Route Traffic by Rule
Domains, IPs, and rule sets are matched in order.
The first match selects a policy; MATCH at the end handles all remaining requests.
rules · YAML list
DOMAIN-SUFFIX,example.com,PROXY
GEOIP,CN,DIRECT
MATCH,PROXYOpen-source mihomo core · Desktop clients
Clash Desktop · Windows and macOS Client Downloads
Client selection and setup guidance based on the mihomo core, covering subscription imports, routing rules, and desktop proxy settings.
Open Source
Multi-platform
Chinese Documentation
- Core: mihomo
- Core license: GPL-3.0
- Supports 5 platforms
- Default mixed port: 7890
Illustrative settings screen; menu labels vary by client.
Configuration Features
Routing Rules and Local Proxy Settings
First, understand how traffic reaches the core; then decide which policy should handle it. The examples below use mihomo configuration syntax. A graphical interface organizes these settings into menus you can manage.
Policy Group Types
Configure manual selection, automatic testing, and fallback separately.
Rules refer to a group name; choose the actual proxy endpoint within the group.
proxy-groups · type
Switch Proxy Modes
Rule mode works well for everyday routing; Global mode helps with troubleshooting.
Direct mode changes how the core handles traffic—it does not exit the client.
RuleGlobalDirect
Ports and LAN
The mixed port accepts both HTTP and SOCKS proxy connections.
Enable LAN access only when trusted devices need to use the proxy.
Mixed Port7890
Allow LAN Connections
Browse instructions by setting
Check the matched rule before changing the proxy
Open the Connections page, find requests from the target app, and check the matched rule and policy chain. Put custom domain rules before broader rules, and keep the final MATCH rule at the end; otherwise, earlier rules may capture the traffic before later exceptions can apply. PROXY in this example is a policy group name and must exist in your configuration. Unlike a single fixed proxy address, Rule mode lets different destinations take different routes, but results depend on domain detection, DNS settings, and rule order.
Explore rule sets and local overrides →Keep selection methods separate from routing conditions
Rules determine which group handles a request; the policy group determines which proxy endpoint that group uses. Use select for manual choice, url-test to select based on test results, fallback to try endpoints in order, and load-balance to distribute connections according to its configured strategy. Automatic tests depend on the test URL, interval, and tolerance, so one result does not predict performance across all sites. Before making changes, check the group type on the Proxies page to avoid manual choices being overridden by automatic selection.
Explore core and policy group settings →Proxy mode and traffic capture are separate settings
Rule, Global, and Direct control how traffic is handled after it reaches the core. System Proxy and TUN control how app traffic gets there. Switching to Global will not automatically route apps that ignore the system proxy. For everyday use, start with Rule mode. To troubleshoot a single site, temporarily switch to Global and compare results, then switch back. If no connections appear after changing modes, check the app's proxy settings, listening port, or TUN routes instead of changing rules.
See how to enable the system proxy →Use the listening port shown in Settings
7890 is a common default mixed port, but the client or a local override may change it. To set up a proxy for one app, use the local loopback address and the current listening port; don't copy settings from another device. Allowing LAN connections also requires attention to the bind address, system firewall, and access controls—it does not create a remote access service. Enable it only when needed on a trusted network, and limit which devices can connect. If startup reports that the address is already in use, check whether another proxy client is running.
See port and connection troubleshooting →Downloads
Choose a client by operating system
The download center lists clients and installers by platform. Desktop users should start with a graphical client; servers and routers may call for a standalone core. Installation and configuration differ between the two.
For desktop use, start with Clash Plus, then compare clients such as Clash Verge Rev and FlClash. Before installing, check your processor type under “About” in your system settings and choose the matching build listed on the download card.
On first launch, import a subscription and verify the system proxy. If you need TUN, follow the client prompts to install its service or grant administrator privileges. Enabling several settings at once can make problems harder to track down.
Go to DownloadsChoose an Apple Silicon or Intel build based on the chip shown under “About This Mac.” Clash Plus, Clash Verge Rev, and FlClash organize their menus differently, so choose the one that best fits how you work.
Move the app to Applications before opening it, and pay attention to system prompts about network services and permissions. The system proxy only affects apps that honor it; command-line tools may need a separate proxy configuration.
Go to DownloadsChoose from Clash Plus, Clash Meta for Android, FlClash, and Surfboard. Supported configuration formats vary by client, so check which format your subscription provider offers before importing.
The first connection usually requires permission to create a system VPN connection. If the connection drops when the screen locks, check battery optimization and background activity restrictions; don't assume a background-running issue means the subscription has expired.
Go to DownloadsThe download center links to Clash Plus on the App Store. The project website is clashplus.io. Refer to the store listing and in-app prompts for installation and permissions.
After importing a profile, make sure the one you want is selected before allowing the system to create a VPN connection. Mobile network permissions work differently from desktop system proxies, so desktop menu instructions may not apply.
Go to DownloadsFor desktop environments, consider Clash Verge Rev or FlClash and choose an installation method suited to your distribution's package system. A standalone mihomo core is better suited to server and router users who already know how to manage services.
