Explore clients for multiple platforms, configuration fields, and protocol references—from importing subscriptions to routing traffic by rule, step by step.
Check your operating system and processor architecture before choosing a client. The desktop app manages configuration, system proxy settings, and logs; the core handles protocol connections and traffic routing. They are not the same package. If you’re new to Clash, start with a graphical client. Consider a standalone core for server or router deployments.
Ideal for desktop browsers, development tools, and everyday work. Get started with Clash Plus, Clash Verge Rev, or FlClash, and check your system architecture before installing. System proxy settings work with apps that honor them. For broader app coverage, see the service and permission requirements for TUN.
After installation, import a configuration and select a proxy group. Check the local listening port, then enable the system proxy. If you run other networking tools, check for port conflicts to prevent apps from repeatedly overwriting system settings.
Choose the package for Apple Silicon or Intel. Clash Plus, Clash Verge Rev, and FlClash offer graphical interfaces, while archived clients may have additional compatibility limitations. Move the app to Applications, then grant the permissions it requests.
Check the menu bar’s connection status separately from the system proxy toggle. Restore proxy settings before quitting the client to prevent browsers from connecting to a closed local port. If you use a virtual network interface, check that its background service is running.
Compare Clash Plus, Clash Meta for Android, FlClash, and Surfboard for their configuration support on phones and tablets. Match the package to your device architecture and the configuration format to your client. Being able to import a subscription does not mean every field is supported.
On first connection, the system will prompt you to authorize VPN access. Battery optimization may interrupt background connections, so allow the necessary background activity in your device settings. Usually, only one app can use the system VPN at a time; disconnect before switching clients.
Find Clash Plus on the App Store. The client’s official site is clashplus.io. After importing a configuration, follow the system prompts to add a VPN configuration, then select a policy in the client. Installing the app, importing a subscription, and connecting are separate steps.
Desktop configuration paths, external controller settings, and virtual network interface options may not work on mobile systems. Before migrating a configuration, check which fields are supported and keep the proxy and rules you need. Use the client’s connection logs to confirm the actual route.
On desktop, choose Clash Verge Rev or FlClash and install the package for your distribution. Servers, containers, and routers can run mihomo directly, but you’ll need to manage configuration paths, processes, service permissions, and network routing yourself.
The package format and processor architecture must both match your system. A standalone core does not provide a full desktop interface or enable the system proxy automatically. Check the logs and listening address first, then configure a proxy endpoint for your app or system.
Similar client names don’t guarantee the same maintenance status, core capabilities, or subscription format. The download page lists options by platform, package type, and system requirements. The protocol reference covers differences between protocol support and core families—so you can choose an interface first, then check its features.
Configuration files separate node sources, policy selection, rule matching, and traffic interception into distinct layers. When something goes wrong, identify the relevant layer before changing its fields. These snippets illustrate the structure; they are not complete configurations and do not include subscriptions or remote nodes. Check compatibility with your client and core before using them.
Keep proxy selection separate from traffic rules
Proxy groups collect multiple outbound options under a name that rules can reference. Use select for manual choice; automatic strategies need their corresponding probe settings. Rules reference the group name, while the client UI determines the active option, so switching outbound routes usually doesn’t require rewriting rules. This minimal example uses a direct connection; if you add remote nodes, their names must match real entries. After updating a subscription, check the group selection if an option was removed—don’t stop at confirming the update succeeded.
proxy-groups:
- name: Select
type: select
proxies:
- DIRECT
Works with: Graphical clients that support Clash configurations
Maintain rule content separately from the main configuration
Rule providers keep matching entries in a separate file, which the main configuration references with RULE-SET. The rule file’s format must match its behavior; a domain list cannot be used directly as a classical rule list. This example declares a local domain rule set, with its path resolved relative to the core’s working directory. To use it, prepare the file and add a reference rule. This approach is easier to maintain than a long rules list, but you must check the source, format, and reference name.
Works with: Clash / mihomo clients that support rule providers
Tell DNS failures apart from proxy connection failures
DNS settings resolve domain names to addresses; they do not choose the outbound option in a proxy group. With fake-ip enabled, the core can use mapping records to handle domain traffic, though some apps may need additional compatibility settings. This snippet shows only a basic DNS structure, not a complete DNS routing design. If a site won’t load, check the DNS logs first, then verify that upstream resolvers are reachable. Blaming every issue on the proxy node can obscure differences caused by local DNS interception or caching.
Works with: Clash / mihomo clients that expose core DNS settings
Route traffic from apps that ignore system proxy settings
TUN receives traffic through a virtual network interface and system routes, covering more than the system proxy used by browsers. Before enabling it, confirm that the client has installed the required service and has permission to create an interface and change routes. This shows common mihomo fields; behavior depends on the operating system and client implementation. If you’re setting this up for the first time, verify the system proxy first, then enable TUN separately. Changing DNS, routes, and proxy mode all at once makes problems harder to isolate.
