Open-source proxy client · Step-by-step guide
From download and install to importing a subscription and rule-based routing, every step is worked through like a classroom example: the how first, then the why — follow along and get your first connection running.
FEATURES · Classroom Notes
The left side is the course index, the right side is a handout pinned to the chalkboard. Each page covers one feature: the problem it solves, how to turn it on, how it differs from similar tools, plus a config snippet you can compare directly.
Rule-based routing is Clash's core capability: every connection is matched top-down against a rule list, and the first match decides whether it goes direct, through a node, or gets blocked. Sites in mainland China go direct with no detour, services outside China are routed to a node, and ad or tracking domains are rejected outright — the three never interfere with each other. Rules support domain suffixes, IP ranges, GeoSite, and more; just order them by priority, no need to configure each site individually. The difference from "global proxy" tools is that rule-based routing only touches the traffic that needs it, keeping speed loss minimal and never changing the apparent region for mainland services.
rules:
- DOMAIN-SUFFIX,example.com,PROXY
- GEOSITE,cn,DIRECT
- GEOIP,CN,DIRECT
- MATCH,PROXYA subscription is a config link — the client periodically pulls the latest nodes and rules from it, saving you the trouble of manual upkeep. After importing, it's best to keep the auto-update interval (commonly 24 hours); expired nodes and entry changes sync locally with each update. Multiple subscriptions can coexist, referenced by separate policy groups by purpose without conflicting. If a subscription update fails, check the HTTP status code in the log first, then verify the system time is accurate and whether your ISP is blocking the link — the tutorial guide has the full troubleshooting order, and working through it usually pinpoints the issue.
proxy-providers:
my-sub:
type: http
url: "https://example.com/sub?token=xxxx"
interval: 86400
path: ./providers/my-sub.yamlSystem proxy hands browser and system-setting-aware app traffic to the client, covering most everyday cases; TUN mode creates a virtual network adapter that takes over every TCP/UDP connection on the machine, so even apps that ignore the system proxy (games, CLI tools) get routed too. Enable only one at a time: system proxy for everyday browsing, TUN when you need full takeover. TUN requires admin privileges to install its service — the authorization steps for Windows and macOS are covered platform-by-platform in the installation guide, and Linux users should also watch firewall and routing table order.
mixed-port: 7890
tun:
enable: true
stack: mixed
auto-route: trueRule mode matches connections against the rule table entry by entry and is the everyday recommendation; Global mode sends every connection through the same node, useful for quick tests or troubleshooting; Direct mode bypasses the proxy entirely, effectively pausing it. All three modes switch with one click in the client's main interface, corresponding to the mode field in config. Beginners should start with Rule mode; if "the proxy is on but nothing happens," switch to Global as a comparison — if Global works but Rule doesn't, the rules aren't matching; if neither works, the issue is likely the node or the system proxy toggle.
mode: rule # rule / global / direct
log-level: info
allow-lan: falseThe log is the first scene of any troubleshooting: the matched rule, selected node, latency, and failure reason for every connection are recorded line by line. Look for the word "timeout" for connection timeouts, check the provider fetch line for subscription failures, and a bind error at startup means the port is already taken. Temporarily set log-level to debug to see finer-grained rule matching, then switch back to info once you've found the issue to avoid log spam. This site's blog translates common errors into plain language, with a troubleshooting order for each — just compare against your own log.
log-level: info # switch to debug temporarily
external-controller: 127.0.0.1:9090DOWNLOAD · Pick a Client by Platform
The first card for each platform is the actively maintained top pick; discontinued clients are marked separately as archive-only references. Click a platform card to jump to its section on the download page, where system requirements and alternative clients are listed.
Windows 10 and above: Clash Plus is the top pick, with Clash Verge Rev and FlClash as alternatives — install, import a subscription, and you're ready.
Go to download →Separate builds for Intel and Apple Silicon: Clash Plus and Clash Verge Rev are actively maintained, while ClashX Meta is discontinued and kept for archive only.
