Configuration Tutorial Documents

Clash User Tutorial
Start from Scratch, Set Up in 10 Minutes

Essential Beginner's Guide: Download & Installation, Subscription Import, Proxy Mode Selection, Rule-splitting Configuration, and TUN Transparent Proxy. Detailed cross-platform steps for Windows / macOS / Android / iOS / Linux.

Quick Start First, download the client

Quick Start

5 Steps to Your First Clash Setup

Subscription Import

Add & Manage Proxy Subscriptions

Proxy Mode Guide

Rule / Global / Direct Mode Explained

YAML Config Breakdown

Config Structure & Field Descriptions

TUN Transparent Proxy

Advanced Mode for Full Traffic Hijacking

Platform Installation Guide

Step-by-step Setup for Every Platform

Strategy Group Config

Fallback / URL-Test / Load-Balance

FAQ

Troubleshoot Connection Failures & Issues
1

Quick Start: 5 Steps to Your First Setup

If you're using Clash for the first time, follow these 5 steps to get configured and online in about 10 minutes.

1

Download the Right Client for Your OS

Go to the Clash Client Download page and choose the installer for your OS. We recommend Clash Verge Rev for Windows, ClashX Meta for macOS, Clash Meta for Android for Android, and Stash or Shadowrocket for iOS.

2

Install & First Launch

Windows: Double-click the .exe installer and follow the prompts. macOS: Drag the App from the .dmg into your Applications folder. Android: Install the .apk file (enable 'Unknown sources').

3

Get Your Subscription Link

Obtain a Clash-formatted subscription URL (a long link starting with https:// ) from your provider. Most providers offer a one-click copy button in their dashboard.

4

Import Subscription & Update Nodes

Find the "Subscription Management" or "Config" interface in your client, click "Add Subscription," paste the URL, and save. Then click "Update" or "Refresh" to load the node list. See §2 Subscription Import。

5

Select Node & Enable System Proxy

Pick a node with low latency, set the proxy mode to "Rule," and finally toggle the "System Proxy" switch to start using Clash.

Pro Tip For first-time use, we recommend "Rule Mode." It automatically handles domestic direct connections and international proxies for balanced speed and security without manual setup.
2

Subscription Import & Management

A subscription link is a hosted Clash YAML config address that the client uses to pull the latest nodes. This is much easier than importing single nodes manually and supports one-click updates.

Adding a New Subscription

1

Open Subscription/Config Management

In Clash Verge Rev, click "Profiles" on the left; in ClashX Meta, click the menu bar icon → Config → Manage; in Clash for Android, click "Profiles" at the bottom.

2

Paste Subscription Link

Click "New" or "+", paste the link into the URL field, give it a name (e.g., My Airport), and click Confirm.

3

Fetch & Enable Config

Click "Update" or "Refresh." Once nodes load, click the profile card to set it as current.

Auto-update Subscription

Most clients can auto-update at set intervals (e.g., every 12 or 24 hours). In Clash Verge Rev, click the settings icon on the profile card and set the "Auto Update" interval.

Manually Import Local Config

If you have a local config.yaml file, you can load it directly via "Import Local File" without a network request.

Security Warning Only get subscription links from trusted sources. Do not scan random QR codes or click unknown links to add subscriptions to avoid data leaks or MITM attacks.
3

Proxy Modes Explained

Clash offers three proxy modes for different scenarios. Understanding them helps you balance speed and privacy perfectly.

Mode How It Works Usage Scenario Recommended
Rule Mode Smart routing via YAML rules: Domestic direct, International via proxy Daily browsing, balances local and global speeds Highly Recommended
Global Mode Forces all traffic through the proxy node Full anonymity, testing node connectivity Use as needed
Direct Mode All traffic bypasses the proxy Temporarily disabling proxy, testing local net Temporary use
About Rule Mode Routing Logic In Rule Mode, Clash matches traffic from top to bottom through your rules. The first match wins. Common types include DOMAIN (exact), DOMAIN-SUFFIX, IP-CIDR (range), GEOIP (location), and MATCH (fallback).
4

YAML Config Breakdown

Clash's core config is a YAML file, usually named config.yaml. It has five core sections: General, Proxies, Proxy Groups, DNS, and Rules.

