System proxyAccept connections that follow system settings
TUN modeRoute traffic through a virtual network interface
Allow LAN connectionsMake available to devices on the same network
Mixed port7897
Routing rules preview
DOMAIN-SUFFIX, github.com,PROXY
GEOIP,CN,DIRECT
MATCH,PROXY
Rules are checked from top to bottom; the first match determines the policy.
config.yaml
mode: rule
mixed-port: 7897
allow-lan: false
Import subscription
https://example.com/subImport
One configuration, six everyday settings
Understand the configuration, traffic entry points, and outbound routes before changing settings. These examples explain common Mihomo features; menu names vary by client.
Subscription links and local configuration
A subscription is a URL for retrieving remote configuration, not an installer or a connection toggle. In your client's subscription page, add a remote subscription and paste the link from your provider. Once it downloads, select that configuration. First confirm it supports Clash or Mihomo format, then check that its proxy groups have loaded. Unlike maintaining a local file by hand, subscriptions make it easier to update nodes and rules centrally. However, edits to downloaded content may be overwritten at the next update. For persistent port or rule changes, use the client's override, merge, or extension features. Subscription URLs may contain access credentials, so keep them out of public screenshots.
mode: rule
mixed-port: 7897
allow-lan: false
log-level: info
# Add subscriptions from the client's subscription page
# This snippet is not a complete, ready-to-use configuration
Proxy mode determines how rules are applied
Rule mode applies policies from the configuration one rule at a time, making it a good choice for everyday use. Global mode sends connections handled by the core through the global proxy group, while Direct mode connects them straight to their destinations. Start with Rule mode, then choose an outbound route in a proxy group to make results easier to understand. Proxy mode and system proxy are separate layers: the former determines how the core handles connections; the latter determines whether apps send connections to the core. Button locations vary by client, but the concepts are the same. Global mode does not capture all device traffic—apps that bypass the system proxy may still need other entry settings.
# Use rule-based routing for everyday traffic
mode: rule
# Options:
# rule Rule mode
# global Global mode
# direct Direct mode
First match wins; rules do not stack
Routing rules send different destinations to different policies, commonly Direct, Proxy, or Reject. The core checks rules from top to bottom and applies the first match; it does not keep looking for a more specific entry. Put exceptions for specific domains before broader rules, then use MATCH to handle the remaining connections. PROXY in the example is the name of a proxy group that must already exist in your configuration, not a built-in keyword available in every setup. Rule mode offers more granular routing than Global mode, but whether a rule matches depends on whether the client has details such as the destination domain.
TUN is a virtual network interface commonly used to capture traffic from apps that ignore system proxy settings. First get the regular system proxy working. Then, if needed, install the client's service component, grant the required permissions, and enable TUN; this makes troubleshooting easier. After enabling it, check routing and DNS settings—DNS handles domain name lookups. A toggle alone will not solve every connection problem. Permissions, network extensions, and routing work differently across operating systems, so the same configuration may not work everywhere. TUN typically captures more traffic than a system proxy and is more likely to conflict with other VPNs or virtual network interfaces.
Rules choose a group; groups choose an outbound route
Proxy groups sit between rules and the actual outbound route. A select group lets you choose manually; url-test selects based on test results, while fallback tries available routes in order. Check which groups your subscription already provides before adding your own, and make sure rule references are updated if you rename a group. The example shows the syntax for a manual group; in a real setup, refer to existing nodes or other proxy groups. Automatic test results reflect connectivity to the test URL, not download bandwidth. Compared with manual selection, automatic policies reduce repetitive work but still depend on suitable test conditions.
Proxy group syntax · requires an existing upstream group
proxy-groups:
- name: PROXY
type: select
proxies:
- Upstream proxy group
- DIRECT
Start troubleshooting with a failed connection
Use the Connections page to check the destination, matched rule, and actual outbound route; use Logs to inspect configuration parsing, DNS lookups, and connection errors. Reproduce the issue first, then filter by domain or process. Avoid changing the mode, port, and DNS all at once. The info log level is usually enough for everyday use. Increase detail briefly when needed, then restore it afterward. Fields vary across interfaces, but the troubleshooting approach remains the same: check the entry point, rule, and outbound route. This makes it easier to gather reproducible evidence than reinstalling at random. Before sharing logs, hide subscription URLs, account details, and other sensitive information.
log-level: info
# Record these details when an issue occurs:
# Destination domain
# Matched rule
# Proxy group and actual outbound route
# Errors around the time of the issue
Choose your operating system, then check your processor architecture and installation method. The downloads page lists client options, system requirements, and maintenance status. These links take you to the relevant platform section; they do not download an installer automatically.
