SUBSCRIPTION CONFIG MANUAL
Choose a client for your device, then complete subscription link import, proxy-group checks, and traffic capture in sequence. Each step maps to a real client entry point and a verifiable status.
A subscription URL only delivers configuration. After importing it, confirm the active configuration, proxy group, proxy mode, and system traffic-capture status. When connections fail, checking each stage of this path is usually more effective than repeatedly reinstalling the client.
PLATFORM OUTPUT
Identify your operating system first, then choose a maintained client that matches your device architecture. The home page only routes you to the right platform; verify installers, system requirements, and client differences on the download page.
DESKTOP / 01
Suitable for everyday desktop use. Before downloading, check for an x64 architecture under “Settings → System → About” or “System Information,” then choose a graphical client such as Clash Plus, Clash Verge Rev, or FlClash. After installation, import the subscription on the configuration page and separately enable the system proxy or TUN mode. A running client does not necessarily mean traffic is being captured.
Go to DownloadsDESKTOP / 02
Use “About This Mac” to distinguish Apple silicon from Intel processors; the two installers are not interchangeable. On first launch, macOS may ask you to approve opening the app, a network extension, or administrator access. After importing the subscription, verify browser traffic with the system proxy first, then decide whether to enable TUN Routing for terminals, development tools, and other apps that need broader coverage.
Go to DownloadsMOBILE / 03
Most recent devices can use an ARM64 package. If you cannot confirm the architecture, check the universal package and other architecture notes on the download page. Android clients usually capture traffic through the system VPN interface, which prompts for VPN authorization on the first connection. After importing the subscription, check the active configuration, proxy-group selection, and background-running permission so battery-saving policies do not terminate the connection.
Go to DownloadsMOBILE / 04
Install Clash Plus on iPhone and iPad through the App Store. To import a subscription, copy the complete URL and add it in the app, or use the redirect entry supplied by the provider. The first connection requires permission to add a VPN configuration. If the configuration has updated but the proxy group has not changed, return to the app and confirm the active configuration file and proxy group instead of relying only on the VPN indicator in the system status bar.
Go to DownloadsDESKTOP / 05
For desktop environments, choose Clash Verge Rev or FlClash; servers, software routers, and automated environments are better suited to running the Mihomo core directly. With a graphical client, confirm that the package matches the distribution. With the core, you must also manage the configuration path, startup arguments, service permissions, and logs yourself. The two approaches have different entry points, so their tutorial steps should not be mixed.
Go to DownloadsSELECTION CHECK
Graphical clients suit desktop users who need a tray menu, proxy-group selection, system-proxy controls, and a configuration update interface. Core programs are better for servers or routers managed through the command line, services, and YAML configuration. An old client may still launch, but once maintenance stops it will not keep up with new core fields or operating-system changes. When migrating, preserve the subscription URL, overrides, and custom rules first, then recheck the traffic-capture method in the new client.
Device architecture is a separate requirement. Windows commonly uses x64; macOS requires distinguishing Apple silicon from Intel; Android may offer ARM64, ARM, or universal packages. The architecture marker in the installer name must match the device. If an installer will not install, check the architecture and system version first rather than repeatedly trying same-named packages from different sources.
View All Clients and System Requirements →RECEIVE CHAIN
A Clash configuration is more than a single switch. Subscription parsing, rule-based routing, DNS processing, and automatic updates act on the same path in sequence. Use the navigation on the left to switch between checks; the vermilion marker shows the current section.
CONFIG INPUT / CHANNEL 01
After accessing the subscription URL, the client reads its proxy nodes, proxy groups, rules, and any included DNS fields, then saves them as a local configuration. A successful import only means the content was written to the client; it does not mean the configuration is active or that traffic has entered the proxy path. Check the configuration name, update time, and active status, then open the proxy group to confirm that node entries appear normally.
