Releases · Platform support · Setup steps
Find Windows, macOS, Android, iOS, and Linux clients in one place, verify installation links by release status, then use the Chinese configuration guides to import subscriptions and set up rule routing, system proxy, and TUN. The page also explains how the original Clash, Clash Meta, and mihomo relate to one another, making it easier to choose a compatible client for an existing configuration.
PROTOCOL ROUTING
Once a configuration file enters the client, requests pass through the listener, DNS resolution, rule matching, and policy groups in sequence. These four indexes cover the stages most often checked in everyday configuration.
PROFILE LAYER
A configuration file defines proxy listeners, policy groups, rules, DNS, and listener parameters. With a remote subscription, the client usually saves the subscription URL first and downloads it as a local Profile; a manually edited YAML file is imported directly. Both methods ultimately produce an active configuration. It must be explicitly enabled before its rules and policies can process requests.
For everyday updates, distinguish between “updating subscription content” and “switching the active configuration.” Updating refreshes the file; switching changes what is running. If an import fails, check YAML indentation, field names, and kernel compatibility first, then confirm that the subscription URL is reachable. For multiple configurations, name them by use case and keep one verified, bootable baseline so you can roll back quickly after editing complex rules.
mixed-port: 7890
mode: rule
log-level: infoRULE CORE
Rule mode does not send every connection through one exit. It checks the rule list from top to bottom, matching conditions such as domain suffixes, domain keywords, IP ranges, process names, and rule sets. Once a rule matches, the request enters its assigned policy group. The group then chooses a proxy, direct connection, rejection, or automatic selection.
The key to custom rules is ordering. Narrower, more specific rules usually come first, while general rules and the final fallback belong later. After making changes, review the matched rule and final policy in the connection log instead of judging the result only by whether a webpage opens. Compared with proxy tools that offer only a global switch, Clash rules are better suited to separating work services, media access, LAN devices, and ordinary direct traffic.
rules:
- DOMAIN-SUFFIX,example.com,PROXY
- GEOIP,LAN,DIRECT
- MATCH,PROXYDNS PATH
DNS settings determine which upstream servers handle domain requests and affect the target information available to the rule engine. When system DNS, the client’s built-in DNS, browser secure DNS, and proxy upstreams coexist, paths can split. This may cause unexpected matches, domains to bypass the expected exit, or the same site to resolve differently across applications. Troubleshooting should begin by identifying which component is actually performing resolution.
A typical configuration explicitly enables the DNS module, selects an enhanced mode for the use case, and sets separate resolvers for ordinary queries and proxy-node domains. After changes, clear system and browser caches, then use connection logs to compare the domain, target address, and policy. DNS test pages are clues only; verify the full configuration path and system network settings step by step.
dns:
enable: true
enhanced-mode: fake-ip
respect-rules: trueSYSTEM INGRESS
A system proxy sends traffic from applications that honor the operating system proxy settings into Clash, which suits browsers, desktop messaging tools, and most everyday software. Some programs connect directly, use their own network stack, or ignore system proxy settings; TUN can be enabled when needed. TUN captures more system traffic through a virtual network interface, but it also requires coordination with routes, permissions, DNS, and other networking software.
For a first setup, validate the regular system proxy before anything else: confirm the listener port is available, the active Profile is loaded, and Rule mode matches the expected policy. Enable TUN only when a program truly remains outside the proxy, and grant the required system permissions. If LAN access breaks, traffic loops, or connectivity fails after waking from sleep, check route exclusions, interface status, DNS settings, and security software in that order instead of changing several parameters at once.
tun:
enable: true
stack: mixed
auto-route: truePLATFORM EXITS
Clients share similar configuration concepts, but their package formats, permission requirements, and traffic-capture methods differ. On the download page, compare maintenance status, architecture, and intended use.
DESKTOP / X64
For long-running desktop use, consider graphical clients such as Clash Plus, Clash Verge Rev, FlClash, and Clash Nyanpasu. Confirm the system architecture before installing; after first launch, import the configuration and check the system proxy switch and listener port. Clash for Windows is archived, so back up the existing configuration before switching clients.
Go to downloadsDESKTOP / ARM · X64
Apple Silicon and Intel Macs require different installers. When first enabling system proxy, a network extension, or TUN, macOS may request administrator approval. After installation, verify a basic connection in Rule mode before configuring launch at login, menu bar controls, or route capture, keeping permission issues separate from configuration issues.
Go to downloadsMOBILE / APK
Android clients typically capture traffic through the system VPN interface, so retain VPN permission and watch for background restrictions. When downloading, distinguish ARM64, ARM, and universal packages; modern devices generally use ARM64. After importing a configuration, choose the policy and run mode, then check battery optimization, persistent notifications, and other VPN apps that may affect connectivity.
Go to downloadsMOBILE / APP STORE
iPhone and iPad users can get Clash Plus from the App Store. After installation, the system network extension establishes the connection; configuration imports, policy selection, and rule inspection are handled in the client. If connectivity changes after switching networks, first confirm the system VPN status, then inspect the active configuration and policy group rather than relying only on the status bar icon.
