What Is Clash?

Clash is an open-source rule-based proxy client supporting Shadowsocks, VMess, Trojan, Hysteria2, TUIC, VLESS, and other major protocols. Unlike traditional VPNs, Clash's biggest advantage is smart split routing — it automatically decides whether each request goes direct or via proxy, keeping your everyday local sites at full speed while smoothly accessing the streaming services, games, or sites you actually need a proxy for.

The dominant Clash core today is Mihomo (formerly Clash.Meta). Clash Plus is a free cross-platform client built on Mihomo — our top recommendation.

Clash does not provide nodes — you need to purchase a subscription from a proxy provider. Clash is just the client that routes traffic according to rules.

Before You Start

Before installing Clash, prepare these two things:

1. Choose a provider

A provider gives you access to server nodes around the world through a "subscription link." When choosing one, consider:

Protocol support: Prefer providers supporting Hysteria2 or VLESS Reality — newer protocols are faster and more stable.
Node regions: Match your use case — streaming needs region-specific nodes (e.g. US nodes for Netflix US), gaming prefers low-latency Japan/Hong Kong nodes.
Reliability: Prefer established providers with public user communities to avoid exit scams.

2. Get your subscription link

After registering and purchasing a plan, find the "Clash subscription link" or "one-click subscribe" in the provider dashboard. Copy the URL — it's an https:// link containing all your nodes and routing rules.

Your subscription link is your account credential — don't share it or paste it into untrusted tools.

Install Clash Client

Follow the section for your OS. All platforms: Clash Plus recommended. Linux users: Clash Verge Rev.

All clients available on the download page.

Windows

Get Clash Plus x64-setup.exe from the download page (Windows 10 / 11). Double-click the installer and follow prompts.

Windows may show SmartScreen during install because the package lacks paid Microsoft code signing — this doesn't mean it's unsafe. Click "More info" → "Run anyway" to continue.

After install, Clash Plus lives in the system tray (notification area). Right-click the tray icon to quickly switch nodes and proxy modes.

macOS

Pick the version for your Mac chip: M-series → arm64.dmg, Intel → x64.dmg (check in About This Mac if unsure).

After download, double-click the .dmg and drag Clash Plus to Applications. On first launch, macOS Gatekeeper may say "cannot verify developer" — go to "System Settings → Privacy & Security" and click "Open Anyway" at the bottom.

If you see "damaged and can't be opened", run this in Terminal to remove the quarantine flag, then reopen:

Terminal

xattr -cr /Applications/ClashPlus.app

Android

Download Clash Plus APK from the download page. Most phones since 2018: arm64-v8a. Older 32-bit phones: armeabi-v7a.

After download, tap the .apk to install. You'll see an "unknown source" prompt — allow it. The exact wording varies slightly by manufacturer:

Samsung: Tap "Install"
Google Pixel: Tap "Install anyway"
Other Android devices: Look for an "Install anyway" or "Continue install" option

After install, go to Settings → Battery → App battery management, find Clash Plus, set to "Unrestricted" or "Don't optimize" to prevent the system from killing the background process and dropping the proxy.

iOS / iPadOS

If Clash Plus isn't showing up in your region's App Store, you can download it using a US Apple ID instead. How to switch:

Open App Store, tap your profile icon (top right)
Scroll to the bottom and tap "Sign Out"
Sign in with a US Apple ID
Search "Clash Plus" and tap "Get" (completely free)

After download, you can switch back to your original Apple ID — the installed app won't be affected.

Get free on App StoreClash Plus

Linux

Linux users: Clash Verge Rev recommended — AppImage, .deb, and .rpm formats. AppImage needs no install and has the widest compatibility:

Terminal

chmod +x ClashVerge_*.AppImage
./ClashVerge_*.AppImage

Ubuntu / Debian: install the .deb directly. Arch Linux: install clash-verge-rev-bin from AUR.

For headless servers or soft routers, use the Mihomo CLI core with the metacubexd web dashboard. This guide focuses on desktop users — see Mihomo docs for server setups.

Import Subscription

After install, open Clash Plus and follow these steps (similar across platforms):

Go to the Profiles page
Windows / macOS: Profiles in the left sidebar. Android / iOS: Profiles tab at the bottom.
Add subscription link
Tap "+" or "Import" (top right), choose "Import from URL", paste your subscription link, and confirm.
Wait for nodes to load
Clash Plus fetches the subscription and downloads the config. When done, all available nodes appear on the Proxy page.