If the imported configuration is empty, first check whether the URL was copied in full, the subscription is still valid, and the client can reach the subscription URL. A text response opening in a browser does not guarantee that the client can parse it; response format, redirects, and field compatibility all matter. Before importing again, run a manual update and review the configuration-loading messages in the client log.
RULE PROCESS / CHANNEL 02
Rules determine which proxy group should handle a domain, IP, process, or network type. The proxy group then chooses a specific node, automatic selection, failover, direct connection, or rejection. Node test results only assist selection; they do not replace rule matching. When troubleshooting a website, first confirm the current mode, then identify the matching rule, the proxy group it enters, and the egress currently selected by that group.
Global mode sends most connections through one unified egress. Rule mode matches rules from top to bottom, while Direct mode bypasses proxy nodes. Rule mode is usually the best starting point for everyday use. Custom rules must be placed correctly because a broad rule earlier in the list may match first and prevent a precise rule later on from taking effect. After switching nodes, wait for existing connections to close before making a new request for verification.
NAME RESOLUTION / CHANNEL 03
Clash can handle DNS queries and pass the results to the rule system for further processing. Fake-IP mode maps domains to virtual addresses, preserving domain information during connection handling; Redir-Host mode is closer to returning real resolved addresses. Neither mode is universally correct—choose based on compatibility with the system environment, LAN services, games, and specialized applications.
If a website domain will not open while its IP address works, LAN device names stop resolving, or an application repeatedly reconnects, include DNS in the troubleshooting scope. Check that DNS is enabled, its listening port is not occupied, and upstream servers are reachable, then review the Fake-IP filter list. The system, browser, and client may cache results independently, so clear caches or restart the relevant apps after changing settings.
CONFIG REFRESH / CHANNEL 04
Clients that support subscription updates can fetch the configuration again at a set interval. An update may add or remove nodes and change proxy groups or rules, so confirm that the active configuration remains valid and that frequently used proxy groups have not been reset. If the client supports overrides, determine whether they are applied before or after the subscription content to avoid having local changes replaced at the next update.
When an automatic update fails, run a manual update first and inspect the error. A practical order is the subscription URL, network reachability, system time, configuration format, and storage permissions. Shortening the update interval repeatedly will not improve connection quality and may create duplicate requests. Use a normal interval supported by the client, and manually refresh once the provider announces a configuration change.
OPEN SOURCE RECORD
The Clash ecosystem combines cores, graphical clients, configuration formats, and community-maintained projects. To decide whether a client remains suitable, check its code, release history, core compatibility, and operating-system support instead of relying only on its interface name.
HISTORY / 01
Clash established familiar workflows around rule matching, proxy groups, and YAML configuration, followed by graphical clients for different platforms. After some original projects stopped being maintained, the community continued developing compatible cores and new clients. A search for “Clash client” now returns several similarly named programs that may use different cores, interface layers, and distribution channels.
Confirm three separate points when choosing one: whether the client is still actively maintained, whether its bundled core supports the fields in your subscription, and whether the installer matches your device, operating system, and architecture. Menu names in older tutorials may differ from those in newer clients, but the configuration path can still be understood as “import configuration—choose a proxy—enable traffic capture—check logs.”
ECOSYSTEM / 02
Compatible cores such as Mihomo parse configurations, establish connections, apply rules, process DNS, and provide control interfaces. Clients such as Clash Plus, Clash Verge Rev, and FlClash add installation, configuration management, tray controls, system-proxy switches, and visual logs around the core. Whether a graphical client is easy to use and whether its core supports a configuration feature are separate questions.
Troubleshooting should respect these boundaries. Installation failures usually belong to the system or client layer; YAML errors belong to configuration parsing; incorrect website routing belongs to the rule or proxy-group layer; and applications that bypass the proxy are often related to the system proxy, TUN Routing, or the app’s own networking implementation. Identifying the layer reduces unrelated changes.
