Clash Setup Guide | Install, Import Subscription, Config & Rule-Based Routing

Quick Start

Clash is a rule-based cross-platform proxy core. It doesn't provide nodes—it routes different connections to proxy or direct based on your config. Getting started takes just three steps:

Download and install the client: Pick a client for your device on the Downloads page.
Import subscription or config: Add a subscription URL or local YAML config to the client.
Choose a node and enable proxy: Select a node in a policy group and turn on system proxy.

Clash is a proxy client only—you need to provide your own nodes or subscription. This site does not offer node services.

Install Client

Recommended clients vary by platform—see the full list on the Downloads page:

Windows / macOS / Linux: We recommend Clash Verge Rev—full GUI, feature-rich, powered by Mihomo core.
Android: We recommend ClashMeta for Android—choose the ARM64 build for devices from 2016 onward.
iOS / iPadOS: Get a Clash-compatible client from the App Store.

If macOS shows "can't be opened" on first launch, go to System Settings → Privacy & Security and click "Open Anyway".

Import Subscription & Config

Most clients support two import methods:

Method 1: Subscription URL (Recommended)

Copy the subscription URL from your provider into the client's Profiles page and download. Enable auto-update (24-hour interval recommended) to sync node changes automatically.

Method 2: Local Config File

If you already have a config.yaml, drag it into the client window or choose "Import from File" on the config page.

Your subscription URL is equivalent to your node credentials—do not share it publicly or upload it to public repositories.

Config File Structure

Clash uses a highly readable YAML config file with four core sections: basic settings, proxies (nodes), proxy-groups (policy groups), and rules (routing rules).

config.yaml

# 1. Basic Settings
mixed-port: 7890        # HTTP/SOCKS Mixed Port
allow-lan: false
mode: rule          # rule / global / direct
log-level: info

# 2. Nodes
proxies:
  - name: "Hong Kong 01"
    type: ss
    server: hk.example.com
    port: 8443
    cipher: aes-256-gcm
    password: "your-password"

# 3. Policy Groups
proxy-groups:
  - name: "PROXY"
    type: select
    proxies: ["Hong Kong 01", "DIRECT"]

# 4. Rules
rules:
  - DOMAIN-SUFFIX,google.com,PROXY
  - GEOIP,CN,DIRECT
  - MATCH,PROXY

proxies (Nodes)

Define proxy servers with support for multiple type values: ss, vmess, vless, trojan, snell, and more. Each node requires fields like name, server, and port.

proxy-groups (Policy Groups)

Group multiple nodes together. Common type values:

select: Manually choose a node.
url-test: Auto-select the node with the lowest latency.
fallback: Failover in order—switch to the next node when the current one is unavailable.
load-balance: Load balance across multiple nodes.

rules (Routing Rules)

Rules are matched top to bottom—first match wins. Each rule follows type,match-value,policy, where policy can be a policy group, node name, or DIRECT / REJECT. A MATCH rule at the end serves as the catch-all.

Proxy Modes

Switch between three global modes via the mode field (or the client UI):

Mode	Behavior	Use Case
`rule`	Route by rules	Daily use (recommended)
`global`	All traffic through proxy	Incomplete rules or temporary full proxy
`direct`	All traffic direct	Temporarily disable proxy

TUN Mode

TUN mode creates a virtual network adapter that captures all system traffic—including apps that ignore system proxy settings, such as some games and CLI tools. Once enabled, you get true global transparent proxying.

On desktop, enable "TUN Mode / Virtual Network Adapter" in client settings.
First-time setup usually requires admin/system permissions to install the virtual network adapter driver.
On mobile, this corresponds to system VPN permissions.

If you lose internet after enabling TUN, disable system proxy first (to avoid stacking with TUN), or check for conflicts with other VPN / firewall software.

Rule Types Reference

Common rule types below—combine them for fine-grained routing:

Rule Type	Description	Example
`DOMAIN`	Full domain match	`DOMAIN,www.google.com,PROXY`
`DOMAIN-SUFFIX`	Domain suffix match	`DOMAIN-SUFFIX,google.com,PROXY`
`DOMAIN-KEYWORD`	Domain keyword match	`DOMAIN-KEYWORD,google,PROXY`
`IP-CIDR`	IPv4 CIDR match	`IP-CIDR,192.168.0.0/16,DIRECT`
`GEOIP`	Match IP by country/region	`GEOIP,CN,DIRECT`
`PROCESS-NAME`	Match by process name	`PROCESS-NAME,Telegram,PROXY`
`MATCH`	Catch-all for remaining traffic	`MATCH,PROXY`

Rule order matters: put more specific rules first, and always place MATCH last as the catch-all.

Troubleshooting

No internet at all

Check if nodes are valid and subscription hasn't expired; try switching nodes or enabling global mode to test; make sure only system proxy or TUN is enabled, not both.

Some sites not going through proxy

They may be routed as direct by rules. Check rules order and add DOMAIN-SUFFIX,xxx,PROXY before MATCH if needed.

Subscription update failed

Usually the subscription URL itself is unreachable. Try opening the link in a browser first, or update when you have connectivity; some subscriptions require an active proxy to fetch.

TUN mode not working

Confirm admin permissions were granted and the virtual network adapter driver is installed; close conflicting VPN / proxy software and retry.

For advanced config, refer to your client's official documentation.