Client Selection / Configuration Basicsmode: rule

Clash Usage Guide
and Client Downloads

Download Clash View Guide

From importing a subscription to routing by rule, complete connection verification along the way.

Windows Android iOS macOS Linux
Chinese Instructions Configuration Field Reference Layered Network Diagnostics

An independent guide site. Clients provide the control interface; subscription services require separate configuration.

Rule logic illustration, not live monitoring. PROXY must be defined separately; this snippet cannot run on its own. Full field explanations are provided below. CONFIG / 01

Getting started: Choose a client → Import configuration → Enable traffic capture → Verify the app

User Guide

Conditions / Actions

How traffic enters the kernel and where it goes

System proxies and TUN determine which requests enter the kernel; rule mode determines which path they take afterward. Separate these layers first, then examine subscription content and policy groups so troubleshooting points to the right setting.

System Proxy: Give Apps a Local Entry Point

Best for browsers and other apps that follow system proxy settings. In the client, select a configuration and start the kernel, then enable “System Proxy” and confirm that the system proxy address matches the client’s listening port. Opening the client alone does not reroute traffic; browser extensions, built-in proxy settings, and terminal environment variables may override system settings.

To verify, make a new web request first, then check the client’s connection log. If the browser works but the terminal still fails, first confirm that the terminal uses the same entry point; do not switch to global mode immediately. Control names vary between clients, but the check order remains: “listening port → app proxy → connection log.”

Layered Troubleshooting for Browsers and Terminals → 
mixed-port: 7890
allow-lan: false
bind-address: 127.0.0.1

Ports are examples; use the value shown by the client. A mixed port accepts both HTTP and SOCKS proxy requests. These fields do not configure proxy settings for apps automatically.

Rule Mode: Match in Order, Not by Guessing from Names

Everyday routing usually starts with mode: rule. The kernel checks rules in order; the first match determines the route, and later rules are skipped for that request. Put specific domain and LAN rules before the fallback rule. Policy group names must exactly match the definitions in your configuration—do not treat PROXY in the illustration as a built-in exit.

DOMAIN-SUFFIX matches a specified domain and its subdomains; DOMAIN matches only the specified domain. The example IP-CIDR covers a private address range, while no-resolve means the IP rule will not actively resolve a domain; it does not disable all DNS. MATCH is the fallback rule and should remain at the end of the list.

Read the Rules and Policy Groups Guide → 
mode: rule
rules:
  - DOMAIN-SUFFIX,example.org,DIRECT
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - DOMAIN,blocked.example,REJECT
  - MATCH,PROXY

This tutorial snippet does not include proxy nodes or policy group definitions. In practice, merge it into a compatible full configuration rather than replacing the entire subscription file.

rule: Select direct connection, rejection, or a policy group according to rules. Useful for keeping LAN traffic direct while assigning different paths to different targets.

TUN: Handle Apps That Ignore System Proxies

Consider TUN when an app has no proxy entry or ignores system proxy settings. TUN captures traffic through a virtual network interface and routing rules, while the kernel’s proxy mode still determines the exit. TUN and rule mode are not mutually exclusive, and TUN is not simply a “more global” version of global mode.

Before enabling it, confirm client support, install any required service, and grant network permissions as prompted while keeping the existing settings. Do not run multiple traffic-capture tools at once; test ordinary web pages, LAN devices, and the target app first, then handle DNS or routing exceptions. If problems appear, disable the newly enabled TUN first, confirm that basic networking has recovered, and adjust one item at a time.

Review TUN Prerequisites and Rollback Steps → 
tun:
  enable: true
  auto-route: true

These examples explain field meanings and are not universal cross-platform configurations. Desktop clients may generate these fields through their interfaces; mobile clients generally use the system VPN interface, with behavior determined by the client implementation.

Subscription Maintenance: Separate Source Configuration from Local Changes

Subscriptions usually provide configuration content such as nodes, policy groups, and rules, but the exact contents depend on the provider. After importing, confirm that the configuration parsed successfully, select it, and inspect the policy groups; “import complete” only means the content was obtained, not that a connection is active. Not every subscription format works directly with Clash-compatible clients.

Keep a working configuration before updating a subscription. Prefer the client’s supported override, merge, or scripting mechanisms for custom rules. Direct edits to subscription-generated files may be overwritten at the next refresh. If an update fails, record the error, check the link and response format, then decide whether to contact the provider; do not repeatedly delete every configuration and retry.

View Import and Local Override Methods →

Subscription and Configuration / Operating Order

  1. Import a compatible subscription from a trusted source.
  2. Confirm that parsing succeeds, then select the active configuration.
  3. Check the policy group names and selected exit.
  4. Enable traffic capture and make a real request.
  5. Back up local changes before scheduling subscription updates.

A subscription URL may contain access credentials. Before sharing logs or screenshots, hide the complete URL, account details, and node passwords to avoid publicly exposing your personal configuration.

