Rules are checked from top to bottom; processing stops at the first match
SettingsPREVIEW
System proxy On
TUN mode On
LAN access Off
Launch at startup Off
mihomo coreGPL-3.05 platformsYAML configuration
CONFIG / ISSUE QUEUE
Rules, TUN, and DNS configuration
First, distinguish between whether traffic reaches the core and which rule handles it once it does. The snippets below check individual components; they are not complete, standalone subscriptions. Proxy group names must match your existing configuration. Replace PROXY in the example with a group that actually exists.
Rules run in order; put specific domains first
Rule mode lets direct connections and proxied traffic coexist on the same device. Set the operating mode to rule, list domains that need explicit handling first, add geographic rules next, and finish with MATCH as the catch-all. Unlike global mode, rule mode does not send every request through a single proxy group; unlike direct mode, it still applies the configured routing logic. After visiting a site, check the connection log for the matched rule and final outbound route. In this example, only traffic to other destinations that match no earlier rule reaches the highlighted line; not every request goes through it.
TUN captures traffic through a virtual network interface, making it useful for apps that ignore the system proxy. Turning it on does not mean every connection will use a proxy; routing rules still determine the outcome. Desktop clients typically require service mode or administrator privileges, while mobile clients use the system VPN permission flow. First confirm that the system proxy works, then enable TUN, auto-route, and interface detection to avoid introducing multiple unknowns at once. If another VPN is running, disable one and test again. If local network addresses become unreachable, check your route exclusions instead of repeatedly switching nodes.
DNS settings determine how domain names are resolved and where DNS requests go. With fake-ip enabled, the core can return a mapped address first and route traffic by domain when a connection is made; this differs from returning the real address directly. Changing the enhanced mode alone does not guarantee that system DNS is intercepted. Also check TUN hijacking settings, browser Secure DNS, and app-specific resolvers. The snippet below shows the basic fields; choose upstream servers to suit your network. When retesting, check both DNS query logs and connection rules. A test site’s reported resolver location is only a clue, not proof of a leak.
Know the difference between a full config and a proxy provider
Importing a subscription gives you a configuration source and a way to update it later. A remote profile in a GUI client usually includes proxies, proxy groups, and rules, while proxy-providers only supplies proxy nodes. These are different features, not interchangeable import options. Add the provider’s URL on the client’s configuration page, update it, and confirm the update succeeds before selecting it as the active profile. Don’t paste the URL into a public browser share or submit it to an unfamiliar converter; subscription links may identify your account. The snippet below shows a proxy provider’s update structure: replace the sample URL and define any proxy groups that reference it. If an update fails, check the HTTP status first, then the link’s expiration and local cache.
Use overrides to preserve local port, DNS, or rule changes across subscription updates. Merge settings, extension scripts, and override workflows vary between clients; a particular frontend’s menus are not universal core features. Back up the original config, override only the fields you need, then inspect the final runtime configuration after startup. For list fields, check whether values are replaced or appended; otherwise, custom rules may end up after the catch-all. A separate override is easier to roll back than editing the remote cache directly. If something breaks, temporarily disable the override to narrow down the cause.
Local override field example · merge behavior varies by client
mixed-port: 7890
allow-lan: false
mode: rule
log-level: info
Troubleshooting order: First check whether the config loads, then verify the listening port, confirm app traffic reaches the core, and finally review rules and DNS. If the connection is missing from the logs, you probably haven’t reached the “which node should I use?” stage yet. Get traffic into the core before troubleshooting the outbound route.
These examples use mihomo as a reference; GUI clients may generate or override some fields. For installation paths, service permissions, and platform-specific limitations, see the all-platform guide. To make your first connection, start with the subscription import guide.
PACKAGES / CHOOSE BY PLATFORM
Clash downloads for every platform
The client provides the interface, configuration management, and system integration; the core handles protocols and routing rules. Choose a client based on your operating system and processor architecture, then check its maintenance status and feature support. Clash Tutorial Hub collects download links and setup instructions. It is not an official site for any client project and does not provide proxy services or subscription accounts.
Start with Clash Plus, or choose Clash Verge Rev, FlClash, or Clash Nyanpasu based on your preferences. Before downloading, confirm your operating system and installation permissions. On first launch, import a configuration before enabling the system proxy. If you need TUN, make sure service mode installed successfully so you don’t mistake a permissions issue for an expired subscription.
Check About This Mac to see whether your device has Apple silicon or an Intel processor, then choose the matching installer. Compare Clash Plus, Clash Verge Rev, and FlClash based on their interfaces and maintenance status. If macOS displays a security warning on first launch, follow the authorization steps in System Settings; don’t disable system-wide security protections for a single app.
Start with Clash Plus, then compare configuration compatibility with Clash Meta for Android, FlClash, and Surfboard. The first connection requires system VPN permission. If the connection drops when the app is in the background, check battery optimization and background activity restrictions. Match the installer architecture to your device, and make sure your config format is supported by the selected client.
The download page links to Clash Plus on the App Store and its official site, clashplus.io. After installation, import a supported subscription or configuration and allow the app to add a VPN configuration. A VPN Connected status only confirms that the tunnel is up. Visit an actual website to verify that routing rules and the outbound route work as expected.