General Settings & Ports

YAML · config.yaml 
# Basic port settings
port: 7890          # HTTP proxy port
socks-port: 7891    # SOCKS5 proxy port
mixed-port: 7892    # HTTP + SOCKS5 mixed port (recommended)
redir-port: 7893    # Transparent proxy port (Linux/macOS)
tproxy-port: 7894   # TProxy port (Linux only)

# Global settings
allow-lan: false    # Whether to allow LAN connections
mode: rule          # rule | global | direct
log-level: info     # silent | error | warning | info | debug
ipv6: false

# External controller (Web Dashboard)
external-controller: 127.0.0.1:9090
secret: ""          # Dashboard access password (optional)

Proxy Nodes (proxies)

YAML · proxies section 
proxies:
  # Shadowsocks node example
  - name: "HK-SS-01"
    type: ss
    server: hk.example.com
    port: 8388
    cipher: aes-256-gcm
    password: "your-password"
    udp: true

  # VMess node example
  - name: "JP-VMess-01"
    type: vmess
    server: jp.example.com
    port: 443
    uuid: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
    alterId: 0
    cipher: auto
    tls: true
    network: ws
    ws-opts:
      path: "/path"

  # Trojan node example
  - name: "SG-Trojan-01"
    type: trojan
    server: sg.example.com
    port: 443
    password: "your-trojan-password"
    sni: sg.example.com

Traffic Routing Rules (rules)

YAML · rules section 
rules:
  # Specific domains - direct connection
  - DOMAIN-SUFFIX,cn,DIRECT
  - DOMAIN-SUFFIX,baidu.com,DIRECT
  - DOMAIN-SUFFIX,taobao.com,DIRECT
  - DOMAIN-SUFFIX,jd.com,DIRECT

  # GeoIP: China mainland traffic - direct
  - GEOIP,CN,DIRECT

  # Private IP ranges - direct
  - IP-CIDR,192.168.0.0/16,DIRECT
  - IP-CIDR,10.0.0.0/8,DIRECT
  - IP-CIDR,172.16.0.0/12,DIRECT

  # Process name rule (mihomo only)
  - PROCESS-NAME,curl,DIRECT

  # Catch-all rule - proxy everything else
  - MATCH,Proxy
Rule Matching Priority Rules match from top to bottom. The first match executes and stops further matching. Place precise rules at the top and theMATCH 'MATCH' fallback rule at the bottom.
5

TUN Transparent Proxy Mode

TUN Mode creates a virtual network adapter at the system level, allowing Clash to capture all traffic — including apps like games, CLI tools, and Steam that ignore system proxy settings.

TUN Mode vs System Proxy Comparison

Feature System Proxy Mode TUN Mode
Traffic Coverage Proxy-aware apps only (e.g., Browsers) All apps, including Games/Terminal
UDP Traffic Partial support Full support
Permissions Required Standard User Permissions Requires Administrator / Root Privileges
Configuration Difficulty Simple Slightly Complex (One-click toggle)
Game Acceleration Usually Ineffective Effective

Enabling TUN Mode (Using Clash Verge Rev as an example)

1

Run the Client as Administrator

Windows: Right-click the client icon → Run as administrator; macOS: Launch normally, the system will prompt for authorization on the first activation.

2

Enter Settings Page

Click the "Settings" icon in the left navigation bar and find the "TUN Mode" or "Virtual Network Adapter" tab.

3

Enable TUN & Select Driver

Toggle the "TUN Mode" switch and select the driver type as Mixed (Recommended). For Windows users, the client will automatically install the WinTun driver on first use.

4

Confirm Virtual Adapter is Active

Once enabled, a virtual network adapter named Clash or mihomo will appear in your system network adapters, indicating all traffic is now hijacked.

Manually Enable TUN in YAML

YAML · TUN configuration 
tun:
  enable: true
  stack: mixed      # mixed (recommended) | system | gvisor
  dns-hijack:
    - "any:53"        # Hijack all DNS queries
  auto-route: true  # Auto-add routes
  auto-detect-interface: true
6

Platform-specific Installation & Config Guides

Clash clients differ slightly in interface and operation across platforms. Below are full installation guides for each.

Windows Installation Guide (Recommended: Clash Verge Rev)

1

Download Installer

Go to the download page, select the Clash Verge Rev Windows version, and download the ClashVergeRev_x.x.x_x64-setup.exe (64-bit) installer.

2

Installation (Recommend 'Install for all users')

Double-click the installer. We recommend choosing 'Install for all users' to ensure TUN mode works correctly. Default installation directory is fine.

3

First Launch → Import Subscription

After launching, click "Profiles" on the left, paste your subscription URL in the top-right box, and click "Import" to download the config.

