Clash client · mihomo core configuration
Choose an installer for your system and learn about Routing Rules, subscription imports, and mihomo core configuration.
CONFIGURATION / FEATURES
Explore configuration snippets by use case, from traffic interception to policy matching. Examples show partial fields and must be combined with valid proxies and policy groups.
In rule mode, rules are evaluated from top to bottom. When a rule matches, its policy is applied and evaluation stops. Domain suffixes are useful for targeting a service, keywords for broader domain matching, and geodata rules for matching by location. Unlike sending every connection through one outlet, routing rules let you choose separate paths for developer services, LAN resources, and everyday websites. Put specific domains first and fallback rules last. In this example, PROXY must match the name of a proxy or policy group in your configuration.
Clash Verge Revrules:
- DOMAIN-SUFFIX,github.com,PROXY
- DOMAIN-KEYWORD,google,PROXY
- GEOIP,CN,DIRECT
- MATCH,PROXYSystem proxy settings work only with apps that respect them; some command-line tools and network applications do not. TUN mode uses a virtual network interface and routing to capture connections, making it useful when you need broader coverage. First verify that a regular proxy connection works, then install the required service or grant permissions as directed by your client. Check auto-routing, interface detection, and DNS capture together. Other VPNs, virtual machine adapters, or corporate network policies may affect the result. TUN determines how traffic reaches the core; it does not replace proxy selection or routing rules.
tun:
enable: true
stack: mixed
auto-route: true
auto-detect-interface: true
dns-hijack:
- any:53Desktop clients usually provide a subscription import option on the configuration page. The downloaded content may be a complete YAML file or just a list of proxies that needs conversion. After importing, make sure policy groups, rules, and proxies have loaded before enabling the system proxy. Subscriptions make updates easier than entering server details one by one, but an update may overwrite changes made directly to a remote configuration. For local rules you need to keep, use the client’s override or merge features. The example below shows a file-based local proxy provider, not a URL to paste into a subscription field.
proxy-providers:
local-nodes:
type: file
path: ./providers/nodes.yaml
health-check:
enable: falsemihomo supports proxy types such as Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC. Available fields depend on the core implementation and server configuration. Proxies shown in the same list can still differ in transport, authentication, and UDP behavior. Check client support and verify the server settings before choosing a protocol; the name alone says nothing about speed. Compared with tools limited to one subscription format, a multi-protocol core makes it easier to manage policies in one place. Renaming a proxy type does not convert its protocol. This example uses reserved domains and a sample password and cannot be used for a real connection.
proxies:
- name: trojan-example
type: trojan
server: proxy.example.com
port: 443
password: "your-password"
sni: proxy.example.com
udp: trueFake-IP uses reserved addresses to map domains, allowing the core to retain domain information when a connection arrives and apply domain-based rules. These are not the destination server’s real addresses or resolution results that can be shared with other devices. Compared with relying on real IP addresses to identify destinations, mappings can reduce some lookup delays, but LAN discovery, printers, and certain apps may need exceptions. If you run into compatibility issues, first confirm that DNS requests are actually reaching the core, then add filters for specific domains. Don’t clear the entire filter list or keep switching modes to mask a configuration problem.
dns:
enable: true
enhanced-mode: fake-ip
fake-ip-range: 198.18.0.1/16
fake-ip-filter:
- "*.lan"
- "*.local"
nameserver:
- 223.5.5.5The external controller lets a dashboard read policy groups, connections, rules, and logs, and can also switch policies. It serves a different purpose from the mixed port that handles browser traffic; the two are not interchangeable. Desktop clients often manage the controller themselves, so you usually don’t need to add a separate configuration. Set it up manually only when running the core independently, following your deployment requirements. A dashboard makes it easier to verify the active state than editing files alone. Bind to the local loopback address first to avoid exposing the controller publicly. If remote access is required, configure authentication and access controls. The example shows a local listening address only.
external-controller: 127.0.0.1:9090
log-level: info
mode: rule
# Desktop client users should prefer the built-in dashboard
# Configure authentication and access controls before enabling remote managementOPEN SOURCE / CORES AND CLIENTS
Clients handle the interface; cores handle connections. Understand how they differ before choosing a download, troubleshooting, or planning updates.
Clash began as a rule-based proxy core, around which graphical clients, configuration editors, dashboards, and other tools developed. After the original project was discontinued, community forks continued its development. Clash Meta later adopted the name mihomo. This links the Meta core mentioned in older guides to mihomo today, but it does not mean every old configuration field is fully compatible with current versions.
An installer’s name is not necessarily the name of its core. Clients such as Clash Verge Rev and FlClash each manage their own interface, system proxy, service installation, and configuration. Their underlying connection capabilities depend on the core they use. When reading older articles, first identify whether they discuss the graphical interface or core settings, then decide whether the instructions still apply. This helps avoid searching for a button with the same name in a different client.
The mihomo repository publishes its source code under the GPL-3.0 license. The source, issue tracker, and release notes can help you understand the implementation and investigate compatibility problems. Each graphical client has its own license and release schedule; the core’s license does not automatically apply to every installer. Before redistributing or modifying software, review the relevant project’s license file and documentation.
This site provides download links and technical articles in Chinese. It does not replace upstream release notes or represent the teams maintaining individual clients. For questions about supported fields or system permissions, consult the documentation for the relevant client and core. When reporting an issue, include the operating system, reproduction steps, and relevant logs, but remove subscription URLs, passwords, and other private details.