CORE RELATION / 03
Switches such as “Rule mode,” “Allow LAN,” “TUN mode,” and “Enhanced DNS mode” in a client ultimately write configuration fields or become core startup arguments. The interface hides field details but does not change their underlying effect. When migrating clients, the subscription URL can usually be imported again; overrides, scripts, rule providers, and local DNS exceptions must be organized separately.
Users who run the core directly must maintain the configuration path, control port, service startup, and log rotation themselves; graphical clients manage some of these tasks. Both approaches use the same or similar configuration concepts, but their workflows cannot be copied interchangeably. This site’s quick-start guides focus on graphical clients, while the configuration reference explains what the core actually reads at each YAML level.
UPDATE POLICY / 04
Client updates fix interface, installation, and system-compatibility issues; core updates add protocol, rule, DNS, and routing capabilities; subscription updates only refresh the configuration delivered by the provider. None replaces another. When connections work normally, there is no need to change every component just to chase versions. When compatibility problems appear, first identify which layer changed.
Before upgrading a client, record the current subscription URL, proxy-group selections, and local overrides. After upgrading, first check that the configuration loads, then verify that system-proxy or TUN permissions remain. If a subscription update changes a proxy group, compare the update time and configuration content instead of immediately rolling back the client. Handle field, permission, and network errors separately in the log.
SOURCE CHECKOUT
To verify core behavior, inspect configuration implementation, issue reports, and release notes in the public repository. The clone command only retrieves source code; it does not install a graphical client or generate a usable subscription. Regular users should choose an installer from the client download page. Developers and router maintainers can continue with the build documentation.
git clone https://github.com/MetaCubeX/mihomo.git
QUICK DIAGNOSIS
These questions help identify where to start checking. For complete steps, platform differences, and troubleshooting, continue to the Help Center.
First confirm that the imported configuration is active, then check whether the client’s system proxy is enabled. Starting the client or selecting a node does not automatically change every app’s network entry point. If the browser uses its own proxy settings, an extension, or secure DNS, check whether those settings override the system proxy.
On desktop, start with the system proxy to test browsers and apps that follow system settings. Evaluate TUN Routing only when games, terminals, app stores, or other programs do not use the system proxy. TUN covers more traffic but requires additional permissions and may conflict with virtual machines, other VPNs, or security software network drivers.
A subscription update may rebuild proxy groups or rename nodes. If the selected item no longer exists, the client returns to the proxy group’s default. After updating, reopen frequently used proxy groups and confirm their egress. If overrides are supported, understand the merge order before pinning local settings; do not directly edit subscription files that the next update will replace.
First determine whether those applications use the system proxy, then check whether their requests appear in the client log. If there is no log entry, the problem is usually at the traffic entry point. If there is an entry but the rule does not match, check the rules and proxy group. For domain-resolution failures, check the DNS mode, cache, and exclusions. Troubleshoot in the order of entry point, rule, egress, and DNS.
CONFIG NOTES
These articles cover configuration structure, traffic-capture methods, and client migration separately. For a specific issue, open the relevant topic directly instead of reading the entire quick-start flow from the beginning.
Follow the actual loading order of port, DNS, proxy-node, proxy-group, and rule fields, including indentation, references, and field-override behavior.
For users who have imported a subscription and are ready to read or modify a configuration file. The article focuses on references between sections and explains why a field can exist without entering the active runtime configuration.
Compare the two traffic-capture methods by operating layer, application compatibility, DNS handling, and permission requirements, with selection guidance for common device environments.
For issues such as “the browser works but other apps do not connect” or “the network becomes unstable after enabling TUN.” The article explains the difference through traffic entry points and lists the permissions, routes, and conflicts to check before switching.
Review clients that remain usable, explain how to migrate subscriptions, override rules, and system-proxy settings, and list checks to perform before and after switching.
The key to migration is not copying the old program directory, but separating reusable configuration from client-specific state. The article explains how to document and recreate subscriptions, overrides, custom rules, and traffic-capture settings.