Import a subscriptionSwitch proxy modeRoute traffic by rules
Workspace file cabinet
Clash Core Settings
Understand what each setting controls before combining them. Labels may vary between clients; these notes describe configuration behavior, not the location of a specific control in a particular app.
mode: rule
Rule-based routing
Rule mode uses conditions in the configuration to decide whether traffic goes through a proxy or connects directly, making it useful when accessing different types of services. Rules are usually evaluated from top to bottom, and the first match determines the outbound route, so rule order and policy group names both matter. After importing a subscription, check the matching rule in the connection log before adding your own domain rules. Compared with Global mode, Rule mode gives you more control over how traffic is routed; compared with Direct mode, it can send selected requests to a proxy group. The example uses PROXY, which must exist as a policy in your configuration; copying the name alone will not make it work.
A subscription link is a configuration URL provided by your service provider, not a website login address. Paste the complete link into the client's import screen and wait for the download to finish. You must then select the configuration before you can use it. Subscription updates typically sync nodes, rules, and policy groups; update frequency may depend on your plan, so there's no need to refresh repeatedly by hand. Clients handle local overrides differently, so check what will be replaced by the next update before editing. Subscription URLs may contain account identifiers. Hide the full link in screenshots, and use a trusted method to transfer it between devices.
TUN uses a virtual network interface and routing settings to capture traffic, which can help with apps that ignore the system proxy. What it covers depends on routes, exclusions, and DNS settings. Desktop clients often require a service or administrator permission, so confirm that a standard proxy connection works before enabling TUN. It is not a node speed boost and cannot replace a valid subscription configuration. If another VPN is running on the device, pause one first to avoid conflicting routes. After enabling TUN, check the connection log for requests from the target app. When you exit, make sure the client restores the network settings.
System proxy points the operating system's proxy address to a local port that the client listens on. Browsers and apps that honor system settings can then connect through it. For your first setup, enable the configuration and select a node before turning on this switch; changing one thing at a time makes troubleshooting easier. Some apps have their own proxy settings, while others ignore the system proxy entirely. Check the app's documentation or consider TUN in those cases. Turn off the system proxy before closing the client to avoid losing access when its local port stops listening. An enabled system proxy does not mean every app is using it.
The Clash ecosystem includes different cores and graphical clients. Configuration compatibility depends on the core a client actually includes, not just its name. Meta is the historical name of a related fork, and mihomo continues that line of development; older versions of the original core may not support newer protocols or fields. If an import fails, check the error for the protocol type and field name, then compare them with the core's documentation instead of repeatedly reinstalling. Some interfaces let you switch cores; others use a single implementation. Before changing clients, keep a copy of the original configuration and check DNS, rule providers, and TUN settings one by one to avoid connection problems caused by different defaults.
LAN sharing lets phones, tablets, and other devices on the same network use a proxy port on your computer. In addition to enabling allow-lan, make sure the listen address accepts connections from other devices and limit firewall access to trusted networks. On a connected device, enter the computer's LAN address and the actual port—not the loopback address, which refers to the device itself. A mixed port can accept both HTTP and SOCKS5 requests, but each device still needs to use a proxy type it supports. Sleep, address changes, or closing the client will interrupt sharing. Test with one device before adding more.
Choose an installer that matches your operating system, processor architecture, and use case. The links below open the relevant platform section on the download page. Downloading a client and getting a subscription are separate steps; you'll still need a usable configuration after installing the app.
For everyday desktop use, start with Clash Plus, then compare the interface and configuration management in Clash Verge Rev, FlClash, and Clash Nyanpasu. Check your processor architecture in system settings before downloading; an installer for another platform may not run on your device.
For your first connection, start with the system proxy. If you need TUN, install its service or grant permissions as described by the client. If you're looking for a Clash for Windows alternative, back up your local rules and configuration first. After migrating, check policy groups, keyboard shortcuts, and launch-at-login settings one by one; old settings may not carry over automatically.
Choose the right installer for Apple Silicon or Intel. Clash Plus, Clash Verge Rev, and FlClash are good starting points for comparing desktop clients. The download page also includes archived information about ClashX Meta to help you plan a migration from an older configuration.
After installation, grant the permissions requested by macOS, then import your subscription. If the system proxy is on but some apps don't appear in the connection log, check whether they use their own network settings. TUN involves routing and permissions, so avoid enabling it alongside another VPN. If you run into problems, start with just one client and one configuration.
Android options include Clash Plus, Clash Meta for Android, FlClash, and Surfboard. Supported configuration formats vary between clients. When switching to Surfboard in particular, first confirm that your provider offers a compatible format; the appearance of a subscription URL alone doesn't tell you whether it's supported.
The first time you connect, Android usually asks you to authorize the system VPN. This allows the client to create a local traffic-capture tunnel. If the connection works while the screen is on but drops when it's off, check battery optimization, background activity, and auto-start settings. Compare speed tests and web access on the same network, since mobile data and Wi-Fi can behave differently.
iPhone and iPad users can open the Clash Plus App Store page from the download page. The project's official site is clashplus.io. After installing, get your subscription link, import it into the app, select the configuration, and follow the system prompts to allow a VPN configuration.
Desktop and mobile clients place their menus differently, so it's more reliable to understand what each step does than to hunt for a switch with the same label as in a screenshot. If another VPN configuration is already on your device, check which one is active. Troubleshoot subscription update failures separately from proxy connection failures; the former can happen while downloading the configuration.
Desktop users can compare Clash Verge Rev and FlClash, starting by checking which package formats each release supports. For servers and routers, see the mihomo command-line deployment guide and prepare a configuration file, working directory, and service management method. A graphical client and a core binary are different kinds of software.
