Choose a client for your device, then import a subscription, select a policy group, and configure the system proxy. The site brings together free clients, open-source cores, and Chinese configuration guides so you can look up fields and troubleshoot issues after installation.
BIOS SETUP / CLIENT FUNCTIONS
Choose a feature on the left. The panel on the right explains what it affects, when to use it, the recommended sequence, and configuration boundaries that are easy to miss.
PROFILE INPUT / YAML
Clash clients typically read configuration from a subscription URL, but they can also import a local YAML file. A subscription URL is the entry point for retrieving configuration; the YAML file contains details such as ports, proxy nodes, policy groups, rules, and DNS settings. On first use, add the complete URL to the profile manager, wait for the client to parse it, and then set the new profile as active. Treating a web page URL as a node, omitting characters from the link, or importing ordinary text will make the configuration unreadable.
After a successful import, do not repeatedly add the same URL. First check that the profile name, update time, and proxy groups appear, then open the policy page to choose a node. Remote updates can replace content managed by the provider, while local edits may be overwritten by the next update; rules that must persist are better placed in the client’s override, merge, or script configuration. See the complete sequence in the user guide.
POLICY GROUP / PROXY
A policy group determines which node or child policy handles a type of connection. Common types include manual selection, latency-based selection, failover, and load balancing. The options shown in the client’s main interface are not always individual servers; some may be another policy group. For the first connection, locate the selection group handling the main proxy traffic, then choose an available node within it. Simply switching files in the profile list may not change the actual exit route.
A latency test reflects the response of its test target under the network conditions at that moment. It does not equal download speed, stability, or access quality across every website. Node location, traffic multipliers, protocol support, and server load can all affect the result. A more reliable approach is to test several candidates, verify the connection with an actual website or app, and check the runtime log for timeouts, handshake failures, or refused connections. See the site’s node selection guide for more.
RULE ENGINE / MATCH ORDER
Rule mode checks requests from the top of the configured rule list and stops at the first matching rule. Common rule types include domains, domain suffixes, keywords, IP ranges, process names, and the final match. Order directly affects the result: an overly broad rule placed first can intercept connections that should be handled later. If the final rule is missing or the target policy group name does not match, traffic may behave differently from expected.
When adding a custom rule, define the match target first and confirm that the destination policy group exists. Domain rules suit specific hostnames, while domain-suffix rules cover multiple subdomains of a site. IP-CIDR rules fit known address ranges, but make sure you understand the effect of DNS-resolution-skip parameters. Do not infer every connection domain from a site name alone; browser developer tools, DNS query results, and Clash runtime logs can reveal the actual requests. Detailed syntax is collected in the configuration reference.
rules:
- DOMAIN-SUFFIX,example.com,Proxy
- DOMAIN,api.example.net,Proxy
- IP-CIDR,192.0.2.0/24,DIRECT,no-resolve
- MATCH,ProxyDNS PIPELINE / FAKE IP
DNS settings determine who resolves a domain, which network path carries the query, and whether the rule engine can retain the domain name. Fake IP mode returns a reserved address first, then lets the core map the connection back to the original domain so domain rules can be applied. Redir Host is closer to the traditional process of returning a real address. Both modes have compatibility limits; LAN devices, games, printers, and apps that require real addresses may need separate exclusions.
When troubleshooting DNS, distinguish the system DNS, browser Secure DNS, the client’s listening port, and upstream resolvers. Changing only one of these may not alter the complete path. First confirm that the Clash DNS module is enabled, then verify that system requests reach the expected port, and finally review query and connection records in the logs. If the domain resolves but the page still will not open, continue checking the rule target, node connection, and IPv6 behavior rather than blaming every connection failure on DNS.
NETWORK MODE / TUN
The system proxy mainly affects apps that follow the operating system’s proxy settings, including most browsers and desktop software. Some games, command-line tools, store apps, and programs that create their own connections do not read this setting. TUN mode uses a virtual network interface to handle a broader range of TCP, UDP, and DNS traffic. It suits scenarios that require unified traffic capture, but also involves administrator privileges, routing tables, network interfaces, and security-software compatibility.
For a first setup, use the system proxy to verify basic connectivity. Once the subscription, nodes, and rules work, enable TUN if your apps require it. If the network stops working, disable TUN first, then check whether the service started successfully, the virtual interface was created, DNS hijacking matches the current system, and another VPN or virtual adapter is causing a conflict. Windows service mode, macOS system extensions, and Linux permissions are handled differently.
DEVICE DOWNLOAD MAP
The homepage only helps you identify the right platform. Client models, processor architectures, system requirements, and package links are collected in the download center.
DEV 00 / WINDOWS
For Windows desktop devices. The download page separates GUI clients by current maintenance status and provides installers for common x64 hardware. After installation, import a profile before enabling the system proxy; if you need to capture more app traffic, check service mode and TUN permissions.
[ Go to Windows downloads ]DEV 01 / MACOS
macOS packages are split between Intel and Apple Silicon. Check the chip type in About This Mac before choosing a file. The first launch may require approval in System Settings; enabling TUN or a system extension may require additional authorization shown by the client.
[ Go to macOS downloads ]DEV 02 / ANDROID
Android devices typically require an installer matched to the ARM architecture; on newer devices, check the ARM64 build first. After importing a subscription, the system will request VPN permission to establish the connection. If it disconnects after running in the background, review battery optimization, background restrictions, and the always-on VPN setting.
[ Go to Android downloads ]DEV 03 / IOS
iPhone and iPad install available clients through the App Store. After adding a subscription, the system will ask you to approve the VPN configuration. Cross-check the connection status in both the client and the system VPN settings. If cellular and Wi-Fi behave differently, check DNS, local-network permission, and the active policy separately.