A graphical desktop's system proxy may not be used by command-line programs. Test browsers, terminals, and system services separately; if needed, configure proxy environment variables or use a verified TUN routing setup.
Go to DownloadsNew users can start with Clash Plus, the featured client in the download center, then compare clients to see whether their configuration editing, service management, and platform support meet your needs. Discontinued clients are useful only as legacy compatibility references; don't overlook maintenance status just because an interface feels familiar. Downloading a client does not create a subscription or provide a working proxy endpoint. Getting a configuration and installing a client are separate steps.
Browse all clients → Compare clients →Quick Start
Import, enable, and verify your connection
For your first setup, get one verifiable path working: enable a profile, select a policy group, and choose one way to route traffic. Once everything works, add automatic updates and advanced rules.
-
Import a subscription profile
Open the Profiles page, paste a subscription URL from a trusted source, and choose Import or Add Remote Profile. Once the download and parsing finish, confirm that a profile appears and set it as the active profile.
Saving a link without enabling the profile may leave the Proxies page empty. If parsing fails, check the logs for a format or network error. Never include subscription URLs in public screenshots, comments, or support requests.
See how to import a subscription → -
Choose a mode and traffic entry point
On the Proxies page, use Rule mode and select an endpoint for the policy group. Then enable System Proxy in Settings and leave the mixed port as shown by the client; you usually don't need to change the default port.
Start by testing with a browser that respects the system proxy. Explore TUN permissions, DNS, and routing only if the target app ignores the system proxy or you need to route more traffic.
See how to set up the system proxy → -
Check requests and rules
Visit a site you want to test while viewing the client's Connections page. Confirm that the request appears and check its matched rule and policy group. Opening a client doesn't mean traffic has reached the core; connection records are a better indicator.
If no requests appear, check the traffic entry point first. If requests appear but sites won't load, check the proxy endpoint, domain resolution, and logs. Troubleshooting in this order is more effective than changing the mode, port, and DNS all at once.
Browse troubleshooting guides →
Open-source Ecosystem and Maintenance
Clash, mihomo, and graphical clients
When identifying a project, check the core, interface, and configuration source separately. Sharing the name Clash doesn't mean projects have the same maintainers or identical features and configuration syntax.
The core handles networking and rules
The Clash ecosystem grew out of early cores and their configuration formats, followed by different forks and graphical clients. mihomo continues and extends this approach to configuration and traffic routing, handling proxy protocols, rule matching, DNS, and the network stack. It is neither the name of a desktop app nor a subscription service.
Desktop clients turn configuration imports, policy selection, logs, and system integration into menus, and may add features such as local overrides and service management. The same core can appear in different places in different interfaces, so check feature names in a guide rather than relying on button locations. The window at the top of this page illustrates how settings relate; not every client has the same interface.
Assess maintenance and updates separately
Client updates, core updates, and subscription updates are three different things. A client update may change the interface or system compatibility; a core update may affect protocols, DNS, or rule behavior; a subscription update usually replaces proxy endpoints and configuration. When something goes wrong, note which layer changed most recently to decide whether to restore the configuration, check core changes, or read the client's release notes.
When choosing a project, check its public repository for the license, commit history, issue discussions, and releases—not just its name or interface. The mihomo core is licensed under GPL-3.0; check each client for its own license. This site organizes download options and setup guides, but does not replace the projects' maintenance documentation or treat separate projects as a single official release.
View mihomo source code
The command below clones the source from a public repository; Git must be installed on your machine. Cloning the repository is for reading and development and does not install a desktop client. For everyday use, choose a graphical installer from the download center.
Visit the mihomo repository →git clone https://github.com/MetaCubeX/mihomo.gitTroubleshoot by configuration layer
If you can connect but some domains behave unexpectedly, see the advanced guide to DNS resolution paths. If problems occur only after enabling a virtual network interface, check TUN and Fake-IP. If local rules disappear after a subscription update, review rule sets and override order. These settings are related, but don't change them all without evidence in the logs. To assess Clash DNS leaks, consider whether the app uses encrypted DNS, the actual routing path, and where DNS queries are resolved; one toggle alone isn't enough to draw a conclusion.
Recent Articles
Desktop Use and Configuration Troubleshooting
Find help for a specific issue: identify where the app or configuration is in the process, then check the relevant menus and logs. Here are the three latest articles.
Windows Store apps bypassing the proxy: How to enable UWP loopback access
UWP apps such as Microsoft Store and Mail are blocked from accessing the local loopback address by default, which can make the system proxy ineffective. This guide covers two ways to allow access: a built-in client tool and the CheckNetIsolation command.
Read article →A tour of the Clash desktop client: What the Proxies, Profiles, and Logs pages do
A sidebar-by-sidebar guide to desktop client pages, including policy group switching, profile management, connection details, and log levels—so you can find the right settings from the start.
Read article →Clash subscription update failures and configuration parse errors: A troubleshooting checklist
Expired subscription links, unexpected response formats, YAML indentation errors, or network blocks can all prevent an import. Use the logs to check each step and pinpoint the cause.
Read article →