Works with: Clients that support mihomo TUN and have the required system permissions
When reading a configuration, check indentation and field hierarchy before examining individual values. Duplicate YAML keys, incorrectly nested lists, or mismatched reference names can prevent a configuration from loading. A client opening the file successfully only confirms that it passed that stage; it doesn’t mean every rule behaves as intended. Check connection logs to see which rules matched and which policies were applied.
To decide whether a client is right for you, check the project’s maintenance status, the core it actually uses, and its configuration and protocol support. This site curates resources and documentation; it is not affiliated with client development teams and does not provide remote proxy services. Identify the app, core, and configuration source separately—one project’s name does not represent the entire ecosystem.
Project History and Maintenance
Clash established a YAML-based approach to defining proxies, policy groups, and traffic-routing rules, followed by graphical clients for different operating systems. The original project has stopped receiving updates. Older packages may still run, but that doesn’t mean they continue to receive protocol compatibility updates or bug fixes. When choosing a client, check for active maintenance and release notes. Keep an older client only when you have a specific compatibility need, not just because its name is familiar.
Don’t judge maintenance by the interface alone. UI changes, core upgrades, and operating system compatibility fixes are separate kinds of work, and a release may update only one of them. If behavior changes after an upgrade, note the client name, core, and relevant settings, then compare them with the project documentation. This makes it easier to narrow down and reproduce the issue than replacing the whole configuration at once.
What the Graphical Client and Core Each Do
mihomo continues the development path of Clash Meta, providing core capabilities for protocol handling, rule matching, DNS, and the network stack. Graphical clients build on it with subscription management, policy selection, system services, and log views. Even two clients using the same core may merge configurations differently, use different defaults, or manage permissions differently. Don’t assume the menu paths from one client will match another.
Before choosing a protocol, check both the server’s requirements and the client core’s support. Adding a protocol name to a configuration won’t give an older core new capabilities; TLS, UDP, and transport settings must also match at both ends. The protocol reference explains common protocols and core differences, including their trade-offs. Read it before switching clients or migrating a subscription.
Where Subscriptions, Nodes, and Rules Come From
A subscription link provides configuration or node information; it is not a client. A configuration may include proxy groups, remote rules, and DNS settings, or it may contain only a node list. After importing it, check the format before deciding whether to add policies. For free Clash nodes or public configurations from unknown sources, review the provider and configuration contents. A successful import does not prove the service is trustworthy.
Clash proxy subscription services typically use a private URL that may contain account credentials. Before sharing a screenshot or submitting logs, remove subscription URLs, account parameters, and node credentials. For troubleshooting, keep the error type, relevant field names, and only the network details needed; don’t post your full private configuration in a public forum.
Update Mechanisms and Migration Order
App, core, subscription, and rule data updates are independent. Refreshing a subscription doesn’t update the app, and updating the app doesn’t refresh the node list. Clash GeoIP updates change the data source for relevant geographic rules, not every domain rule. Whether the update takes effect depends on the configuration’s data format, file location, and rule type.
Before migrating, save a working configuration and note the proxy port, selected proxy group, and traffic interception method. After upgrading the app, test the connection in its original mode, then restore custom DNS, rule overrides, or TUN settings one at a time. Clash node latency tests measure response to a specific test target using a particular method; they don’t predict video streaming, download speeds, or availability across all sites.
First-Run Verification Steps
Install the app and import a subscription, then confirm the configuration loads. Check that the selected proxy group has a working outbound option and switch to rule mode. Next, verify the system proxy settings or VPN authorization on mobile, open a specific test site, and review the matched rule and policy in the connection logs. If the app says it’s connected but you can’t access anything, check DNS, rules, outbound connectivity, and local traffic interception separately rather than changing every setting at once.
You don’t have to enable the system proxy and TUN at the same time. If you only need browsers and apps that honor proxy settings to use the proxy, start by testing the system proxy. Consider a virtual network interface for apps that establish connections without reading system settings. If your browser has problems after you close the client, check whether the system still points to a local proxy address. For the full setup, see the Clash setup guide; for complex protocols and core compatibility, see the protocol reference.
Technical Notes / Recently Updated
Deployment and Connection Setup Notes
Practical notes on configuration paths, permissions, and troubleshooting steps for specific use cases. Follow a setup guide to get a basic connection working, then check the relevant note for your issue. Router deployments and TUN traffic interception affect system networking; record the original settings so you can verify and roll back changes one at a time.
Starting with virtual network interfaces and system routing tables, this guide explains how TUN differs from the system proxy, what the stack options mean, and how to enable TUN on Windows, macOS, and Android, including permissions you’ll need.
An overview of ways to run the mihomo core directly on a router or bypass router. Compare network topologies and learn about architecture choices, memory requirements, and gateway settings.
Learn why subscription updates fail, including expired links, incompatible formats, and requests routed through the wrong proxy. Find where to set auto-update intervals and whether updates use a proxy in each client.
