Clash Setup Guide: The Complete Manual

Chapter 1: Core Concepts — Know Your PartsCH-01

First-time Clash users often get lost the moment they see "core," "proxy group," and "Mixed Port" all at once. There aren't actually that many pieces involved. Learn them now and everything downstream gets a lot easier — like checking the parts bag before you start assembling furniture.

Core vs. Client: Engine and Cockpit

"Clash" today refers to an entire ecosystem: a core that does the actual work, plus a range of clients that provide the interface. The main core is mihomo (often called the Clash Meta core) — a headless program that builds proxy connections and routes every bit of traffic according to your rules. The apps you click around in day to day — Clash Plus, Clash Verge Rev, FlClash — are all graphical clients wrapped around a core. Think of the core as the engine and the client as the cockpit: the engine determines whether it runs at all, the cockpit determines how pleasant it is to drive. Clients look very different from each other, but underneath they usually share the same core, so the principles in this manual apply no matter which client you use.

Config File: The Only Manual the Core Reads

Once running, the core only understands one thing: the config file, usually a config.yaml. It lists every node, every protocol, which traffic gets proxied and which goes direct, and how DNS gets resolved. Every click you make in a client is really just an edit to this file behind the scenes. Once that clicks, the "editing configs" topics in Chapters 6 and 9 stop feeling mysterious — it's just opening the manual and changing a few lines.

Subscription, Node, Rule: Three Terms You'll See Constantly

• Subscription link: a URL pointing to a remote config hosted by your provider. Your client fetches it periodically and automatically gets the latest node list — no manual copying needed.
• Node: each entry under the proxies section of the config — one usable proxy server, with a name, address, protocol, and password. Dozens of nodes typically appear in a list for you to choose from.
• Rule: each line under the rules section, deciding which traffic goes through which exit. Direct connections for local sites and proxied connections for international ones — that's rules at work.

Port: The Local Socket

Once running, the core opens a local listening port — commonly 7890 by default (a mixed port accepting both HTTP and SOCKS5). Your browser and other apps send traffic into the socket at 127.0.0.1:7890, and the core receives it and routes it according to your rules. Chapter 5 covers system proxy, and Chapter 8 covers port conflicts — both trace back to this port.

More terms (proxy groups, fake-ip, GEOIP, and so on) get explained the moment they come up in later chapters; if you want everything in one place, the glossary lists them all by category.

Chapter 2: Pick a Client — The Right Part for Each of the Five PlatformsCH-02

Now that you know the parts, it's time to pick your cockpit. Picking the wrong client isn't fatal, but the right one saves you headaches. One rule: beginners should pick actively maintained, simple clients first; switch later once you know what you prefer.

Recommended Order by Platform

A Quick Rundown

• Clash Plus: the top pick across every platform. The interface logic is consistent across all five systems — importing subscriptions, switching nodes, and toggling modes are all front and center, so following Chapter 4's steps won't leave beginners lost. On iOS, it's one of the few options installable directly from the App Store.
• Clash Verge Rev: the most feature-complete desktop option, with config overrides, script extensions, and core switching all built in — it comes up often when Chapter 6 covers custom rules. The go-to pick for Linux desktop users.
• FlClash: open-source and cross-platform, with one consistent interface across desktop and Android — good if you want every device to look the same.
• Clash Nyanpasu: Windows-only, with a light, snappy interface and a feature set similar to Verge Rev.
• Clash Meta for Android / Surfboard: two extra options on Android — the former stays close to the raw core, the latter is minimal and battery-friendly.

About Clash for Windows Being Discontinued

Clash for Windows, the client that shows up in nearly every old tutorial, is no longer maintained: no new releases, no core updates, no fixes if something breaks. Old installers still run, but there's no reason for a beginner to start with a discontinued part. Whenever you see a "CFW" tutorial, just map the steps onto Clash Plus or Verge Rev instead — the concepts carry over directly. The same applies to ClashX Meta on macOS.

Once you've picked a client, head to the download page and grab it for your platform — every card is labeled with a recommendation badge and supported systems. If you're not sure, go with the first option; that's not a guess, it's the order we settled on after dealing with the pitfalls ourselves.