4

Enable System Proxy

Go to "Settings," find the "System Proxy" toggle and turn it on. Select a node in the "Proxies" page to start browsing.

Windows Firewall Prompt If Windows Firewall prompts you on the first launch, select "Allow Access," otherwise Clash cannot listen to network ports.

macOS Installation Guide (Recommended: ClashX Meta)

1

Download DMG Installer

Choose based on your Mac model: Apple Silicon (M1/M2/M3) select the arm64 version; Intel Mac select the x64 version.

2

Install & Remove Quarantine Attribute

Open the DMG and drag the App to Applications. If the system says 'Developer cannot be verified,' open a terminal and run:xattr -cr /Applications/ClashX\ Meta.app

3

Import Subscription & Enable System Proxy

Click the ClashX Meta icon in the menu bar → Config → Remote config → Manage, and add your subscription URL. Return to the menu and select 'Set as system proxy' to enable it.

Android Installation Guide (Recommended: Clash Meta for Android)

1

Download APK & Allow Installation

Go to the download page, download the cmfa-x.x.x-meta-universal-release.apk installer, and enable 'Install unknown apps' in system settings before running it.

2

Add Configuration Profile

Open the App → "Profiles" at the bottom → "+" in the top-right → select "URL," paste your subscription link and save. Click the refresh icon to update.

3

Start Proxy

Return to the main page, click the center start button, and click "OK" when the system asks to establish a VPN connection.

iOS Installation Guide (Recommended: Stash / Shadowrocket)

About iOS Clients Due to App Store policies, the main iOS clients compatible with Clash formats are Stash (native Clash config support) and Shadowrocket. Both are paid apps and require a non-Mainland China Apple ID.
1

Install Stash or Shadowrocket

Search for and purchase Stash or Shadowrocket in a non-China App Store.

2

Import Clash Subscription (Stash Example)

Open Stash → "Config" → "Install from URL," paste your Clash subscription link, and confirm the download.

3

Start Proxy

Return to the main page, toggle the proxy switch, and click "Allow" for the VPN configuration request, then confirm with Face ID / Touch ID.

Linux Installation Guide (Recommended: mihomo CLI / FlClash)

1

Download mihomo Binary

Choose the version for your architecture (amd64 / arm64 / armv7, etc.), extract it to /usr/local/bin/mihomo and grant execution permissions:chmod +x /usr/local/bin/mihomo

2

Place Config File

Place your config.yaml in the ~/.config/mihomo/ directory and launch with:mihomo -d ~/.config/mihomo

3

Set System Proxy or Configure TUN

Set environment variables: export http_proxy=http://127.0.0.1:7890 and https_proxy=http://127.0.0.1:7890; or enable TUN mode in your YAML to hijack all traffic.

4

Set Up systemd Autostart (Optional)

Create a /etc/systemd/system/mihomo.service service file and run systemctl enable --now mihomo to enable start on boot.

Recommended GUI For a graphical interface, choose FlClash (cross-platform Flutter version). It supports AppImage and DEB packages and has an interface similar to the Android version.
7

Proxy Strategy Groups Explained

Proxy strategy groups (proxy-groups) allow you to combine multiple nodes into one "virtual node," enabling advanced features like auto-selection, failover, and load balancing. This is one of Clash's most powerful features.

Strategy Group Types Description Usage Scenario
select Manually select nodes via the Dashboard Main proxy group, manual exit point
url-test Periodic speed tests, auto-selects the lowest latency node Auto-selection, low-latency gaming
fallback Sequential health checks, auto-switches if a node fails High availability, prevents single point of failure
load-balance Round-robin traffic distribution across multiple nodes Heavy downloads, multi-task concurrency
relay Traffic relays through multiple nodes in sequence Multi-hop links, enhanced anonymity

Strategy Group Config Example

YAML · proxy-groups 
proxy-groups:
  # Main proxy group - manual select
  - name: "Proxy"
    type: select
    proxies:
      - Auto-Best
      - HK-SS-01
      - JP-VMess-01
      - SG-Trojan-01

  # Auto url-test group - pick lowest latency
  - name: "Auto-Best"
    type: url-test
    proxies:
      - HK-SS-01
      - JP-VMess-01
      - SG-Trojan-01
    url: "http://www.gstatic.com/generate_204"
    interval: 300    # Test every 300 seconds
    tolerance: 50    # Switch if diff > 50ms

  # Fallback group - failover
  - name: "Fallback-Group"
    type: fallback
    proxies:
      - HK-SS-01
      - JP-VMess-01
      - SG-Trojan-01
    url: "http://www.gstatic.com/generate_204"
    interval: 300

  # Load balance group
  - name: "Load-Balance"
    type: load-balance
    strategy: consistent-hashing
    proxies:
      - HK-SS-01
      - JP-VMess-01
    url: "http://www.gstatic.com/generate_204"
    interval: 300
8

DNS Settings & Leak Protection

Proper DNS settings prevent DNS Leaks, ensuring your browsing habits aren't logged by your local ISP while speeding up resolution.

