Windows
Ideal for everyday desktop use. Choose a graphical client such as Clash Plus, Clash Verge Rev, FlClash, or Clash Nyanpasu, then configure the system proxy, startup behavior, and TUN interception as needed.
Go to DownloadsFind Windows, macOS, Android, iOS, and Linux clients in one place, then follow clear steps for subscription imports, rule-based routing, and DNS configuration.
The Clash client handles configuration management and system integration, while cores such as mihomo listen on ports, resolve DNS, match rules, and select proxy policies. The four key stages below follow a practical configuration workflow, explaining what each stage solves and where to find more detail.
Rule-based routing answers one question: “Where should each connection go?” The rules section checks domains, IPs, processes, or rule sets from top to bottom, then sends a match to the specified proxy group. Put more specific rules first and fallback rules last to avoid common mismatches.
Unlike traditional proxy tools with a single on/off switch, the Clash ecosystem separates matching conditions from node selection. The same rules can be reused over time; when nodes change, update the subscription or adjust the proxy groups instead. For syntax details, see the rules section in the configuration reference.
rules:
- DOMAIN-SUFFIX,example.org,DIRECT
- GEOIP,LAN,DIRECT
- RULE-SET,work,Work
- MATCH,Proxy
DNS settings determine how domains are resolved and whether the rule engine can still identify them during connection setup. With fake-ip enabled, the core returns reserved addresses and maintains a mapping; when the connection arrives, it restores the original domain and applies the rules. This approach suits configurations that need consistent domain routing and transparent interception.
Check nameserver, fallback, and rule policies together; replacing a single server address is rarely enough. When a website resolves incorrectly, verify the listener, enhanced mode, filter lists, and upstream reachability in that order. The glossary explains the differences between Fake-IP, DNS pollution, and resolution paths.
dns:
enable: true
enhanced-mode: fake-ip
fake-ip-range: 198.18.0.1/16
nameserver:
- system
Proxy groups provide a stable interface between rules and nodes. Rules reference group names such as “Proxy,” “Work,” or “Streaming,” while each group organizes nodes through manual selection, latency testing, or failover. After a subscription update, the rules usually need no changes as long as group names and references remain consistent.
Automatic policies do not mean every scenario should use the same test method. Mobile networks benefit from stable switching, fixed networks can use longer test intervals, and services requiring a fixed exit are better suited to manual selection. Understand the differences between select, url-test, and fallback before deciding how to nest groups.
All five platforms can load a Clash configuration, but system proxies, VPN interfaces, startup behavior, and background execution differ. On desktops, start with the system proxy for verification and consider TUN when more applications need to be intercepted. Android and iOS use the VPN interfaces provided by their operating systems.
Cross-platform migration is therefore more than copying a configuration file. Recheck file permissions, DNS interception, background restrictions, and local network access. The download page lists clients by operating system, while the guides follow a shared workflow and call out desktop-versus-mobile differences at key steps.
The download page lists available graphical clients, use cases, and system requirements by platform. It does not distribute installer files directly; it takes you to the section for your current device so you can compare client options.
Ideal for everyday desktop use. Choose a graphical client such as Clash Plus, Clash Verge Rev, FlClash, or Clash Nyanpasu, then configure the system proxy, startup behavior, and TUN interception as needed.
Go to DownloadsSupports both Apple Silicon and Intel devices. Check your processor architecture before choosing an installer, then follow the system prompts to grant app permissions and configure the network extension on first launch.
Go to DownloadsIntercept app connections through the Android VPN interface. Common choices include Clash Plus, Clash Meta for Android, FlClash, and Surfboard. Before importing, confirm the subscription format and background-running permissions.
Go to DownloadsInstall Clash Plus from the system store and use the system VPN configuration for interception. On mobile, also check on-demand connection, cellular data permissions, and background restrictions.
Go to DownloadsGraphical clients work well on desktops, while servers, routers, and lightweight environments are better suited to direct mihomo deployment. Before installation, distinguish the package format, processor architecture, and service permissions.
Go to DownloadsWhen using the client for the first time, there is no need to change complex rules immediately. Install the client, import a configuration, and verify a basic connection first. Once the main path works, handle DNS, TUN, local network access, or overrides. This makes each problem easier to isolate.
View the Full Guide →Open the download page and choose your operating system and processor architecture. Complete the permission setup requested by the desktop OS, or approve VPN configuration access on mobile. After the first launch, keep the default port and basic options.
Paste the subscription URL on the configuration page or load a YAML file from local storage. After refreshing, check that the configuration parsed successfully and that the proxy page shows proxy groups and available nodes.
Select the primary proxy group first, then enable the system proxy or mobile VPN. Test both direct and proxied destinations, and check the logs for matched rules to confirm that traffic exits as expected.
The Clash ecosystem consists of multiple independent projects. To decide whether a client fits your device, look beyond its interface name and confirm its core, supported configuration fields, system integration method, and maintenance status.
Clash established a rule-driven proxy configuration model: nodes handle connections, proxy groups handle selection, and rules handle routing. The community later developed desktop clients, mobile clients, and derived cores around this model. Although today’s clients look different, they still expose similar structures for configuration, proxies, connections, and logs.
Different clients are usually maintained by different teams, so release schedules and platform support vary. This site organizes download links, client comparisons, terminology, and configuration documentation separately to avoid treating “Clash,” “mihomo,” and a specific graphical client as one project. Choose based on platform compatibility and actual feature requirements.
Graphical clients mainly handle configuration management, system proxies, tray menus, log viewing, and update entry points. Cores such as mihomo handle protocol connections, DNS, rule matching, proxy groups, and traffic forwarding. If a configuration field is not recognized, check both the core used by the client and its supported syntax instead of reinstalling only the interface.
Client updates, core updates, subscription refreshes, and GeoIP or GeoSite data updates follow four separate paths. Upgrading a client does not necessarily change subscription content, and refreshing a subscription does not automatically fix local overrides. Keep a configuration that loads correctly and record where you make changes so you can identify differences quickly after an update.
First check the refresh result and parsing errors in the logs, then confirm that the subscription contains proxy-groups. If it includes nodes but no proxy group definitions, the client will not automatically create a complete routing structure. See installation and configuration issues for more solutions.
For initial testing, start with the system proxy because it is simpler and easier to observe. Use TUN when you need to intercept applications that ignore system proxy settings, after reviewing its routing, DNS, and permission requirements. Compare the related concepts in the glossary.
Check whether the proxy group actually selected that node, which rule matched the request, whether DNS returned the expected result, and whether the system proxy or VPN is still enabled. Avoid changing several components at once, or it will be difficult to identify the real cause.
Keep a copy of the configuration that currently loads correctly, use spaces for indentation, and avoid Tab characters. Change one logical block at a time, run a configuration check after saving, and only then enable the new configuration. Look up field details in the configuration reference.
These articles cover client interfaces, YAML structure, and DNS troubleshooting. Each focuses on one specific topic, making it easy to consult after completing the basic installation.
Breaks down proxy group and node switching on the Proxy page, subscription management and override entry points on the Configuration page, and level filters and connection records on the Logs page. Ideal for learning the interface before changing settings.
Read the Full ArticleWalks through common fields, DNS, node definitions, proxy groups, and rule tables in file order, using readable YAML snippets to show how the fields reference one another.
Read the Full ArticleStart by confirming the actual path of DNS requests, then check enhanced mode, filter lists, default upstreams, and fallback upstreams in order, with a verification sequence for the updated settings.
Read the Full Article