Chapter 3: Install & First Launch — Bolt It On and Power UpCH-03

Installing itself isn't hard — it's the OS-level warning prompts that trip people up. This section covers every platform's prompts and exactly how to handle them, so you never have to second-guess.

Windows

1. Grab the installer from the Windows section of the download page, double-click, and click through the setup. Installing to a path without special characters is the safest bet.
2. If SmartScreen pops up with "Windows protected your PC": click "More info" → "Run anyway." This happens because open-source software usually doesn't pay for a commercial code-signing certificate, so Windows flags any unrecognized signature by default — it doesn't mean the file is unsafe, as long as you downloaded it from an official source.
3. If the first launch asks for admin rights or to install a service, allow it. Chapter 7's TUN mode depends on this service.

macOS

1. Open the downloaded .dmg and drag the app icon into the Applications folder. Pay attention to chip type: Apple Silicon (M-series) and Intel each have their own installer, clearly labeled on the download page cards.
2. If the first launch says "cannot verify developer": open System Settings → Privacy & Security, scroll down to find the just-blocked app, and click "Open Anyway." You only need to do this once.
3. When the client first tries to take over your network, it will ask to install a helper tool or change your system proxy settings, prompting for your login password — this is standard macOS authorization, just enter it.

Android and iOS

1. Android: download and install the APK. If the system blocks "install from unknown sources," grant permission once in the settings page that pops up for your browser or file manager. The first time you enable the proxy, a VPN connection request will appear — you must tap "OK," or traffic will never reach the core.
2. iOS: install Clash Plus from the App Store, linked from the iOS section of the download page. The first launch will similarly ask to add a VPN configuration — confirm with Face ID/Touch ID or your passcode.

Linux

Desktop users can install the .deb package with a single command:

sudo apt install ./clash-verge-rev_amd64.deb

Dependencies are pulled in automatically. For other distros and server deployments, see the blog post "Setting Up Clash on Linux: The Full Walkthrough", which also covers running it as a persistent systemd service.

First-Launch Checklist

• The client icon shows up in the tray or menu bar — the program is alive.
• The settings page shows a mixed port (commonly 7890 by default) — the core is listening.
• Not being able to browse yet is totally normal — you haven't imported a subscription, so there are no nodes to route through. That's next.

Chapter 4: Import Your Subscription — Plug the Nodes InCH-04

The subscription link is the power cord for the whole setup. This chapter covers where to get it, how to plug it in, and how to keep the power on.

Where the Subscription Link Comes From

Your provider issues the subscription link: log into your provider's user dashboard, find the "Subscription" or "One-Click Subscribe" section, and copy the full URL. Two things matter here: first, it needs to be a Clash-format subscription (sometimes labeled mihomo or Clash Meta) — other formats won't parse; second, copy it in full — these links are usually long, and missing even one character breaks the whole thing, so use the dashboard's "Copy" button rather than manually selecting the text.

Four Steps to Import

1. Copy the subscription link to your clipboard.
2. Open your client and go to the "Profiles" or "Subscriptions" page (both Clash Plus and Verge Rev call it Profiles).
3. Paste the link into the input field and click "Import" or "Download." The client fetches the remote config, and a new profile card appears in the list within seconds.
4. Select that card to activate it. Back on the home screen or "Proxies" page, a long list of node names confirms the power is on.

Updating Subscriptions: Manual and Automatic

Providers occasionally change server addresses, so subscriptions need updating. Manual: click the refresh button on the profile card. Automatic: most clients let you set an update interval in minutes (e.g. 1440 for once a day) — once set, you can mostly forget about it. Best practice is to use both: rely on auto-updates day to day, but do a manual refresh first if nodes suddenly stop connecting en masse.

Three Common Reasons Import Fails

• The link is incomplete or expired: go back to the dashboard and copy it again, and make sure your plan hasn't lapsed.
• The subscription domain is unreachable on your current network: some providers' subscription URLs are themselves blocked. If you have any working node, enable the proxy temporarily and try updating again, or fetch it from a different network (like your phone's hotspot).
• Wrong format: you grabbed a subscription meant for a different app. Go back to the dashboard and get the Clash-specific link instead.

