Choose a maintained client for your operating system, then complete setup through three paths: subscription import, rule matching, and traffic interception. The site also organizes references for the mihomo core, DNS, TUN, and common connection failures.
Platform entry · Plate 02
The same Clash configuration can be read by different graphical clients or the mihomo core, but installation methods, system permissions, and maintenance status vary. Identify your operating system first, then compare clients on the download page to avoid architecture mismatches, abandoned projects, and mixed configuration directories.
OS · 01
Designed for desktop users who want a graphical interface for managing subscriptions, proxy groups, and system proxy settings. Before downloading, confirm your system architecture and prioritize maintained options such as Clash Plus, Clash Verge Rev, FlClash, or Clash Nyanpasu. Clash for Windows is listed only as a historical archive.
Go to downloadsOS · 02
For Apple Silicon and Intel Macs. The installer must match your processor architecture, and the first launch requires confirmation of system network and proxy permissions. Use the graphical client for everyday proxy-group switching; for finer control, check the configuration directory, enhanced mode, and system extension status.
Go to downloadsOS · 03
For phones, tablets, and some Android TV devices. Clients typically take over traffic through the system VPN interface, so they cannot share that interface with another VPN app at the same time. After importing a subscription, select a proxy group first, then review battery optimization and background-execution limits.
Go to downloadsOS · 04
iPhone and iPad establish proxy connections through system network extensions. The download page provides the Clash Plus App Store listing and official website details. After installation, import content from a subscription URL or configuration file, then confirm the network configuration in the system permission dialog.
Go to downloadsOS · 05
Desktop environments can use graphical clients, while servers, soft routers, and headless systems are better suited to running mihomo directly. During deployment, distinguish the binary architecture, configuration directory, and service account, and decide whether systemd, a container, or the current terminal owns the process lifecycle.
Go to downloadsRule chain atlas · Plate 03
Clash is not simply about toggling a proxy on or off. It connects DNS resolution, rule evaluation, proxy-group selection, and system traffic interception into an inspectable execution chain. Understanding each stage’s inputs and outputs makes configuration changes and troubleshooting less dependent on trial and error.
Reading order
A standard proxy request usually enters through a local listening port, after which DNS and rules are processed according to the configuration. TUN mode receives more system traffic from a virtual network interface. Rules are evaluated from top to bottom in file order, and the first match determines the target proxy group. The group then selects a specific outbound based on manual choice, health testing, or failover. If a webpage will not open, inspect interception, resolution, matching, selection, and connection in that order instead of changing every option at once.
Specimen 01 · Matching
Rules are checked from the top of the configuration file downward and stop at the first match. Common types include exact domain matches, domain suffixes, processes, IP ranges, geographic data, and fallback rules. Place custom rules before broad rules that could capture traffic first; otherwise, even valid syntax will have no effect. Unlike proxy tools that offer only a global switch, Clash can assign different sites, programs, and address ranges to separate proxy groups while preserving traceable match records.
When making changes, record the target domain first, then check the actual matched rule on the connections or logs page. If the result is unexpected, check the rule position, whether the rule set is up to date, whether the domain has already resolved to an IP, and whether the target proxy-group name exists. Do not change the proxy node first: connectivity and rule matching are separate stages.
DOMAIN-SUFFIX,example.com,PROXYDomain suffix → proxy groupGEOIP,CN,DIRECTGeographic IP region → direct connectionMATCH,FALLBACKUnmatched request → fallback policySpecimen 02 · Selection
Rules typically point to proxy groups such as select, url-test, fallback, or load-balance rather than a fixed node. This means subscriptions and nodes can be updated without rewriting the entire rule set. Manual selection groups suit cases that require explicit control of the exit; automatic test groups choose available entries based on probes; failover groups check entries in order and switch to the next one when the current exit is unavailable.
When troubleshooting a proxy-group issue, check both the group named by the rule and the group’s current selection. If some sites open while others time out, different rules may be landing in different groups rather than the system proxy failing globally. Proxy-group names are case- and space-sensitive; references must exactly match their definitions.
Specimen 03 · Resolution
DNS does more than translate domains into addresses. It also affects whether domain rules remain visible, how address rules are evaluated, and where requests ultimately connect. mihomo can configure a listening address, upstream resolvers, fallback resolvers, split-DNS policies, and Fake-IP mode. With Fake-IP enabled, the client first returns a reserved address and stores the domain mapping internally so TUN traffic can still be processed by domain rules.
If an IP address works but the domain fails, check the DNS logs, upstream reachability, and whether the system is still using an old resolver. Test changes to nameserver, fallback, or nameserver-policy one at a time, and keep the currently working configuration so resolution failures are not confused with proxy-node connectivity errors.
Specimen 04 · Capture
Some programs do not follow the operating system’s HTTP or SOCKS proxy settings; games, command-line tools, and certain system services may connect directly. TUN mode receives this traffic through a virtual network interface and passes it to mihomo’s DNS, rule, and proxy-group chain. Its coverage is broader, but compatibility also depends on administrator permissions, routing tables, network-interface drivers, and other network software.
Before enabling TUN, confirm that the standard system proxy already works, then turn on TUN separately. If the network goes down, check in order whether the virtual interface was created, whether the default route was added, whether DNS points to the core’s listening address, and whether a firewall or another VPN is occupying the same path. Staged verification is more effective than repeatedly reinstalling the client.
