Clash Beginner's
Guide
From download and installation to configuration, this step-by-step guide helps you fully understand how to use Clash, including subscription imports, rule splitting, and cross-platform tutorials.
Start Using Clash in Three Simple Steps
No complex configuration required. Follow these three steps to quickly get started with Clash from scratch and enjoy a stable, smooth network proxy experience.
Download and install the Clash client for your platform
Go to the Download Center to get the graphical Clash client for your OS (Windows, macOS, Android, iOS, or Linux). We recommend Clash Verge Rev for Windows users, Clash Verge Rev or ClashX Meta for macOS users, and Clash Meta for Android for Android users.
Paste your proxy subscription link on the "Profiles" page
Open the installed Clash client, find the "Profiles" or "Subscription" menu, and paste the subscription link provided by your proxy service provider. Click download/update, and the client will automatically fetch and parse all node information. You can also import local YAML config files directly.
Switch to "Rule" mode and enable the proxy
Go to the "Proxies" page and select "Rule" mode at the top—this mode automatically determines which traffic goes through the proxy and which connects directly, making it the best choice for daily use. Finally, turn on System Proxy or the TUN switch for the configuration to take effect instantly.
What is Clash?
Clash is a free and open-source network proxy tool developed in Go. It uses flexible rules to precisely split network traffic to different exits, widely used for internet access, developer debugging, and cross-border business acceleration.
Core Advantages of Clash
- Powerful rule-based splitting engine, supporting Domain/IP/GeoIP rules
- One-click subscription import with automatic node updates
- Supports 10+ mainstream proxy protocols
- Cross-platform graphical clients with simple operation
- Fully open-source and free with auditable code
- Built-in encrypted DNS to prevent DNS pollution
Common Terms
- Subscription Link: A URL provided by a proxy service provider containing node configurations.
- Rule Splitting: Automatically determining whether traffic goes through the proxy or direct based on rules.
- TUN Mode: An enhanced proxy mode that takes over all system network traffic.
- Policy Group: A set of switchable nodes, such as "Auto-select fastest node."
- Mihomo: The new name for the Clash Meta core, extending support for more protocols.
- YAML Config: The configuration file format used by Clash, with .yaml/.yml extensions.
Clash for Windows Installation Guide
This tutorial uses Clash Verge Rev as an example, the most recommended Clash client for Windows, maintained by the community and featuring the Mihomo core.
Download Installer
Go to the download page and click "Clash Verge Rev - Download x64 version" to get the .exe installer. Most Windows PCs use the x64 architecture. Run the installer after downloading.
Handling Windows Security Alerts
If a SmartScreen alert "Windows protected your PC" pops up, it's because the program isn't signed by Microsoft. Click "More info" → "Run anyway" to continue. This is common for open-source software with fully transparent code.
Complete Installation and Launch
Follow the installation wizard. A Clash Verge Rev shortcut will appear on your desktop. Double-click to open; it will automatically configure the Mihomo core on the first launch.
Import Subscription Link
Click "Profiles" in the left menu, paste your subscription link into the top input box, and click "Download." Once the configuration file appears in the list, click it to set it as active.
Enable System Proxy
Return to "Home" and toggle the "System Proxy" switch on the right (it will turn blue). Traffic from browsers and other apps will now go through Clash. Enable "TUN Mode" to take over all traffic.
Clash for macOS Installation Guide
This tutorial uses Clash Verge Rev as an example, supporting both Apple Silicon (M1/M2/M3) and Intel-based Macs. Choose the version corresponding to your model.
Check Chip Type and Download
Click the Apple menu → "About This Mac" to check your processor. If it says Apple M1/M2/M3, download the Apple Silicon (arm64) version; if it says Intel, download the x64 version from the download page.
Install App and Bypass Isolation
Double-click the .dmg file and drag the app into the Applications folder. If you see an "unverified developer" warning on first launch, go to "System Settings → Privacy & Security," find the app at the bottom, and click "Open Anyway."
Grant Necessary Permissions
On first launch, Clash Verge Rev will request to install a VPN profile (for TUN mode) and network access permissions. Click "Allow" and confirm with your Mac password.
