Choose a client by platform, then explore the mihomo core, YAML fields and routing rules one by one.
Check which section a field belongs to, then compare it with the example. These snippets show structure; they are not complete subscriptions.
CORE / mihomo
mihomo is a proxy core in the Clash ecosystem. It reads configuration, accepts connections, matches rules and establishes outbound connections. Clients handle subscriptions, tray menus and system integration; they operate at a different layer. The original Clash, Clash Meta and mihomo are related through the project’s evolution, but older cores may not recognize newer fields. When troubleshooting, first check which core the client actually runs, then verify that core’s field support. The example’s mixed port accepts both HTTP and SOCKS requests. If you only need local access, keep LAN access disabled.
Browse common fields →# Top-level common fields
mixed-port: 7890
allow-lan: false
mode: rule
log-level: info
ipv6: falseROUTING / rules
In rule mode, connections are checked in list order and handed to the policy for the first matching rule; later rules are not considered. Domain suffix rules are useful for grouping sites, while IP rules cover address ranges. MATCH typically goes last as the fallback. Proxy must refer to a policy group or proxy name defined elsewhere in the full config; DIRECT is the built-in direct policy. Unlike global mode, rule mode can send different destinations through different exits. Put specific rules before broader ones. If traffic takes an unexpected route, check the matched rule in the connection log instead of looking only at the selected node.
Browse rule syntax →# Proxy must be defined in the full config
mode: rule
rules:
- DOMAIN-SUFFIX,github.com,Proxy
- GEOIP,CN,DIRECT
- MATCH,ProxyNETWORK / tun
TUN uses a virtual network interface and routing settings to send eligible traffic to the core. It can handle apps that do not use the system proxy. TUN changes how traffic enters the core; it does not automatically send every connection through a proxy. The mode and rules still determine the policy. Before enabling it, make sure the client service or required system permissions are ready, and check whether another VPN is using the same resources. auto-route configures routes automatically; dns-hijack captures specified DNS requests. This example also requires a complete DNS configuration. Available options depend on the operating system and core.
Learn how TUN works and how to configure it →tun:
enable: true
stack: mixed
auto-route: true
auto-detect-interface: true
dns-hijack:
- any:53PROFILE / merge
Subscriptions fetch remote configuration; overrides preserve local preferences such as listening ports, log levels or extra rules. Editing a downloaded subscription file directly can lose your changes on the next update, so use the client’s override feature when available. Clients differ in how they merge maps, lists and scripts; do not assume a new rule will always be appended at the end. The YAML on the right is a snippet to merge, not a universal override format. Before saving, inspect the generated final config: check for duplicate fields and correct indentation, and keep a working copy of the previous config.
Browse overrides and merging →# Merge according to the client's override rules
mixed-port: 7890
allow-lan: false
mode: rule
log-level: warning
# Keep proxies and policy groups in the full configCLIENT / integration
Clients using the same core can usually share most YAML fields, but system proxy settings, background operation, virtual interfaces and per-app exclusions depend on platform integration. When moving to another device, import the config first, then check system permissions separately. Do not blindly copy interface names or file paths from the old device. Desktop clients often manage connections from the system tray; mobile clients require system VPN permission. When choosing a client, check processor architecture, installer format and maintenance status. Use the common fields on the right as a starting point, and only enable local listening or LAN sharing when your use case requires it.
View the client comparison guide →# Check common behavior when migrating
mode: rule
allow-lan: false
log-level: info
# System proxy and VPN permissions
# Configure this in the relevant clientWhen reading a config, trace the flow in this order: entry point → mode → rules → policy → outbound. Ports and TUN determine how connections reach the core; mode selects how they are handled; rules choose the policy for each flow. Changing one layer at a time makes it easier to identify what caused a change.
Check the platform and processor architecture first, then compare the interface, traffic capture options and maintenance status.
Choose from clients such as Clash Plus, Clash Verge Rev and FlClash. For everyday browsing, start with the system proxy. Consider TUN if games or command-line tools do not use it. Before installing, check your processor type in system settings; after an update, confirm that service mode still works.
Go to downloadsApple Silicon and Intel Macs need different installers. Check your chip in About This Mac. Follow the system prompts to grant permission on first launch, then check the menu bar status and network proxy settings. When switching clients, quit the old app first to prevent both from changing the system proxy.
Go to downloadsCompare Clash Plus, Clash Meta for Android, FlClash and Surfboard, paying attention to differences in config formats and core support. Allow the VPN request when connecting for the first time. If the connection drops after the screen locks, check battery optimization, background activity and auto-start permissions instead of repeatedly reinstalling the subscription.
Go to downloadsThe download page links to Clash Plus on the App Store and lists its official site, clashplus.io. After installing, import a compatible config and follow the system prompt to add a VPN configuration. Mobile operating systems manage background network extensions differently; desktop service installation steps do not apply to phones.
Go to downloadsOn desktop, choose Clash Verge Rev or FlClash and select a package format for your distribution. Server and router users can explore the mihomo core and manage the service, config directory and permissions themselves. Desktop proxy settings may not apply to every process inside a terminal.