A single port accepts both HTTP and SOCKS5 proxy connections, making it suitable for entering one local proxy address across desktop applications.
A common mode that uses the rule table to determine where requests go; for everyday use, it usually offers better control over direct and proxied traffic than global mode.
Uses reserved addresses to maintain domain mappings, allowing TUN-intercepted connections to retain domain information and participate in rule matching.
A management interface that lets control panels read runtime status and change proxy-group selections; set access controls before exposing it to the local network.
Selected questions
Use the observed symptom to locate the specific stage in the execution chain, then change one setting at a time. Complete procedures are available in order in the usage documentation.
First confirm that the subscription response is a YAML configuration readable by Clash or mihomo, rather than a regular webpage, login page, or content in a format intended only for another client. Then check parsing errors in the subscription update history, paying particular attention to indentation, proxy-group references, and node fields. If authorization is required, make sure the link has not expired. Continue with the subscription import steps.
A connected status only means that the core process is running. Also check whether the system proxy is enabled, whether the browser uses its own proxy settings, whether the current proxy group has a working exit selected, and whether DNS returns a result. Start by visiting a direct-connection site, then check the connection log for the request to determine whether the problem occurs before traffic interception or after rule processing.
Rule mode is usually best for everyday use: the configuration decides where traffic goes based on domains, addresses, or processes. Global mode sends interceptable requests to one proxy group and is useful for temporarily testing a node. Direct mode bypasses the proxy and can show whether a failure comes from the proxy chain. These modes change traffic decisions; they do not repair a subscription or the nodes themselves.
Consider TUN when a target program ignores system proxy settings, when command-line applications need to be intercepted, or when you want to handle more system traffic consistently. First make standard proxy mode work reliably, then enable TUN separately and verify the interface, routes, and DNS. This makes it clear whether a network outage comes from the basic configuration or virtual-interface interception. See the usage documentation for the full sequence.
Open source record · Plate 04
Client names may look similar, but the graphical interface, core process, and configuration format are separate layers. Understanding how projects relate helps identify the correct update source, compatibility scope, and place to report an issue.
Clash established widely used YAML configuration structures, rule types, and proxy-group concepts, followed by graphical clients for different platforms. After the original project stopped being maintained, the ecosystem did not automatically become one replacement project: clients chose different cores, interface frameworks, and release schedules. A name containing Clash therefore does not mean the project comes from the same maintainers, and an old tutorial alone cannot establish current compatibility.
When choosing a client, check the maintenance status of both the interface project and its bundled core. Older configurations can often be migrated, but enhanced fields, rule-set formats, DNS behavior, and TUN implementations may differ. The download center lists maintained options by platform and clearly marks discontinued projects for archival reference.
A complete runtime chain usually combines a graphical client, the mihomo core, subscription configuration, and rule data. The client imports configurations, displays proxy groups, switches the system proxy, and manages the process; the core listens on ports, resolves DNS, evaluates rules, and establishes outbound connections; rule sets provide domain, address, or application categories. A failed update at any layer can appear as missing nodes, unmatched rules, or request timeouts.
Open-source code lets the community review configuration behavior, parameter definitions, and change history. When an issue occurs, first determine whether it belongs to interface operation or core execution, then consult the relevant project’s documentation and logs. Blaming the client name for every problem can hide the component where the error actually occurred.
mihomo is a commonly maintained core in the current Clash ecosystem, extending support for rule sets, DNS, TUN, domain sniffing, and external control. Many desktop and mobile clients integrate it inside their graphical interface; after the user clicks Start, the core process is what actually listens on local ports and handles connections. In server and soft-router environments, the graphical interface can be skipped and the core run directly.
Configuration usability should be judged against the fields supported by the current core. A client importing a file does not mean every field is executed as expected; conversely, a core may support new fields before the interface exposes a visual switch for them. For fine-grained configuration, compare runtime logs with the generated configuration file.
Client updates, core updates, and subscription updates are three independent paths. Updating the graphical client may bring interface fixes and a newer core, but it does not automatically change the nodes or rules supplied by the subscription service; updating a subscription replaces configuration content without necessarily upgrading the local program. Rule sets may also download on their own schedule, so record exactly which layer changed during troubleshooting.
Before upgrading, keep a copy of the working configuration and custom overrides. After the upgrade, verify subscription loading, proxy-group display, system proxy, and DNS first, then restore TUN or complex overrides step by step. This narrows compatibility differences to clear stages instead of introducing several variables at once.
Repository command
The commands below clone the public repository and are useful for reviewing configuration definitions, change history, and build instructions. Regular client users do not need to install the software from source for everyday use.
git clone https://github.com/MetaCubeX/mihomo.git
Field notes · Plate 05
These articles divide procedures by concrete tasks and cover Linux deployment, runtime-log analysis, and proxy sharing over a local network. Match the core fields in each article to the corresponding settings in your client’s interface.
A complete guide to deploying Linux desktop clients, the mihomo command-line core, automatic service startup, and configuration directories, with separate instructions for temporary runs and long-term service management.
Read the article →Breaks logs down into startup, subscription, DNS, connection, and rule-matching stages, showing how to trace an error record back to a specific configuration item instead of changing nodes and settings at the same time.
Read the article →Explains the relationship between mixed-port, LAN access, the listening address, and firewall rules, with a check sequence for devices that cannot connect through the shared proxy.
Read the article →