Client Downloads · Configuration Guides

Clash ToolboxCross-platform clients and configuration guides

Choose a client for your system and learn how to configure subscription imports, traffic rules, and TUN mode.

Open-source core
Chinese documentation
YAML configuration

5 platforms
mihomo · GPL-3.0
Single-file YAML configuration

+ : # = - + : # = - + : # = - +
: DOMAIN-SUFFIX : + = # : - + :
# = - + : # = - + : # = - + : #
+ : DIRECT = + : # = - + : # =
- # + : = - # + : = - # + : =
MATCH : + = # : - + : DIRECT
: + = - # : + = - # : + = - #
# REJECT + : = - # + : = - #
+ : # = - + : # = - + : # = -
: DOMAIN-SUFFIX : + = # : - +
# = - + : # = - + : # = - + :
+ : DIRECT = + : # = - + : # =
- # + : = - # + : = - # + : =
MATCH : + = # : - + : DIRECT
: + = - # : + = - # : + = - #

+ : # = - + : # = - + : # = - +
: + = # : MATCH : - + : # = - :
# = - + : # = - + : # = - + : #
+ : DIRECT = + : # = - + : # =
- # + : = - # + : = - # + : =
DOMAIN-SUFFIX : + = # : - + :
: + = - # : + = - # : + = - #
# REJECT + : = - # + : = - #
+ : # = - + : # = - + : # = -
: + = # : MATCH : - + : # = - :
# = - + : # = - + : # = - + :
+ : DIRECT = + : # = - + : # =
- # + : = - # + : = - # + : =
DOMAIN-SUFFIX : + = # : - + :
: + = - # : + = - # : + = - #

Clash · Settings CONFIGURATION

Clash

Proxies

Profiles

Rules

Connections

Logs

Settings

SettingsGENERAL

System proxy

Let apps use the system proxy settings

TUN mode

Route traffic through a virtual network interface

Allow LAN

Routing mode

RuleGlobalDirect

Mixed port

7890 TCP

External controller

127.0.0.1:9090

config.yamlREAD ONLY

1mixed-port: 7890

2allow-lan: false

3mode: rule

4external-controller:

5 127.0.0.1:9090

6tun:

7 enable: true

8rules:

9 - DOMAIN-SUFFIX,example.com,DIRECT

10 - GEOIP,CN,DIRECT

11 - MATCH,DIRECT

Configuration reference / Configuration

Traffic rules, routing, and configuration management

The client interface handles controls; the core handles connections. First check whether traffic reaches the client, then identify which rule matched. Checking these two layers separately is more effective than repeatedly switching modes.

A configuration file is the starting point for a new setup. Installing a client does not provide proxy connections by itself; you usually need a subscription URL as well. After importing it, check that the profile is selected and its proxy groups are available. Then enable the system proxy or TUN mode as needed. The examples below explain how configuration fields relate to each other. They include no proxy servers and are not a substitute for a working subscription.

rules · matched from top to bottom

Choose an outbound route by rule

In rule mode, connections are checked against the configuration in order; the first matching rule determines the outbound route. Domain suffixes, destination addresses, and fallback rules each serve a purpose. Put specific rules before broader ones. Select rule mode under Proxies or Settings in the client, then check the match under Connections. Unlike global mode, rule mode allows direct and proxied traffic to coexist instead of sending every request through the same route. The examples use DIRECT to demonstrate syntax only. Before replacing a policy name, make sure the corresponding proxy group exists in your configuration.

For desktop and mobile clients that support Clash rule syntax.

# Put specific domain rules before the fallback rule
mode: rule

rules:
  - DOMAIN-SUFFIX,example.com,DIRECT
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - GEOIP,CN,DIRECT
  - MATCH,DIRECT

# DIRECT: connect directly
# REJECT: reject the connection
# GEOIP requires the corresponding geolocation data

tun · virtual network interface

Route traffic that ignores the system proxy

TUN mode routes traffic through a virtual network interface, making it useful for apps that do not use the system proxy. Desktop clients may require a service installation or administrator privileges before you can enable TUN in Settings. Mobile clients generally use the system VPN permission to route traffic. TUN mode and rule mode are not alternatives: TUN determines how traffic enters the core, while rules determine where it goes next. If you use another VPN, virtual network interface, or enterprise network policy, note the existing settings first. If something goes wrong, check routes and DNS rather than relying only on the toggle state.

For clients with TUN support and the required permissions; available fields depend on the core.