Import Subscription and Enable Proxy
Click "Profiles," paste your subscription link, and download the config. Once active, return to Home and enable "System Proxy" to route macOS browser and system traffic through Clash.
sudo xattr -rd com.apple.quarantine /Applications/Clash\ Verge.app
Clash for Android Installation Guide
We recommend Clash Meta for Android or FlClash for Android. Both provide APKs for direct installation without needing an app store.
Check Architecture and Download APK
Most modern Android phones (released after 2016) use the ARM64 (arm64-v8a) architecture. If your phone is older, choose the ARMv7 version. If unsure, the Universal version is a safe bet.
Allow Installation from Unknown Sources
Since the APK isn't from Google Play, you'll need to authorize it. Android 10+ will prompt you automatically when opening the APK; on older systems, go to "Settings → Security → Unknown Sources" first.
Install and Configure VPN Permissions
Tap the downloaded APK and follow the prompts. On first launch, the system will ask to "allow a VPN connection." Click "OK" to authorize. Clash uses this to take over traffic via a VPN interface.
Import Subscription Link and Connect
Open the app, add your subscription link in the "Profiles" or "Subscription" page, and select the config after updating. Return Home and tap the start button; a VPN icon in the notification bar indicates success.
Clash for iOS Installation Guide
On iOS, you need to download clients from the App Store. We recommend Stash (best Clash config compatibility) or Shadowrocket.
Switch to Overseas Apple ID and Purchase Stash
Use a US (or HK) Apple ID in the App Store to search for "Stash," then buy and download it. Stash offers the best Clash configuration compatibility on iOS.
Add Remote Config (Subscription Link) in Stash
Open Stash, go to "Config," click "Download from URL," paste your Clash subscription link (.yaml format), and click "Download." It will automatically parse all nodes.
Allow Adding VPN Configuration
On first connection, iOS will prompt to "Add VPN Configurations." Click "Allow" and confirm with Face ID / Passcode. This is the standard way proxy tools work on iOS.
Select Proxy Mode and Connect
Select a proxy mode on the Home page (Rule is recommended), then tap the connect button. A VPN icon in the status bar indicates that the proxy is active. You can manually select nodes on the "Proxy" page.
Clash for Linux Installation Guide
Linux platforms offer two ways to use Clash: graphical clients (Clash Verge Rev, FlClash) and the command-line Mihomo core.
Install .deb package (Debian / Ubuntu)
After downloading clash-verge-rev-linux-amd64.deb, execute in terminal:sudo dpkg -i clash-verge-rev-linux-amd64.deb，Once installed, find and launch Clash Verge Rev from the application menu.
Install .rpm package (CentOS / Fedora)
After downloading clash-verge-rev-linux-x86_64.rpm, execute:sudo rpm -i clash-verge-rev-linux-x86_64.rpm Installation complete.
Server Deployment: Using Mihomo Core
In headless server environments, extract mihomo-linux-amd64.gz to get the binary, and grant execution permissions:chmod +x mihomo-linux-amd64，Then start it with a YAML config file. You can use the Clash Dashboard Web UI for remote management.
How to Import Subscription Links
A Subscription URL is provided by a proxy service provider to automatically fetch and update all proxy node configurations.
Get Subscription Link from Provider
Log in to your proxy service (airport) user panel, find "Subscription Link," "Clash Subscription," or "Node Info," and copy the URL (usually a long https:// link).
Add Subscription in Clash Client
Open your Clash client, go to "Profiles," find "Import from URL" or "Add Subscription," paste the URL, and click download. The client will automatically fetch the config and display it in the list.
Update Subscription Regularly for Latest Nodes
Proxy providers update nodes periodically. We recommend setting "Auto Update" in your client (e.g., every 24 hours) or clicking "Update" manually before use to ensure your node list is current.
Clash Proxy Modes Explained
Clash offers three proxy modes. Understanding their differences helps you choose the best one for your needs.
Rule Mode — Recommended for Daily Use
Based on the rules in the config file, it automatically determines how to handle each request: domestic sites connect directly, while overseas sites go through the proxy. This balances speed and privacy and is the best choice for most users.
Global Mode — All Traffic via Proxy
All network traffic is forwarded through the selected proxy node, including domestic websites. Suitable for complete anonymity or temporary access to specific services. This may slow down domestic site access and isn't recommended for long-term use.