Go to download →Android 7 and above: both Clash Plus and Clash Meta for Android run on the mihomo core, with subscription support and per-app proxying.
Go to download →Clash Plus is on the App Store: search for it or jump to the store page from the download page, then install and import a subscription. Platform notes are on the official clashplus.io site.
Go to download →Clash Verge Rev is recommended for desktop distros, with deb and rpm packages; for servers and routers, deploy the mihomo core directly and run it as a service with a YAML config.
Go to download →The core (mihomo) targets advanced server and router users and is listed separately on the download page; everyday desktop and mobile users can just pick a GUI client from the five platforms above.
QUICKSTART · Three Steps
This is the condensed version of the tutorial guide's main flow. The full version covers platform differences and troubleshooting branches for each step — for now, just remember the order: install the client, import a subscription, turn on the proxy and verify. Don't skip the order.
OPEN SOURCE · Why You Can Trust It
The source code for every Clash-family client is public, with the core and GUI maintained separately by the community. The four sections below cover the project's history, how the ecosystem divides the work, how the core relates to the clients, and how updates work — read through before deciding whether to trust it with your traffic.
Clash first appeared around 2018 as a command-line proxy core written in Go, and its "rule-based routing" idea spread through developer communities. After the original project stopped being maintained, the community continued development from the public source, giving rise to today's cross-platform family of clients — every client listed on the download page traces back to this open development history.
Separating the core from the interface defines this ecosystem: mihomo (formerly Clash Meta) handles core forwarding and rule matching, while GUI clients like Clash Plus, Clash Verge Rev, and FlClash wrap the core into an interface anyone can use. Either layer can be swapped out on its own — nothing is tied to a single author or repository.
mihomo is the actively maintained core, compatible with the original Clash config format and extended with TUN mode, rule sets, and more. Most GUI clients on the download page bundle mihomo internally; server and router users can also run the core directly with the same YAML config, getting identical routing behavior to desktop clients.
Each client ships releases on its own schedule, and the download links on this site follow upstream releases without hardcoding a version number. The subscription and GeoIP/GeoSite databases built into each client update automatically on a set interval, so node lists and routing data stay current without manual downloads.
git clone https://github.com/MetaCubeX/mihomo.git
The core's repository address is public — clone it to read the full forwarding and rule-matching implementation.
BLOG · Latest Posts
Posts follow a "one problem, fully explained" format — how to pick a mode, how to verify your first connection, how to read log errors — each with steps you can follow directly and the reasoning behind them.
Explains how Clash's Rule, Global, and Direct proxy modes work, when to use each, and how to switch between them — so you can pick the one that fits your habits.
Read more →Starts from your first connection after importing a subscription: how to pick a node, run a latency test, turn on the system proxy, and confirm with two methods that it's actually working.
Read more →Shows you how to open and read Clash client logs, explaining common errors like connection timeouts, subscription parse failures, and port conflicts, along with the order to troubleshoot them.
Read more →FAQ · Top Questions
More terms and concepts are collected on the glossary page, while platform-specific installation details and pitfalls are covered chapter by chapter on the installation guide page.
The mixed port defaults to 7890. A bind error at startup means the port is in use: change it to a free value like 7891 in settings, or quit whatever program is holding the port. Port and listen address concepts are covered in the networking and ports section of the glossary.
Check in order: whether the system time is accurate, whether the subscription link still opens in a browser, and whether the current network is blocking that domain. The HTTP status code on the provider line in the log tells you exactly where it's stuck — just compare it step by step.
System proxy is enough for everyday browsing; TUN's full takeover is only needed for apps that ignore the system proxy, like games or CLI tools. Don't enable both at once — see the tutorial guide for the full differences and setup steps.
They mean go direct, route to a node, and block outright. The rule list is matched top-down, and the first match applies — order is priority. More on policies and rule syntax is in the rules and routing section of the glossary.