How to Install and Set Up a Clash Client: Windows, macOS & Android

Before You Install: Check the Client, Core, and System Architecture

A Clash client typically consists of a graphical interface and a proxy core. The interface handles configuration imports, node selection, and system proxy settings; the core processes rules, establishes connections, and forwards traffic. Clash Meta is now called mihomo and is a core project. Different clients with Clash in their name may use different cores and support different configuration fields.

Before installing, check three things: your device's architecture, the operating system versions supported by the client, and whether your subscription provides a configuration compatible with the core in use. The legacy Clash core is not interchangeable with mihomo. For example, subscriptions with nodes such as Hysteria2 require a client whose bundled core supports that protocol.

A 64-bit Android processor does not necessarily mean the system supports 64-bit apps. If you see an incompatible package warning, check which ABIs the system actually supports. If you're familiar with ADB, run adb shell getprop ro.product.cpu.abilist. If in doubt, use the client's universal build and check its minimum Android version.

Windows: Install the Client and Set Up a Local Proxy Port

Get the Client Running Before Configuring Traffic Routing

1. Download the installer that matches your system architecture. Follow the setup wizard for an installer build. For a portable build, extract it to a permanent folder first; don't run it from the archive preview window.
2. Launch the client as a standard user the first time. Check that the main window opens, the status page shows the core running, and the logs aren't repeatedly reporting startup failures.
3. Import and activate a configuration, then note the HTTP, SOCKS, or mixed port shown in the client. This guide uses 7890 as an example; use the value from your current configuration.
4. For your first test, use Rule mode with System Proxy. Leave TUN off for now to avoid adding virtual network adapters, routing, and service permissions to the mix.

A Windows Firewall prompt and an administrator permission prompt are not the same thing. Using the loopback address for the proxy typically does not require opening inbound access to public networks. Only consider LAN listening and firewall rules if other devices need to connect to this machine; set access controls and restrict the allowed sources as well.

Make Sure the System Proxy Uses the Right Port

In Windows 11, check manual proxy settings under Settings → Network & internet → Proxy. When the client enables the system proxy, the address is usually 127.0.0.1, and the port should match its HTTP or mixed port. Don't enter a SOCKS-only port in the HTTP proxy field.

# PowerShell: Check whether the example port is listening
Get-NetTCPConnection -LocalPort 7890 -State Listen

# Use the built-in curl.exe to test through the local HTTP proxy explicitly
curl.exe -I --proxy http://127.0.0.1:7890 https://example.com

If the first command returns nothing, check that the port is correct and the core is running. The second command tests an explicitly configured proxy connection; it doesn't prove that every app is using the system proxy. Using curl.exe instead of curl also avoids alias differences in some PowerShell environments.

macOS: Install the App and Grant Network Permissions

1. Open the disk image, drag the app into Applications, then launch it from there. Avoid running it from the read-only disk image long-term, as updates or helper component installs may fail.
2. Check the installer architecture. Apple silicon devices should use an arm64 build; Intel devices can't run apps built exclusively for Apple silicon.
3. If the client asks to install a helper tool, verify the app's name and purpose in the prompt first. Setting the system proxy or creating a TUN interface may require approval; importing a subscription alone generally does not.
4. After enabling the system proxy, check the address and port in System Settings → Network → your active network service → Details → Proxies on macOS 13 and later.

Menu names may vary slightly between macOS versions. Check the network service you're actually using, such as Wi-Fi or Ethernet, rather than an inactive service. HTTP, HTTPS, and SOCKS are separate proxy endpoints; which ones to enable depends on the client. You don't need to turn on every option.

To check the system proxy in Terminal, run scutil --proxy. Compare the enabled status and port for HTTP, HTTPS, or SOCKS with the client settings. Terminal tools may not use the macOS system proxy, so specify --proxy explicitly when testing.

Android: Grant VPN Access and Allow Background Activity

Android clients often use the system VpnService to create a local VPN interface that routes device traffic through the proxy core. This doesn't mean you need to buy a separate VPN service, nor does it guarantee that every connection uses a remote node. The exit path depends on your rules, proxy groups, and per-app settings.