Installation Entry Points / Choose by Platform

Before Downloading Clash, Check Your System and Architecture

The client imports configurations, switches policies, and displays connection logs; the kernel executes requests. Similar interfaces do not imply identical kernel capabilities. Consider system requirements, configuration compatibility, and maintenance methods—not just the product name. The links below lead to download pages rather than starting an installer download directly.

Windows

First confirm your device architecture in the system’s About section. You can start with GUI clients such as Clash Plus or Clash Verge Rev, then verify the system proxy entry after installation. If you need TUN, configure service permissions according to the selected client’s instructions.

Go to Downloads
Android

Choose an installer compatible with your device architecture, import a configuration, and confirm system VPN authorization. Background operation, battery optimization, and per-app routing settings affect the capture scope; complete a foreground connection test before adjusting background policies.

Go to Downloads
iOS

Use the download page to open the Clash Plus store listing and check device compatibility and developer details. After installing the client, import a working configuration and add a VPN configuration when prompted by the system; store installation and subscription service are separate steps.

Go to Downloads
macOS

Distinguish Apple Silicon and Intel installers. Network extensions, VPN configurations, and Keychain prompts serve different purposes, so grant permissions according to the mechanisms the client actually uses. When a security prompt appears, verify the source and release notes rather than disabling system protection.

Go to Downloads
Linux

On desktop systems, compare Clash Verge Rev and FlClash, and choose an installation method for your distribution. Headless servers are often better suited to a standalone mihomo deployment. Do not mix GUI client configuration directories with systemd service directories; terminal proxy settings also require separate verification.

Go to Downloads

For first use, follow the shortest path: keep the default listening settings, import one compatible configuration, choose an available policy, and verify with a single app. Before basic connectivity is confirmed, avoid adding TUN, custom DNS, and complex routing rules at the same time. Change one thing at a time to make the cause of each result clear.

View All Clients →

Sources / Ecosystem and Maintenance Boundaries

What Clients, Kernels, and Subscription Services Each Do

Independent Guide Site and Upstream Projects

Clash Usage Guide organizes installation entry points, configuration concepts, and reproducible procedures. It is not the official site for any client, kernel, or subscription service. When searching for the “Clash official site,” first identify the project you need: clients have their own release channels, kernels have separate repositories, and subscriptions come from their respective providers. This site’s guidance does not replace upstream announcements and makes no guarantee about third-party service availability.

The Relationship Between Clash and mihomo

The name Clash is often used for a family of compatible configuration and rule systems, not a single client with unified releases for every platform. The original project, later kernels, and different GUIs have separate maintenance histories. mihomo continues the Clash Meta development line. When “Meta” and “mihomo” appear in older documentation or newer configurations, identify them from context rather than assuming an installer suits the current device.

A GUI client may bundle a kernel or allow you to switch kernels. Protocol support, DNS fields, and rule capabilities depend on the kernel actually running, while the available interface settings depend on the client. Before migrating an old configuration, review parsing errors and unsupported fields, then adjust them individually; changing a file extension to YAML does not convert the format automatically.

Keep a Rollback-Ready Configuration When Updating

App updates, kernel updates, and subscription updates are three different operations. An app update may change the interface and permission model; a kernel update may change field compatibility; a subscription update changes the provider’s content. During maintenance, record the client, kernel, and current configuration before making changes. Read the release notes, verify the connection after updating one item, and only then continue. This makes the rollback target clear instead of requiring every component to be reinstalled.

Verify with Real Requests, Not Just Toggles

A node test reflects one probe at one moment and does not prove that browsers, terminals, and other apps will work. A more reliable check is to make the target request, find it in the connection log, confirm the matched rule and policy, and then check whether the app received the expected response. When reporting a problem, redacted error details, reproduction steps, and network context are more useful than simply saying “unable to connect.”

Three Common Questions Before You Configure

Does downloading a client provide usable nodes?A client is a management and connection tool, not a subscription service. You need a trusted, compatible configuration and must confirm that its service is still active. See the Help Center’s basics on concepts, installation, and configuration.

Can Clash global mode fix every connection failure?No. Global mode changes how requests are selected after entering the kernel; it cannot fix an inactive listening port, an app bypassing the proxy, an expired subscription, or insufficient permissions. Troubleshoot the capture, rules, and exit in that order instead of attributing every problem to routing.

Why does the same subscription behave differently across clients?Possible factors include kernel capabilities, client overrides, DNS settings, and the scope of app traffic capture. For a meaningful comparison, use the same network and target request, then compare the final effective configurations. See the daily maintenance chapter for more approaches.

Recent Articles / Scenario-Based Troubleshooting

Client Selection and Connection Issues

Each article breaks a practical problem into operating conditions: describe the symptoms, locate the affected path, then provide verification and rollback steps. Distinguish operating-system permissions, client settings, and kernel configuration so that a local fix is not mistaken for a universal switch across platforms.

View All Articles