Check your operating system and processor architecture before choosing a client. The installer provides the interface and runtime; connecting also requires a working subscription or configuration file. If you already have a configuration, first check whether the target client supports its protocols, proxy groups, and rules. Don’t assume compatibility based on the app’s name alone.
Windows
Start with a graphical client such as Clash Plus or Clash Verge Rev. Check your device’s architecture in system settings before installation. After launching the app, import a configuration and enable the system proxy to test browser connectivity. For games, command-line tools, or other apps that ignore proxy settings, check service mode and TUN permissions.
If only App Store apps are affected, check for UWP loopback restrictions. Quit the old client before switching to another to prevent both apps from changing system proxy settings or competing for the same listening port.
Choose the installer for Apple Silicon or Intel based on the chip shown in About This Mac. A graphical client can manage subscriptions, proxy groups, and menu bar controls. System proxy is a good way to test web access first; TUN requires additional network permissions, so follow the client’s prompts to grant access.
If terminal requests behave differently from browser traffic, check the terminal’s proxy environment variables first. Enabling the system proxy doesn’t guarantee that every command-line tool will use the same route.
Options include Clash Plus, Clash Meta for Android, and FlClash. Most recent phones use ARM64, but check your device information to be sure. Import a subscription and select its configuration. On first launch, you’ll usually need to allow the system VPN connection request, which creates a local channel for taking over traffic.
If the connection drops in the background, check battery optimization and background activity restrictions. For per-app routing, verify the app list and make sure another VPN app isn’t already using the system connection.
Open the Clash Plus App Store page from the downloads page, or visit the official website at clashplus.io. After installing, import a compatible subscription and select its configuration. Follow the system prompts to add a VPN configuration, then connect and test the app you want to use.
Downloading a subscription and connecting through one of its proxies are two separate things. If the import fails, check the link and format. If the connection works but only some sites fail, check the rules, DNS, and proxy service status.
For desktop Linux, choose Clash Verge Rev or FlClash and install the package format used by your distribution, such as DEB or RPM. On servers, in containers, or on routers, you can deploy the mihomo core directly and manage it through a configuration file and service manager. Command-line deployment requires you to manage the config directory, file permissions, logs, and startup behavior; it doesn’t offer the one-click controls of a graphical client.
On first run, test the configuration in the foreground and confirm the listening address before handing it over to systemd. Before enabling TUN or changing the default route on a remote machine, keep a separate management connection available so proxy routing doesn’t disrupt SSH. For most desktop users, a graphical client makes configuration issues easier to diagnose.
Older clients are best reserved for cases with specific compatibility requirements. For new deployments, consider actively maintained options and compare subscription compatibility, permissions, and supported operating systems.
A configuration describes where connections go; the client manages and applies it. The snippets below show how fields relate—they are not complete subscriptions that can connect on their own. PROXY is a proxy group name in these examples and must match a group defined in your configuration. Adjust TUN and DNS settings for the platform you’re running on.
Rules are evaluated from top to bottom; the first match determines where a connection goes. Domain suffix rules target specific site domains, GEOIP routes by the destination’s location, and MATCH at the end catches everything else. PROXY must refer to a defined proxy or proxy group. Unlike global mode, rule mode can route different requests through different exits. Before changing rules, confirm that app traffic reaches the core, then check the matched rule in the connection log. If the request doesn’t appear at all, troubleshoot the system proxy or TUN before adding more rules.
proxy-groups:
- name: PROXY
type: select
proxies:
- AUTO
- DIRECT
- name: AUTO
type: url-test
use:
- provider-main
url: https://www.gstatic.com/generate_204
interval: 300
Choosing a proxy group
proxy-groups separate rule targets from individual proxies. select lets you choose manually; url-test selects an available exit based on results from a specified test URL. The provider-main example must also be defined under proxy-providers; this snippet alone won’t start the client. Proxy groups let you keep rule names stable while changing the selections within a group. Test results reflect connectivity to the test target only—not the experience on every site, traffic multipliers, account quotas, or regional restrictions imposed by a destination service.
TUN takes over traffic routed through a virtual network interface, making it useful for apps that ignore system proxy settings. Options such as auto-route and interface detection affect routing, so they must match your platform’s permissions and client implementation. TUN typically covers more traffic than a system proxy, but it also depends more on DNS, routing, and the state of other VPNs. Test the subscription with the system proxy first, then enable TUN and check adapter and route details in the logs. If remote connections or local network access stop working, check route exclusions before switching to global mode.
Subscription link
↓ Create a remote profile under “Profiles” in the client
Fetch and parse YAML
↓ Select the profile and check the load logs
View proxy groups
↓ Enable the system proxy or platform VPN
Verify the request and matched rule
Importing a subscription
A subscription link provides a configuration; installing a client doesn’t create a working proxy. Usually, you create a remote profile on the configuration page, paste the link, download it, and select the profile to view its proxy groups. Remote profiles make it easier to sync provider updates than editing local YAML by hand, but edits to downloaded content may be overwritten at the next update. Use the client’s supported override mechanism for rules you need to keep. Subscription links may contain account credentials, so store them securely. If an update fails, check the link, network access, and format before considering conversion. Avoid sharing sensitive links with unfamiliar conversion services.
