mihomo coreOpen-source license GPL-3.05 platform downloadsDefault mixed port 7890
CLIENTS / Choose a platform
Download Clash clients
Check your operating system and processor architecture first, then choose a client. The graphical app manages configuration; the core handles connections. Similar configuration fields don’t mean every client puts settings in the same place.
Start by comparing Clash Plus, Clash Verge Rev, FlClash, and Clash Nyanpasu. Before installing, check your processor type in system settings rather than relying on the package icon to tell you whether it’s compatible.
For your first connection, start with the system proxy. Once browser requests appear in the connection log, enable TUN if needed. When switching from an older client, quit it and turn off its proxy settings first to avoid port conflicts or two services changing routes at once. Clash for Windows is no longer maintained; its archived download is provided for reference with older setups.
Choose the right package for Apple Silicon or Intel. Clash Plus, Clash Verge Rev, and FlClash manage configurations differently. Whether you need a background service depends on your system proxy, TUN permissions, and startup requirements.
Move the client to the Applications folder, then complete its first launch and grant any requested system permissions. If the connection fails, check that the proxy address and port for the active network service match the running client. Check again after switching Wi-Fi networks; a menu bar icon alone doesn’t confirm that traffic is being routed. The download page clearly marks ClashX Meta as archived.
Compare Clash Plus, Clash Meta for Android, FlClash, and Surfboard. Match the package architecture to your device, and check the subscription format first. A configuration from another proxy client isn’t necessarily compatible with Clash YAML.
On the first connection, Android will ask for permission to set up a VPN connection. If the connection drops when the app goes into the background, check battery optimization and background activity restrictions, then review the client logs. If another VPN app is running, confirm which app is handling the connection. Switching repeatedly between two apps makes results hard to compare.
The download page links to Clash Plus on the App Store and lists its official website, clashplus.io. Before installing, check the system requirements in the store listing. Before importing, make sure the subscription’s configuration format is supported by the client.
After adding a configuration, follow the system prompt to allow a VPN configuration, then return to the client and select the active subscription and outbound. Test Wi-Fi and cellular connections separately. If one fails, note the network, DNS results, and connection logs before changing DNS settings. A VPN icon only confirms that the tunnel is enabled; it doesn’t confirm that rules match or the destination is reachable.
For desktop Linux, choose Clash Verge Rev or FlClash and install the package for your distribution. For servers and routers, see the mihomo core section on the download page. Check the processor architecture, permissions, and configuration directory before setting up the service.
A desktop system proxy may not cover command-line tools. Check proxy options or environment variables for terminal apps, and check permissions and routes for TUN. When running as a system service, specify the configuration path and keep logs accessible. Don’t assume the service and your current shell share a working directory or user permissions.
Choose settings to solve the issue at hand instead of turning on every option. These snippets show how fields fit together; they don’t include a working proxy server. Add your own subscription or outbound details to use them.
Rule mode checks domains, IP addresses, or rule sets in order, then sends matching connections to the specified outbound. The final MATCH rule catches everything else. To temporarily compare proxy routes, switch to global mode and check which outbound is selected in GLOBAL. Direct mode helps test your local network; it doesn’t turn off the client. Unlike tools that provide a single proxy address, Clash lets you inspect routing criteria in the configuration. When troubleshooting, check the matched rule first, then change the rule order to avoid mistaking an outbound failure for a rule issue.
TUN mode
TUN receives traffic through a virtual network interface, making it useful for apps that don’t use the system proxy. Before enabling it, verify that your subscription and outbound work, then check that the client has the required service or administrator permissions. TUN captures more traffic than a system proxy and depends more heavily on routing, DNS, and firewall settings. This example uses automatic routing and DNS hijacking, but implementations vary by platform. If LAN access breaks after enabling TUN, check for route conflicts and exclusions. Don’t run multiple traffic-capture services at once.