# mihomo TUN configuration example
tun:
  enable: true
  stack: mixed
  auto-route: true
  auto-detect-interface: true
  dns-hijack:
    - any:53

# DNS hijacking also requires DNS settings in the core
# Check for other VPNs and virtual network interfaces before enabling
# The client may override these fields in its interface

profiles · subscriptions and providers

Know the difference between a full profile and a proxy provider

A full subscription profile can include proxies, proxy groups, and rules. A proxy provider supplies proxy entries to an existing configuration. To import a subscription for the first time, create a remote profile under Profiles, save it, and select it. Then check that the update succeeded. Scheduled updates fetch the remote content again, so direct edits to a downloaded file may be overwritten. For lasting changes, use the client's override or merge features. The example on the right uses local provider syntax to show how files relate to one another. File paths are relative to the core's working directory, not arbitrary system paths.

Remote profile management depends on the client; the provider example is for mihomo.

# The local file must include a proxies list
proxy-providers:
  local:
    type: file
    path: ./providers/local.yaml

proxy-groups:
  - name: Choose manually
    type: select
    use:
      - local

# Don't expose subscription URLs in public screenshots or logs

core · configuration compatibility

Choose a core based on the fields you need

Clash, Clash Premium, and mihomo differ in configuration support and maintenance status. Similar-looking interfaces do not guarantee support for the same fields. mihomo continues the Clash Meta configuration ecosystem, and many current clients use it to handle connections. Only some clients let you switch cores; others bundle a fixed core, so the same steps do not apply everywhere. If you encounter an unknown field or unsupported protocol, check the logs, identify the core used by the client, and consult its configuration documentation. Replacing the executable on its own may break compatibility with the client interface; use the product's update method whenever possible.

For core selection and configuration migration; not every client supports switching cores.

Name	What to check
Clash	Original configuration format and basic rule syntax
Clash Premium	Proprietary extensions in legacy configurations
mihomo	Successor projects to Clash Meta; check current documentation for field support

platform · permissions and system settings

Configurations can be reused, but permissions must be set up again

A compatible configuration can be reused across platforms, but check listening ports, file paths, and system permissions on each device. On desktop, start by testing the system proxy and enable TUN only if needed. On mobile, grant VPN permission first. When migrating, do not copy absolute paths from an old device or assume every client can read the same subscription format. Check which formats the target app accepts, then import and select the profile and verify its proxy groups. Once the connection works, configure startup and background operation. This helps separate configuration issues from system restrictions.

For migrating configurations across five platforms; see the cross-platform guides for installation steps.

Platform	Where to check in system settings
Windows	Settings → Network & Internet → Proxy
macOS	System Settings → Network → Current network → Details → Proxies
Android	VPN and battery settings in System Settings
iOS	Settings → General → VPN & Device Management
Linux	Desktop proxy settings, service permissions, and terminal environment variables

Downloads / Platforms

Choose a Clash client for your platform

First identify your operating system and processor architecture, then compare interfaces, configuration support, and permission requirements. The download center lists installers and system requirements; these links open the relevant platform section directly.

Windows

Choose from desktop clients such as Clash Plus, Clash Verge Rev, and FlClash. For a new setup, prioritize actively maintained software. Clash for Windows is listed for archival reference only. You can migrate existing configurations, but do not copy legacy scripts, service settings, or absolute paths without checking them first.

After installing, import a profile and enable the system proxy. If your browser works but your terminal does not, check the terminal's environment variables before reinstalling the client. For apps that need TUN, check service permissions and the virtual network interface separately.

Go to downloads →

macOS

Apple Silicon and Intel Macs require different installers. Check your chip under About This Mac. Clash Plus, Clash Verge Rev, and FlClash offer desktop interfaces; ClashX Meta is no longer maintained, so save a copy of your existing configuration before migrating.

When launching for the first time, pay attention to macOS security prompts and network permissions. The system proxy usually applies to the current network service, so check it again after switching between Wi-Fi and Ethernet. TUN requires the relevant client service or permissions; changing browser settings alone is not enough.

Go to downloads →

Android

Compare Clash Plus, Clash Meta for Android, FlClash, and Surfboard. Supported configuration formats vary between products; subscription support does not guarantee compatibility with every Clash field. Match the installer architecture to your device. If you're unsure, check the download page's selection notes first.

Confirm the system VPN permission when connecting for the first time. If the connection drops when the screen locks, check battery optimization and background activity restrictions. If you use another VPN, check which service is active before troubleshooting the configuration.

Go to downloads →

iOS

Get Clash Plus from the App Store. See clashplus.io for product information. Before importing, confirm that the client supports your configuration format. The options for importing a link or local file vary by app; a file extension alone cannot tell you whether its contents are compatible.

After saving the profile, grant VPN permission, choose an outbound policy, and connect. Check network access permissions for Wi-Fi and cellular separately. When troubleshooting, first confirm that the profile is selected, then check the connection status. Do not assume a problem with one website means the entire client has stopped working.

Go to downloads →

Linux

For desktop Linux, consider Clash Verge Rev or FlClash. For servers, routers, and similar setups, you can run the mihomo core directly. Check your distribution's package format and processor architecture first. A desktop installer is not a universal package for every device.

