From choosing a client to establishing a connection, find practical guidance on subscription imports, rule-based routing, and TUN mode.
Clients differ in interface design and kernel integration. Open the download page for your device first, then choose software based on maintenance status, system architecture, and your workflow.
Ideal for everyday desktop use: choose Clash Plus, Clash Verge Rev, FlClash, or Clash Nyanpasu, or read the migration notes for discontinued clients. Check your system architecture before downloading; after installation, configuration usually starts from the subscription section.
Supports both Apple Silicon and Intel devices. When first enabling the system proxy or TUN, follow the system prompts to grant network extension permissions.
Suitable for phones and tablets. After importing a subscription, approve the system VPN request; adjust per-app proxy and background activity limits in the device settings.
Get Clash Plus from the App Store. After installation, the system creates a VPN profile; add your subscription in the client and select Rule mode.
Desktop users can choose a graphical client, while servers, soft routers, and container environments often run the mihomo kernel directly. Both use the same general YAML configuration style, but service management, permissions, and log locations differ. The download page lists separate entry points.
Start with a working base configuration, then handle system interception, rule maintenance, and subscription updates step by step. The panels below mirror the settings most commonly found in clients.
A subscription URL centrally provides proxy nodes, proxy groups, and rule configuration. Before importing, confirm that the link comes from your own service provider, then paste the complete address into the client's subscription or configuration section. Save it and run one manual update to verify that the configuration name, proxy groups, and rules appear correctly. There is no need to use a very short update interval; daily updates are usually sufficient. If an update fails, first check whether the URL has expired, whether the system clock is accurate, and whether the current network can access the subscription address directly.
Rule mode determines where connections go based on domain, IP, process, or geographic rules in the configuration, making it suitable for most everyday use. Global mode sends most traffic through the currently selected proxy group and is useful for temporarily checking whether a rule is missing a match. Direct mode bypasses the proxy and helps determine whether a problem is related to client interception. These are not speed settings, and switching modes does not change a node's bandwidth. If a page will not open, compare Global and Direct mode, then return to Rule mode to identify the specific rule.
Clash rules are typically matched from top to bottom. Once a request matches the first applicable rule, it enters that rule's proxy group, so specific domain or process rules should come before broad rules. Proxy groups provide a second choice among proxies, automatic selection, or direct connections; a rule itself is not a node. When editing a configuration, identify the matching target first, confirm that the destination proxy group exists, then review the match in the connection log instead of judging effectiveness from the webpage alone.
DOMAIN-SUFFIX,example.com,Proxy
DOMAIN,local.example,DIRECT
GEOIP,CN,DIRECT
MATCH,Proxy
Rules are matched in order
TUN mode uses a virtual network interface to capture more traffic that ignores system proxy settings, including traffic from command-line tools, some game launchers, and standalone network applications. Before enabling it, configure the regular system proxy and verify that subscriptions and rules work correctly. Then handle additional requirements such as administrator privileges, network extensions, and DNS hijacking. If enabling TUN makes LAN devices unreachable, causes DNS failures, or creates a network loop, disable TUN first to restore the basic connection, then check routes, DNS, and excluded subnets one by one.
Understanding the roles of the kernel, client, and configuration file helps keep interface, rule, and network issues separate during troubleshooting.
The original Clash kernel established familiar practices such as rule matching, proxy groups, and YAML configuration. After the original project stopped being maintained, community forks continued work on protocol extensions, TUN implementations, rule types, and data management. Today, graphical clients commonly ship with the mihomo kernel, but update schedules, interface layouts, and system integration still vary by client.
The graphical client handles subscription management, system proxy switches, policy selection, log viewing, and desktop integration; the kernel reads configuration, establishes connections, applies rules, and handles DNS. An interface opening does not mean the kernel is running, and a successful subscription update does not mean system traffic is being intercepted. During troubleshooting, verify configuration loading, kernel status, system proxy settings, and actual connection logs separately.
Common base fields are broadly similar across Clash ecosystem clients, but mihomo extensions for protocols, rule types, or DNS fields may not be recognized by older kernels. When migrating between clients, do not simply copy the entire configuration and assume compatibility. A safer approach is to import the subscription first, then migrate your own rules, overrides, and DNS settings separately while checking field warnings in the startup log.
Client updates, kernel updates, subscription updates, and rule-data updates are four separate things. A client update mainly changes the interface and system integration; a kernel update affects protocol and configuration capabilities; subscription updates are generated by the service provider; and rule data may be downloaded independently. When an update fails, identify what failed first, then check the network, permissions, configuration path, or upstream status.
git clone https://github.com/MetaCubeX/mihomo.git
First identify whether the issue occurs during download, subscription import, kernel startup, or system interception, then open the relevant guide.
Confirm that the subscription URL is complete and still accessible, then check the system clock, current network, and client logs. If the old configuration still works, keep it instead of repeatedly deleting and recreating configurations.
View subscription import steps →Use Rule mode for everyday use. Global mode is useful for briefly checking whether a target connection is being routed incorrectly; return to Rule mode afterward and fix the rules.
Read about proxy modes →Some programs do not read system proxy settings. Check the app's own proxy options first; if you need to capture more traffic, configure TUN mode according to the operating system's requirements.
View connections & verification →Disable TUN first to restore basic connectivity, then check administrator permissions, DNS hijacking, auto routing, and the LAN exclusion range. Avoid changing several parameters at once.
Read the TUN configuration guide →Explore multi-device synchronization, the mihomo kernel, and DNS configuration after establishing a basic connection.
Compare centralized management with subscription URLs, WebDAV backup and restore, and manual imports, including use cases, effort, and migration considerations.
Read the full article →Review mihomo’s extensions and compatibility boundaries compared with the original kernel, from protocol support and rule types to TUN implementation and GEO data management.
Read the full article →Break down the roles of core DNS fields, filtering logic, enhanced-mode differences, and the practical role of DNS hijacking with TUN.
Read the full article →