Clash Clients for iOS: App Store Availability and Subscription Import

Separate the client, config format, and server protocol

To use a Clash subscription on an iPhone, first choose an iOS app that can read its config format. Clash configs are typically YAML files containing proxies, proxy groups, rules, and DNS settings. The app imports and displays the config, then starts a network extension. These are different layers, and an app’s name containing “Clash” alone doesn’t prove compatibility.

Clash Meta is now called mihomo and is a core project. Using mihomo on desktop doesn’t mean an iOS app uses the same core—or that it can apply every field in your subscription as-is. Even when protocol names match, transport parameters, TLS options, and rule extensions may differ.

This guide focuses on clients that support Clash-style configs. Stash is one example to check; it isn’t an official iOS release of the original Clash project. For other apps, verify the developer, supported formats, and current App Store listing individually. Don’t mistake this site’s branding or a similar app name for an official project affiliation.

App Store availability and account region requirements

Check the App Store listing before assuming a region restriction

Whether an app appears in search depends on your Apple Account’s App Store region, the developer’s distribution regions, device compatibility, and the app’s current availability. Your device language, time zone, and region in Settings aren’t the same as your App Store account region. Changing your network location won’t change your storefront.

1. Open the App Store listing from the developer’s official website and check the app name, developer, minimum iOS version, and price.
2. If you see “This app is not available in your country or region,” first check which account is used for Media & Purchases instead of repeatedly changing your iPhone’s language.
3. If you see a message that your iOS version isn’t supported, check the version under Settings → General → About. Changing your region won’t fix an OS compatibility issue.
4. Before purchasing, check whether the app is a one-time purchase, a subscription, or another type of paid app. The current listing is the source of truth. App costs and subscription service fees are separate expenses.

Changing regions and keeping your account secure

Using iOS 18 as a reference, check your account region in Settings → Apple Account at the top → Media & Purchases → View Account → Country/Region. Labels may differ slightly across iOS versions. Before changing regions, follow Apple’s instructions for handling your account balance, active subscriptions, Family Sharing, and payment method.

App Store availability can change, so this guide can’t promise an app will remain available in any particular region. TestFlight is for beta distribution, with limits on participant slots and build validity; it isn’t a permanent download channel. For installation links, first check the platform details in our Download Center, then verify the official channels provided by the developer.

Before importing: make sure the subscription returns a complete config

“Subscription link” doesn’t refer to one universal format. Some links return a full YAML config; others return only a list of nodes, encoded node URIs, or different content based on request parameters or the client identifier. Opening a link in a browser only confirms that it returned a response—not that the response works with your app.

• Full Clash config: Typically includes fields such as proxies or proxy-providers, along with proxy-groups, rules, and other settings.
• Proxy provider: May contain only a proxies list that needs to be referenced by proxy-providers in a main config. It may not work as a complete config on its own.
• Web page response: A sign-in page, plan page, or HTML response usually means you opened a page URL, authentication failed, or the server requires you to sign in first.
• Format for another client: Ask your service provider for the link intended for your app. Don’t judge the contents by the file extension alone.

Query parameters in subscription URLs often contain access credentials. Copy the entire URL, including every parameter, and make sure you don’t miss the final characters. Hide the full URL in screenshots. Never submit an active subscription to an untrusted online converter. If conversion is needed, use an adapter provided by your service provider or a conversion tool you control.

If you already use the subscription on a computer, note three things first: the selected proxy group, the node you’re actually using, and the format specified by the subscription provider. After importing it on your iPhone, you can compare these items instead of relying on the node count alone.

Importing a subscription: check download, selection, and updates separately

Button labels vary by app version, but the import process should cover three actions: add a remote config, download it, and set it as the active config. In an app like Stash, add a URL source from the config list. If your version supports QR code or file import, confirm whether you’re importing a remote link or a local copy.

1. Open config management. Open the app’s config list and choose the option to add a config or download one from a URL. Don’t paste the subscription into a field for an HTTP proxy address, DNS address, or node server address.
2. Paste the original subscription URL. Check for spaces, line breaks, Chinese punctuation, or extra text added by a messaging app. Give it an easy-to-recognize name, such as “Daily Rules.”
3. Download the config. Wait for the app to finish parsing it. If an error appears, note the status code and field location rather than just writing “import failed.”
4. Select the active config. After the download succeeds, return to the config list and confirm that the config is selected. If you have multiple configs, adding one doesn’t necessarily switch to it.
5. Check proxy groups. Open the proxy or policy page and confirm the main proxy group has selectable nodes and that every group referenced by the rules exists.
6. Check the update source. Make sure the remote URL is saved and check for an automatic update toggle or a manual update option. Local files usually won’t receive changes from the original subscription automatically.

Troubleshoot by error type instead of retrying repeatedly

• 401 or 403: Check your credentials, whether the link is still valid, and any server access restrictions first. Don’t start by changing DNS.
• 404: Check the full path and confirm that the old subscription hasn’t been replaced.
• YAML parsing error: Check indentation, duplicate keys, and the line mentioned in the error. The server may also have returned HTML instead of YAML.
• Download timed out: Check your basic network connection and whether the subscription domain is reachable. If the app supports updating through an existing proxy, try that while you have a working connection.

