Windows
Windows 10 / 11
For desktop daily drivers — Clash Verge Rev is full-featured and actively updated.
Go to DownloadsClash Client Downloads & Setup Handbook for All Platforms
Covers Windows / macOS / Android / iOS / Linux — complete documentation for client downloads, subscription import, and rule-based routing.
- All-Platform Clients
- Open-Source Code
- Full Documentation
features
Core Feature Index
Clash runs on a single YAML config file, with five modules — rules, subscriptions, proxy groups, TUN, and DNS — covering every everyday scenario. Pick an item on the left; the panel on the right shows the explanation and a config snippet you can apply directly.
Rule-Based Routing
Clash matches every connection against the rules list from top to bottom: a match on a domain suffix, GEOIP, or similar condition sends the connection to the specified outbound, and anything unmatched falls through to the catch-all MATCH rule at the end. The core problem it solves is that "which traffic goes through the proxy" no longer depends on manual switching: local sites connect directly, foreign sites go through the proxy, and ad domains get rejected — all handled automatically by rules. Rules live in the config file, so edits take effect on reload without reinstalling the client. Compared with a traditional global proxy, routing granularity goes down to a single domain or IP range — the key difference between Clash and simpler proxy tools.
rules:
- DOMAIN-SUFFIX,github.com,PROXY
- DOMAIN-KEYWORD,speedtest,DIRECT
- GEOIP,CN,DIRECT
- MATCH,PROXYSubscription Management
Node information is usually delivered by your provider as a subscription link. The client can import the link directly, or you can declare the subscription source and refresh interval with proxy-providers in the config, which pulls the latest node list automatically — so multiple devices only need to maintain the same link. It solves the sync cost of frequently changing nodes: when your provider rotates servers, you don't edit configs device by device — a subscription refresh brings everything back in line. With health-check enabled, dead nodes are probed periodically and dropped from the candidates. Keep interval around one day: shorter wastes traffic, longer means stale nodes.
proxy-providers:
main:
type: http
url: https://example.com/subscribe.yaml
interval: 86400
path: ./providers/main.yaml
health-check:
enable: true
url: https://www.gstatic.com/generate_204
interval: 600Proxy Groups
proxy-groups bundles multiple nodes together and defines a selection strategy: select for manual switching, url-test to auto-pick the fastest node by latency, and fallback to switch in order when the preferred node fails. Rules ultimately point to a group name, so switching nodes doesn't require touching the rules. It decouples rules from nodes: hundreds of rules only reference a handful of group names, so the rule layer stays untouched no matter how nodes come and go. In practice, give streaming, downloads, and messaging each their own group with a different strategy; the tolerance parameter prevents flapping between two nodes with near-identical latency.
proxy-groups:
- name: PROXY
type: url-test
proxies: [node-hk-01, node-jp-01, node-sg-01]
url: https://www.gstatic.com/generate_204
interval: 300
tolerance: 50TUN Mode
System proxy settings only affect apps that respect them; enabling TUN makes the client create a virtual network adapter that takes over all system traffic, so command-line tools, games, and other processes that ignore the system proxy still go through Clash's rule chain. It solves the "proxy leak" problem: some programs ignore the system proxy and connect directly, and TUN catches that traffic back at the network layer. Enabling it requires administrator privileges or installing a system service, and on Windows the first activation also installs a virtual adapter driver. TUN gives fuller coverage than the system proxy but leans more on logs when debugging — get the system proxy working first, then enable TUN as needed.
tun:
enable: true
stack: system
auto-route: true
auto-detect-interface: trueDNS Resolution
The built-in DNS module handles domain resolution and routing decisions. fake-ip mode returns a placeholder address from a reserved range first to speed up connections, while nameserver and fallback handle regular queries and queries that need to avoid DNS tampering, respectively. It solves the "nodes are fine but pages won't load" symptom caused by poisoned or slow resolution: local domains use a fast local DoH server, while foreign domains go to the trusted resolvers in fallback. If a LAN printer or certain games misbehave under fake-ip, exclude those domains with fake-ip-filter. This section is broken down line by line on the blog.
dns:
enable: true
enhanced-mode: fake-ip
fake-ip-range: 198.18.0.1/16
nameserver:
- https://223.5.5.5/dns-query
fallback:
- https://1.1.1.1/dns-query
downloads
Get the Client for Your Platform
Actively maintained clients exist for all five platforms. Pick your system to jump to the matching section of the download page, where the recommended pick and system requirements are listed; one subscription works across every platform, so mixed-device setups don't need separate configs.
macOS
macOS 11+
Native builds for Intel and Apple Silicon; ClashX Meta is the lightweight pick.