Recommended DNS Config Example

YAML · DNS configuration 
dns:
  enable: true
  ipv6: false
  listen: 0.0.0.0:1053

  # Enhanced mode: fake-ip intercepts DNS and returns virtual IPs
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16

  # Domains that should NOT use fake-ip
  fake-ip-filter:
    - "*.lan"
    - "localhost.ptlogin2.qq.com"
    - "+.stun.*.*"
    - "+.stun.*.*.*"

  # Default nameservers (used for bootstrap)
  default-nameserver:
    - 223.5.5.5     # Alibaba DNS
    - 119.29.29.29  # Tencent DNS

  # Nameservers for proxy traffic
  nameserver:
    - https://doh.pub/dns-query
    - https://dns.alidns.com/dns-query

  # Nameservers for direct traffic
  fallback:
    - https://1.1.1.1/dns-query    # Cloudflare DoH
    - https://8.8.8.8/dns-query    # Google DoH

  # Only use fallback servers for non-CN IPs
  fallback-filter:
    geoip: true
    geoip-code: CN
About fake-ip Mode fake-ip mode, Clash returns a spoofed IP address to establish connections quickly, but this may cause issues with certain software (like online games or P2P programs). If problems occur, you can change enhanced-mode to redir-host。
9

FAQ - Frequently Asked Questions

Does Clash include its own node/server resources?
No. Clash is a local proxy client and rule-splitting engine; it does not provide any server nodes. You must obtain subscription links or node configuration info from a third-party service provider.
I see "No proxies" or an empty node list after importing a subscription. How do I fix this?
Please check: ① Is the subscription link correct (try re-copying it)? ② Can your current network access the subscription address (some links require a specific network environment)? ③ Try opening the link directly in a browser to confirm it returns YAML content. If the issue persists, contact your provider.
My browser works with Clash, but other apps (games/applications) don't use the proxy?
The default "System Proxy" mode only works for apps that recognize HTTP proxy settings (mostly browsers). Game clients and terminal programs usually require enabling TUN Mode to be captured. Please refer to the setup steps in §5 TUN Transparent Proxy Mode .
Some domestic websites are inaccessible or slow in Clash Rule Mode?
Possible causes: ① The site isn't in the direct connection rules, so traffic goes through a slow proxy; ② The rule file in your subscription is outdated. Solutions: ① Update your subscription (rules update with it); ② Manually add a DOMAIN-SUFFIX,example.cn,DIRECT rule for that domain in your YAML; ③ Temporarily switch to "Direct Mode" to test.
How do I view real-time Clash connection logs?
Clash has a built-in RESTful API and Web Dashboard (default address: http://127.0.0.1:9090/ui). Open this in your browser and go to the "Connections" page to see all active connections and their routing (proxy vs. direct).
Where is the Clash config file located? Can I edit it manually?
Windows：%APPDATA%\clash-verge\profiles\ or C:\Users\Username\.config\clash\；macOS/Linux：~/.config/clash/config.yaml or ~/.config/mihomo/config.yaml. You can edit it with any text editor. Click "Reload Config" in the client or restart it to apply changes.
What's the difference between Clash and V2Ray / Xray?
V2Ray/Xray focuses more on protocol implementation and traffic obfuscation. Clash (particularly the mihomo/Clash.Meta core) builds on that with a refined rule-splitting engine, strategy group management, and a Web Dashboard, making it easier for daily use and managing multiple subscriptions. Modern Clash.Meta cores also support Xray-specific protocols like VMess, VLESS, and Reality.
Does Clash support merging multiple subscriptions?
Native Clash doesn't support merging subscriptions directly, but you can use third-party tools (like Sub-Store or subconverter) to merge multiple links into one. The resulting URL works in Clash just like a single subscription.

Don't have a Clash client yet?

Download the latest version for your OS now and follow this tutorial to get started.

Free Download Clash Client