For desktop Linux, choose Clash Verge Rev or FlClash and install the package for your distribution. Headless servers and routers are usually better served by running the mihomo core directly. A desktop environment’s system proxy switch may not affect terminal programs, so check environment variables, app-specific proxy settings, or TUN to determine the actual traffic path.
Archived clients can help explain legacy configurations, but familiarity with an old interface is no reason to ignore maintenance status. When moving to the mihomo ecosystem, check protocol fields, proxy group references, and DNS settings. Being able to import a file does not mean every field is supported. Multiple proxy clients running at once can also compete for ports and routes, so run only one while testing.
Start with the simplest working path, then add overrides, custom rules, and TUN. You’ll need a supported subscription URL, a device with internet access, and a backup of the original configuration. A client does not generate usable proxy nodes: installing the app is not the same as having a proxy service.
01 / IMPORT
Import a subscription and select it as active
Add the remote URL on the client’s configuration or subscription page, then run an update. Once the nodes and proxy groups appear, set the profile as active. If the list is empty, check the update log for the status code and parsing errors. Subscription links may contain account identifiers, so don’t include the full URL in a public screenshot. Leave DNS unchanged for now so you have a known-good starting point to return to.
02 / ROUTE
Choose rule mode and enable traffic entry
Select rule mode, choose an available outbound route in a proxy group, and enable the system proxy. This is usually enough for a first test in a desktop browser; on mobile, grant VPN permission when prompted. If an app ignores the system proxy, evaluate TUN separately. Don’t switch global mode while also changing ports and routes; if the test then succeeds, you won’t know which change fixed it.
03 / VERIFY
Visit a website and check the connection and rule logs
Visit one destination that should use the proxy and another that should connect directly. Check the connection page for the domain, matched rule, and proxy chain. If a page fails, note the exact error: DNS failures, connection timeouts, and certificate errors call for different checks. After testing, turn off the proxy and visit the site again to confirm the system proxy resets properly. A toggled switch is not a successful test, and saving a config does not make it correct.
To decide whether a client is suitable for long-term use, check which core it relies on, how it updates configuration, and whether you can inspect runtime logs when errors occur. Similar project names don’t mean the projects share maintainers, features, or release schedules.
From the original Clash to mihomo
After development of the original Clash project stopped, the community continued building around compatible rule syntax and configuration structures. mihomo follows the Clash.Meta technical lineage and maintains capabilities for protocols, routing, and DNS. Clash, Clash Meta, and mihomo are historically related, but they are not simply different names for the same software. Check current core documentation before relying on fields, proprietary features, or platform limitations described in older guides.
The GUI client and core each handle a different layer
Frontends such as Clash Verge Rev, FlClash, and Clash Nyanpasu provide subscription management, tray menus, system proxy settings, and service integration. The core establishes connections, evaluates rules, and handles traffic. Updating the frontend does not necessarily change protocol support; conversely, replacing the core may leave the interface unchanged while changing which fields are supported. When reporting an error, include the client name, operating system, and core details to help identify the responsible layer.
Open-source licenses and project resources
The mihomo repository publishes its code under the GPL-3.0 license. Source files, commit history, and issue discussions can help verify where features come from. Open source means code can be reviewed; it does not make every configuration safe. If you expose a listening address, enable LAN access, or open the control interface, check who can reach it. Rules and subscriptions are also input data: don’t replace a long-term configuration with one from an unknown source, and never share credentials for the control interface.
Keep app updates separate from subscription updates
App updates fix frontend or core issues; subscription updates refresh nodes and rules; GeoIP and GeoSite data updates affect geographic routing results. These are separate operations. Keep a working configuration before updating, then check startup logs and rule matches for key sites. Reinstalling the client repeatedly won’t fix a subscription response error. If a field is incompatible, check whether the running core supports that configuration.
Find the right guide: Not sure how mixed-port differs from the controller interface? See the glossary. Imported successfully but can’t connect? Start with FAQs. Need to check system proxy settings, permissions, or background restrictions on a specific platform? See the all-platform installation and setup guide. This site focuses on reproducible steps and configuration explanations, not download counts or ratings as a substitute for technical evidence.
FIELD NOTES / LATEST TROUBLESHOOTING NOTES
Clash setup and troubleshooting articles
Quick-start guides help you make your first connection; the notes below cover what happens afterward. Before reading, turn your symptoms into a testable question, such as “The browser works, but the terminal doesn’t” or “The rule matches, but DNS queries time out.” Narrowing down the cause with evidence is more reliable than copying an entire configuration.
Check each item in order, from subscription expiration and node connectivity to the system proxy port, TUN permissions, rule mode, and DNS interference, to find out why you can’t get online.
A field-by-field guide to default-nameserver, nameserver, fallback, fallback-filter, and dns-hijack under TUN, with ready-to-use configuration snippets.
Trace the evolution from the original core and Premium to mihomo, and see how frontends such as Verge, FlClash, and Nyanpasu relate to the cores they use.
When changing DNS settings, keep the before-and-after resolution results and note whether Secure DNS is enabled in your browser. For rule changes, record the destination domain and the rule that actually matched. Logs should show where the failure occurred, not just a red icon. Remove account details before sharing; shorter reproduction steps make issues easier to diagnose.