Go to DownloadsAndroid
Android 8.0+
Install the APK directly — VpnService-based, no root required.
Go to DownloadsiOS
Available on the App Store
Compatible apps like Stash use the same config syntax as desktop clients.
Go to DownloadsLinux
deb / rpm / AppImage
GUI packages for desktop; on servers run the mihomo core under systemd.
Go to Downloads
quickstart
Three Steps to First-Time Setup
From a blank system to a working proxy, the main path is just three steps. Full instructions and screenshots for each step are in the tutorial docs.
-
Download and install the client
Pick the recommended client for your platform on the download page, run the installer, and follow the prompts. On Windows, the first launch may trigger a SmartScreen or similar security warning — common for unsigned open-source software; the workaround is covered in the installation chapter of the docs. On macOS, if you see "cannot verify the developer", allow it once under Privacy & Security in System Settings.
-
Import your subscription link
Copy the subscription link provided by your service, then paste it into the client's config or subscription page to import it. Once imported, the node list and rules are written to your local config automatically, and they'll refresh on the schedule you set. Treat the link as an account credential — don't screenshot or share it; if the node list comes back empty after import, check that the link was copied in full.
-
Turn on the system proxy and verify
Toggle on the system proxy switch in the client, choose a node with normal latency, then visit a site covered by the rules to confirm it connects. Run a latency test in the client first to rule out timed-out nodes before verifying. The verification steps and latency testing details are in the docs' verification chapter; if it fails, work through the troubleshooting page layer by layer.
open source
Open-Source Code You Can Review and Build Yourself
The core and mainstream clients across the Clash ecosystem are released under open-source licenses, with code hosted in public repositories that anyone can review, file issues against, or build from source.
Ecosystem Facts
- The original Clash core went open source in 2018 and established the YAML config, rule-based routing, and proxy-group model; after the original repository was archived in 2023, the community fork mihomo (the Clash Meta core) took over, released under GPL-3.0 with ongoing releases
- GUI clients and the core are two layers: Clash Verge Rev, FlClash, ClashX Meta and others all wrap the same mihomo core, which is why one config file works across clients — switching clients never means rewriting your config
- These clients are likewise public repositories maintained by the community; updates ship through GitHub Releases with version numbers, changelogs, and checksums open for verification, and clients offer in-app core hot updates
- The config file is plain-text YAML with every field documented publicly for offline reference; this site's documentation is written from public sources and verified against real configs, without modifying any installer
Get the Core from Source
If you need to review the code or build the core yourself on a server, clone the repository directly:
git clone https://github.com/MetaCubeX/mihomo.gitRegular desktop and mobile users don't need this step — just use the GUI client from the download page. The main branch is the development branch; releases are the tagged versions. Building requires the Go toolchain and produces a single static binary — drop it in your PATH with a config.yaml and it runs as a long-lived service on a server.
faq
Frequently Asked Questions
The questions new users ask most, with a one-line answer pointing you in the right direction — full steps live on the linked docs pages.
Clash for Windows is discontinued — can I still use it?
The original stopped receiving updates in 2023; migrate to the actively maintained Clash Verge Rev — your config file carries over as-is. See the client comparison for the migration details.
Imported a subscription but got no nodes, or updates fail?
Usually the link was copied incompletely or the subscription endpoint itself needs a proxy to reach — work through the subscription section of the troubleshooting page to pin it down.
Proxy is on but pages still won't load?
First confirm the node latency is normal, then check whether the rules actually match — the verification order and test commands are in the docs' verification chapter.
Startup error says the port is already in use?
Another program grabbed port 7890 or similar; find the conflicting process with one command or switch the mixed port — see this troubleshooting article.
blog
Recently Updated Articles
Long-form guides on installation, client comparisons, and troubleshooting, with copy-paste commands and config snippets.
Advanced Config
Clash DNS Config Explained: How to Write nameserver, fallback, and Anti-Tampering Settings
Walks through enhanced-mode, how nameserver and fallback split their roles, and what fallback-filter and DNS anti-tampering actually do — plus a ready-to-use dns section template with line-by-line comments.
Read more →Troubleshooting
Clash Says Port Already in Use: Finding the Conflicting Process and Changing the Mixed Port
A startup error like bind: address already in use usually means port 7890 or similar is taken by another program. This article covers the lookup commands for Windows, macOS, and Linux, plus the correct way to switch to a different port in the config file.
Read more →Platform Guides
Installing Clash on Windows: Every Step from Download to a Working System Proxy
Walks through the full process on Windows 10/11 — downloading, installing, importing a subscription, enabling the system proxy, and verifying connectivity — plus a roundup of common installation-stage issues like SmartScreen blocks and startup-on-boot failing to work.
Read more →