Open-source cores · Clients for five platforms
Choose a client for your device and learn about routing rules, subscription imports, and TUN setup.
Downloads by Platform
Check your operating system and processor architecture first, then compare how each client manages configuration. Find installers, system requirements, and maintenance status in the download center.
For everyday desktop use, compare Clash Plus and Clash Verge Rev, or consider FlClash and Clash Nyanpasu. Check your processor architecture in system information before installing. After the first launch, import a configuration before enabling the system proxy. If you need to route more app traffic, follow the guide to check TUN permissions and service status.
Go to DownloadsCheck About This Mac to see whether your device uses Apple silicon or an Intel processor, then choose the matching installer. Clash Plus, Clash Verge Rev, and FlClash are good starting points to compare. Read system authorization prompts when enabling network features for the first time. If connections stop working after an update, check whether background services and the system proxy are still enabled.
Go to DownloadsCompare Clash Plus, Clash Meta for Android, FlClash, and Surfboard. On mobile, check configuration format, VPN permissions, and background battery management. Most modern devices use ARM64, but verify your device’s specifications. Surfboard uses a different configuration system from Clash YAML, so confirm that your subscription provides a compatible format before importing it.
Go to DownloadsUse the download center to open the Clash Plus page in the App Store, and visit its official website at clashplus.io. After installing, follow the app’s prompts to add a configuration and authorize VPN access. Desktop and mobile clients don’t have identical options. When migrating a subscription, check which protocols, rule syntax, and import methods the client supports.
Go to DownloadsFor desktop Linux, start with Clash Verge Rev or FlClash and choose a package supported by your distribution. Server and router users can also explore the mihomo core. A command-line core requires you to manage configuration paths, permissions, and service lifecycle yourself; this is a different deployment approach from installing a graphical client.
Go to DownloadsClient Basics
The graphical client provides the controls; the core handles connections. Understand the proxy mode, traffic interception method, and configuration source first to make troubleshooting more effective.
Rule mode sends connections according to the order of rules in your configuration, making it suitable when you need both direct and proxied traffic. Global mode typically applies a global policy to connections intercepted by the client; it doesn’t mean every app on your device is being proxied. Direct mode sends those connections straight to their destinations. For your first setup, keep Rule mode and check which policies are selected in each group. Temporarily switching to Global can help identify a routing-rule issue, but it won’t tell you whether the system proxy or TUN is configured correctly. Switch between the three modes on the right to see what each one does. This demo won’t change your device’s network settings.
Compare the three modes →Mode guide · No network controls
Rules are checked in order; matching connections use the assigned policy. Best for everyday routing.
The global policy handles intercepted connections. Useful for temporary comparisons during troubleshooting.
Intercepted connections go out directly. Useful for comparing results with local network access.
A system proxy registers a proxy address with the operating system. It works with browsers and apps that honor that setting. TUN mode uses a virtual network interface to handle matching traffic, typically covering more connections but relying more heavily on permissions, routing, and DNS configuration. Neither option is simply faster than the other. Start with the system proxy to verify your first connection. Consider TUN for apps that don’t honor the system proxy. Before enabling it, pause other VPNs that could conflict and note your current settings. Mobile VPN permissions and desktop service controls are in different places, so follow the platform-specific guide.
See traffic interception methods and permission steps →Clash custom rules are generally matched from top to bottom, so put specific domain rules before broader ones. MATCH is commonly used as the final fallback. DOMAIN-SUFFIX matches domain suffixes; GEOIP matches the region associated with a destination IP. They rely on different information. The snippet on the right shows valid syntax: PROXY must refer to a policy or policy group that already exists in your configuration. Back up your configuration before making changes, and use the client’s override or extension features where possible to avoid losing local edits when a subscription updates. To confirm a rule is working, check the match result for a new connection rather than relying only on whether a webpage loads.
Check rule and core compatibility →A subscription URL provides connection settings and routing rules; the client itself doesn’t create a working service. Before importing, make sure the URL comes from a trusted source and check whether it provides Clash YAML or another format. After downloading, select the configuration in the client’s profile list for the core to use it. Saving a URL alone doesn’t switch configurations. Updates fetch the latest remote content, so manage personal rules and interface settings separately using the options your client supports. Subscription URLs may contain access credentials—don’t share them in public screenshots or with public conversion services. If an update fails, check that the URL is valid and not expired, and that your network can reach it.
