Open-source proxy ecosystem · Cross-platform setup hub
Find Clash clients for Windows, macOS, Android, iOS, and Linux, then follow the steps for importing subscriptions, configuring system proxies, and routing traffic by rule. The guides also cover TUN permissions, DNS settings, and connection logs.
Platform workflow index
Clash clients have different interfaces, but the core setup is largely the same: obtain a working configuration, confirm the proxy mode and policy groups, then enable the system proxy or TUN. The five key steps below follow the order used in practice.
A subscription URL is usually generated by the service provider; the client only requests, parses, and stores the configuration. Use the client’s subscription or configuration import screen—do not paste the URL into unrelated fields such as a node name or rule editor. After updating, check that the proxy list and policy groups appear before choosing a node. If the list is empty, inspect the subscription response, configuration format, and client logs instead of repeatedly changing the system proxy.
Rule mode matches domains, IPs, processes, or rule sets from the top of the configuration downward. The first matching rule determines which policy group handles the traffic. For everyday use, keep the rules supplied with the subscription and add custom entries only when the intended match is clear. Global mode is useful for briefly testing whether a node works, but it bypasses granular routing. DIRECT mode helps determine whether the proxy path is causing the problem.
When the system proxy is enabled, the client writes the local proxy address to the operating system settings, allowing browsers and most desktop apps to route traffic through it. This method requires fewer permissions and is easy to disable, making it a good first connection test. Some games, command-line tools, and apps with their own network stack may ignore the system proxy. Check whether the app has its own proxy option before deciding whether TUN is needed.
TUN mode creates a virtual interface at the system network layer, allowing it to handle traffic from apps that do not read system proxy settings. Enabling it often requires administrator privileges and may conflict with other VPNs, virtual adapters, security software, or enterprise network policies. For the first setup, disable similar tools, confirm that the regular system proxy works, and then enable TUN. This makes it easier to distinguish node problems from virtual-adapter problems.
Read logs according to when the problem occurs: configuration parsing errors usually appear during startup or subscription updates; DNS errors mention name resolution, fallback, or timeouts; connection errors typically involve the destination, policy group, or handshake. During troubleshooting, record the first error rather than repeatedly switching many options. Restore a configuration that starts successfully, then add custom DNS, rules, and TUN settings one at a time to pinpoint the change.
Client download hub
The download page organizes graphical clients, package formats, and system requirements by platform. Before choosing one, confirm your device architecture. If an older client is already installed, preserve the existing subscription URL and custom rules before migrating.
Ideal for users who need a desktop tray icon, a system proxy toggle, and rule management. Check the system architecture before downloading. After installation, import the subscription and choose a policy group before enabling the system proxy. If an older Clash for Windows installation still contains settings, back up the subscription URL, override rules, and port settings separately before migrating.
Go to downloadsmacOS packages differ between Apple Silicon and Intel processors. On first launch, you may need to approve the app source, network extension, or background service permissions; TUN also requires approval for its system components. After granting access, verify the subscription and node with the system proxy before configuring the virtual adapter.
Go to downloadsAndroid clients use the system VPN interface to route traffic, and Android displays a VPN authorization prompt when connecting. If the system stops the client in the background, check battery optimization, background activity, and notification permissions. After importing a subscription, choose a policy group, start the connection, and use the connection log to confirm that the target app enters the proxy path.
Go to downloadsGet iPhone and iPad clients from the App Store. The first connection requires permission to add a VPN configuration. Subscription updates, policy selection, and connection status are handled in the client. If mobile data and Wi-Fi behave differently, test DNS, IPv6, and on-demand connection settings separately instead of simply switching nodes.
Go to downloadsLinux users can choose a graphical client or run the Mihomo core directly. Desktop environments require attention to how the system proxy is written and whether tray support is available. Servers and routers require an understanding of configuration paths, service management, listen addresses, and firewall rules. Before deploying from the command line, run it once in the foreground to confirm that the configuration parses, then hand it over to the service manager.
Go to downloadsOpen-source ecosystem and maintenance boundaries
Clash established a proxy workflow centered on YAML configuration, rule matching, and policy groups. After the original project stopped being maintained, the community-maintained Mihomo core continued expanding support for protocols, DNS, rule sets, and TUN. Today’s common desktop and mobile clients are generally graphical layers that download configurations, switch policies, manage the system proxy, and call the core to handle actual traffic.
Understanding the relationship between the core and the client makes troubleshooting easier. An interface that will not start, a broken tray menu, or a system proxy that is not written usually points to the client layer. Configuration parsing failures, unmatched rules, DNS fallback issues, and connection handshake errors are more likely to involve the core or configuration layer. Release schedules can differ as well, so when switching clients, compare more than the interface: check the core type, configuration compatibility, and system permission requirements.
Open-source repositories publish source code, issue reports, and release notes, making it easier to verify feature changes and known problems. The site’s documentation focuses on stable workflows rather than treating a particular interface location as permanent: button labels may change after a client update, but the sequence of importing a configuration, choosing a policy, taking over traffic, and reviewing logs remains applicable. When interfaces differ, use setting names and feature meanings to locate the right option instead of mechanically searching for the same screenshot.
Configuration updates also require distinguishing where each component comes from. Nodes, policy groups, and rules in a subscription are maintained by its provider; updating the client does not automatically fix subscription content. Client upgrades mainly change the interface, core version, and system integration. When a problem appears, first determine whether the latest change came from the subscription, client, or operating system. Then decide whether to roll back the configuration, restart the service, or check permissions—this greatly reduces wasted effort.
Featured FAQs
Most issues can be isolated by separating configuration, proxy takeover, and network resolution into three stages. The checklist below covers the most common order of checks for first-time users.
Windows users can compare Clash Plus, Clash Verge Rev, FlClash, and Clash Nyanpasu on the download page. Save the subscription URL and custom rules before migrating. After installing the new client, import the subscription, choose a policy, and test the system proxy. Overrides tied to the old interface may not migrate directly, so recreate them using the new client’s settings.
A successful import only means the client has read the configuration file. You still need to choose a working node in the policy group and enable the system proxy or TUN. Then review the connection log: no requests usually means traffic has not been taken over; requests that fail point to a node issue; requests routed to DIRECT indicate that you should check the mode and matched rules. Confirm each item using the quickstart guide.
Rule mode matches requests in configuration order and sends traffic to the corresponding policy group, making it suitable for everyday use. Global mode sends most traffic to one proxy policy and is useful for briefly testing the node path. Direct mode bypasses the proxy and helps determine whether a site or app can be reached directly. After troubleshooting, return to rule mode to avoid bypassing granular routing long term.
Consider TUN when games, command-line programs, or specific apps do not read system proxy settings. Before enabling it, confirm that the regular system proxy and node connection work, and disable VPNs or virtual-adapter tools that may conflict. TUN usually requires administrator privileges. If the entire network goes offline afterward, disable TUN first, then check the virtual adapter, DNS hijacking, and routing settings.
Configuration and troubleshooting articles
From certificate errors and TUN traffic interception to DNS leaks, these articles organize troubleshooting by network layer, making it easier to isolate causes without changing many settings at once.
Diagnose HTTPS errors by checking system time, the browser certificate chain, proxy intermediaries, and network interception, then restore normal access step by step based on the scope of the issue.
Read the full article →Learn how the TUN virtual adapter handles traffic that ignores the system proxy, along with platform permissions, activation order, and common network conflicts.
Read the full article →Use browser tests and system queries to identify the DNS egress, then inspect domain resolution paths involving fake-ip, DNS hijacking, and fallback resolution.
Read the full article →