For desktop use, compare Clash Plus, Clash Verge Rev, and FlClash. Before installing, check your processor and system type in settings and choose the matching package. During initial setup, run only one proxy client to prevent apps from competing for ports or repeatedly changing system proxy settings.
After installation, import a subscription, select the configuration, and then enable the system proxy. If command-line tools still cannot connect, check whether they use the system proxy; if needed, set a proxy address for them separately. When migrating from an older client, keep a copy of the original configuration, but don't let both apps manage network traffic at the same time.
On a Mac, check About This Mac to see whether it has Apple silicon or an Intel processor, then choose the matching architecture. Clash Plus, Clash Verge Rev, and FlClash offer different interfaces and configuration management. For everyday use, compare how easy they make subscription updates and system proxy management.
Grant the required permissions when prompted on first launch. After enabling the system proxy, check its current status in Network settings. If you need TUN, configure the required service or network permissions separately. Don't assume permissions on another computer apply to yours, and recheck everything after a system upgrade.
For phones and tablets, compare Clash Plus, Clash Meta for Android, FlClash, and Surfboard. The installer architecture must match your device, and the configuration format must be supported by the client—don't rely on the link name alone. After importing, confirm the configuration is active before starting the connection.
The first connection usually requires permission to set up a system VPN. If the connection drops when the app moves to the background, check battery optimization and background activity restrictions, then review the client logs. Other VPNs, work profiles, or device management policies may interfere; first check which app currently controls the network connection.
iPhone and iPad users can follow the downloads page to Clash Plus in the App Store, where they can check compatibility, features, and store details. The product website is clashplus.io. Install the app first, then import a supported subscription or configuration from within the app.
When prompted during setup, allow the app to add a VPN configuration. If performance changes between Wi-Fi and cellular, reconnect first and check the active policy. Desktop service modes, system proxy menus, and VPN permissions on a phone are different mechanisms; you don't need to look for identically named settings on each platform.
For desktop Linux, compare Clash Verge Rev and FlClash. First check your distribution, package format, and processor architecture. Graphical clients manage subscriptions, policy selection, and controls, making them suitable for users who prefer a GUI. After installation, check whether your desktop environment supports system proxy settings.
For servers and routers, see the Mihomo core section on the downloads page. The core requires you to provide your own configuration, runtime permissions, and service management; it is not a graphical client. Before changing routing, make sure you have a way to revert the change. This is especially important when managing a remote device, so you don't lose your existing connection.
Clash refers to a family of tools that route network connections by rules, as well as a configuration ecosystem shared by multiple clients. Understanding how the core, interface, and subscription work together makes it easier to choose a client and troubleshoot issues than relying on the software name alone.
Project continuity: similar names don't mean the same maintenance status
After some original Clash projects stopped being maintained, the community developed different core forks and graphical clients. Mihomo continues and extends this rule-based proxy configuration ecosystem, while clients such as Clash Verge Rev and FlClash provide an interface for everyday use. Screenshots, menus, and installation steps in older guides may not apply to current software. Before downloading, confirm the full project name and check its supported platforms and maintenance status. Don't assume a file is right for your device just because its name includes Clash.
A project being unmaintained does not mean your existing local configuration will stop working immediately. However, system updates, protocol changes, and different network conditions can cause compatibility issues. Before migrating, note your subscription source, proxy group selections, ports, and custom rules, then restore them one at a time. If a new client can read the configuration, that only confirms it passed the syntax check; you still need to verify actual connections and routing. The downloads page distinguishes archived clients from current options to help you choose for your needs.