Terminal apps usually do not use the desktop system proxy automatically. Set proxy environment variables as supported by each app, or use TUN with the required permissions. When managing a remote system, keep a way to restore the connection before changing default routes or DNS, so you don't lock yourself out.

Go to downloads →

Browse all clients →Read cross-platform setup guides →

Open-source references / Source

Client interfaces and open-source cores

Clash is an ecosystem, not a single installer shared across every platform. When consulting documentation, check the client name, the core it uses, and the configuration source. Instructions for one product may not apply to others.

5 platformsPlatform downloads

Covers desktop and mobile systems. Installation methods, permissions, and background restrictions vary, so verify connection behavior on the device you're using.

GPL-3.0mihomo license

The mihomo project publishes its source code and license. The license applies to the core project; it does not determine how each client or app store product is licensed.

YAMLSingle-file configuration

Organize proxies, proxy groups, and rules in one main configuration, or reference external rule sets and providers. Indentation and field support matter just as much.

Project history and configuration compatibility

Early Clash clients popularized using YAML to define proxies and traffic rules. As the original project’s maintenance status changed, community clients and successor cores continued to evolve. As a result, button names, download links, and extension fields in older guides may no longer match current software. You can keep the basic structure of an existing configuration, but check that the core still supports its fields—especially DNS, TUN, and external resource paths. Successfully importing a legacy configuration only means it parsed; it does not guarantee the same behavior as in the original environment.

Client controls and the configuration actually in use

Clients typically handle configuration downloads, policy selection, tray menus, and system services; the core handles listening ports, rule matching, and connections. Some interface toggles generate configuration before startup or change settings through a control interface while running. As a result, the interface may temporarily show different values from an edited subscription file. When troubleshooting, check the selected profile, runtime logs, and connection details first, then see whether overrides are enabled. Avoid changing the subscription file, interface port, and system proxy at the same time; otherwise, it is difficult to tell which change affected the result.

Updates and configuration backups

Client updates, core updates, subscription updates, and rule-set updates are four separate actions. Updating the client will not automatically fix an expired subscription, and re-downloading a subscription will not add support for new fields to an older core. Before maintenance, save local overrides and custom rules, read the product's release notes, and update one layer at a time. After each update, retest the same app and destination and note any differences. A configuration backup is more reliable than trying to remember which toggles to restore if you need to roll back. Subscription URLs may contain access credentials; never post them in public discussions or screenshots.

Source code and issue reports

Open-source repositories are useful for checking field definitions, licenses, and known issues. They are not a general-purpose source for downloading client installers. The mihomo repository tracks changes to the core; issues such as broken interface buttons or failed service installation should be reported to the relevant client project. When filing a report, include your system, architecture, reproduction steps, and redacted logs. Remove subscription URLs, proxy credentials, and external controller secrets. If only one app cannot connect, explain whether traffic is routed through the system proxy or TUN instead of simply reporting a connection failure.

mihomo · source codeView repository ↗

git clone https://github.com/MetaCubeX/mihomo.git

This command retrieves the core source code. Install Git before running it.

First-connection troubleshooting steps

First verify that the current configuration loads, then confirm the target app's traffic reaches the client, and finally check the matched rule and outbound policy. If the system proxy is on but no connections appear, check whether the app uses the system proxy. If connections appear but the destination is unreachable, check the matched rule, DNS resolution, and selected outbound. Latency tests only reflect the target and method used; they cannot prove that websites, terminals, or other apps will all work. Gather information layer by layer to distinguish permission, configuration, and network issues.

For the complete setup sequence, start with the subscription import and first connection guide. For configuration parsing or connection issues, see common questions and troubleshooting. Installation, system permissions, and platform-specific settings are covered in the cross-platform guides, so you can check each item for your device.

Recent configuration and troubleshooting articles

Find guidance for specific issues: importing a configuration on iPhone, subscription parsing failures, and the basics of mixed ports and routing modes. Identify the step where the problem occurs, then check the setting in your client.

2026-10-17Platform Guides

Using Clash rules on iPhone: Find a compatible App Store client and import a configuration

Learn how to get an iOS client that supports Clash configurations from the App Store and import a subscription by link, file, or QR code. Includes VPN permissions and background activity settings.

Read article →

2026-09-28Troubleshooting

Clash subscription update failures and configuration parse errors: Causes and troubleshooting steps

Work through expired subscription links, unexpected response formats, YAML indentation errors, and unsupported fields, from the outside in. Also explains common log messages.

Read article →

2026-09-09Getting Started

10 Clash questions for beginners: Mixed ports, routing modes, subscriptions, and rules explained

Answers to 10 common beginner questions, including how clients and cores relate, rule mode versus global mode, what port 7890 does, and how often to update subscriptions. Each answer points to the relevant setting.

Read article →

Browse all articles →