Open-source ecosystem · Cross-platform clients and Chinese configuration notes
Start with the right client, then work through installation permissions, subscription import, and rule-based routing. The site organizes common entry points in installation order and also covers DNS, TUN, system proxy settings, and connection issues.
If you are new to Clash, start with the guide and establish one verifiable connection path. When you need a specific client, open the download page for your operating system. This keeps the core, graphical client, and configuration file from being confused as the same installation package.
Platform downloads
The homepage sends you to the right platform list. The download page then shows available clients, supported architectures, and system requirements. A platform may offer a desktop GUI, a mobile app, or a core package for servers, so confirm your device type before installing.
Suitable for desktop browsers, office software, and everyday environments that rely on a system proxy. Check your system architecture before downloading, import a configuration after installation, and then enable the system proxy. If a Microsoft Store app cannot connect, check the UWP loopback setting and local port conflicts.
Choose the matching package for Intel or Apple Silicon. If the first launch is blocked by system security, use System Settings to confirm the app source and permissions. To route more application traffic, enable enhanced mode or TUN according to the client’s documentation.
Suitable for phones, tablets, and some Android-based TV devices. After importing a subscription, allow the system to create a VPN connection. If the connection drops after running in the background, check battery optimization, background activity limits, and permission for persistent system notifications.
Get Clash Plus for iPhone and iPad through the App Store. The first connection prompts you to approve a VPN configuration; only then can it route device traffic. Rule mode, policy groups, and subscription updates are managed in the app, but check that the active configuration is still valid before everyday use.
Desktop distributions can use a graphical client, while servers, software routers, and containers typically run the Mihomo core directly. Distinguish deb, rpm, and archive packages, then confirm the architecture, such as AMD64 or ARM64. For service deployments, also set the configuration path, service user, and log-directory permissions separately.
For regular desktop and mobile use, choose a client with a graphical interface. Consider the Mihomo core for servers, routers, and environments that already have a management panel. The client comparison page shows platform coverage and differences in how each option is used.
Configuration drawer
Clash configuration can be understood as four connected layers: decide how traffic is matched, choose the client’s operating mode, configure system takeover, and maintain subscriptions and configuration. On desktop, switch sections from the left; on narrow screens, sections expand in sequence.
Rule routing
Rule mode sends requests to a designated policy group based on domains, IP addresses, network types, or rule sets. Configuration files are usually checked from top to bottom, and matching stops after the first hit. Place specific rules before broad ones and keep the final fallback at the end. When a site uses the wrong route, check the matched rule in the connection log and then the policy group’s current selection instead of switching every node repeatedly.
Unlike global proxying, rule-based routing can handle local services, LAN devices, and proxied requests separately. Keep rule sets up to date, avoid overlapping overrides, and retain a clear final policy after custom rules. Save the original configuration before editing, then test only one or two specific targets to narrow down the cause faster.
Proxy modes
Rule mode is best for everyday routing, with configuration deciding where each type of traffic goes. Global mode sends most routable requests through one policy and is useful for determining whether rules are the problem. Direct mode temporarily bypasses the proxy to verify that the local network itself works. Mode switching is a diagnostic tool, not a permanent fix for every issue.
If rule mode fails while global mode works, check rule order, rule-set updates, and policy groups. If global mode also fails, check the subscription, node availability, system proxy, and DNS. After testing, restore the mode suited to daily use and make sure a manually selected policy group is not still pointing to an unavailable node.
System takeover
A system proxy mainly affects applications that follow the operating system’s proxy settings. Some games, command-line tools, and software with its own network stack may bypass it. TUN creates a virtual network interface and captures traffic at a lower level, so coverage is usually broader. Before enabling it, check client permissions, the virtual network driver, routing, and DNS settings; desktop systems may also require administrator approval.
If enabling TUN cuts off the network, do not change several settings at once. Disable TUN first and verify that the system proxy works, then check port conflicts, DNS listeners, route exclusions, and other VPN software. If LAN devices behave unexpectedly, confirm that private addresses remain direct. Troubleshoot the TUN layer only after the basic proxy path works.
Configuration care
A subscription supplies configuration content, while the client reads, updates, and runs it. After importing one, confirm that it is selected and that its policy groups and rules are complete. Updating a subscription does not guarantee that local edits will remain; some clients overwrite changes made directly to generated subscription files. Put long-term rules in a supported override, script, or merge configuration instead.
Use a consistent maintenance sequence: record the working configuration, update the subscription, select policies again, test one direct target and one proxied target, then review DNS and connection logs. If an update suddenly breaks things, switch back to the last working configuration and compare the differences rather than changing several fields while offline.
