Windows
Ideal for everyday desktop use. The download page lists graphical and archived clients separately and explains differences in package architecture, system proxy support, and TUN permissions.
Go to downloads
Open source · Clients for five platforms
ClashX OfficialClash clients and guides
Choose the right Clash client for your platform, then use the documentation to complete subscription imports, rule-based routing, DNS, and TUN configuration. Download links, basic steps, and advanced settings are organized separately, so there is no need to jump between project pages.
Free forever
Open source
English documentation
mihomo kernel guides
Core Capabilities
From subscription imports to rule-based routingConfiguration options explained by purpose
Clash clients have different interfaces, but their underlying workflow typically centers on loading configuration, selecting policies, matching rules, and taking over traffic. The four sections below cover the areas users check most often, with tabs for concepts, configuration examples, and practical limits.
01 / CONFIG
Subscription Imports and Local Overrides
Subscriptions provide proxies, policy groups, and base rules, while the client periodically fetches them and writes them to local configuration. On first use, confirm that the subscription URL returns a valid response, then check the configuration preview for proxies and policy groups. If local DNS, port, or rule settings must be preserved, avoid repeatedly editing generated subscription files. Use the client’s override, merge, or script features instead, keeping personal changes in a separate layer. When the subscription updates, the proxy list can be replaced while manual settings are merged in the intended order.
View the subscription import steps →mixed-port: 7890
mode: rule
profile:
store-selected: true
proxy-providers:
primary:
type: http
path: ./providers/main.yaml
02 / GROUPS
Policy groups determine how connections are selected
A policy group is more than a folder of proxies: it turns manual selection, latency testing, failover, and load distribution into a reusable decision layer. Manual selection or latency-test groups work well for everyday browsing; services where stability matters can use fallback, while load-balance is useful when long-lived connections need to be distributed. Check the group members, test URL, interval, and tolerance together instead of relying on the type name alone. Once rules point to policy groups, changing proxies does not require editing every rule, which significantly reduces maintenance.
View policy group configuration →RULE
PROXY
select
url-test
fallback
direct
03 / RULES
Domains, IPs, and rule providers match in order
Rule mode checks rules from top to bottom and immediately passes a match to the assigned policy group, so order is part of the configuration logic. Place exact domains and service-specific rules first, broader domain suffixes, GeoSite, or GeoIP rules later, and use MATCH last for everything else. Large rule lists are best split into independently updated rule-providers, while the main configuration keeps only the references. When routing goes wrong, first inspect the rule actually matched in the connection log, then determine whether the rule is missing, overridden by order, or pointing to the wrong policy group.
View rule provider management →rules:
- DOMAIN-SUFFIX,example.com,DIRECT
- GEOSITE,category-ads-all,REJECT
- GEOIP,CN,DIRECT
- MATCH,PROXY
Exact rules first
Broad rules later
MATCH handles the rest
04 / NETWORK
Evaluate DNS resolution and traffic interception separately
The system proxy affects only applications that actively read proxy settings, while TUN uses a virtual network interface to intercept a broader range of traffic. DNS handles domain resolution and mapping, so Fake-IP, nameserver, fallback, and rule matching must form a consistent chain. If websites work but an app cannot connect, domain resolution fails, or local network addresses behave unexpectedly, check the proxy port, TUN permissions, DNS listener, and excluded routes separately instead of changing every option at once. Layer-by-layer verification makes it easier to locate the failure.
View the DNS and TUN section →
Application traffic
System proxy / TUN
Rule matching
DNS resolution
Policy group
Choose by Platform
Clash Client Downloads
Start with the tab for your current operating system, then compare maintenance status, interface style, installer format, and architecture support. The home page provides platform entry points; the download page contains the complete client list, system requirements, and package links in one place to keep information consistent.
macOS
Pay attention to both Apple Silicon and Intel architectures. The platform page covers installation methods for different clients, along with system proxy behavior, menu bar controls, and configuration directory locations.
Go to downloadsAndroid
Suitable for phones and tablets. Confirm the processor architecture before downloading; after importing a subscription, allow the client to establish a system VPN connection for traffic interception to work.
Go to downloadsiOS
Install Clash Plus through its store page. The iOS tab includes the app entry point, official website details, and the system steps required when adding a VPN configuration for the first time.
Go to downloadsLinux
Desktop users can choose a graphical client, while servers, software routers, and container environments more often run the mihomo kernel directly. The download page separates these use cases so desktop installers are not confused with kernel archives.
Go to downloadsNot sure which client to choose?
Start with the operating system, then decide whether a graphical interface is needed. Desktop and mobile devices generally benefit from graphical clients, making subscription imports, policy switching, and log viewing more direct. Linux servers and routers typically use the mihomo kernel with configuration files and a service manager. For ARM devices, also verify labels such as ARM64 and ARMv7. Similar client names do not mean packages are interchangeable across systems; follow the system requirements on the download page before installing.
