Clash の使い方チュートリアル
ゼロから 10 分で使いこなす

# Basic port settings
port: 7890          # HTTP proxy port
socks-port: 7891    # SOCKS5 proxy port
mixed-port: 7892    # HTTP + SOCKS5 mixed port (recommended)
redir-port: 7893    # Transparent proxy port (Linux/macOS)
tproxy-port: 7894   # TProxy port (Linux only)

# Global settings
allow-lan: false    # Whether to allow LAN connections
mode: rule          # rule | global | direct
log-level: info     # silent | error | warning | info | debug
ipv6: false

# External controller (Web Dashboard)
external-controller: 127.0.0.1:9090
secret: ""          # Dashboard access password (optional)

proxies:
  # Shadowsocks node example
  - name: "HK-SS-01"
    type: ss
    server: hk.example.com
    port: 8388
    cipher: aes-256-gcm
    password: "your-password"
    udp: true

  # VMess node example
  - name: "JP-VMess-01"
    type: vmess
    server: jp.example.com
    port: 443
    uuid: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
    alterId: 0
    cipher: auto
    tls: true
    network: ws
    ws-opts:
      path: "/path"

  # Trojan node example
  - name: "SG-Trojan-01"
    type: trojan
    server: sg.example.com
    port: 443
    password: "your-trojan-password"
    sni: sg.example.com

rules:
  # Specific domains - direct connection
  - DOMAIN-SUFFIX,cn,DIRECT
  - DOMAIN-SUFFIX,baidu.com,DIRECT
  - DOMAIN-SUFFIX,taobao.com,DIRECT
  - DOMAIN-SUFFIX,jd.com,DIRECT

  # GeoIP: China mainland traffic - direct
  - GEOIP,CN,DIRECT

  # Private IP ranges - direct
  - IP-CIDR,192.168.0.0/16,DIRECT
  - IP-CIDR,10.0.0.0/8,DIRECT
  - IP-CIDR,172.16.0.0/12,DIRECT

  # Process name rule (mihomo only)
  - PROCESS-NAME,curl,DIRECT

  # Catch-all rule - proxy everything else
  - MATCH,Proxy

tun:
  enable: true
  stack: mixed      # mixed (recommended) | system | gvisor
  dns-hijack:
    - "any:53"        # Hijack all DNS queries
  auto-route: true  # Auto-add routes
  auto-detect-interface: true

proxy-groups:
  # Main proxy group - manual select
  - name: "Proxy"
    type: select
    proxies:
      - Auto-Best
      - HK-SS-01
      - JP-VMess-01
      - SG-Trojan-01

  # Auto url-test group - pick lowest latency
  - name: "Auto-Best"
    type: url-test
    proxies:
      - HK-SS-01
      - JP-VMess-01
      - SG-Trojan-01
    url: "http://www.gstatic.com/generate_204"
    interval: 300    # Test every 300 seconds
    tolerance: 50    # Switch if diff > 50ms

  # Fallback group - failover
  - name: "Fallback-Group"
    type: fallback
    proxies:
      - HK-SS-01
      - JP-VMess-01
      - SG-Trojan-01
    url: "http://www.gstatic.com/generate_204"
    interval: 300

  # Load balance group
  - name: "Load-Balance"
    type: load-balance
    strategy: consistent-hashing
    proxies:
      - HK-SS-01
      - JP-VMess-01
    url: "http://www.gstatic.com/generate_204"
    interval: 300

dns:
  enable: true
  ipv6: false
  listen: 0.0.0.0:1053

  # Enhanced mode: fake-ip intercepts DNS and returns virtual IPs
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16

  # Domains that should NOT use fake-ip
  fake-ip-filter:
    - "*.lan"
    - "localhost.ptlogin2.qq.com"
    - "+.stun.*.*"
    - "+.stun.*.*.*"

  # Default nameservers (used for bootstrap)
  default-nameserver:
    - 223.5.5.5     # Alibaba DNS
    - 119.29.29.29  # Tencent DNS

  # Nameservers for proxy traffic
  nameserver:
    - https://doh.pub/dns-query
    - https://dns.alidns.com/dns-query

  # Nameservers for direct traffic
  fallback:
    - https://1.1.1.1/dns-query    # Cloudflare DoH
    - https://8.8.8.8/dns-query    # Google DoH

  # Only use fallback servers for non-CN IPs
  fallback-filter:
    geoip: true
    geoip-code: CN