The client stores the configuration, and the core reads it to handle connections. A successful import only confirms that the configuration was received. Check that proxy groups, traffic capture, and DNS settings work together.
This is a configuration snippet, not a complete, working setup. Get subscription URLs from your service provider. Proxy entries must be referenced by a proxy group, and rules must select the appropriate policy. Back up local changes before updating the configuration.
Rule Matching Order
rules · PROXY is a defined proxy group
DOMAIN-SUFFIX,example.org,DIRECTDIRECT
DOMAIN-KEYWORD,ads,REJECTREJECT
GEOIP,LAN,DIRECTDIRECT
MATCH,PROXYPROXY
Rules are evaluated in order, not by vote. More specific conditions usually come first, with the catch-all MATCH rule at the end. Here, PROXY is a proxy group name that must be defined in the full configuration and match exactly.
TUN Virtual Interface: Capture Traffic from More Apps
TUN uses a virtual interface and routing settings to send matching traffic to the core. It can handle command-line tools and some apps that ignore the system proxy. Import a subscription and test a basic connection before enabling TUN, then install the required service or grant permissions as prompted by the client. TUN differs from the system proxy in how traffic is captured, not in node quality; UDP support still depends on the node and protocol. If you use another VPN, a virtual machine, or custom routes, check routing and DNS to avoid capturing traffic twice.
Rule-Based Routing: Match Conditions, Then Choose a Policy
Rule mode routes connections based on conditions such as domains and destination addresses. Put specific rules before broad ones; MATCH handles anything left over, while the proxy group selects a node. After editing, check the syntax and group names, then make a new connection and review the match log. Unlike global mode, rule mode can route local services, frequently used sites, and other requests differently, but the order needs maintenance. Subscription updates may overwrite direct edits, so keep long-term rules in a client-supported override or merged configuration.
Fake-IP returns a virtual address for a domain. The core uses a mapping to recover the domain on later connections, so domain-based rules can apply. Fake-IP is neither a remote node nor encrypted DNS. Route DNS requests through the intended resolver path and make sure the virtual IP range does not conflict with your LAN. If an app requires real IP addresses, add it to the filter list rather than disabling DNS handling altogether. The key difference from returning real addresses is how domain information is preserved and when connections are processed.
Automatic Subscription Updates: Configurations vs. Proxy Lists
A full configuration subscription can include nodes, proxy groups, and rules. A proxy list typically contains only node entries, which must be referenced in the main configuration. Client-scheduled updates and the core's proxy-providers updates operate at different levels, so check them separately when troubleshooting. After importing, run an update manually and confirm the entries are readable and the groups have selectable nodes before setting a schedule. Subscriptions track changes on the server more easily than static local configurations, but remote content can also replace local edits; save your overrides first.
Multi-Core Compatibility: Check the Client and Core Separately
The graphical client handles the interface, permissions, and configuration management; the core handles protocol connections, rule matching, and DNS. Some clients let you switch cores, while others bundle a fixed implementation, so the interface name alone does not tell you what is supported. The original Clash, Clash Meta, and mihomo are historically related, but their extended protocols and configuration fields are not fully interchangeable. Before migrating, check node types, transport options, and rule-provider syntax, then test that the configuration loads. Being able to import a file does not mean every field in it is supported.
Troubleshoot connections in a consistent order: check whether the configuration loaded, whether proxy groups have nodes, whether traffic reaches the core, and whether rules match the intended destination. Change one setting at a time and retest the same request. This helps distinguish subscription issues from system proxy settings and node connectivity, without losing track after changing modes and DNS at once.
Protocol names describe how a client connects to a server; they do not determine how every app behaves. Server parameters, UDP availability on your network, certificates, and transport settings must also match. See the protocol reference for the capabilities and limitations of SS, VMess, Trojan, VLESS, Hysteria2, and TUIC. Choose based on your network and devices, not just the protocol name.
Choose a Client
Browse Downloads by Platform
The download center lists clients and installation instructions by operating system. Desktop and mobile clients use different permission models, and the same subscription may need to be imported in a client-specific format.