See how to import a subscription →First Connection
First, establish a connection you can verify. Then adjust startup behavior, custom rules, and other advanced options. Change one thing at a time to make problems easier to track down.
Choose the installer for your platform in the download center. Once installed, open the profile or subscription page. Paste the subscription URL, wait for it to finish downloading, then select the profile in the list. If you’re using a local file, make sure its contents are in a supported format; changing the file extension alone won’t convert it. If importing fails, read the error and determine whether the URL couldn’t be reached or the configuration couldn’t be parsed. There’s no need to keep toggling the system proxy before a profile loads successfully.
Keep Rule mode, check the selected policy in each group on the Proxies page, then enable the system proxy or start the VPN as prompted on mobile. On desktop, make sure another client isn’t using the same port. For testing, temporarily disable other traffic-interception tools to prevent conflicting routes. Verify apps that need TUN separately, once the basic connection works. Allow LAN Connections, Global mode, and TUN are separate settings, not interchangeable switches.
Visit destinations that should connect directly and through the proxy, then check the Connections or Logs page for the selected policy and matched rule. Clash node latency tests only measure response time to the test target; they don’t directly indicate download speed, full page load time, or whether every service is available. If a browser works but one app doesn’t, first check whether the app uses the system proxy. Then look at DNS, UDP support, and TUN routing rather than immediately reinstalling the client.
Open-Source Ecosystem & Maintenance
Evaluate the interface, core, and configuration source separately. Similar names don’t guarantee identical features, and support for the same file format doesn’t mean every field is compatible.
The Clash ecosystem brings together proxy cores, graphical clients, and configuration tools. After development of the original Clash project stopped, the community continued to build on its configuration syntax and usage patterns. The Clash.Meta fork later evolved under the name mihomo, adding and improving protocol support, DNS, rules, and traffic interception. Many concepts in Clash Meta guides still apply to mihomo, but check the current core documentation for specific fields. Paths and interfaces shown in older guides may have changed.
Clients such as Clash Verge Rev and FlClash provide profile lists and controls for the system proxy, policy groups, and logs. The core in use determines the underlying connection capabilities. A feature may require both a client setting and a core configuration; conversely, core support for a field doesn’t mean every client offers a graphical control for it. If you need a specific protocol, rule provider, or DNS feature, check the core’s supported features first, then see how the client stores those settings.
Documentation, licenses, and issue discussions in open-source repositories can help clarify what a project supports. This site provides download links and setup guides; it isn’t the developer or service provider for every client. Connection addresses, accounts, usage limits, and expiration dates in a configuration depend on its source and won’t be fixed by switching clients. When following troubleshooting advice, note the client name, operating system, interception method, and error message. Remove subscription URLs and other sensitive information before sharing logs.
Client updates and subscription updates are different: the former changes the app or core, while the latter replaces the remote configuration. Back up personal rules and overrides, read the release notes, then update the app. Avoid changing the core, subscription, DNS, and interception method all at once while troubleshooting. The download center marks clients that are no longer maintained as archived. For new devices, consider actively maintained options; when migrating an existing setup, check protocol and configuration compatibility first.
DNS and connection checks: Fake-IP is a DNS mode, not a standalone proxy protocol. To troubleshoot a Clash DNS leak, check the client’s DNS settings, system resolver, browser Secure DNS, and actual traffic routes together. Enabling a single setting isn’t enough to verify the DNS resolution path or connection exit. For local domain names, printers, and development services, also check local DNS resolution and bypass rules.
Technical Notes
Once your basic connection is working, dig deeper based on the problem you’re seeing. First identify which layer is failing to avoid conflating network path, DNS, and routing-rule issues.
Pinpoint slow speeds by checking four layers in order: node quality, relay routes, local DNS and TUN settings, and system configuration. Each section includes practical ways to diagnose and resolve the issue.
Read the technical note →Learn where GeoIP and GeoSite data files come from and how they’re used. Covers automatic updates in mihomo, manual file replacement paths, and common GEOSITE rule syntax.
Read the technical note →Breaks down how these three automatic policy groups select nodes and explains parameters such as interval and tolerance, with configuration strategies for stability or load balancing.
Read the technical note →