After a successful import, run a latency test before picking a node. For how to read the latency numbers and what traffic multipliers mean, the blog post "How to Choose a Clash Proxy Node" breaks it down across four angles — worth reading right at this step.

Chapter 5: Proxy Modes and System Proxy — Where Traffic Enters and Where It GoesCH-05

With nodes in place, two questions remain: how does traffic get into Clash (system proxy), and once inside, which path does it take (proxy mode)? These two switches do different jobs — mixing them up is exactly how you end up thinking "I turned it on and nothing happened."

Three Proxy Modes

Stick with Rule mode day to day. Global mode might look convenient, but it routes local traffic through an international server too, slowing things down and burning bandwidth — treat it as a temporary tool only. Direct mode's real value comes up in Chapter 8: use it during troubleshooting to check whether your network works fine on its own, proxy aside.

What System Proxy Actually Does

Turning on the "System Proxy" toggle tells the OS: "Use 127.0.0.1:7890 as the HTTP proxy." Your browser and most regular apps respect this system setting, so their traffic flows automatically into Clash's port. This explains two things: first, without system proxy on, even green nodes won't change anything — your browser connects directly regardless; second, system proxy is a "gentleman's agreement" — some apps (certain games, CLI tools, UWP apps) simply ignore system settings and bypass Clash entirely. To round up those stragglers, see Chapter 7's TUN mode.

Picking a Node and Testing Latency

Run a latency test on your proxy group from the "Proxies" page — the client pings each node and shows round-trip time in milliseconds. Rule of thumb: 100–200ms feels smooth for everyday use; lower is better, but don't obsess over shaving off a few dozen ms between nodes in the same data center. Skip any node that times out. Once you've picked one, open a webpage to confirm it works. If latency looks fine but real-world speed is slow, that's a different kind of problem — the blog post "Troubleshooting Slow Clash Speeds" lays out a three-layer method; don't jump straight to switching providers.

At this point, you've actually finished the quick path: install, import, enable system proxy, pick a node — you're online. That's exactly what the visual guide covers. The chapters from here take you from "it works" to "I actually understand this."

Chapter 6: Rule-Based Routing — From Reading Rules to Writing Your OwnCH-06

How does Rule mode know which sites go direct and which get proxied? It's all in the rules section of the config file. This chapter shows you how to read it, then how to safely edit it.

The Three Parts of a Rule Line

Each rule line has three comma-separated parts: type, match pattern, and target. For example, DOMAIN-SUFFIX,github.com,Manual Select means: traffic to domains ending in github.com goes to the target named "Manual Select." Common types:

• DOMAIN-SUFFIX: matches a domain suffix — the most commonly used type.
• DOMAIN-KEYWORD: matches if the domain contains a given keyword — broader in scope.
• IP-CIDR: matches an IP range, often used to allow local network traffic through.
• GEOIP,CN: matches when the destination IP is registered in mainland China, typically paired with DIRECT for local traffic.
• MATCH: the catch-all rule, always placed last, picking up anything not matched above.

Rules are matched top to bottom, and the first match wins. So order is priority: for your custom rule to actually apply, it needs to come before any broader rule that would otherwise catch it first. Remembering this one fact explains most "my rule isn't working" mysteries.

Targets Aren't Just Nodes: Proxy Groups

The target in a rule usually isn't a specific node but a proxy group — a set of nodes plus a selection strategy. Three common types: select (manual pick — that dropdown you see in the UI), url-test (tests latency on a timer and auto-picks the fastest), and fallback (checks nodes in order, switching to the next one automatically if the current one fails). The "Auto Select" and "Failover" groups bundled in most subscriptions are exactly the latter two.