Go to downloadsDESKTOP / SERVER
Use Clash Verge Rev or FlClash on desktop systems; servers, routers, and containers are better suited to deploying the mihomo core directly. Check both distribution format and CPU architecture when choosing a package. Command-line deployments also require you to manage the config path, permissions, service startup, and log location, making them best for users familiar with system networking.
Go to downloadsQUICK START
Complete the shortest configuration path first, then handle TUN, custom DNS, and complex rules. Change one stage at a time to make the source of errors easier to identify.
From the download page, open the panel for your operating system, choose a maintained graphical client, and verify the architecture. Windows commonly uses x64, Apple Silicon uses ARM, and Android packages differ between ARM64, ARM, and universal builds. After installation, launch the client normally and confirm that the interface opens, the core loads, and the listener port is available. Do not change DNS, TUN, and custom rules all at once.
When the system requests permission, grant it according to the feature: system proxy is for regular desktop apps, while mobile clients and TUN usually require VPN or network extension access. If the client reports an error on launch, record the exact message first and check whether an older client is still running on the same port.
On the Profile or configuration page, add a subscription URL or import a local YAML file. After parsing finishes, set the target Profile as active, then open the policy groups and confirm that selectable policies appear. Rule mode is recommended for the first test because it preserves rule routing and makes it easier to see which rule matched in the connection log.
A successful subscription update only means that the file was refreshed; it does not necessarily mean the running configuration changed. If several Profiles remain in the interface, recheck the active marker, update time, and configuration name. If a manual YAML import fails, check indentation and field types first, then verify that the configuration does not use syntax unsupported by the current kernel.
On desktop, enable the system proxy; on mobile, start the system VPN connection. Open a familiar website and inspect the domain, matched rule, and final policy in the client’s connection log. The goal is to confirm that the request entered the client, matched the intended rule, and used the correct exit—not merely that the page loaded.
After regular traffic works, decide whether TUN is needed based on the applications involved. If LAN devices, development environments, or other network tools are affected, check route exclusions, DNS capture, and interface priority. Change one item at a time and retest to preserve a clear troubleshooting path.
OPEN SOURCE RECORD
To judge whether a client is suitable for long-term use, review its graphical interface, proxy core, configuration compatibility, and installer release history separately.
The original Clash established core concepts such as rule matching, policy groups, configuration files, and control APIs. After the original project stopped updating, its client ecosystem did not follow one maintenance path: some older clients were archived, while some graphical clients continued adapting to newer cores and system interfaces. Before following a guide, confirm whether it targets original Clash, Clash Meta, or mihomo so new fields are not placed in an older core.
Clients such as Clash Plus, Clash Verge Rev, and FlClash mainly handle configuration management, system proxy control, log viewing, and the platform installation experience; mihomo handles rule parsing, protocol support, DNS, TUN, and connection processing. Similar client names do not imply identical release schedules, platform permissions, or feature locations. The download page therefore lists multiple options by platform and marks archived projects separately.
Common ports, proxy groups, and basic rules are broadly portable, but enhanced DNS, TUN, rule sets, script extensions, and newer protocol fields may have version boundaries. When migrating a configuration, load the basic portion successfully before adding advanced settings section by section. Even after the client reports a successful import, check core logs to confirm that fields were recognized rather than merely saved by the interface.
Installer links are organized by platform, architecture, and client project. Before updating, read the relevant project’s release notes and check for configuration migration, system permission changes, or a core upgrade. There is no need to chase every release; updates affecting traffic capture, DNS, or rule behavior deserve a configuration backup, a rollback package, and dedicated time for testing.
ROUTINE CHECKS
These questions cover the four points most often confused during first-time setup. For the complete sequence and interface locations, continue to the user documentation.
First confirm that the imported Profile is set as the active configuration, then check that the run mode is Rule. Enable the system proxy or mobile VPN and inspect the connection log to see whether requests reach the client. Importing a file without activating the current configuration does not put its rules into the running path. See the configuration import steps for the full checklist.
On desktop, enable the system proxy first and confirm that browsers and everyday apps connect according to the rules. Configure TUN only when a program truly ignores the system proxy. This separates port, configuration, and rule issues from virtual interface, routing, and permission issues, reducing interference from changing several settings at once.
Check that the subscription update time and the active Profile refer to the same entry. Some clients refresh the file while keeping the previous running configuration, so you may need to apply or switch it again. If nothing changes, check whether the subscription response is complete, whether parsing reported an error, and whether the policy group references proxy names that still match the updated entries.
The subscription URL, base YAML, rules, and policy groups are usually good migration starting points; client-specific interface settings, auto-start, system proxy controls, and backup formats may differ. Save the original configuration first, verify basic rules in the new client, then handle TUN, DNS, and script extensions. See the client download page for platform options.
FIELD NOTES
Step-by-step coverage of port conflicts, DNS paths, and Profile management. Each article follows the symptoms, diagnostic commands, configuration location, and verification result.
From the error symptoms and system port checks to configuration changes, this guide walks through mixed-port, HTTP, and SOCKS listener conflicts and explains which system proxy settings to recheck afterward.
Read the full article →Understand why test pages may show misleading results, then check the real path of domain requests through DNS mode, upstream servers, browser settings, and system caches.
Read the full article →Learn how configuration sources, subscription updates, the active Profile, and the running core relate, along with practical methods for naming, switching, and rolling back multiple configurations.
Read the full article →