[ Go to iOS downloads ]DEV 04 / LINUX
Linux users can choose a desktop client for their distribution or use the Mihomo core directly. GUI clients suit desktop environments, while the core is better suited to servers, containers, and routers. When selecting a file, confirm both the system architecture and package format. Command-line use also requires a configuration path, service permissions, and a startup method.
ARCHITECTURE CHECK
macOS mainly distinguishes Intel from Apple Silicon. Android commonly uses ARM64 or ARM, while Linux may involve AMD64, ARM64, ARMv7, or other device architectures. The architecture label in the filename must match the device.
CLIENT OR CORE
Graphical clients provide profile management, policy switching, logs, and system-proxy controls. The Mihomo core is better suited to server or router users who are comfortable with the command line, service management, configuration paths, and network permissions.
FIRST BOOT
After launching the client, you still need to import a valid profile, choose a policy group and node, and enable the system proxy or TUN for your use case. Verify connectivity through an actual request, the exit status, and the runtime logs.
OPEN SOURCE CONTEXT
Clients, cores, configuration providers, and site documentation occupy different layers. Understanding those boundaries makes downloading and troubleshooting more direct.
Clash first became widely used as a rule-driven proxy core with a structured configuration format. Around these capabilities, the community built desktop, mobile, and command-line clients. Different clients share concepts such as proxy nodes, policy groups, rules, DNS, and system proxies, but their interfaces, maintenance status, platform support, and extension capabilities are not identical. “Clash” therefore usually refers to a configuration and usage ecosystem, not one installer covering every platform.
Some early clients are no longer maintained, but they may still appear in searches because of older guides and legacy configurations. When choosing a client, put its current maintenance status, system support, and configuration compatibility ahead of interface preferences. The download center labels maintained and archived clients separately so names from old tutorials are not mistaken for the current first choice.
Open-source code lets the community inspect core behavior, configuration fields, and issue reports, while enabling different developers to build graphical interfaces for each platform. GUI clients handle profile management, system-proxy switches, tray actions, logs, and installation updates; the core reads YAML, establishes connections, matches rules, and handles DNS and TUN. When something fails, first identify whether the problem is in the interface, configuration, core, or system network layer. That is more effective than repeatedly reinstalling.
Subscription services are separate from the client itself. The client reads the configuration and executes its nodes, policy groups, and rules; the configuration source maintains the subscription content. Check the source for inactive nodes, subscription access, or traffic status. YAML parsing errors, occupied ports, a disabled system proxy, and TUN permission issues are better investigated through client logs and system settings.
Mihomo is a common open-source core implementation in the current Clash ecosystem. It preserves core concepts such as rules, policy groups, DNS, and proxy protocols while continuing to expand configuration fields and runtime capabilities. Whether a client uses Mihomo, which fields it supports, and how it applies overrides depend on that client’s documentation. Copying every field supported by one core into an older client does not guarantee that the configuration will parse.
The site’s configuration references focus on general YAML structures and commonly used Mihomo fields, while explaining dependencies between fields. Before editing, keep a recoverable copy. Change one related group of fields at a time, then use the logs to confirm that the configuration loads. Changing ports, DNS, TUN, rules, and policy groups all at once makes the source of an error difficult to locate.
Updating the client program and updating a subscription configuration are separate paths. A program update may change the core, interface, or system compatibility; a subscription update mainly refreshes nodes, policy groups, and rules. When connections fail, do not treat “update subscription” and “upgrade client” as the same step. First confirm that the current profile parses, then check the client’s maintenance status and system compatibility before deciding whether to migrate.
The download page parses the current file links from a unified manifest, and version slots appear only when the manifest provides valid information. The homepage does not show version numbers, avoiding the impression that one client’s program version is a single version for the entire Clash ecosystem. Documentation is continually organized by configuration concepts, platform differences, and issue types for reference after installation.
CONFIG IMPORT
First confirm that the URL returns configuration the client can read, then check whether the profile is set as active. If the parsing log reports a YAML syntax error, start with indentation, field types, and list nesting.
View installation and configuration issues →SYSTEM PROXY
Check that the system proxy is enabled, whether the browser uses separate proxy settings, and whether the active policy group has a node selected. Then use the logs to confirm that the browser connection reaches Clash’s listening port.
View connection troubleshooting →UWP LOOPBACK
Some UWP apps are subject to loopback access restrictions. After confirming that ordinary desktop apps work through the proxy, check the UWP loopback setting provided by the client and enable the required permission only for the apps that need it.
View Clash UWP loopback settings →DNS ROUTE
Check the system resolver, browser Secure DNS, the Clash DNS module, and upstream servers separately. If the domain resolves but the connection still fails, continue checking rules, nodes, and IPv6 routing.
View DNS and network modes →LATEST TECH NOTES
The latest content is organized around log analysis, node selection, and subscription imports. Each article provides a repeatable diagnostic workflow.
Starting with log levels, timestamps, and key fields, this guide explains how to investigate configuration parsing, occupied ports, DNS, TUN, and connection failures. Follow it step by step when the client starts but connections behave unexpectedly.
READ ARTICLE →Learn the limits of latency tests, how traffic multipliers affect usage, how to choose a location, and how common protocols differ. Build a repeatable node-selection process instead of choosing a long-term node from one speed test.
READ ARTICLE →Understand the difference between subscription URLs and YAML configuration files, with step-by-step guidance for importing and manually updating profiles and checking links the client cannot recognize. The guide also explains how local overrides relate to remote updates.
READ ARTICLE →