A Minimal Example You Can Actually Follow

proxy-groups:
  - name: Manual Select
    type: select
    proxies: [Auto Speedtest, HK-01, JP-01, DIRECT]
  - name: Auto Speedtest
    type: url-test
    proxies: [HK-01, JP-01]
    url: https://www.gstatic.com/generate_204
    interval: 300

rules:
  - DOMAIN-SUFFIX,github.com,Manual Select
  - DOMAIN-KEYWORD,google,Manual Select
  - IP-CIDR,192.168.0.0/16,DIRECT
  - GEOIP,CN,DIRECT
  - MATCH,Manual Select

How to read it: GitHub and any domain containing "google" go through the "Manual Select" group; local network and mainland China IPs go direct; everything else falls through to "Manual Select" as the catch-all. These five lines are the skeleton of nearly every subscription config out there — subscriptions just expand it into a few hundred lines.

How to Add Your Own Rules

Editing the downloaded subscription file directly won't work — the next subscription update will overwrite your changes entirely. The right way is to use your client's override/merge feature: Clash Verge Rev has "Global Merge Config" for overrides, and Clash Plus has its own custom rules section — rules written there get automatically layered on top of the final config after every subscription update. Add your DOMAIN-SUFFIX line, save, reload the config, and check the logs to confirm it's matching. If something goes wrong, just delete the line and reload — the subscription itself stays untouched.

Chapter 7: TUN Mode and DNS — Rounding Up the StragglersCH-07

As Chapter 5 mentioned, system proxy can't reach every app. This chapter installs two more advanced parts: TUN, which takes over all traffic, and DNS, which determines how well domain resolution actually works.

TUN: Taking Over at the Virtual Network Adapter Level

Enabling TUN mode makes the client create a virtual network adapter on your system and point the default route through it — from then on, every app's traffic goes through Clash before leaving your machine, whether or not it respects the system proxy setting. Games, CLI tools, and every stubborn app that ignores system settings all get swept up. Requirements:

• Windows: the client needs to run with admin rights, or you can install "Service Mode" in settings beforehand (recommended — install once, works indefinitely).
• macOS: the first time you enable it, you'll be asked to authorize with your password.
• Android / iOS: these platforms already work as VPN-style takeover by default, so there's no separate TUN toggle needed.

It's a good idea to turn off system proxy once TUN is on, to avoid running two entry points at once. To verify it's working: try a CLI tool that normally ignores system proxy — if it connects, the takeover succeeded.

fake-ip: Route First, Resolve Later

TUN is usually paired with enhanced-mode: fake-ip: when an app looks up a domain, the core immediately returns a fake IP in the 198.18.0.0/16 range so the connection can proceed right away, and the real resolution happens later during forwarding. This saves a real DNS round trip and lets rules match precisely on domain name. Seeing a fake IP isn't a sign of infection — it's working exactly as designed.

A Minimal Working DNS Section

dns:
  enable: true
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  nameserver:
    - https://doh.pub/dns-query
    - https://dns.alidns.com/dns-query
  fallback:
    - https://1.1.1.1/dns-query

The gist: domestic domains get resolved quickly via the encrypted DNS servers under nameserver, while anything suspicious or foreign gets double-checked via fallback to prevent tampered results. For how to weigh each option and how to write fallback-filter, the blog post "Understanding Clash DNS Config" covers it line by line — worth reading alongside this section.

Windows-Only: UWP Loopback Exemption

Windows Store apps (UWP) are blocked from accessing the local loopback address by default — meaning they can't reach 127.0.0.1:7890, and end up refusing to go through the proxy no matter what. Fix: most clients include a built-in "UWP Loopback Exemption" tool — open it, check the affected app, and save. If your client doesn't have one, use the built-in Windows command to exempt it manually:

CheckNetIsolation LoopbackExempt -a -n=app_package_name

Chapter 8: Ongoing Maintenance and Troubleshooting — Work Through It in OrderCH-08

Even a well-built setup needs upkeep. This chapter gives you two things: three habits worth keeping, and a fixed troubleshooting sequence. The worst way to troubleshoot is poking at random settings one after another — go in order, and each step narrows things down.

Three Daily Habits

• Keep your subscription fresh: set an auto-update interval; when something stops connecting, refresh the subscription manually first, before reinstalling anything.
• Keep the client updated: client updates usually bundle core updates, including protocol compatibility fixes and rule-handling fixes. Don't put off update prompts for too long.
• Learn to read the logs: the client's "Logs" page shows in real time which rule each connection matched and which node it used. It's the one witness that never lies — you'll be calling on it at every troubleshooting step below.

