Open-source core ecosystem · Cross-platform clients
Find Android, iOS, Windows, macOS, and Linux clients in one place, then follow the steps for importing subscriptions, routing by rules, and taking control of network traffic. The site also explains configuration structure, DNS behavior, and common connection issues, helping you go from installation to a working setup.
Tunnel Console
Clash is more than a connection toggle. Understanding how rules, proxy groups, DNS, and TUN work together keeps configurations readable, adjustable, and easier to troubleshoot across different network environments.
RULE ENGINE
Rule mode reads rules from top to bottom and hands the connection to the matching proxy group on the first hit. Domain rules suit common websites, IP rules apply when the destination address has already been resolved, and process rules can route a specific app separately. Unlike a system proxy that offers only a global switch, a Clash configuration records matching conditions in a text file, making results easier to review and reuse on phones and computers. Put narrow, high-priority rules first, then use MATCH for remaining traffic.
rules:
- DOMAIN-SUFFIX,example.com,DIRECT
- GEOIP,CN,DIRECT
- MATCH,ProxyPOLICY GROUP
Proxy groups form the layer between rules and individual nodes. Manual groups suit situations where you need precise control over the exit; auto-select groups choose an available target using the client’s supported tests; failover groups check candidates in order and switch when the current target is unavailable. Rules reference group names, so changing nodes does not require editing every rule. This structure works better with subscription updates than embedding nodes directly in each rule and keeps configuration responsibilities clear.
proxy-groups:
- name: Proxy
type: select
proxies:
- Auto
- DIRECTDNS PIPELINE
DNS settings determine where domains are resolved, how results reach the rule engine, and which fallback path is used when the local network has problems. Fake-IP mode returns a mapped address first, then the core restores the original domain for matching, making it suitable for stable domain rules; redir-host follows a more traditional resolution flow. Also check whether encrypted system DNS, browser-level DNS, and client settings are running in parallel, which can bypass the intended path. When connections work but webpages do not load, DNS is usually worth checking before repeatedly switching nodes.
dns:
enable: true
enhanced-mode: fake-ip
nameserver:
- systemNETWORK STACK
Some games, command-line tools, and standalone runtimes do not read system proxy settings, so enabling a system proxy alone cannot cover their connections. TUN mode uses a virtual network interface to receive more system traffic, then lets the Clash core apply DNS and routing rules. Coverage is broader, but it depends more heavily on system permissions, routing tables, and the state of other VPN tools. On first enablement, close similar traffic-capture tools, complete every permission prompt, and test the browser, terminal, and target apps one by one to avoid mistaking permission conflicts for node problems.
tun:
enable: true
stack: mixed
auto-route: true
auto-detect-interface: truePlatform access
Installation packages, permission models, and background behavior vary by platform. Open the relevant platform section first, then choose a client based on its interface, system architecture, and maintenance status.
Best for desktop workflows involving office apps, browsers, and the command line. After installation, import a subscription and enable the system proxy; to cover more apps, enable service mode or TUN when permitted. The download page lists both graphical and archived clients so you can choose according to your workflow.
For Intel and Apple Silicon devices. The first launch may require installing a network extension and approving system permissions. You can then manage connection status, proxy groups, and the system proxy from the menu bar.
Go to downloadsUses the system VPN interface to capture traffic, making it suitable for phones and tablets. Choose a package for your device architecture and add the client to the background-app whitelist to reduce unexpected disconnects caused by battery-saving policies.
Go to downloadsGet Clash Plus from the App Store, with the connection provided through the system VPN configuration. After importing a subscription, switch between rule mode and proxy groups; during lock-screen use, the system manages the network extension state.
Go to downloadsDesktop environments can use a graphical client, while servers and routers often run the Mihomo core directly. Before installation, confirm the distribution, CPU architecture, and package format. Without a desktop environment, plan the configuration directory, process supervision, log access, and the scope of any external control interface in advance.
