A focused guide to Clash client downloads, cross-platform setup, and rule-based routing troubleshooting. Choose a maintained graphical client for your operating system, then follow the guides to import a subscription, select proxy groups, and enable the system proxy or TUN.
A connection starts with rule matching, passes through proxy-group selection, and then enters the local core through the system proxy or TUN. The sections below follow that processing order to explain each stage, when to use it, and where to configure it.
Clash checks the rules section of the configuration from top to bottom. Domain rules, GeoSite, GeoIP, IP ranges, and process rules can handle different kinds of requests; the first matching rule determines which proxy group receives the connection. MATCH usually handles connections that matched nothing earlier. Rule order therefore matters more than rule count: place specific rules before broad ones to prevent premature matches.
This approach suits everyday configurations that distinguish direct, proxied, and rejected traffic. After importing a subscription, check that the current configuration contains a complete rules section, then use the client’s connection log to confirm the matched rule. If a site uses the wrong exit, check rule order, domain type, and the referenced proxy-group name before switching to global mode.
Proxy groups sit between rules and proxy nodes. Rules only pass a connection to a group; the group decides whether to use a specific node, automatic selection, fallback, direct connection, or rejection. This lets you change an exit without rewriting the entire rule set—for example, switch nodes only for the “Outside China” group while keeping separate choices for streaming, messaging, and direct services.
First confirm that every node or subgroup referenced by a proxy group actually exists, then check that the current selection is available. After a subscription update changes group names, older rules may no longer find their targets. When merging configurations manually, also verify YAML indentation and exact name matching. Compared with proxy tools that offer only a single toggle, proxy groups are better suited to purpose-based exit management.
When the system proxy is enabled, the client points the operating system’s HTTP, HTTPS, or SOCKS proxy settings to a local listening port. Browsers, office software, and most desktop apps read these settings, making this the usual first interception method after importing a subscription. Restore the system proxy before closing the client so the system does not keep pointing to a port that is no longer listening.
The system proxy does not automatically cover every program. Terminal tools may need separate environment variables, while some games and apps with custom network stacks may ignore system settings. If the browser works but the terminal does not, check the browser’s independent proxy, command-line environment variables, local port, and firewall separately instead of repeatedly updating the subscription.
TUN mode creates a virtual network interface so programs that ignore system proxy settings can still enter the Clash core and be processed by the same rules and proxy groups. It suits terminal tools, game launchers, and other apps that are difficult to configure individually, but it requires appropriate system permissions and may conflict with other VPNs, virtual adapters, endpoint-security software, or corporate network policies.
Before enabling it, confirm that the regular system proxy works; this makes configuration issues easier to distinguish from TUN driver problems. If the network goes offline, check administrator permissions, virtual adapter status, DNS settings, route conflicts, and other traffic-capture software in that order. Configure startup launch only after troubleshooting is complete, so a bad configuration does not reload at every boot.
The homepage provides platform entry points only; the download page lists specific clients, maintenance status, system requirements, and package types. Before choosing one, check your operating system version and CPU architecture. This avoids using a macOS Apple Silicon package on an Intel device or a desktop package on a mobile device.
Suitable for regular desktop use, with options including Clash Plus, Clash Verge Rev, FlClash, and other graphical clients. Check your system architecture before downloading, then import a subscription and enable the system proxy after installation.
Go to downloadsSeparate downloads are provided for Apple Silicon and Intel Macs. On first launch, handle the system security prompt and grant the permissions required for the system proxy or TUN by the selected client.
Go to downloadsChoose a package based on your device architecture. After installation, traffic is usually captured through Android’s VPN interface. The first connection triggers a system permission prompt; also check subscription updates and permission to run in the background.
Go to downloadsGet Clash Plus from the App Store, then add a subscription or configuration in the app. Allow the VPN configuration when prompted during the first connection; you can later switch proxy groups and update the subscription in the app.
Go to downloadsDesktop users can choose a graphical client, while servers, soft routers, and automated environments are generally better suited to running the Mihomo core directly. Before deployment, define service permissions, configuration paths, and log access.
Go to downloadsThe complete process is not simply downloading the app and flipping a switch. Confirm that the client matches your system, import a trusted configuration, choose a routing mode, and then verify the actual matches in the connection log.
