What Is Clash and Which Client Should You Use?

Clash started as an open-source, rule-driven proxy core: instead of sending every packet through one remote server, it evaluates each connection against a policy list and decides whether to route it direct, through a proxy node, or reject it. That design is ideal for users who want foreign sites and services tunneled while keeping domestic traffic and local devices fast.

Today, most newcomers interact with Clash through a GUI client built on the Mihomo kernel (the community fork formerly known as Clash Meta). Mihomo adds modern protocols — VLESS, Hysteria2, TUIC, and more — on top of the classic Shadowsocks and Trojan support. You do not need to edit YAML by hand to get started; the client imports your provider subscription and exposes nodes, policy groups, and modes in a visual interface.

This article is the umbrella guide: download and install on each platform, import a subscription, configure everyday proxy behavior, then step into advanced routing, DNS, and TUN. For deep dives on a single client, see our Clash Verge Rev tutorial and Clash for Android subscription guide.

Download and Install on Every Platform

Always download from trusted sources — the official Clash download page or your provider's verified links. Third-party repacks sometimes bundle outdated kernels or unwanted software.

Windows (Clash Verge Rev)

1. Download the .exe or .msi installer for 64-bit Windows.
2. Run the installer and approve User Account Control when prompted.
3. Launch the app and allow it through Windows Firewall — blocking network access breaks the proxy.
4. If SmartScreen warns about an unknown publisher, click More info → Run anyway when you trust the source.

macOS (Clash Verge Rev)

1. Download the .dmg — ARM64 for M-series Macs, x86_64 for Intel.
2. Drag the app into Applications and open it.
3. If macOS blocks the app, go to System Settings → Privacy & Security and choose Open Anyway.
4. Grant network permissions when asked so local proxy ports can bind.

Android (Clash for Android)

1. Install CFA from the official download page or a trusted mirror your provider lists.
2. On first launch, accept VPN configuration permission — CFA uses Android's VPN API to capture traffic.
3. Optional: enable notification access if you want quick toggles from the shade.

Import Your First Subscription

A subscription URL is a link your proxy provider gives you. It points to a remote YAML (or Base64-wrapped) config listing servers, credentials, policy groups, and built-in rules. Clash clients poll that URL on a schedule to refresh nodes.

Desktop (Clash Verge Rev)

1. Open the Profiles tab and click New → URL.
2. Paste the full subscription link with no leading or trailing spaces.
3. Name the profile (for example, MyProvider) and click Import.
4. Activate the profile when import succeeds, then enable Auto Update (24-hour interval is a sensible default).

Android (CFA)

1. Tap Profiles → + → URL.
2. Paste the subscription URL and save.
3. Select the profile, tap the refresh icon, and confirm nodes appear under Proxies.

Providers sometimes ship a local .yaml file instead of a URL. Use New → Local on desktop or import from storage on Android. The rest of the workflow — picking nodes and enabling proxy — stays the same.

Basic Setup: Modes, Nodes, and System Proxy

After the profile loads, open the Proxies tab. Subscriptions define policy groups — containers like PROXY, AUTO, HK, or US that hold one or more nodes and a selection strategy.

• Select / Manual — you pick a fixed node until you change it.
• URL-test / Auto — the client pings nodes and uses the lowest latency.
• Load-balance — spreads sessions across nodes; fine for downloads, poor for latency-sensitive apps.
• Fallback — tries nodes in order until one responds.

For daily use, set the client to Rule mode and turn on System Proxy (desktop) or start the VPN toggle (Android). Rule mode applies your subscription's split list: domestic domains and private IP ranges often go DIRECT, while foreign or blocked targets use the proxy group you selected.

Run a latency test on your policy group, then choose a region close to the service you need — Hong Kong or Singapore for much of Asia-Pacific, US West for American services. Latency in the UI is an estimate; confirm with the actual site or app you care about.