VPN permission: how the iOS network extension handles traffic

When you connect for the first time, iOS will usually ask whether to allow the app to add a VPN configuration. Verify the app’s source, follow the system prompt, and authorize it with your device passcode or system authentication. VPN here refers to the system network extension; it doesn’t mean every node in your subscription uses a traditional VPN protocol or that all traffic necessarily passes through a remote node.

Using iOS 18 as a reference, go to Settings → General → VPN & Device Management → VPN to review configurations and connection status. If a work VPN, another proxy app, or security software is already connected, disconnect the other personal VPN before testing. Restrictions on managed devices must be checked with your device administrator.

How this differs from desktop system proxies and TUN

Desktop system proxies typically require apps to follow HTTP or SOCKS proxy settings. On iOS, apps like these often use Network Extension’s Packet Tunnel to connect to the system network. Both desktop TUN and iOS Packet Tunnel can route traffic at the network layer, but permissions, routing capabilities, traffic exclusions, and lifecycle are governed by each OS. Don’t copy Windows service-mode instructions directly.

• You usually don’t need to change the Wi-Fi HTTP proxy. When the app uses a VPN network extension, setting a manual proxy in Wi-Fi details is not normally required.
• A port isn’t VPN authorization. mixed-port: 7890 in a desktop config is an example of a local listening port, not an iOS system authorization setting.
• Limit LAN exposure. Unless other devices genuinely need to connect, don’t enable LAN access just to get online on your iPhone.
• The VPN icon doesn’t verify everything. A connected VPN status only confirms the tunnel state; you still need to check the rules, node, and target request.

Switching rule modes: check the policy group and final route

For your first session, start with Rule mode. It matches destinations against rules in order and applies the corresponding policy. Global mode sends traffic normally controlled by the app to the global policy, while Direct mode connects without a proxy. The exact scope also depends on the app’s routing settings and iOS restrictions. Don’t assume “Global” guarantees that every system connection on the device is covered.

The rules below illustrate matching order; they aren’t a complete, standalone config. “Proxy Select” must match an existing policy group in your config. If the actual group name differs, replace it with the name in your config.

mode: rule
rules:
  - DOMAIN-SUFFIX,apple.com,DIRECT
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - MATCH,Proxy Select

This config sends requests for apple.com and its subdomains directly, sends destinations in the specified LAN ranges directly, and routes all other requests through “Proxy Select.” It illustrates rule structure only; it isn’t a recommended routing setup for everyone. In particular, a domain suffix rule won’t cover every domain used by a company.

Verify three things with the same request

1. Select a policy group: Find the group referenced by the rules on the app’s proxy page and choose a node. For an auto-select group, check which member is currently selected.
2. Run a latency test: Use the test provided by the app. A result of 120 ms only reflects the time to the test target under that test method. This is an example reading, not a measurement from this guide, and it doesn’t replace bandwidth or service-availability tests.
3. Check connection logs: Open a website you expect to use the proxy, then check the app’s connection or request logs for the destination domain, matched rule, policy chain, and actual node.

If your egress IP still matches your local carrier, first check whether the request went direct under a rule. The IP-check site itself may also be routed directly. Compare the result with connection logs from the same time instead of assuming the whole iPhone’s proxy is broken based on one IP address.

Common iPhone issues: DNS, failed updates, and network switching

A node passes the latency test, but websites won’t load

First check whether the latency test and the actual request target the same destination, then review DNS and the rules. A successful node handshake doesn’t guarantee access to a target website. If the logs show a DNS resolution failure, check whether the app accepts the DNS fields in the config and whether app-level DNS settings override them. Fake-IP also requires support in the app; adding enhanced-mode: fake-ip alone doesn’t make it work.

The desktop config works, but iOS reports an unsupported field

Keep the name of the field that triggered the error and check the config docs for your current app version. mihomo-specific extensions, proxy provider behavior, and transport options may differ. Don’t delete an entire rule section or DNS config just to clear the error. First use an iOS-compatible config from your subscription provider, then confirm that the essential policies remain in place.

Wi-Fi works, but cellular data doesn’t

First turn off the proxy and check that cellular data works normally. Then confirm the app has the required data access in Settings → Cellular. After switching between Wi-Fi and cellular, check whether the tunnel reconnects and the node completes its handshake again. Some networks handle UDP differently. If you use a QUIC-based protocol such as Hysteria2, check UDP reachability specifically instead of assuming the issue is related to your account region.

Your selections disappear after a subscription update

The subscription may have changed node names, policy group names, or group structure. Check the update results, then select a member again. If the app supports persistent policy selections, it can restore a selection only while its matching rules still apply. A node removed by the server can’t be kept in service through a local preference.

Stop the connection or remove a config

Stop the connection in the app first, then check whether On Demand or auto-connect is enabled to prevent iOS from reconnecting immediately. To remove the config, delete the corresponding entry from the system VPN list. When reporting an issue, note the app version, iOS version, network type, time of the error, and relevant logs. Hide subscription credentials, node passwords, and private domains. For more troubleshooting, see FAQs.