Linux desktop environments handle system proxy settings differently, and command-line tools may need proxy environment variables configured separately. Before running a persistent service, start it in the foreground and check that the configuration parses correctly. Then set up systemd user permissions and the working directory. When enabling a listener on a remote machine, restrict the permitted sources so you don't expose the management interface or proxy port to untrusted networks.
If you're unsure which client to choose, start with the recommendation for your platform, import a subscription, and test a web page before trying advanced settings. When comparing clients, focus on configuration compatibility, system integration, maintenance status, and workflow rather than installing many clients at once. Keep a clean test environment so you can identify which change caused a connection problem.
Download links help you choose software; project documentation helps explain how it works. When troubleshooting a configuration, look at the client, core, and subscription source separately. That's usually more useful than searching for a software name alone.
Project history and client relationships
Clash began as a rule-based proxy implementation, followed by different forks and companion graphical interfaces. The configuration list, tray menu, and connection panel you see on a desktop are usually provided by the client; the core handles protocols, rule matching, and network connections. They work together, but their update schedules and compatibility are not always in sync.
A similar name doesn't guarantee the same features. An older client may load a configuration without supporting every newer field in it, while a newer client may use different defaults. Before migrating, record your original subscription, local changes, and interface preferences separately. Restore a basic connection first, then bring back custom rules gradually. Archived software can help you understand historical behavior; for a new installation, a maintained option is usually a better starting point.
Meta and mihomo cores
Clash Meta and mihomo are names from the same line of development, and many guides and configurations still use the historical name Meta. The mihomo project documentation covers its supported protocols, rule providers, DNS, and TUN settings. Check which core your current client uses while reading the docs; fields from another fork are not necessarily interchangeable.
When a configuration fails to parse, note the field name and error location shown by the client. If a protocol isn't supported, check the subscription's output format and the core's capabilities. If a policy is missing, make sure the name referenced by the rule matches a policy group. Changing a connection toggle in the interface usually won't fix syntax or compatibility problems in the configuration itself. See the site's Comparisons and Glossary to understand these distinctions.
Open-source documentation and updates
Open-source repositories track code, issue discussions, and release notes, making them useful for checking feature changes. This site doesn't publish unverified star counts, download totals, or ratings; recommendations are based on platform support and configuration compatibility. To explore the core's implementation, visit the MetaCubeX/mihomo repository and review the documentation before deciding whether to build it yourself.
Client updates, core updates, and subscription updates each affect different things. A client update may change the interface, system integration, or bundled core; a subscription update mainly syncs configuration supplied by your provider. Back up local overrides before updating. Afterwards, check that the configuration is still selected, whether the listening port changed, and whether the system proxy is restored. The download page collects current download links; the homepage explains how to choose and configure a client.
Configuration privacy and use
Subscription URLs, configuration files, and connection logs may contain account identifiers, server addresses, or visited domains. When troubleshooting, share the error type, rule name, and necessary fields, but hide subscription URLs and authentication details. Review configurations from unfamiliar sources before importing them, especially remote rule sources, listen addresses, and external control settings. Don't merge snippets into an existing configuration if you don't understand what they do.
Proxy clients are network configuration tools. Whether a connection works depends on your subscription service, the destination website, and your current network. Follow local laws, your organization's network policies, and your provider's terms. This site collects ecosystem information and installation guides; client features and release information should be verified with each project. The site name identifies this brand and does not imply that we represent the developers of every third-party client.
Popular FAQs
Why do I need to import a subscription after installing Clash?
The client provides proxy connections and configuration management; the subscription supplies the nodes, policies, and rules. Installing the app doesn't give you a usable outbound connection by itself. Get a subscription link from your provider, import it, select the configuration, and then enable the connection. Don't use a control panel's login URL as a subscription link. See the Glossary to learn the difference between subscriptions, nodes, and policy groups.
Why can't I open a website even though a node test succeeds?
A speed test usually measures the response from one test address; it doesn't prove that a particular website is reachable. Check whether the browser request appears in the connection log, then review the matched rule, active policy group, and DNS result. If there's no log entry, check the system proxy or the app's own network settings first. Understanding the terminology can make troubleshooting easier; see Rules and Network Modes.
Are Rule mode, system proxy, and TUN the same setting?
They control different parts of the connection. System proxy and TUN determine how requests enter the client; Rule mode determines which route an intercepted request takes. You can use Rule mode with either the system proxy or TUN. When setting things up, change one part at a time. See Network Mode Terms.
Why did my local rules change after a subscription update?
Direct edits to a configuration downloaded from a remote subscription may be overwritten during the next update. To keep rules long term, use the client's supported override, merge, or local configuration features, and check their processing order. After updating, check whether policy group names have changed so your local rules don't refer to groups that no longer exist. See Subscription and Configuration Terms.
Practical Guides
Clash configuration guides
From choosing nodes and deploying on Linux to core compatibility, these articles explain common points of confusion in everyday use. Articles are listed by publication date. For platform-specific steps and basics, visit the all-platform guides.
For new users who have just imported a subscription, this guide explains latency readings, traffic multipliers, region labels, and protocol types in the node list, with tips for choosing nodes for browsing, video, and gaming.
Two ways to run Clash on Linux: install a graphical client on a desktop distribution, or run the mihomo binary with config.yaml as a persistent systemd service on a headless server.
Trace the evolution of the original Clash core, Clash Meta, and mihomo, then compare protocol support, rule types, and configuration fields to determine which core works with your subscription.