Sources and maintenance
Open source means that code and collaboration can be inspected, but you still need to distinguish project relationships, release sources, and maintenance status. The download page lists graphical clients and the Mihomo core separately, while the homepage explains how they fit together so you can identify what you need before installing.
Clash established common practices around configuration files, rule matching, policy groups, and local proxy ports. After the original project’s status changed, the community continued maintaining different branches around compatible configuration and familiar workflows. Mihomo is one of the commonly used core implementations today. Desktop and mobile clients typically add subscription management, policy switching, log viewing, system proxy controls, and update tools on top of the core.
Therefore, “Clash client” does not refer to one particular installation package. Similar interfaces may use different cores, and the same core may be used by multiple graphical clients. When choosing one, consider platform support, maintenance status, configuration compatibility, and system takeover methods instead of judging by name alone.
Public repositories can provide source code, licenses, issue reports, commit history, and release notes. When behavior changes, check the release history for the relevant client and core first to see whether configuration fields changed. For reproducible failures, search existing issues; this is usually more effective than guessing from interface messages alone.
Each project is maintained by its own contributors, so release schedules and platform coverage vary. This site organizes entry points by client and operating system rather than presenting every component as one project. Archived clients are marked with their maintenance status on the download page; for active projects, rely on the current information in the available release list.
The core reads configuration, establishes proxy connections, applies rules, handles DNS, and writes runtime logs. The graphical client provides clickable controls on top of it. A connected status only means that the client completed a particular operation; actual access still depends on configuration validity, policy selection, system takeover, DNS, and the target network.
Separating the interface layer from the core layer makes troubleshooting clearer. If a subscription will not download, start with the subscription URL and local network. If every node fails, inspect the configuration and network restrictions. If a specific app bypasses the proxy, check the system proxy or TUN. If only certain domains fail, prioritize matched rules and DNS resolution.
Client updates, core updates, rule-set updates, and subscription updates are four different things. A client update may change the interface or system integration; a core update can affect configuration fields and network behavior; a rule-set update changes matching results; and a subscription update changes the content supplied by its provider. Handle one type of update at a time so the cause is easier to identify when something goes wrong.
There is no need to chase every release. When the current configuration is stable, read the change notes first and schedule an update only if it contains a needed fix. Beforehand, record the client name, system version, configuration name, and key toggles. Afterwards, test a direct target, a proxied target, and LAN access separately to create a repeatable verification loop.
Source checkout
The following command clones a public repository for users who want to inspect the implementation, build instructions, or commit history. If you only need to install a graphical client, no command is required; go straight to the download page.
git clone https://github.com/MetaCubeX/mihomo.git
Installation notes
Launch the client and grant the required permissions when prompted by the operating system, then import a valid subscription or local configuration. Select the configuration, choose a policy, and enable the system proxy. Do not enable TUN, change DNS, and add custom rules all at once; establishing the smallest working connection path makes each step easier to verify.
View the first-time setup stepsFirst confirm that the active configuration is selected and that the policy group points to an available option, then check that the system proxy is enabled. Test direct mode and global mode separately to determine whether the problem is local networking, rules, or the proxy connection. If it still fails, check DNS, port conflicts, and TUN permissions.
View the complete troubleshooting sequenceIf your browser and everyday apps work as expected, you can continue using the system proxy. Consider TUN only when some apps ignore the system proxy, you need to cover more traffic, or you understand how the app handles networking. After enabling it, verify LAN access, DNS, and conflicts with other VPN software.
View system takeover guidanceDirect edits to a subscription-generated configuration may be overwritten during refresh. Restore the last working configuration first, then move long-term rules into a client-supported override, merge, or script layer. Check rule placement and the final fallback afterward, and use connection logs to confirm that the custom rules actually matched.
Read the rules and subscription maintenance sectionsRecent notes
Each article focuses on one specific task, making it useful when installation is stuck, a rule does not match, or the connection status is unexpected. Use the tutorial and user guide as the main path for complete setup.
From installation sources and system permissions to subscription import and the first connectivity check, this guide covers platform-independent steps and commonly missed initial settings. Use it as a checklist on first launch or to restore configuration after reinstalling.
Read the full articleBreaks down common rule types, top-to-bottom matching, fallback placement, and ways to troubleshoot custom rules that do not behave as expected. Use connection logs before and after editing to verify the actual match.
Read the full articleCovers Windows client installation, configuration import, system proxy setup, and connection checks, including permissions, local ports, and UWP loopback issues. The steps follow the practical order of a first-time installation.
Read the full articleFor certificate errors, DNS problems, or a connection that still cannot access the internet, browse the article list under Troubleshooting.
Read user tips