The download page includes client details for every platform, system requirements, package links, and answers to common download issues.
View all clients →Quick start
Start with a valid configuration source, then choose a policy and verify the connection. There is no need to change complex parameters immediately; establish a repeatable basic workflow first.
Open the client’s Config, Subscription, or Profiles page, paste the subscription URL provided by your service, and update it. After import, you should see the profile name, proxy groups, and rule details. If the format is invalid, check that the copied content has no extra spaces, and do not confuse a webpage or dashboard URL with the subscription URL. If the profile is still valid but the update fails, check whether the current network can reach the subscription source.
For most daily use, start with rule mode so the configuration chooses direct or proxy routing based on domain and IP conditions. Then open the proxy or policy page and choose auto-select, failover, or a specific node in the main group. Global mode sends most connections through one policy and is better suited to temporary troubleshooting; avoid leaving it enabled long-term without understanding its scope. Return to the home screen after switching and confirm that both the profile and policy are selected.
Enable the system proxy or mobile VPN switch, accept the system permission prompt, and test one site that should connect directly and one target that requires a proxy. If the browser works but other apps do not, check whether those apps read the system proxy and consider TUN mode if necessary. If nothing opens, check subscription status, node availability, DNS, port conflicts, and other VPN tools in that order instead of changing several settings at once.
Open-source ecosystem
The Clash ecosystem brings together cores, graphical clients, configuration providers, and rule-maintenance projects. Understanding these boundaries matters more than memorizing a button’s location: clients handle the interface and system integration, cores parse configurations and process traffic, subscriptions provide nodes and policies, and rule sets describe matching conditions.
git clone https://github.com/MetaCubeX/mihomo.gitEarly Clash established widely used configuration syntax, rule models, and proxy-group concepts. Community cores and clients have continued development from that foundation. Core implementations do not support exactly the same fields, so confirm the target client’s core and syntax documentation before importing a profile. When an unknown field appears, check startup logs and configuration parser errors before deleting an entire feature block.
Graphical clients handle installation, menus, system proxies, VPN permissions, subscription updates, and interface actions; cores such as Mihomo listen on ports, apply rules, manage DNS, and establish proxy connections. Similar client names do not guarantee identical capabilities, so compare platform support, system integration, core type, and maintenance status rather than judging by appearance alone.
YAML configurations express ports, DNS, proxy groups, and rules as readable text. When something goes wrong, you can narrow it down to subscription content, rule order, DNS routing, or system permissions. Rule-set subscriptions are useful for centrally maintaining large domain lists, while local overrides preserve device-specific settings; separating the layers prevents subscription updates from overwriting personal changes.
Client updates, core updates, subscription updates, and rule-set updates are four separate paths. After upgrading a client, check system permissions and configuration compatibility; after updating a subscription, verify that proxy-group names have not changed; after updating rule sets, review source URLs and behavior differences. Updating and validating one layer at a time makes issues easier to locate and is better for maintaining configurations across multiple devices.
Configuration articles
From syncing profiles across devices to macOS permissions and Windows installation, these articles follow real workflows and document key decisions and common stopping points.
After installing clients on phones, computers, and tablets, keeping configurations consistent directly affects rules and policies. This article compares centralized distribution through subscription URLs, WebDAV backups, and manual import and export, explaining what belongs in sync and which settings should remain local.
Read moreOn first launch, network extension, system settings, and Keychain prompts may appear one after another. This article explains each prompt in authorization order and collects reset steps for ineffective permissions, duplicate extension installations, and a system proxy that will not switch.
Read moreFrom choosing an installer and handling Windows security prompts to importing a subscription, enabling the system proxy, and verifying rule matches, this article walks through the full Windows setup flow and explains how to troubleshoot port conflicts, insufficient permissions, and duplicate proxy tools.
Read moreThe article list also includes step-by-step Troubleshooting checklists for Android background battery drain and cases where the client connects but the internet remains unavailable.
View all articles →