Use Clash Rules on iPhone: Get a Compatible App from the App Store and Import a Config

Compatibility: Clash Rules Aren’t a Universal iOS Config

To use Clash rules on an iPhone, what matters is whether the client supports the config format—not whether its name includes Clash. Windows installers won’t run on iOS, and iOS clients don’t necessarily use the desktop Clash or mihomo core. Even when both can read YAML, supported fields, protocols, and rule-set formats may differ.

This guide uses Stash, which supports Clash-style configs, as an example. Before purchasing, check the App Store listing and client documentation for system requirements, config compatibility, and pricing. App availability can vary by Apple Account region and listing status, so a missing search result doesn’t necessarily indicate a device problem.

Get the app from the App Store: Check the listing before installing

App Store listing and system requirements

1. Open the App Store and search for the product name, such as Stash.
2. Open the product page and check the developer, description, update history, and minimum iOS version under “Compatibility.” Don’t rely on a similar icon or a search ad.
3. Check the price and purchase terms shown for your account, then download if they work for you. The app’s purchase price and any subscription service fee are separate costs.
4. Open the client and locate its config import option before preparing a subscription link or local file. You don’t need to connect on first launch.

If the app doesn’t appear in search, tap your profile picture in the top-right corner of the App Store and check the Apple Account used for “Media & Purchases.” Store availability depends on the purchasing account and other factors; changing “Settings” → “General” → “Language & Region” doesn’t switch storefronts.

If you need to change your account’s country or region, follow Apple’s official process and resolve any balance, subscription, and payment-method restrictions. Don’t use shared accounts from unknown sources or sign someone else’s account into iCloud on your device. Enterprise certificates, configuration profile distribution, and App Store downloads are different distribution methods—not interchangeable installation steps.

Three details to note before installing

• Client version: Note the version shown under “Settings” or “About” in the app. You may need it to check support for specific config fields when troubleshooting.
• iOS version: Find it under “Settings” → “General” → “About.”
• Config source: Check which client the subscription panel recommends. If the provider lists separate options for Clash, Stash, and Surge, choose the one explicitly made for your app.

Import by URL: Keep the subscription link and update access

Remote configs are useful when you need regular updates to proxies or rules. These steps follow the typical Stash interface: open the config list, tap “+” in the top-right corner, then choose an option such as “Download from URL.” The label may appear as “Download Config” in other versions. Choose the option for a remote config URL, not the one for adding a single proxy manually.

1. Copy the subscription link for your client from the provider’s account panel. Make sure you copied the full URL—not a login page, purchase page, or piece of displayed text.
2. After pasting, check that the URL is complete and has no extra spaces, line breaks, or punctuation added by a messaging app. Don’t remove query parameters to “clean up” the link.
3. When the download finishes, give the config a name, such as “Everyday Config,” then select it in the config list.
4. Open the config contents or summary and confirm that proxies, proxy groups, and rules loaded. If you see only a list of nodes, check whether you received a proxy subscription instead of a full config.
5. Check the update source and update option in the config details. Run one manual update first, then choose an update interval from the options the client actually provides.

Updating a subscription and updating rule sets may be separate processes. A config may use proxy-providers for proxy collections and rule-providers for rule collections. Even if the main config downloads successfully, these remote resources may fail to download separately. Check the specific resource URL and error in the logs rather than relying on the config name appearing on the home screen.

Import from a file or QR code: Know whether the source is local or remote

Import YAML from the Files app

Local files are useful for moving an existing config or checking its syntax when a network download fails. First save the .yaml or .yml file to Downloads, iCloud Drive, or On My iPhone in the Files app. The extension is only a clue; the contents must still be supported by the target client.

1. In the client’s config list, tap “+” and choose the file import option. If your version doesn’t have one, touch and hold the file in the Files app, tap “Share,” and look for the client.
2. After importing, select the config and check for YAML parsing errors. Use spaces for indentation; don’t use tabs.
3. Check for external resources referenced by the file. Local paths from a desktop config won’t automatically point to files with the same names on your iPhone. Re-import those resources or change the references to a method supported by the client.
4. Keep an untouched copy. Before making local rule changes, check whether a remote update will overwrite them.

A local import is usually a static copy from the time of import; the filename alone won’t link it to the original subscription. To keep it updated, add the source again through the remote config option. Don’t assume that downloading a new file manually updates an existing config.

Scan a subscription QR code

A QR code carries information; it isn’t a config format on its own. It may encode an HTTPS subscription URL or a single proxy URI. Scan it from the client’s add-config or scan option. If the client supports scanning from the photo library, you can select a saved QR code image instead.