Subscriptions update server details or a complete configuration. After importing one, select and enable it; a successful download doesn’t mean you’re connected. A full configuration subscription and a proxy collection under proxy-providers serve different purposes, so use the import option that matches the content. Local overrides can preserve ports and custom rules without editing a remote file, reducing the risk of losing settings during the next update. If an update fails, record request errors separately from configuration parsing errors, then check the network path and YAML syntax. Never share subscription links that contain access credentials.
example.org is only an example of where a field goes; it isn’t a working subscription source.
DNS settings
DNS resolves domain names; rules decide which outbound handles each connection. Both need to work together. fake-ip maps domain names to reserved addresses so the core can associate them with later connections. nameserver-policy lets you choose a resolver for specific domains. Unlike changing system DNS alone, core-level DNS can handle requests along the traffic-capture path, but you’ll need to check encrypted DNS built into individual apps separately. After making changes, reconnect and check DNS logs; clear the cache if needed. Successful name resolution doesn’t guarantee a working proxy connection, so test them separately.
Clash-based projects share a similar YAML structure, but supported protocols and fields vary between cores. mihomo builds on Clash-style configuration and adds support for some protocols and routing features. Older cores may reject newer fields or handle them differently than expected. When migrating, check the core name, configuration syntax, and feature support—not just the client’s appearance. If the client lets you select a core, back up your configuration before switching. This example uses basic fields; after migrating, verify DNS, outbound groups, and final rule matching one by one.
The same outbound groups and rules can be a starting point for multiple devices, but system permissions, file paths, and traffic capture need platform-specific handling. Desktop systems often start with a system proxy; mobile devices typically connect through the system VPN interface; servers usually need an explicit service configuration. Keeping shared rules separate from device-specific settings is safer than copying the whole file, and makes it easier to preserve differences in ports and traffic capture. After migrating, check that all referenced outbound groups exist, then test DNS and connections. Absolute paths from a desktop won’t work as-is on a phone.
# Check local ports on each device
mixed-port: 7890
allow-lan: false
# Rules that can be shared across devices
rules:
- DOMAIN-SUFFIX,example.org,DIRECT
- GEOIP,CN,DIRECT
- MATCH,PROXY
Follow the connection path to understand the configuration
First route requests through the client, then check DNS resolution, rule matching, and outbound selection. PROXY on the configuration canvas is a group name, not a proxy service included with the app.
Start with a connection path you can verify. Complete each step before moving on so you can tell whether a problem lies with importing, traffic capture, or the outbound connection.
01
Import and enable a configuration
Add a link in the client’s subscription or configuration page, or import a local YAML file. After saving, check that it parses correctly and includes the expected outbound groups, then set it as the active configuration. Seeing a subscription in the list doesn’t mean the core has loaded it.
If importing fails, check whether the error is from the network request or the configuration syntax. A webpage with instructions isn’t a subscription, and incorrect indentation needs to be fixed in the file. Keep a copy of the original configuration when getting started. Add custom settings through the client’s override feature where available, so you can distinguish remote updates from local changes later.
02
Choose a mode and traffic-capture method
Start with rule mode for everyday use, and select an outbound in the group you use. On desktop, enable the system proxy and check the listening port. On mobile, allow the VPN connection when prompted. If an app doesn’t follow the system proxy, check the TUN setup for your platform.
Global mode changes how connections already reaching the core choose an outbound; it won’t route apps that the client hasn’t captured. After switching modes, make a new request and check the logs. To compare results, keep the destination and network unchanged and adjust one setting at a time. This avoids mistaking temporary network fluctuations for the effect of a setting.
03
Check rule matches and outbound results
Open the destination you want to test, then find its domain in the connection log and check the matched rule and final outbound. Test a destination expected to connect directly as well, to confirm that rules are applied in order. Testing both an app and a browser can reveal when proxy settings cover only some programs.
If there’s no connection log, check the system proxy, app settings, or TUN capture first. If a connection is logged but fails, check DNS resolution, outbound availability, and the remote server’s response. When you’re done, turn off traffic capture in the client before quitting to avoid leaving the system proxy pointed at a local port. See the guide for the full setup and recovery steps.
Client names, core names, and subscription services are different things. To check whether a feature is available, consult the project documentation, identify the core in use, and review local logs—not just whether the app’s name includes Clash.