Direct Mode — Disable Proxy
All traffic connects directly without going through any proxy nodes. Equivalent to temporarily disabling the proxy while keeping Clash running, allowing quick switching back to other modes.
Introduction to Clash Rules
Clash Rules are the core of the configuration file, deciding the path for each request. Here is a basic YAML configuration structure example.
# Basic proxy configuration mixed-port: 7890 allow-lan: false mode: rule log-level: info # DNS configuration dns: enable: true nameserver: - https://doh.pub/dns-query - https://dns.alidns.com/dns-query # Proxy nodes definition proxies: - name: "My Server" type: vmess server: example.com port: 443 # Traffic routing rules rules: - GEOIP,CN,DIRECT # Mainland China IPs: direct connect - DOMAIN-SUFFIX,google.com,My Server - DOMAIN-SUFFIX,github.com,My Server - MATCH,DIRECT # Default: direct connect
Common Rule Types
-
DOMAIN：Exact match for full domain -
DOMAIN-SUFFIX：Match domain suffix (including subdomains) -
DOMAIN-KEYWORD：Match domain by keyword -
IP-CIDR：Match IP address range -
GEOIP：Match by IP geolocation (e.g., CN) -
MATCH：Default rule, matching all remaining traffic
Rule Configuration Tips
- When using subscription links, rules are pre-configured by the provider and don't require manual editing.
- Rules are matched from top to bottom; more specific rules should be placed higher.
-
MATCHRules must be placed at the end as the default exit. - Use Rule Providers to import third-party rule sets.
Clash DNS Configuration
Clash features a built-in DNS server that uses encrypted DNS resolution to prevent DNS pollution and query leakage, safeguarding your privacy.
Recommended DoH (DNS over HTTPS)
- Tencent DoH:
https://doh.pub/dns-query - Alibaba DoH:
https://dns.alidns.com/dns-query - Cloudflare：
https://1.1.1.1/dns-query - Google：
https://8.8.8.8/dns-query
DNS Best Practices
- Enable fake-ip or redir-host resolution mode.
- Use domestic DoH for domestic domains and proxy DNS for overseas domains.
- Enable fallback DNS to ensure accurate resolution.
- DNS configuration is critical in TUN mode and requires careful setup.
High-Performance Go Core, Low Resource Usage
Clash is built with Go, leveraging the goroutine concurrency model to maintain extremely low CPU and memory usage even under high concurrency. It's the top choice for performance-conscious developers and power users.
Performance Advantages
- High-concurrency connection handling based on goroutines, easily managing thousands of concurrent requests.
- Typical RAM usage is only 20–50 MB, with minimal impact on system resources.
- Single-process architecture with no extra daemons; fast start and stop response.
- Latency can be kept in the single-digit millisecond range in Gigabit fiber environments.
- Supports TCP/UDP dual-stack proxying, suitable for gaming and real-time audio/video.
Performance Tuning Tips
- Choose "Rule" mode over "Global" for daily use to reduce unnecessary proxy traffic.
- Check your core version before enabling TUN mode; Mihomo (Clash Meta) core offers better performance.
- Test node latency on the "Proxies" page and prioritize low-latency nodes.
- Reasonable dns.fake-ip configuration can significantly reduce initial connection latency from DNS resolution.
- In high packet loss networks (like mobile data), prioritize QUIC-based protocols like Hysteria2.
Check Current Core Version
In graphical clients like Clash Verge Rev or FlClash, check the core version (Mihomo/Clash Premium) in the "Settings" page. Keep the core updated for best performance and compatibility.
Enable TUN Mode for Lowest Latency
TUN (Virtual Network Card) mode takes over all system traffic, bypassing system proxy limits. This can further reduce latency for gaming and UDP-intensive apps. Enable it in "Settings → TUN Mode" with admin/root privileges.
Use "Auto Select" Policy Groups
In subscription policy groups, setting the mode to url-test (auto-select fastest) or fallback (auto-switch to available nodes) allows Clash to choose the lowest latency node in real-time.