Understanding the client, core, and configuration source helps you identify which layer an update affects. Clash Guide organizes download links and configuration guides; it isn’t a substitute for project announcements and doesn’t provide proxy subscriptions. Check each project’s public documentation for its status, feature scope, and license.
How Clash and mihomo are related
Clash began as a rule-driven proxy core with its own configuration ecosystem. After the original project stopped being publicly maintained, the community continued along different core and client paths. mihomo carries forward the development direction of Clash Meta, with support for proxy protocols, rule matching, DNS, and traffic interception. Similar names don’t mean projects are maintained by the same team, or that every configuration field works across all implementations.
Graphical clients usually bundle a core behind an interface to manage configurations, update subscriptions, toggle the system proxy, and display logs. For unsupported protocols, unrecognized fields, or runtime errors, record both the client name and the core it uses. “Clash won’t connect” usually isn’t enough information to reproduce an issue; the same configuration can also behave differently across cores.
You can find mihomo’s source code, license, release notes, and issue discussions in its public repository. Open-source code makes implementation details and behavior changes traceable, but it can’t replace checking your local configuration. Before reporting an issue, read existing discussions and include your operating system, launch method, steps to reproduce, and relevant logs. A screenshot of a toggle alone isn’t enough.
Logs and configurations may contain subscription URLs, proxy credentials, and browsing records. Remove account details before sharing and include only the smallest configuration needed to reproduce the issue. Troubleshooting can be split into stages: parsing the configuration, listening on the port, taking over traffic, selecting a rule, and connecting to the destination. Find the failing stage before reviewing the related implementation or filing a report; this is more reliable than changing several settings at once.
Git must be installed on your machine to run this command. Cloning downloads the source code, not a graphical client installer. For a standard installation, use the downloads page.
git clone https://github.com/MetaCubeX/mihomo.git
Client updates and subscription updates
Client updates change the interface, system integration, or core components. Subscription updates fetch new configuration content. These are separate operations: a successful subscription update doesn’t mean the app itself is up to date, and installing a new package won’t fix an expired subscription. Before upgrading, keep a working configuration and any required overrides. After upgrading, check the load logs, then verify how the system proxy and TUN behave.
Rules, proxy groups, and providers in remote profiles may be managed by the service provider. Editing downloaded files directly can mean your changes disappear at the next refresh. Before adding custom rules, check which override or merge methods the client supports, then inspect the final effective configuration. Set automatic update intervals according to the provider’s guidance; frequent requests won’t fix an invalid subscription.
For your first setup, run only one client at a time. After importing a profile, confirm that it parses correctly and that the local port is listening. Then enable the system proxy or the platform’s VPN traffic routing, visit a destination, and check the connection log. If the browser works but another app doesn’t, first check whether that app follows system proxy settings—don’t assume the proxy server is down.
If the issue only happens with TUN enabled, focus on permissions, DNS, and routing. If every mode fails, check the subscription and proxy availability. Change one setting at a time and compare the logs before and after. Export a backup before resetting the configuration, so you don’t lose the original rules or the evidence needed to reproduce the issue. The full documentation covers installation, permissions, and common conflicts by platform.
First confirm that the link returns a compatible configuration—not a login page or error message. Keep the original link and check its expiration and network access. Consider subscription conversion only if there’s a genuine format mismatch. Conversion involves transferring configuration data and credentials, so find out who receives them and how they’re handled.
Start with the system proxy, which has a more clearly defined scope, to verify basic connectivity. Enable TUN only if the target app ignores proxy settings or you need broader traffic routing. Broader coverage also means more routing and DNS checks; don’t turn everything on just because the options are available.
You’ll also need a legitimate, working configuration source, protocols compatible with the client, and any network permissions required by your operating system. A client manages traffic; installing one doesn’t provide a proxy service. Once you have these prerequisites, follow the guide to import a profile, choose a proxy group, and test the connection.
Linux penguin vector: Font Awesome Tux, licensed under CC BY 4.0; shown in the site’s monochrome color scheme.
04 / TECHNICAL NOTES
Clash Technical Notes
Each note tackles a specific configuration issue: what’s happening, why it happens, and where to check settings. Here are the latest three. Start with the tutorials for basic setup; see the full documentation for platform differences and command-line deployment.
Learn how to distinguish an expired link, blocked update request, traffic that bypasses the proxy, and an incompatible format. Find the client’s update controls and check the auto-update interval and network route used for updates—so you don’t mistake a configuration download failure for a proxy connection failure.
Covers desktop client installation and core deployment in headless environments. Follow steps for config directories, runtime permissions, terminal proxy variables, and systemd services to understand why a successful foreground test may need additional setup for reliable background operation.
Compare apps that follow proxy settings with traffic routed through a virtual interface. Covers DNS handling, stack options, and permission requirements, with guidance on choosing between the two approaches when the browser works but other apps connect directly.