Go to downloadsAn installer provides the application; a subscription provides proxy configuration. Neither replaces the other. After installation, import a compatible config from a trusted source. This knowledge base provides software links and field references, not proxy service; installing a client does not create a working outbound connection. Subscription links are often tied to account access, so hide the full URL before sharing screenshots or logs.
Clash for Windows is no longer maintained. It may help when identifying an old guide or migrating existing settings, but familiarity with the name alone is not a good reason to make it the default for a new device. When migrating, keep your subscription URL and custom rules, then inspect the config generated by the new client. Protocol support depends on the actual core and client integration, not on whether the app’s name includes Clash.
Browse all clients →Start with one connection you can verify, then add routing rules, overrides or TUN settings.
In the client’s config manager, add a subscription URL or import a local YAML file. Once it has downloaded and parsed, select it as the active config. If parsing fails, check the reported line number and distinguish a network request failure from invalid YAML; they require different fixes.
A subscription may contain nodes, policy groups and rules, or just a list of nodes. A successful import does not guarantee a complete config. First check that the interface shows a selectable policy, then connect. Do not save Base64 text as if it were a complete YAML file.
For everyday use, start with rule mode, select an available exit in the relevant policy group, then enable the system proxy or connect through the mobile VPN. Global mode sends traffic entering the core to the global policy; direct mode connects without a proxy. These are not speed settings.
The system proxy and TUN are traffic entry points; rule and global are processing modes. If a browser works but another app does not, check whether that app follows the system proxy before considering TUN. Change one setting at a time and note its original state.
Open a destination that should use the proxy, then check its domain, matched rule, policy group and actual exit on the Connections page. A VPN icon or a changed tray icon does not prove every app is using the expected route; check the relevant connection log.
If there is no connection record, check the traffic entry point first. If the wrong policy matched, check rule order. If the policy is right but the connection fails, check the exit and DNS. Once verified, save a working config so you can compare it step by step if a later update causes problems, rather than resetting everything at once.
If a browser works but a terminal does not, check the terminal app’s proxy settings first. If a subscription updates but a website will not load, check the selected exit and the destination connection. Subscription downloads, core outbound traffic and browser requests may use different network paths, so success in one does not prove the others are working.
If DNS changes still return old results, disconnect and try again; clear the cache for your platform if needed. If another VPN, accelerator or virtual network tool is active, quit them one at a time to narrow down the cause. Keep your current settings before testing, then decide whether to retain the changes.
Read the full guide →Know whether guidance applies to the client, core or service provider before following it.
The Clash ecosystem includes cores, graphical clients, config tools and rule projects. The original Clash established a base configuration structure for rule-based proxying. Clash Meta extended it, and the project later continued under the mihomo name. Older guides about Meta are often related to current mihomo docs, but that does not mean every field, protocol or default behaves the same way.
When reading a guide, first identify which core it describes, then check whether your client lets you set the relevant fields directly. A graphical client may generate port, DNS or TUN settings for you, or merge local overrides before startup. For troubleshooting, inspect the final runtime config rather than just the subscription source file; differences between the two often explain changes in behavior.
mihomo’s source code is public, and the core is licensed under GPL-3.0. The public repository lets you inspect the implementation, review changes and investigate issues; the license sets conditions for using and distributing the code. Graphical clients are separate projects and may use different licenses. The core’s license does not automatically apply to every client, nor does it indicate whether a subscription service is available.
Issue reports in open-source repositories can help confirm known behavior, but one discussion does not mean every device will have the same issue. When reporting a problem, include the operating system, client name, core details, reproduction steps and redacted logs. Do not publish full subscription URLs, account credentials or config files containing private network information.
A client update may change core capabilities, interface options or system integration; a subscription update usually changes remote config content. If something breaks after an update, first identify which layer changed. Keep the working config from before the update, review the client’s release notes, then compare the generated rules and DNS settings. A filename alone does not tell you whether the core was updated too.
The config snippets in this knowledge base explain fields and syntax; they do not include a working proxy exit. Before copying an example, read its comments, check that policy names are defined and confirm the current platform supports the feature. YAML uses spaces for nesting, and list dashes, commas and string quotes all matter. Combining snippets without checking can create duplicate keys or missing dependencies.
Start with the setup guide to import and verify a config. Need help choosing a client? See the client comparison. Looking for a specific field? Go to the config reference. Core concepts and use-case analysis are covered in topic guides. Choosing resources that match your current question makes it easier to tell whether a setting worked than enabling everything at once.
Explore how proxy modes, traffic capture and mobile system permissions work under the hood.
Compare how rule, global and direct modes handle traffic. Learn which behavior changes when switching modes, which connections remain subject to system proxy settings, and how to confirm the active policy in connection logs.
Read article →Learn how TUN captures traffic through virtual interfaces and routing tables, with a look at stack, auto-route and dns-hijack. If it will not start, narrow down the cause by checking permissions, interfaces, routes and DNS in order.
Read article →Understand how system VPN permission affects background operation. If the connection drops when the screen locks, distinguish battery optimization, background process termination and network changes from subscription problems.
Read article →