Separate responsibilities: the interface, core, and service each do a different job
The graphical client manages subscriptions, switches policies, and displays logs. The core handles protocols, matches rules, and forwards connections. The subscription provider manages its service and the configuration it distributes. These three often work together, but none can replace the others. A working interface doesn't mean the subscription updated successfully; a successful update doesn't guarantee the outbound route is reachable. Checking each layer in turn can save you from repeated reinstalls and toggling settings at random.
On the same device, the system proxy and TUN belong to the traffic entry layer. An app must send a connection to the core before rules can decide whether it goes direct or through a proxy. If the Connections page never shows requests from a target app, check the entry point before changing rules. If the requests appear, inspect the matched rule and selected proxy group. This separates traffic that isn't being captured from traffic that is captured but failing, so the two problems don't get confused.
Open source: learn about projects through documentation, commits, and licenses
Mihomo's source code, issue discussions, and release history are available in its project repository. The core is licensed under GPL-3.0. To understand a configuration field, start with the current project documentation, then check the release notes to confirm support. Graphical clients may use different licenses and add their own layers around some settings. Sharing the same core does not mean every client has identical features, licensing, or platform support.
You don't need to compile anything to read the documentation. Developers and anyone interested in how the core works can run the command below to clone its source code. It only downloads the code repository; it does not install a client, import a subscription, or change network settings. When reviewing issue discussions, look for details that match your operating system, core version, and error message. A screenshot showing a successful setup on one device does not prove the same configuration will work elsewhere.
Mihomo · source code repository
git clone https://github.com/MetaCubeX/mihomo.git
Update in order: keep a copy of your configuration, then check what changed
Client updates, core updates, and subscription updates are three separate things. A client update may change the interface, permissions, or configuration management. A core update may add protocol support or change how some fields behave. A subscription update mainly replaces content from the service provider. If something breaks, note which layer changed most recently, then check the relevant release notes or documentation. Updating the client, subscription, and rules all at once makes it harder to find the cause.
Before updating, save custom rules and overrides. Check which settings the client saves and which ones are regenerated with subscription updates. Afterward, test a frequently used destination and check the matched rule and outbound route in the connection history; there's no need to change every advanced setting right away. When migrating from older software, get the new client working on its own before configuring startup or service mode. After closing the old client, check that the system proxy is back in the expected state.
Configuration boundaries: examples explain syntax, not complete setups
The interface and code examples on this page explain how settings relate to each other. They don't represent the default state after installation or provide a complete, ready-to-use proxy configuration. The proxy group in a rule example must exist in your configuration, and geolocation databases and rule sets must be prepared for your chosen setup. Pasting snippets into the end of a subscription file can create duplicate fields, incorrect indentation, or invalid references. A safer approach is to understand each field first, then add it using the merge features supported by your client.
Subscription URLs may contain account access parameters. Hide them in screenshots and logs when troubleshooting. Share only necessary information with trusted sources, and avoid uploading full configurations to public conversion tools. Before sharing a network with other devices, understand the scope and access controls for LAN connections. Routing rules help direct traffic according to your needs; they don't override your provider's terms of use or applicable laws and network policies.
New to Clash? Start with the subscription import and connection guide. If you're already connected and want to fine-tune your setup, consult the complete guide to Clash configuration. The first walks through the steps; the second explains concepts and configuration layers, making it easier to look up specific issues.
From sharing subscriptions and choosing an outbound route to interpreting test results, find the next article based on what you're working on. Apply configuration advice to your client's actual settings; there's no need to change everything at once.
Compare sharing a subscription link, manually copying configuration files, cloud storage, and reusing override scripts, with steps and caveats for each approach. Before syncing, distinguish provider-supplied content from local settings; ports, paths, and permissions should not be copied blindly.
When your subscription lists a long lineup of nodes, use latency, traffic multipliers, exit regions, and protocol types to narrow down your options. Learn when automatic proxy group selection is useful. Start by defining what you need, then compare results under the same conditions.
Learn what latency measurements in your client actually represent, why a low reading can still come with slow or choppy browsing, and how test URLs, connection handshakes, and bandwidth affect results. Treat test results as a guide, then use real-world access and connection logs to pinpoint issues.