1. When installing an APK, temporarily grant install permission only to the app you're using to open it. The usual path is Settings → Apps → Special app access → Install unknown apps; names may vary by device.
2. Open the client, import a configuration, and select it as the active configuration. Make sure the nodes and proxy groups appear before tapping Connect or Start.
3. Read the system VPN connection prompt and allow it only after confirming it comes from the client you just installed. A VPN icon in the status bar means the interface is up; it doesn't confirm that a remote node is working.
4. If the connection drops when the screen locks, check background restrictions under Settings → Apps → [client name] → Battery. Some manufacturers also require you to allow the app to run continuously in Autostart or Background management settings.

VPN services usually can't run side by side freely within the same user or work profile. If the device is already running a corporate VPN, a VPN-based firewall, or another proxy app, starting a new client may disconnect the existing one. Check which VPN is active before testing so you don't mistake a service switch for a node failure.

For your first setup, don't turn on Always-on VPN or Block connections without VPN right away. First verify that the subscription, nodes, and internet connection work, then enable these options if needed. If blocking is on and you stop the client, losing internet access may be expected system behavior.

Import a Subscription: Updating It Isn't Enough—Activate the Configuration

Check the URL, the downloaded content, and the active configuration—in that order

1. Choose URL import in the client's subscription or configuration screen and paste the complete URL. Don't delete query parameters or mistake a webpage title for the subscription link.
2. After downloading, check the update time and parsing results. A successful download that returns a login page, an error message, or a format for another client still won't give you a usable configuration.
3. Set the new configuration as the active one. Seeing a subscription in the list doesn't necessarily mean the core has switched to it.
4. Open the proxy groups page and select a working node or an automatic selection group. If a rule ultimately points to a manual selection group, the group's selected option determines where requests go.

If a subscription update fails, first check whether the link has expired, whether your network can reach the provider, and whether the server returned valid content. If the client offers an Update via proxy option, it may not work before you have a usable node. Follow the provider's instructions to choose an update method that works in your situation.

You can start with automatic updates every 24 hours; this is a suggested starting point, not a default shared by all clients. Subscription updates in graphical clients usually replace the local configuration, so edits made directly to a downloaded file may be lost the next time it updates. For changes you need to keep, use the client's supported override or merge feature, and back up your configuration first.

Full Configurations vs. Proxy Providers

A complete YAML configuration can include proxies, proxy-groups, rules, and DNS settings. proxy-providers reference a source of nodes from within a configuration; their interval field should not be treated as the update interval for an entire subscription in a graphical client. If you only have a node list, don't assume it includes traffic-routing rules.

Initial Setup: Ports, Rule Mode, and When to Use TUN

For your first test, run just one client. Two clients changing the system proxy at the same time, or two cores listening on the same port, make problems harder to diagnose. The local configuration fields below are examples only; they contain no nodes and can't provide internet access on their own.

mixed-port: 7890
allow-lan: false
mode: rule
log-level: info

• mixed-port: Accepts both HTTP and SOCKS proxy connections on the same port. The example uses 7890. If the port is already in use, choose another available port and update anything that uses it.
• allow-lan: false: Don't allow LAN access. Keep this disabled for single-device use to reduce unnecessary exposure.
• mode: rule: Use rules to decide whether traffic goes direct, through a proxy, or is blocked. Global mode is useful for a temporary comparison test, but shouldn't replace checking which rules match.
• log-level: info: Start with standard logging. Switch to debug briefly when troubleshooting, and remove subscription credentials, node passwords, and private browsing details before sharing logs.

The system proxy only affects apps that honor the relevant settings; it doesn't automatically route all UDP traffic, games, or apps with their own network stack. Desktop TUN routes more traffic through a virtual network adapter and routing rules, and usually needs administrator privileges or a helper service. Android VPN routing and desktop system proxy settings are also different mechanisms, not equivalent switches.

After your first test succeeds, consider TUN only if a target app still doesn't use the system proxy. Note the original settings before enabling it, and avoid running it alongside another VPN. Configure DNS mode, route exclusions, and the TUN stack according to the core and client documentation; don't replace your subscription with a full YAML snippet from the internet.

First Connection Check and Common Errors

Separate local access, rule, and node issues in three steps

1. Check local access. Make sure the core is running and the port is listening. On desktop, test with an explicitly configured proxy command. On Android, confirm the VPN is running and that per-app rules haven't excluded the target app.
2. Check connection details. Make a new web request and check the domain, matched rule, and outbound route on the client's connections page. DIRECT may be the expected result for a rule; it doesn't mean the system proxy is broken.
3. Check the remote response. Try two different websites and switch to another node in the same proxy group. A latency result only reflects the test target; it doesn't mean every website is reachable.