A Six-Step Troubleshooting Sequence

1. Switch to Direct mode to test the raw connection: if you can't get online even in Direct mode, the problem is your broadband or Wi-Fi, not Clash — fix the network first.
2. Test node latency: everything times out → subscription expired or provider outage, refresh the subscription and check your plan; only some nodes time out → try a different node.
3. Switch nodes or regions: a single flaky node is common — try another one in the same region, then try a different region if that doesn't help.
4. Check mode and toggles: confirm you're in Rule mode and that either System Proxy or TUN is actually switched on. "Everything looks fine but nothing's proxied" is almost always a toggle that never got flipped.
5. Check the logs for matches: if the connection to your target site is matching DIRECT, that's a rule problem — go back to Chapter 6 and add a custom rule.
6. Check for a port conflict: if startup fails with bind: address already in use, something else is using port 7890. Check what's using it:

# Windows
netstat -ano | findstr 7890

# macOS / Linux
lsof -i :7890

Once you've found the offending process, either close it or change the mixed port to something else (e.g. 7897) in the client's settings. For full steps across all three platforms and more on changing ports, see the blog post "Fixing 'Port Already in Use' Errors in Clash"; for the layered approach to slow speeds, see "The Three-Layer Method for Diagnosing Slow Speeds"; for anything else, the FAQ page covers a full page of issues by category.

Switching Clients and Migrating

Switching from one client to another doesn't require any "moving" — your subscription link is your entire setup. Just install the new client and import the link again; copy your custom rules from the old client's override page into the equivalent spot in the new one. Before uninstalling the old client, remember to turn off its system proxy and TUN first — otherwise leftover proxy settings can leave you unable to get online after uninstalling, which is one of the most common issues in the FAQ.

Chapter 9: Advanced Path — From User to Power UserCH-09

By the end of Chapter 8, you're already a solid everyday user. This final chapter maps out where to go next — follow this order and you won't get lost going deeper.

Stop 1: Hand-Editing and Understanding config.yaml

Open your downloaded config file in a text editor and read through it alongside the examples from Chapters 6 and 7: what port, mode, proxies, proxy-groups, rules, and dns each control. Reading through it once is usually enough to get the picture. Then try writing your own proxy group in an override — for example, bundle three go-to nodes into a fallback group dedicated to a specific site. Keep a backup of the original config before editing — if something breaks, you can just roll back.

Stop 2: CLI Usage and Server Deployment

A desktop client is just a shell — the mihomo core itself can run standalone on any Linux box: a router running custom firmware, a NAS, a cloud VPS. It comes down to three steps — place the core binary, write a config.yaml, and register it as a persistent systemd service. After that, open the dashboard URL in a browser to manage nodes and rules remotely. Full commands and a service file template are in the second half of the blog post "Setting Up Clash on Linux: The Full Walkthrough"; core binaries are available by architecture on the core section of the download page.

Stop 3: Rule Sets and Automation

Once your hand-written rules hit a few dozen lines, it's time to move to rule sets (rule-providers): split rules into remotely maintained list files organized by purpose, referenced with a single line in your main config, and updated on a schedule automatically. Community-maintained lists already cover most mainstream site categories, which saves far more effort than building your own line by line. Combined with a url-test group and sensible DNS, you end up with a config that basically runs itself.

Recommended Order to Learn It All

• Go through the "Config Fields" and "Rules & Routing" categories in the glossary to build up your vocabulary.
• Read the DNS post and the node-selection post closely — they're the two highest-value reads on this topic.
• Practice in an override file: add a rule → build a proxy group → reference a rule set, checking the logs at every step to confirm it's matching correctly.
• If you have a spare Linux box, follow the CLI deployment post to run mihomo yourself and see what the core looks like without a GUI wrapped around it.

One last reminder: a proxy is a tool, and rules bring order to how you use it. However elaborate your config gets, always follow the laws and regulations that apply where you live, and use network tools responsibly. That's the whole manual — if any chapter feels shaky, come back and rebuild it from that section.