Web Dashboard and RESTful API
Clash includes an HTTP RESTful API controller. Combined with a Clash Dashboard UI, you can view real-time traffic, switch nodes, and integrate with third-party tools via the browser.
Configure External Controller
Add the following fields in your YAML config to enable the RESTful API. external-controller specifies the listening address and port, and secret is your access key (recommended to prevent unauthorized access):
# Enable RESTful API controller external-controller: 127.0.0.1:9090 secret: "your-secret-token" # Optional: serve a built-in dashboard external-ui: ui external-ui-url: "https://github.com/MetaCubeX/metacubexd/archive/gh-pages.zip"
Access Clash Dashboard via Browser
After starting Clash, open your browser and go to https://metacubexd.pages.dev. In the connection settings, enter: Backend Address http://127.0.0.1:9090 (local), and enter your secret. Click "Add" to connect to your local Clash instance.
Manage Nodes and Traffic in Real-Time
Once connected, the Dashboard features: "Proxies" to switch nodes and test speed; "Rules" to view active traffic rules; "Connections" to monitor source IPs, target domains, and real-time usage; and "Logs" for debugging rule matching.
Automated Integration with RESTful API
Clash exposes a full RESTful API, supporting proxy mode switching, config updates, and traffic stats via HTTP requests. It can be deeply integrated with scripts, HomeAssistant, and third-party GUIs. Clash Wiki。
Recommended Dashboards
- Metacubex Dashboard：Most feature-complete with a modern UI; highly recommended.
- Clash Dashboard（官方）：Lightweight and simple, ideal for headless command-line deployments.
- Yacd：Yet Another Clash Dashboard, clear and intuitive interface.
- Graphical clients (like Clash Verge Rev) have equivalent built-in management UIs and usually don't need extra setup.
Common API Examples
-
GET /proxies：Get list of all proxy nodes -
PUT /proxies/{group}：Switch selected node in a policy group -
GET /connections：Get list of currently active connections -
PATCH /configs：Hot-reload configuration (e.g., switch proxy mode) -
GET /traffic：Get real-time traffic stats (WebSocket push)
List of Supported Proxy Protocols
Supported protocols for the original Clash core and Mihomo (Clash Meta) core are listed below. Most modern providers use VMess or Trojan, while high-end ones support Hysteria2 and VLESS+Reality.
| Protocol Name | Native Clash Support | Mihomo Core Support | Description |
|---|---|---|---|
| Shadowsocks (SS) | Supported | Supported | Classic proxy protocol, fast and highly compatible |
| ShadowsocksR (SSR) | Supported | Supported | Obfuscated version of Shadowsocks |
| VMess | Supported | Supported | V2Ray core protocol, widely used |
| Trojan | Supported | Supported | Camouflages as HTTPS traffic, strong anti-detection |
| SOCKS5 / HTTP(S) | Supported | Supported | General proxy protocol, often used for local forwarding |
| VLESS | — | Lightweight V2Ray protocol, better performance | |
| VLESS + Reality | — | New protocol with extremely strong anti-censorship | |
| Hysteria2 | — | Based on QUIC/UDP, extremely fast in high packet loss environments | |
| TUIC v5 | — | Based on QUIC, low-latency and high-performance protocol |
Common Troubleshooting Guide
If you encounter issues while using Clash, refer to the following solutions for common problems.
Internet connection failed after enabling proxy
Cause: Subscription config failed to load, or the selected node is unreachable. Solution: ① Ensure the config is downloaded and selected; ② Test speed in the "Proxies" page and select a low-latency node; ③ Try "Global" mode; ④ If issue persists, disable System Proxy, restart the client, and try again.
Slow speeds or high latency
Solution: ① Run a speed test in "Proxies" and select the lowest latency node; ② Check if you're in "Global" mode; switching to "Rule" mode improves speeds for domestic sites; ③ Try different nodes; ④ Check node type—Hysteria2 performs better in high packet loss networks.
Subscription download failed or config cannot be parsed
Solution: ① Check if the subscription has expired; ② Check your internet connection; ③ If the link is Base64 encoded instead of Clash YAML, use a Sub-Converter to convert it; ④ Contact your provider for a new link.
Still have questions?
Check our blog for more tutorials and tips, or visit GitHub Issues for community support.