The client provides the controls; the core handles connections. Find the settings relevant to your needs, start with a minimal working configuration, then expand it one step at a time.
Rule-Based Routing: Choose an Outbound Route for Each Connection
Rule mode sends different destinations to different policies, so every connection does not have to use the same outbound route. The core checks rules from top to bottom and applies the proxy group or direct policy for the first match. Put specific domains before broader rules, then use MATCH at the end to catch everything else. Rule mode is better than global mode when you need to handle both local services and remote resources. Before editing rules, confirm that the policy names exist, then check the Connections page to see which rule matched. A webpage loading successfully alone does not tell you whether routing worked as intended.
In this example, PROXY is a policy name that must be defined separately in a proxy group. GeoIP matching depends on a local geolocation database and cannot replace all domain rules.
Proxy Group Policies: Separate Rules from Individual Nodes
Proxy groups give rules stable target names, so you do not have to edit them every time a node changes. Use select to choose an outbound route manually, url-test to pick an option based on test results, and fallback to use the first available option in order. Grouping is easier to manage when subscriptions update or you switch routes than writing node names directly into rules. Before using a group, check that its members exist and set a reasonable test interval. For connections that rarely need to switch, manual selection is often easier to understand.
proxy-groups:
- name: PROXY
type: select
proxies:
- DIRECT
This example shows a direct-only setup; it does not include any proxy nodes. After importing a subscription, add members based on the nodes or proxy providers in your configuration.
TUN Mode: Capture Traffic from Apps That Ignore the System Proxy
The system proxy mainly affects apps that explicitly read the system proxy settings; some programs and UDP traffic need another way in. TUN uses a virtual network interface and routing settings to send eligible traffic to the core, where existing rules determine the outbound route. TUN and global mode operate at different levels: rule-based routing still works with TUN enabled. Before enabling it for the first time, check service permissions and consider other VPNs, virtual adapters, and LAN access requirements. If something conflicts, turn TUN off and test again before changing DNS or rules.
This example is for mihomo environments that support the relevant fields. Graphical clients may generate this section themselves; when using a client, manage these settings there first.
DNS and Fake-IP: Use Domains in Routing Rules
DNS settings determine not only where queries go, but also whether the core can associate connections with domains. Fake-IP assigns reserved addresses to DNS queries and maps them back to domains when connections are made, enabling domain-based rules. This differs from resolving a domain directly to its real address. If LAN devices, games, or specific apps have compatibility issues, add DNS filters for those domains instead of disabling DNS altogether. Apps with built-in encrypted DNS may also bypass the expected route, so check the browser, system, and client settings when troubleshooting.
This example shows only the fields related to address mapping. Your actual configuration also needs upstream resolvers suited to your network. Fake-IP addresses are not remote server addresses.
Subscription Management: Keep Remote Content Separate from Local Changes
A subscription link provides access to a remote configuration; it does not mean the client itself provides network service. Before importing, verify the link source and configuration format. Afterward, check the proxy groups, rules, and update time. Direct edits to subscription-generated files are often overwritten by the next update. To keep custom ports, DNS settings, or rules, use the client's supported override or merge configuration. Remote subscriptions make it easier to keep nodes in sync than a static file, but check for update errors and confirm that the service is still active.
# Example address for documentation only; not a working subscription
https://example.com/sub?token=xxxx
# Setup steps
Import URL → Update profile → Set as active profile → Check proxy groups
Subscription URLs may contain access credentials. Hide the full link before sharing screenshots or troubleshooting logs, and use a trusted or self-hosted environment for subscription conversion.
Cross-Platform Clients: Reuse Rules, Not System Settings
Clients in the same ecosystem may share some YAML configuration concepts, but their system proxy integration, permission requests, and background behavior differ. Desktop clients typically manage connections through a tray menu and service mode; mobile clients rely on the system VPN interface and are subject to battery and background restrictions. When switching clients, check which core and fields the new client supports, then import your subscription, choose a proxy group, and reconfigure system integration. Migrating settings one at a time is easier to troubleshoot than copying an entire old directory, which may carry over stale paths, network interface names, or caches.
Reusable: subscription source, domain rules, proxy group design
Review: local ports, permissions, network interfaces, configuration file paths
Set up again: system proxy, background behavior, launch at startup
Choose an installer by platform and processor architecture; see the links below. For configuration compatibility, check the features supported by your chosen client.
For your first connection, follow the getting started guide to set up a subscription and system proxy. For the full setup sequence and maintenance tips, continue to the user guide.
Platform Downloads
Choose an Installer by System and Architecture
The homepage provides a platform index; the download page lists specific clients, installers, and system requirements. Check your device's architecture first, then compare how each client integrates with your system.
A good fit for desktop users who want tray controls, a system proxy, and launch-at-startup options. The download page lists clients such as Clash Plus and Clash Verge Rev. Before downloading, check your processor and operating system in system settings; do not guess the installer architecture based on your computer's brand.
After installing, import your configuration before enabling the system proxy. Check service mode and TUN permissions only if you need to capture traffic from apps that ignore proxy settings. When migrating from an older client, keep your subscription source and custom rules, and avoid overwriting the new client's entire configuration directory.