Advanced Configuration: Rules, DNS, and TUN

Once basics work, power users tune three areas: custom rules, DNS, and TUN transparent proxy. You can start with provider defaults and add overrides only when you hit a specific problem.

Custom rules and overrides

Subscriptions ship a rule chain evaluated top to bottom. Common match types include DOMAIN-SUFFIX, DOMAIN-KEYWORD, GEOIP, and the catch-all MATCH. Clash Verge Rev exposes Merge and Override snippets so you can append rules without editing the provider file manually.

# Keep LAN and local names direct (append via Merge)
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
DOMAIN-SUFFIX,local,DIRECT

# Send a specific app domain through your proxy group
DOMAIN-SUFFIX,example.com,PROXY

For a full syntax reference and priority examples, read our Clash rules masterclass when it is published, or inspect the rules: section inside your active profile YAML.

DNS settings

Misconfigured DNS causes "proxy works in browser but fails elsewhere" symptoms. Mihomo can run a local DNS module (dns.enhanced-mode: fake-ip is common) that resolves domains before routing decisions. If domestic sites resolve slowly, ensure Chinese domains use a domestic resolver in your profile while foreign domains use an upstream that returns accurate geo results.

TUN mode (full traffic capture)

System proxy only affects apps that honor OS settings. Games, many CLI tools, and some Electron apps open raw sockets and ignore the proxy. TUN mode creates a virtual adapter so Mihomo sees packets before they leave the machine.

1. In Clash Verge Rev, open Settings and enable TUN Mode.
2. Approve the administrator prompt (Windows UAC or macOS password).
3. Confirm the dashboard shows the TUN adapter running.
4. Add direct rules for private IP ranges before heavy LAN use — otherwise printers, NAS shares, or local multiplayer may break.

On Android, CFA's VPN mode already captures traffic; you rarely need a separate TUN toggle like on desktop. For router-wide TUN, see our OpenWrt transparent proxy guide and game acceleration with TUN.

Protocol and client choice (quick reference)

Your subscription nodes may use Shadowsocks, Trojan, VLESS, or newer transports. Mihomo handles them in one profile; you do not pick protocols manually in the GUI — the YAML defines types. If you wonder which protocol fits your threat model, our Shadowsocks vs Trojan vs VLESS comparison walks through trade-offs. Choosing between desktop GUIs is covered in Clash Verge vs Clash for Windows.

Troubleshooting and FAQ

Most first-week issues fall into a short checklist. Work through them before reinstalling or switching providers.

Subscription import fails

Verify the URL is complete, the account is active, and the link returns config in a browser. Try importing from a mobile hotspot if your ISP blocks the provider domain. Remove stray spaces or line breaks from copy-paste.

All nodes timeout

Manually refresh the profile. If every node still fails, request a new subscription link. Confirm you activated the correct profile — an empty local profile looks like "broken nodes" even when the provider is fine.

Sites load without proxy

Check that System Proxy is on and mode is Rule, not Direct. Test with Global temporarily; if Global works, your target site matches a DIRECT rule — adjust overrides instead of staying on Global permanently.

Apps still bypass proxy on desktop

Enable TUN mode and keep LAN direct rules in place. On macOS, grant network permissions; on Windows, confirm the client is allowed through the firewall.

Android VPN disconnects in background

Disable aggressive battery optimization for CFA, allow background data, and turn off vendor "auto kill" features on Xiaomi, Huawei, or Samsung devices. Re-import the profile if the OS cleared app storage.

Compared with one-click commercial VPNs that tunnel everything through a single server — often slowing domestic banking, streaming, and work apps — Clash keeps routing transparent and rule-based. Browser extensions cannot proxy games or terminal traffic. Plain command-line Mihomo offers the same kernel power without subscription management or visual node picking. Clash clients sit in the practical middle: modern protocols, split routing out of the box, and a path from five-minute setup to custom rules, DNS, and TUN when you need them.

Download Clash free for every platform →