Project history and maintenance status
Clash began as a rule-based proxy core, with a configuration ecosystem that later grew to include graphical clients for desktop and mobile systems. The original Clash project and some early clients are no longer maintained. Today, similarly named clients can have very different maintenance statuses. Buttons, service setup steps, and protocol support in older guides may not apply to newer clients.
Before choosing a client, check whether it still receives releases, then review its system requirements and configuration support. Software that works in an older setup may not recognize fields in a new subscription. Before migrating, save your configuration, group selections, and local rules. After migrating, test the connection; a successful launch alone doesn’t mean the migration is complete.
The core and the interface
mihomo is an actively developed core in the Clash ecosystem. It parses configurations, matches rules, and establishes outbound connections. A graphical client manages subscriptions, system proxy settings, service installation, and logs. Two clients using the same core may offer similar core configuration features, but differ in local overrides, permission handling, and system integration.
A setting missing from the interface doesn’t necessarily mean the core lacks support for its configuration field. If the documentation doesn’t match what you see, first check the core listed in the client’s About page, then consult the relevant documentation. The download page helps you choose a client; the full documentation covers installation and core configuration separately, so you can find instructions for your setup.
Open-source licensing and project references
mihomo is licensed under GPL-3.0. Browse its code, issue discussions, and release notes in the project repository. The license applies to the project itself; it doesn’t mean every graphical client, subscription service, or add-on uses the same license. Before distributing or modifying software, read the relevant project’s license and dependency information.
Review source code and issue reports to check field behavior, platform limitations, and known problems. This site doesn’t publish unverified download counts, user ratings, or connection performance statistics. Open-source code provides an implementation you can inspect, but network performance still depends on your local environment, the destination service, and the selected outbound. Popularity is no substitute for testing.
Updates and configuration backups
Client, core, and subscription updates are separate operations. A client update may change the interface or system services; a core update may change supported fields or connection behavior; a subscription update mainly replaces servers, rules, or configuration content. If something breaks, note which layer changed before restoring settings or checking the release notes.
Before updating, export local overrides and custom rules, and note your ports and traffic-capture settings. After updating, check that the configuration loads, then verify outbound group references, DNS, and routing. If a problem starts after a subscription update, compare the subscription content first instead of immediately reinstalling the client. Recording changes by layer makes troubleshooting easier.
Subscription services and local configurations
Installing a Clash client doesn’t provide proxy servers. Outbound connections come from a service you set up yourself or an existing subscription; the client only handles connections according to its configuration. Keep subscription addresses, access credentials, and account details private. When sharing troubleshooting details, include the error type and necessary fields, but remove anything that could grant access to a service. Never post a complete subscription in a public repository.
This page’s configuration editor illustrates field structure. DIRECT in a selection group means a direct connection; it doesn’t mean a proxy route is configured. If you come across an unfamiliar term, start with the core, outbound group, and network mode definitions in the glossary, then compare client differences in the client comparison. For platform-specific permissions and service issues, consult the full documentation for your system.
View mihomo source code
The command below clones the project repository for browsing its source code and documentation. If you just want to install the software, choose a client instead. Building from source also requires the toolchain and environment specified in the project documentation.
Step-by-step guidance based on real setups. Troubleshooting articles follow the connection path: identify which layer is causing the issue before changing settings, and keep the network and destination the same when comparing tests.
Follow the complete Windows setup, from choosing an installer and importing a subscription to enabling the system proxy and TUN service mode. Includes common errors such as port conflicts and failed service installation.
Use a DNS leak test to see where queries are actually going, then tighten DNS handling in three steps with fake-ip, nameserver-policy, and TUN DNS hijacking. Includes a dns section you can use as a reference.
Isolate the issue across three layers: node quality, relay routes, and local settings. Compare nodes, inspect outbound paths, and check TUN stack and DNS settings to find the bottleneck.
When troubleshooting, distinguish between “can’t connect” and “slow connection.” For the former, first check whether requests reach the core; for the latter, keep test conditions consistent. See common configuration questions for field explanations and platform-specific recovery steps.