• Allow camera access when prompted the first time you scan. You can change this later under “Settings” → “Privacy & Security” → “Camera.”
• If the QR code contains a remote config URL, verify its source and download result, then follow the same steps as for importing by URL.
• If it contains a single proxy, check that it appears in the proxy list. It won’t include a complete set of routing rules.
• When you scan with the built-in Camera app, iOS may show a URL or a redirect prompt; it isn’t guaranteed to send the contents directly to your proxy client.

If the QR code is displayed on the same iPhone, use the client’s photo library scanner if available, or copy the original subscription URL. Don’t upload a screenshot containing a token to a public QR code scanning service.

Grant VPN access and check the first connection

After selecting a config, turn on the client’s connection switch. On the first connection, iOS usually asks permission to add a VPN configuration. Check the app name, tap “Allow,” then authenticate with your passcode or biometrics if prompted. This lets the client create a network tunnel; it doesn’t install a certificate from the subscription provider.

Check the VPN status under “Settings” → “General” → “VPN & Device Management” → “VPN.” If your device is managed by an organization, its policies may restrict VPN permissions. Ask your administrator; repeatedly importing the config won’t bypass the restriction.

Verify routing in four steps

1. Choose rule mode: In the client’s outbound or mode settings, select “Rule.” Global mode is mainly useful for temporary comparisons, not for verifying that rules work.
2. Check proxy groups: Open a proxy group that exists in the config and select an available node, or use the auto-select group defined in the config.
3. Test two types of requests: Visit one site expected to connect directly and another expected to use the proxy. Check the request log for the matched rule, policy, and outbound.
4. Test your apps: Once a browser works, test the app you want to use. Existing long-lived connections may keep using the old route, so close and reopen the app if needed.

The desktop setting mixed-port: 7890 defines a local proxy listening port; it isn’t required to start a VPN tunnel on iPhone. Don’t set your Wi-Fi proxy to 127.0.0.1:7890 as a substitute for turning on the client. That address points to the phone itself, and there may not be a service listening on it.

iOS clients typically create tunnels through the system Network Extension. You can’t follow desktop mihomo instructions for “installing a service” or setting up a TUN interface. Don’t assume desktop config options such as tun, routing, and DNS settings have equivalent effects on iOS.

Background operation: Screen lock, network changes, and on-demand connections

On iOS, the Network Extension handles the tunnel; the app’s interface doesn’t need to stay in the foreground. “Background App Refresh” is a separate setting and doesn’t determine whether the tunnel stays active. Enabling it doesn’t guarantee a connection will never drop, and repeatedly force-quitting the client won’t “keep it alive.”

Recommended test sequence

• Lock-screen test: First confirm that browsing works in the foreground. Then lock the screen for about 2 minutes, unlock it, and check the VPN status and new request logs. This is a troubleshooting step, not a battery-life or stability test.
• Network switch test: Switch from Wi-Fi to cellular and see whether the connection recovers. If it fails only on cellular, check the client’s cellular data access under “Settings” → “Cellular.”
• On-demand connection: If the client offers “On Demand,” configure its network conditions as instructed. This controls when a connection starts; it won’t fix a dead proxy node or a faulty config.
• Low Power Mode: If a problem occurs only in Low Power Mode, temporarily turn it off to compare. Don’t assume it explains every dropped connection.

Remote config updates may depend on the client’s scheduler, foreground operation, or opportunities allowed by iOS to run in the background. Even with an update interval configured, iOS won’t necessarily wake the app at exact times. If you haven’t opened the client in a while, check when the config was last updated before using it again.

Other VPNs, DNS filters, and security-related network extensions can affect routing or DNS resolution. For troubleshooting, disable other services and test with just one tunnel active. Don’t delete management profiles installed by your employer or school.

Common errors: Troubleshoot downloads, parsing, and connections separately

A successful latency test doesn’t mean every connection will work. The test may use a specific URL and may not cover the target site’s DNS, UDP, or routing path. Conversely, a timeout may mean the test endpoint is unreachable. One number alone can’t prove the entire subscription is broken.

When contacting your provider or client maintainer, include the client version, iOS version, import method, time of the error, and redacted logs. Keep field names and error line numbers, but remove subscription tokens, passwords, private keys, and personal account details. Troubleshoot in this order: can the config download, can it parse, can the tunnel start, and which outbound handles the request? This is usually more effective than reinstalling repeatedly.