for Windows →Choose the installer that matches your Apple Silicon or Intel device. Follow the system prompts to authorize the client on first launch. If the menu bar shows a connection but your browser isn’t using the proxy, check the active config and system proxy status in the client.
Download for macOS →After importing a config, grant VpnService permission when prompted so the client can create a local VPN interface. If connections often drop after the screen locks, check battery optimization, auto-start, and background permissions instead of repeatedly deleting the subscription.
Download for Android →Use the download page to open the Clash Plus App Store listing. After installing, follow the app’s prompts to import a config and approve the system VPN request on first connection. Return to the client to switch rules or policy groups.
Download for iOS →Desktop users can compare graphical client package formats; server and router users can look at the standalone kernel. Before installing, check your distribution, processor architecture, and runtime requirements, and make sure the config file has a readable and writable location.
Download for Linux →The same subscription may not work with every client. Check the format provided by your service provider, then confirm the target client supports its protocols and rule syntax. When moving to another device, check its network permissions and system proxy settings too.
Clash is the name of an ecosystem of rule-based proxy tools. A graphical client provides the interface for importing configs, switching settings, and viewing connections; the kernel parses configs, establishes connections, and applies rules. Choose an installer for your operating system, then check that the kernel supports your config syntax.
The original Clash, Clash Meta, and its successor mihomo are at different stages of maintenance. Similar-looking interfaces don’t guarantee the same kernel. Some newer protocols, rule types, and DNS options are available only in specific kernels. If a config fails to load, check which kernel the client uses and compare it with the subscription syntax rather than relying on the app’s name alone.
mihomo is an open-source kernel with publicly available source code and license information. GPL-3.0 describes the terms for using, modifying, and redistributing the software; it is not a guarantee about node services. When choosing a GUI client, check its own project information too. An open-source kernel and the maintenance status of a particular graphical client are separate matters.
The client reads the config and displays status; subscription content is usually maintained by your service provider. If a subscription imports but its nodes don’t work, check when the config was updated, the available policy groups, and the connection log. If the client won’t install, check the package format and system requirements. Separating these issues makes troubleshooting clearer.
Before updating the client, note the active config and any important local overrides. After the update, confirm the kernel starts, then check the subscription, policy groups, Rule mode, and system proxy. If the kernel changes or a long maintenance gap has passed, review rule providers, DNS, and TUN fields in older configs. Don’t assume an existing config will always remain compatible.
git clone https://github.com/MetaCubeX/mihomo.gitThe clone command is for viewing public source code locally; it isn’t required to install a graphical client. Most users can choose an app for their device on the download page. To change rules or DNS, follow the Advanced Config guide one step at a time.
Check config loading, traffic routing, and rule matching in that order. Change one setting at a time to see which change affects the connection.
Importing only loads the config. First make sure it’s set as the active profile, then choose Rule mode and a policy group, and enable the system proxy. Check the connection log for browser requests. If none appear, check the system proxy toggle and port first. Follow the step-by-step checks →
Use Rule mode for everyday browsing so the config rules determine where requests go. Global mode can help as a temporary troubleshooting comparison: if it works but Rule mode doesn’t behave as expected, check rule order and policy group names. Switch back to your preferred mode when you’re done. See how to switch modes →
Make sure another program isn’t using the new port, and check whether the system or app proxy address still points to the old one. Reload the config in the client after editing it. If you change YAML but don’t update the system proxy, the two settings won’t match. Back to connection checks →
Start with the system proxy for a basic connection. Enable TUN only if a target app ignores the system proxy and you need to route more of its traffic; follow the client’s prompts to grant the required system permissions. If LAN access is affected, check routing and DNS separately. Read the TUN setup guide →
These articles are listed by publication date and cover common next steps after initial setup, from subscription formats and Android background connections to choosing a kernel.
Learn how full YAML configs, Base64 node lists, and single-node share links differ; why the same URL can import differently across clients; and which fields may be lost during conversion.
Read article →Check system permissions, battery optimization, auto-start, and background restrictions to troubleshoot disconnects when the screen locks. Confirm the client still has VPN permission, then determine whether Android is stopping the process or the subscription itself is unavailable.
Read article →Compare kernel maintenance, protocol support, and rule syntax, and learn how graphical clients relate to their kernels. If a config contains an unfamiliar field, start by checking kernel differences.
Read article →