Updating a graphical client, core, subscription, and rule set are separate operations. A client update may change how services are installed; a core update may alter field behavior; a subscription update mainly replaces configuration content. Change one component at a time, keep a copy of your original configuration, then test connections and routing. This makes it easier to identify the cause of a problem than updating everything at once.
Keep remote subscription content separate from local settings. Editing a file downloaded from a subscription directly may work only until the next refresh. For persistent LAN direct-connection rules, personal policy groups, or DNS exceptions, use the client’s override feature and document why you made each change. When switching clients, import the existing configuration first, then verify mixed-port, DNS, and TUN behavior. Don’t treat the location of a toggle in the old interface as a configuration standard.
An enabled proxy toggle only shows that a traffic interception setting is on; it does not prove that every app is using the proxy. To verify, check whether connections reach the core, which rule matched, and which policy was ultimately selected. Browsers and terminals may use different proxy settings, and LAN apps may bypass the system proxy, so check each app separately.
Troubleshoot in this order: confirm the configuration loads, verify proxy settings, check DNS, confirm traffic reaches the core, then inspect rules and TUN routing. Don’t judge the entire client by a single connection attempt. For protocol differences and core compatibility, see the protocol and core technical reference. If configuration field names are unfamiliar, start with the quick reference glossary.
For users researching the implementation or building from source. Most users can choose a graphical client without cloning the repository.
View the MetaCubeX/mihomo repository ↗git clone https://github.com/MetaCubeX/mihomo.gitPACKAGES / CHOOSE A PLATFORM
Start with your operating system, then check the processor architecture and whether the software is still maintained. These links open the relevant platform section on the downloads page; they do not start a download directly.
Choose from clients such as Clash Plus and Clash Verge Rev. On desktop, start with the system proxy and confirm that your browser connects successfully before considering TUN for apps that need it. Check system requirements and processor architecture before installing. When upgrading, keep track of your subscription source and local override rules.
Go to downloadsChoose the installer for Apple Silicon or Intel. The first time you open the app, follow the system prompts to grant permissions. For features that require a network extension or background service, follow the client’s instructions. Before choosing an archived client, check that it still supports your current system and subscription configuration.
Go to downloadsChoose an installer for your device architecture and approve the system VPN permission when connecting for the first time. Mobile background restrictions can interrupt connections, so check battery management settings. Make sure your subscription format is compatible with the client before importing, then test DNS and app access after switching networks.
Go to downloadsThe downloads page links to Clash Plus on the App Store and its official site, clashplus.io. After installing, follow the client’s instructions to import a configuration and authorize the VPN. Mobile systems handle traffic interception differently from desktop system proxies, so recheck policy groups and connection settings when migrating.
Go to downloadsDesktop users can choose Clash Verge Rev or FlClash; make sure the package format matches your distribution. Server and router users can find the core section on the downloads page and manage services, permissions, and configuration files separately. A graphical client’s installation steps are not a substitute for server deployment instructions.
Go to downloadsThe installer provides the client app; it does not generate working proxies. To connect, you also need valid proxy details or a subscription configuration, and the current core must support the protocol in use.
If you’re new, start with the setup guide. If you already have a configuration and are switching clients, compare platform support, configuration management, and traffic interception before importing the existing file.
Compare clients →After installing, open the configuration manager and import a subscription or local YAML file. Wait for the client to download and parse it, then confirm that selectable proxies appear in the policy groups before enabling the appropriate traffic interception method. Turning on the system proxy without a valid configuration, or having a proxy list with no matching policy group, can prevent requests from being handled as expected. Button names vary by client. For full instructions, see the Clash setup guide.
For the first test, keep the configuration’s existing rule mode and test both services that require a proxy and local resources. If an app’s traffic does not reach the core, first check whether it respects the system proxy rather than changing proxy settings right away. Enable TUN and configure permissions and routing only if you need to capture that traffic. Global mode can help temporarily check whether an exit works, but it should not replace checking which rules matched.
The client manages subscriptions, system settings, and the user interface; the core handles proxy connections, DNS, and rule matching. Similar-looking interfaces don’t guarantee the same core capabilities, so check both when troubleshooting. Learn more about the difference between a core and a client in the quick reference glossary.
A subscription can include proxies, policies, and rules. Policy groups determine which proxy to use when a rule matches. Some configurations use manually selected groups, so you may still need to choose an available proxy after importing. Check the group selection first, then review connection logs instead of repeatedly refreshing the subscription.
Not necessarily. The right traffic interception method depends on app behavior and client implementation. Start by testing the system proxy; consider TUN only if you need to capture traffic from apps that ignore it. If both are enabled, watch for duplicate interception or routing conflicts with other VPNs. See the network stack glossary for related terms.
A remote update may regenerate the configuration file and overwrite edits made directly to it. Move rules you want to keep into an override configuration supported by the client, then check the actual order of the merged rules. Back up the original file and change one thing at a time so you can verify the result.
TECH NOTES / GUIDES
Guides to core differences, log analysis, and configuration features. Check what applies to your setup before merging snippets from an article into your own files.
Trace the history and naming changes of three generations of cores, compare configuration fields, protocol support, and client compatibility, and find out whether an older configuration can still be used as is.
Read the core comparison →Understand client output by log level, with explanations of common errors such as connection timeouts, DNS failures, port conflicts, and configuration parsing issues. Follow practical steps to trace each message to the relevant setting.
Read the log troubleshooting guide →Explore how mihomo extends the original core with remotely loaded rule sets, traffic sniffing, VLESS and Hysteria2 support, and the configuration syntax for each feature.
Explore configuration features →