OPEN SOURCE CONTEXT
Open-Source Kernels and Clients
The Clash ecosystem includes kernels, graphical clients, configuration formats, and community rules. Different clients may use the same or similar configuration concepts, but their maintainers, supported platforms, interface features, and release schedules can differ. Evaluate project status and platform compatibility together rather than judging by name alone.
Project History
Clash established a widely used rule configuration style and policy group model. Later community projects maintained clients and compatible kernels on that foundation. When reviewing configuration capabilities today, you will often encounter mihomo and Clash Meta. They have historical and compatibility links, but should not be treated as the same installer. The download list names each specific client, while the documentation focuses on configuration concepts still in active use.
Kernel Relationships
mihomo parses configuration, establishes proxy connections, matches rules, and provides lower-level capabilities such as DNS and TUN. Graphical clients add installation, subscription management, policy switching, log viewing, and system tray controls around it. Whether a particular interface feature exists depends both on kernel support and on whether the client exposes that setting. YAML parameters in the documentation and options in the client interface should therefore be understood separately.
Community Ecosystem
Rule providers, GeoSite data, dashboards, subscription processing tools, and clients for different platforms together form the operating environment. Community resources can reduce configuration effort, but before adding external rules or scripts, review their update source, reference paths, and override order. When a remote rule provider changes structure, the result may be a configuration loading failure or simply traffic that no longer matches the intended policy; these cases require different troubleshooting approaches.
Update Mechanisms
Client updates, kernel updates, subscription updates, and rule provider updates are four separate paths. A client upgrade mainly changes the interface and integrated features; a kernel upgrade affects protocols and configuration capabilities; a subscription update replaces proxies and provider-supplied policies; and a rule provider update changes domain and IP classifications. When a problem appears, identify which path changed most recently, then roll back or inspect that component. This is more effective than reinstalling everything and rewriting the configuration at once.
mihomo source
git clone https://github.com/MetaCubeX/mihomo.git
Common Questions
Four things to confirm before downloading and configuring
Many connection problems are not caused by the proxy itself, but by a mismatch between the client type, subscription content, proxy mode, and system permissions. These are the most common checks during a first installation or configuration migration.
What is the relationship between Clash, mihomo, and graphical clients?
Clash usually refers to a configuration system and its surrounding ecosystem. mihomo is one actively maintained compatible kernel, while graphical clients connect kernel capabilities to desktop or mobile systems. In practice, you install a specific client or kernel file, not a universal package for every platform. Check the operating system first, then confirm the kernel and feature scope used by the client. See more basics →
Why are there no selectable proxies in the policy group after a successful subscription import?
First verify that the subscription returns a configuration Clash can recognize, then inspect the client’s configuration preview and runtime log. If the subscription returns an error page, authentication prompt, or incomplete YAML, the interface may report a successful import without generating a proxy list. Also confirm that the policy group references the correct proxy or provider; proxies may exist without being added to any visible policy group. Troubleshoot installation and configuration →
Should you use system proxy or TUN mode?
Browsers and most desktop apps that follow system proxy settings can usually start with the system proxy. Games, command-line tools, and apps that ignore system proxy settings may require TUN for coverage. TUN involves a virtual network interface, routing, and permissions, so check DNS and LAN exclusions after enabling it. Do not stack multiple proxy methods simply to expand coverage, as this makes troubleshooting harder. Read about TUN and Fake-IP →
What should you check first when a subscription update fails?
First use a browser or command line to confirm that the subscription URL returns valid content. Then check the client clock, network connectivity, URL completeness, and HTTP status in the log. If the old configuration still connects but the new content cannot be fetched, the problem is usually in the subscription request path. If downloading succeeds but loading fails, check YAML syntax, rule provider paths, and the result of overrides and merges. View the complete troubleshooting guide →
Configuration and Troubleshooting Articles
View all articles →
Recent Updates
Reproducible checks for system proxy settings, runtime logs, and traffic interception. Each article first explains which layer produces the symptom, then provides a verification order so you do not reset every setting at the first sign of a connection problem.
Troubleshooting
Browser works through the proxy, but the terminal does not? A scenario-based guide to system proxy issues
A browser may read the system proxy or use its own settings, while terminal programs often rely on environment variables. This article checks proxy overrides, ports, environment variables, and verification commands separately to show where traffic bypasses the client.
Read the full article →Troubleshooting
How to read Clash runtime logs: tracing DNS errors and connection timeouts
Runtime logs can contain rule matches, DNS queries, connection establishment, and error details at the same time. This article explains the recommended order for reading common fields and distinguishes where to look for resolution failures, connection timeouts, refused connections, and configuration loading errors.
Read the full article →Advanced
TUN mode or system proxy? Comparing how the two traffic interception methods work
A system proxy depends on applications actively reading its settings, while TUN intercepts traffic at the network layer through a virtual network interface. This article compares coverage, DNS handling, permission requirements, and troubleshooting effort, then explains which option fits everyday desktop use and special applications.
Read the full article →