Start with Clash Plus, then compare how Clash Verge Rev, FlClash, and other clients manage configurations. Before your first connection, check the installer architecture and test with the system proxy; enable service mode or TUN only if needed.
Check About This Mac to see whether your Mac has Apple Silicon or an Intel chip, then choose the matching installer. Follow the system prompts to authorize network capture. The download center also lists the ClashX Meta archive and its maintenance status.
Compare Clash Plus, Clash Meta for Android, FlClash, and Surfboard. Choose an installer for your device architecture and allow the VPN connection when prompted. If the connection drops when the screen locks, check battery optimization and background activity restrictions.
Use the download center to open the Clash Plus page on the App Store; its official site is clashplus.io. After importing a configuration, follow the prompts to add a VPN configuration and check the proxy groups. Not every desktop setting is available on mobile.
For a graphical desktop client, choose Clash Verge Rev or FlClash and select the package format for your distribution. If you manage a server, router, or service yourself, see the mihomo core section for separate instructions on startup, permissions, and listening addresses.
A client is not a node service. After installation, you still need a valid local configuration or subscription; turning on the connection switch in the interface does not create usable nodes. When moving an existing configuration to a new device, keep the original file and check protocol and field compatibility. Mobile devices usually capture traffic through the system VPN interface, while desktop clients may offer both a system proxy and TUN.
For your first setup, start in rule mode, select an available node manually, open the target app, and check the connection log. A latency test only reports the result for one test request; it does not verify real-world access. If your browser connects but command-line tools still go direct, check whether they use the system proxy before setting proxy environment variables or enabling TUN.
Use source code, configuration documentation, and actual connection logs as references. Client names, core features, and subscription services are separate layers and should be checked independently.
Project History and Naming
The original Clash established a configuration system that uses rules to choose connection routes. Clash Meta expanded protocol and network-handling capabilities within this ecosystem, and later continued its development under the mihomo name. Meta may still appear in older guides, client options, configuration docs, and logs; check which implementation the documentation covers. A shared history does not mean configurations are interchangeable, especially when extended fields or newer protocols are involved.
Client Interface and Connection Core
Graphical clients such as Clash Verge Rev and FlClash provide controls for subscriptions, proxy selection, the system proxy, and services. Available features also depend on the integrated core. The client interface and core may update on different schedules. If a field is not recognized, first check which core is running and whether the configuration loaded successfully. Then decide whether an update is needed; do not infer support from the app name alone.
Open-Source Ecosystem and Reproducing Issues
The public mihomo repository includes source code, issue discussions, and release notes for understanding configuration behavior. Before reporting an issue, remove sensitive details such as subscription URLs, node passwords, and personal file paths, leaving only what is needed to reproduce it. Include your system, client, core, traffic capture mode, and steps to trigger the issue, along with relevant error context. A clear description of one failed connection is more useful than an unfiltered, full log.
Updates and Preserving Configuration
Client, core, and subscription updates change the interface, connection implementation, and remote configuration, respectively. Identify what you intend to update and save proxy group selections, custom rules, and overrides first. After updating, confirm the configuration loads, then check DNS, rule matches, and real-world access in order. If something regresses, keep a minimal reproducible configuration and consult the relevant release notes; repeated reinstalls are no substitute for diagnosing the cause.
Configuration Notes
Client Setup and Connection Troubleshooting Guides
Follow the setup flow: choose a platform and import method, verify the connection, then troubleshoot DNS and rules. Here are the three latest articles.
A guide to iOS clients that support Clash configurations and App Store account region requirements, with steps for importing a subscription link, authorizing a VPN configuration, and switching to rule mode.
Learn what causes DNS leaks and how to test for them, with configuration guidance for enhanced-mode, nameserver, fallback, and DNS hijacking under TUN.
After importing a subscription, select a proxy group, test latency, and check the exit IP in order. Use connection logs and rule matches to confirm that traffic is actually routed through the proxy.
Client menus may change, but the troubleshooting approach still applies: check app requests, traffic capture, rule matching, and node connections separately. If you encounter a port conflict, permission issue, or configuration syntax error, save the error details and revisit the relevant step. For common issues, see the FAQ; for the full import workflow, read the user guide. Protocol and core differences are covered in the protocol reference.