Start by choosing the right client, then work through installation on every platform, subscription imports, and Routing Rules. This page also explains how the Mihomo core, system proxy, TUN, DNS, and logs work together, helping you trace configuration issues from their symptoms.
Using Clash can be broken into four connected sets of observations: first confirm that the client is capturing traffic, then see how rules match, correct DNS behavior, and finally use connection records and logs to narrow down faults.
Installing a client does not mean every application is already using Clash. The system proxy usually affects browsers and desktop apps that honor the operating system's proxy settings, while TUN mode captures a broader range of connections through a virtual network interface. For the initial setup, choose one traffic entry point, handle any permission prompts, and then check the connection list to confirm that requests are reaching the core.
Menu labels vary between GUI clients, but the checks are the same: a profile must be active, either the system proxy or TUN must be enabled as needed, and new requests must appear on the connections page. This separates “the client is not capturing traffic” from “a rule selected the wrong policy,” so there is no need to start by repeatedly switching nodes.
In rule mode, order and target policy matter more than the number of rules. A domain may match an exact-domain rule, domain suffix, rule set, and fallback rule at the same time. The core checks them in configuration order and uses the first match. When troubleshooting routing, record the matched rule type, proxy group, and final node in the connection details instead of checking only whether a page opens.
Proxy groups turn rule outcomes into specific outbound routes. Manual selection works well when a fixed route is needed, while health-check groups continuously evaluate multiple candidates. A proxy group's name must match the rule target, and the group must contain at least one working candidate. Otherwise, a correctly written rule can still lead to an unusable route.
rules:
- DOMAIN,example.org,DIRECT
- DOMAIN-SUFFIX,example.net,PROXY
- GEOSITE,category-ads-all,REJECT
- MATCH,PROXYDNS determines how a domain is resolved and can affect whether domain-based rules receive complete information. Secure DNS built into the browser, the system cache, router DNS, and Clash DNS may all be active at once. Changing only one layer often produces different results between browsers and command-line tools, or leaves some apps working while others fail.
During diagnosis, first record the requested domain, then check the resolver, returned address, and rule match in the client logs. With fake-ip enabled, applications see mapped addresses while the core continues handling actual resolution and outbound selection, so an address shown by an app is not enough to identify a fault. Add targeted exclusions only when dealing with LAN devices or special-purpose domains.
dns:
enable: true
ipv6: false
enhanced-mode: fake-ip
nameserver:
- 1.1.1.1
- 8.8.8.8“No internet access” describes the result, not the cause. A reliable troubleshooting sequence is to confirm that the request reaches Clash, verify that the domain resolves, identify which policy the rule selected, and check whether that policy's outbound route can establish a connection. Change only one variable at a time so the setting that restores connectivity remains clear.
Verbose logging does not need to stay enabled. Temporarily raise the log level before reproducing the issue, and record the time, target domain, application name, and active mode. Return to the normal level after testing. Do not publish full subscription profiles, as they may contain service addresses, credentials, and custom policy names.
Different GUI clients can provide the same Mihomo routing features. Start by checking operating system support, processor architecture, and maintenance status, then compare interface preferences, TUN permissions, and profile management. The links below switch to the matching platform on the download page; they do not link directly to installer files.
A GUI client makes it easier to manage profiles, the system proxy, and TUN. Choose between x64 and ARM64 before downloading. When enabling TUN for the first time, watch for administrator permission requests and virtual network adapter installation prompts.
Go to DownloadsChoose the installer for either Intel or Apple Silicon. The system proxy works for typical desktop apps, while TUN requires additional system permissions. On first launch, you may also need to approve the app based on macOS security prompts.
Go to DownloadsClients usually capture traffic through the system VPN interface. After importing a profile, confirm VPN permission, background operation, and battery settings so the system does not stop the service or terminate the process after the screen locks.
Go to DownloadsInstall Clash Plus from the App Store and connect through a system VPN profile. On first launch, allow the app to add a VPN configuration, then import the subscription and verify the proxy group selection.
Go to DownloadsDesktop users can choose a GUI client, while servers and routers often run the Mihomo core directly. Before installation, check the distribution's package format, CPU architecture, and service management method.
Go to DownloadsA quick setup does not require editing complex rules first. Establish a repeatable baseline: the profile updates successfully, traffic reaches the core, and the target connection uses the expected policy. Once all three are confirmed, adjust DNS, TUN, and proxy groups one at a time.
Paste the subscription URL supplied by your provider into the client's profiles or subscriptions page, then download or update it. After a successful import, a new entry should appear in the profile list; set it as the active profile. If the list does not change, check that the URL is complete, the network can reach it, and the client log does not show a download error.
The profile name is visible, the client has loaded its proxy groups and rules, and the update action returns a clear result.
For the first test, use rule mode and select a working outbound option in the primary proxy group. On desktop, enable the system proxy or TUN based on which applications need coverage. On mobile, allow the system to establish the VPN connection. Then open a regular webpage and check the connections page for the domain, destination address, matched rule, and policy name.
New connections continue to appear in the log, and the policy column shows DIRECT, PROXY, or a specific proxy group.
Test one site expected to connect directly and another expected to use a proxy, then compare the matched rules and final outbound routes for both connections. If a page does not open, record the results in this order: entry point, DNS, rule, and outbound route. Do not switch modes, nodes, and DNS at the same time, or the actual fix will remain unclear. Once the baseline works, use the full guide to review platform-specific differences and error handling.
Both request types follow the expected routes, and system network settings return to normal after the client is closed.
Clash established a widely used YAML configuration format built around proxies, proxy groups, rules, DNS, and traffic entry points. After the original project stopped receiving updates, the ecosystem did not converge on a single client. Different maintainers continued developing cores, desktop interfaces, and mobile tools, while configuration compatibility evolved from project to project. When choosing a client, check both its core and its maintenance status.
Mihomo is one of the actively maintained Clash-compatible cores. It retains the familiar configuration structure while continuing to support networking features such as rules, proxy groups, TUN, and DNS. GUI clients handle installation, profile management, system permissions, and status displays; the core parses profiles, establishes connections, and applies rules. These are separate responsibilities, so a GUI update does not necessarily include a corresponding change to core functionality.
Open-source repositories provide source code, release history, issue discussions, and changelogs. When reading documentation, search the repository for a feature name or configuration key to confirm whether a parameter is still supported. For profile parsing errors, the field name and line number in the log are usually more specific than the interface message. For behavior changes, compare the client version, core version, and profile update time.
This site organizes updates by platform download options, installation steps, configuration concepts, and troubleshooting symptoms. The download page lists clients and system requirements; the guide presents a continuous setup workflow; the platform installation reference covers permissions and platform-specific issues; and the blog explores focused topics such as latency tests, proxy groups, mobile background operation, and router deployment.
Each article focuses on a specific problem and expands on technical concepts, platform differences, or troubleshooting steps that would interrupt the main guide. Complete the basic setup first, then use connection records to reproduce the test.
A practical walkthrough of first launch, subscription imports, proxy mode selection, and system permissions, including setup details often missed on Windows, macOS, Android, and iOS.
Read Full Article →Learn the differences between probe requests, connection setup, route congestion, and application data transfer, plus what else to evaluate when choosing a node.
Read Full Article →Trace unusual battery drain on Android and iOS by checking persistent VPN activity, rule matching, background wakeups, and power-saving policies, while distinguishing normal operation from abnormal activity.
Read Full Article →