A good fit for users who manage proxies, switch subscriptions, and check connections from the menu bar. Apple Silicon and Intel Macs use different installers; check your chip in About This Mac. Choose a client that is actively maintained and supports your macOS version.
After installing, grant any required permissions and check that the system network proxy matches the client's status. If connections fail after waking from sleep, switching Wi-Fi networks, or connecting to another VPN, first check the current network interface and proxy status. You usually do not need to reimport the entire subscription.
A good fit for users who manage mobile connections through the system VPN interface. Choose an ARM64, ARM, or universal installer as appropriate and check the client's requirements. After installation, grant VPN permission so the client can capture local traffic.
If the connection drops when the screen locks, check battery optimization, background activity, and the manufacturer's auto-start settings first, then review the logs. Do not disable every background restriction at once. For per-app proxying, confirm that the target app is included and that no other VPN service is already running on the device.
The download page links to Clash Plus on the App Store and lists its official website, clashplus.io. After installation, confirm that the client recognizes your subscription format, add the VPN configuration when prompted, then choose the proxy policy you want to use.
After switching between mobile data and Wi-Fi, check the client status and test the connection in the app you want to use. A VPN icon alone does not confirm that the remote route is working. Check the subscription's validity, selected proxy group, and matched rule separately.
Desktop users can compare Clash Verge Rev and FlClash, then choose a package for their distribution. After installation, check proxy support in your desktop environment, tray behavior, and required permissions. Command-line programs may not use the desktop system proxy; configure environment variables as documented or use another traffic capture method.
Server and router users can explore the mihomo core, but must manage startup arguments, configuration paths, and service lifecycle themselves. Restrict the control interface and proxy listening address to what you actually need. Before allowing LAN connections, check your firewall and access scope so local services are not exposed to untrusted networks.
Know the Difference Between the Core, Interface, and Configuration Source
Use public code, project documentation, and release notes as your references. Similar client names do not guarantee the same maintenance status, feature set, or configuration behavior.
From Clash to mihomo
The Clash ecosystem includes distinct projects such as proxy cores, graphical clients, and configuration tools. After the original Clash and some early clients stopped being maintained, community forks continued to evolve. The name Clash Meta also appears frequently in older guides and configuration notes. mihomo is now a widely used core project in the ecosystem. When reading older material, check which period and core it describes rather than relying on whether a filename contains Clash.
The core handles protocol support, rule matching, DNS, and connection routing. Graphical clients manage subscription imports, tray menus, system proxies, permissions, and logs. Products such as Clash Verge Rev wrap core features in a desktop interface, but interface toggles do not always map one-to-one to core configuration fields. The same subscription can also behave differently across clients because of default overrides and system traffic capture.
What Public Source Code Can Tell You
Project repositories can help you look up configuration fields, release notes, known issues, and proposed fixes. To determine whether an issue has been addressed, check its description, change history, and the released package—not just the repository's popularity. This site does not recommend clients based on unverified download counts or ratings. Choose based on device compatibility, ongoing maintenance, and the features you need.
The mihomo repository is licensed under GPL-3.0. Check each graphical client, bundled resource, and third-party dependency for its own license. Open-source code can be reviewed and studied, but installers, subscription services, and third-party configurations have separate sources. Before importing an unfamiliar configuration, inspect remote rules, scripts, and control interfaces to make sure they suit your needs, and protect the credentials in your subscription URL.
Update the Client, Core, and Configuration Separately
Client updates, core updates, subscription updates, and rule resource updates such as GeoIP are separate operations. Updating the client mainly affects its interface and system integration; updating a subscription changes remotely provided nodes or rules. Completing one update does not mean the others are up to date. When compatibility changes, read the release notes first and keep a copy of your previous configuration so you can restore it.
Back up custom rules and override files separately, note why you changed them, and verify only the affected features after an update. If you replace the core, DNS, and routing rules all at once, it is difficult to identify the cause even if the connection starts working again. For reliable day-to-day use, a configuration you can understand is usually more valuable than continually adding parameters.
Use Connection Logs to Verify What Actually Happened
When getting started, confirm in order that the configuration is active, a proxy group is selected, and system traffic capture is enabled. Then open the target app and check the destination domain, matched rule, and applied policy on the Connections page. Global mode can help briefly isolate a rule issue, but it does not guarantee that every program is routed through the client. The system proxy and TUN determine how traffic gets in; proxy mode determines how the core handles it.
If websites work but Store apps do not, see the guide to UWP loopback exemptions. If only domain lookups fail, focus on the DNS path. For more targeted steps, see frequently asked questions; for a complete learning path, read the user guide. Once everything works, remove temporary test settings to avoid leaving global mode or excessive logging enabled.
Recent Articles
Client Relationships and System Troubleshooting
Once the basic connection is working, explore guides that address your specific symptoms. The articles distinguish operating system restrictions, client settings, and core behavior to help avoid repeated trial and error across layers.
Trace the evolution of the original core, the Meta fork, and mihomo through three perspectives—core, graphical front end, and mobile—and see which core popular clients use.
Learn why UWP apps are blocked from accessing local loopback addresses by default, how to grant exemptions with a graphical tool or command line, and how to undo the change and verify the result.
Find common causes of excessive battery use on mobile, understand the trade-offs between manufacturer background restrictions, battery optimization exemptions, and keeping a VPN service running, and follow a step-by-step settings checklist.