Open the relevant platform page from the downloads section and choose a maintained client that fits your system architecture. After installation, open the main interface and check for port conflicts, insufficient permissions, or core startup errors. On macOS, watch for security authorization; Windows may require administrator privileges for TUN; mobile platforms will request VPN configuration permission.
Paste the subscription URL provided by your service into the configuration or subscription page, or import a local YAML file. After a successful update, check that proxy nodes, proxy groups, and rules all appear; if you see nodes but no rules, the client may be unable to route traffic by purpose. Subscription URLs are sensitive configuration data and should never be published or included in screenshots.
For first-time use, keep rule mode enabled, choose an available exit in the main proxy groups, and then enable the system proxy. Open the connection log and visit familiar sites to confirm that requests match the expected rules and groups. Once the regular proxy works, enable TUN, startup launch, and background operation as needed; if something breaks, the problem will be easier to isolate.
Clash is not the name of a single installer. It is an ecosystem made up of a rule-based proxy core, maintained forks, graphical clients, and configuration data. Understanding these layers helps clarify what to download, where updates come from, and where troubleshooting boundaries lie.
The original Clash project established the core workflow built around YAML configuration, proxy nodes, proxy groups, and rule lists. As the ecosystem evolved, Mihomo continued and expanded the core’s capabilities, and many maintained desktop and mobile clients now use Mihomo underneath. Users typically download a client with a graphical interface rather than operate core files directly; servers and routers are the cases where running the core itself is more common.
Clash Plus, Clash Verge Rev, FlClash, and similar clients offer different interfaces and platform integrations, but their basic workflow is similar: manage configuration files, start the core, display proxy groups, change the system proxy, and read connections and logs. Similar names do not mean installers are cross-platform or equally maintained, so the downloads page lists platform, architecture, and discontinued status separately.
Subscriptions usually provide nodes and configuration content, rules determine traffic routing, and GeoIP and GeoSite data provide matching inputs for geographic or domain-classification rules. Their update schedules may differ. If a domain is classified incorrectly, the client is not necessarily at fault; separately confirm that the subscription is current, rule-set references are valid, the databases loaded, and proxy-group names match the rules.
Client updates mainly fix interface, system-integration, and packaging issues. Core updates affect protocols, DNS, rule execution, and the network stack, while subscription updates change nodes and configuration content. Treating these three update types as interchangeable can lead to ineffective fixes. Record the current client and system environment first, inspect clear errors in the logs, update only the layer related to the problem, and then recheck rule matches.
First distinguish download, configuration, traffic-capture, and rule issues by their symptoms, then open the FAQ page for the full diagnostic path. Do not change the port, DNS, rules, and proxy groups all at once before identifying the failing stage.
Filter by operating system first, then compare maintenance status, CPU architecture, and required features. Users who want a graphical interface do not need to download the Mihomo core separately; server and router deployments should focus on core packages and service-management options. See client comparison for the details.
A successful import only means the client read the configuration. Also check that the core is running, the proxy group has an available exit, the system proxy or TUN is enabled, the local listening port is not conflicted, and which rule matched the current request. Follow the connection verification steps one by one.
In most cases, start with the system proxy. Enable TUN only when an app that ignores system proxy settings genuinely needs to be captured. Clients may handle the two modes differently; after enabling them, check routes, DNS, and virtual adapter status to avoid duplicate capture by another VPN or network-management tool.
Rule mode evaluates connections against the configuration and suits everyday use; global mode sends connections to one proxy group and is mainly useful for short-term exit testing; direct mode bypasses the proxy. If only one site behaves incorrectly, check the matched rule first rather than using global mode to hide a configuration problem. See the FAQ for more.
The articles below cover project relationships, YAML configuration structure, and migration from older clients. They are intended for users who have completed the basic setup and want to understand core dependencies and configuration maintenance in greater depth.
Maps out the roles, dependencies, and selection boundaries of Clash, Mihomo, and common graphical clients, including whether regular users should download a client or use the core separately.
Read the full article →Breaks down common fields by YAML hierarchy and explains how proxy nodes, proxy groups, DNS, and rules reference one another, along with indentation pitfalls when editing configurations manually.
Read the full article →Covers preparation before migrating from an old client, moving subscriptions and local configurations, and reviewing alternative clients and settings by operating system.
Read the full article →