Subscription import failed? Your subscription server may be unreachable if you don't have a working connection yet. Manually add a node first to get initial connectivity, then import — or ask your provider if they offer an alternate mirror link.

Enable automatic subscription updates

Node info updates periodically — enable auto-update to avoid manual refreshes. On Profiles, long-press or tap settings next to the subscription, enable "Auto Update", set to 12 or 24 hours.

Enable Proxy & Verify Connection

Select a node

On the Proxy page, you'll see policy groups and node lists. Most subscriptions include an Auto Select group that speed-tests and picks the lowest-latency node.

To pick manually, expand a policy group and choose a low-latency node (under 100ms recommended). Tap the lightning icon next to a node for individual speed test.

Enable system proxy

After selecting a node, enable proxy — steps vary slightly by platform:

Windows: Enable "System Proxy" in the main window or tray menu.
macOS: Click the menu bar icon, or enable System Proxy in the client.
Android / iOS: Tap "Connect" on the main screen. First time, iOS/Android will request VPN permission — tap Allow.

Verify proxy is working

With proxy enabled, open google.com in your browser — if it loads, setup succeeded. Or visit ip.sb — if the IP shows your node's location, traffic is going through the proxy.

Done! Basic setup is complete. To proxy game clients, terminal commands, and other apps that ignore system proxy, continue to the TUN mode section below.

Proxy Modes Explained

Clash offers three proxy modes — switch in the client header or settings. Understanding them prevents most common issues:

Rule Rule Mode

Auto-routes based on subscription rules: local domains/IPs connect directly, everything else goes via proxy, and ad domains get blocked. Use this mode for daily use.

Global Global Mode

All traffic goes through the proxy node, including local sites. For temporary node testing only — not recommended daily, as everyday local sites will slow down.

Direct Direct Mode

All traffic connects directly, no proxy. Equivalent to temporarily disabling Clash proxy — for testing local network or pausing proxy.

If local sites are slow, 99% of the time proxy mode was switched to Global. Switch back to Rule mode to restore normal speed.

TUN Mode (Transparent Proxy)

System Proxy only works for apps that honor HTTP/SOCKS5 — most browsers do, but game clients, download tools, and UWP apps often bypass it.

TUN mode creates a virtual network adapter at the OS kernel level, capturing all TCP/UDP traffic — every app request goes through Clash's rule engine regardless of proxy settings.

How to Enable TUN Mode

Windows: Run Clash Plus as administrator, enable in Settings → TUN Mode. First enable installs a virtual network driver.
macOS: Enable in Settings → TUN Mode. macOS will prompt to install a network extension — allow and enter your password.
Android / iOS: Tapping Connect already uses VPN (TUN) mode by default — no extra steps.
Linux: Enable TUN in Clash Verge Rev settings — may require CAP_NET_ADMIN permission.

TUN captures all system traffic and uses slightly more CPU/RAM than system proxy. Use system proxy daily — enable TUN only when you need to proxy specific apps.

DNS Configuration & Leak Protection

Even with proxied traffic, improper DNS handling lets your ISP see which domains you query — that's a "DNS leak." Proper DNS config prevents leaks and speeds up resolution.

Recommended: Fake-IP Mode

Clash offers two DNS modes: redir-host and fake-ip. We recommend fake-ip — it returns a virtual local IP for each domain and resolves the real IP only when connecting, avoiding DNS pollution and reducing latency.

Most subscription configs already include sensible DNS settings — no manual changes needed. For custom configs, use this template:

config.yaml – DNS section

dns:
  enable: true
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16

  # Local domains resolved via regional DNS (fast)
  nameserver:
    - 1.1.1.1            # Cloudflare DNS
    - 8.8.8.8            # Google DNS

  # Non-local domains resolved via encrypted DNS (avoids tampering)
  fallback:
    - tls://8.8.8.8      # Google DNS over TLS
    - tls://1.1.1.1      # Cloudflare DNS over TLS

  # Local domains skip fallback
  fallback-filter:
    geoip: true
    geoip-code: US

Verify DNS Isn't Leaking

With proxy enabled, visit dnsleaktest.com. If DNS servers show your node's location (US, Japan, etc.) instead of your local ISP, config is correct.

Custom Split Routing Rules

Subscription configs usually include comprehensive rules covering 90%+ of scenarios. Sometimes you need custom rules — force OpenAI through a US node, or direct-connect an internal IP.

Rule Syntax

In the config's rules section, each rule is type,value,policy. Rules match top to bottom — first match wins. Put custom rules at the top for highest priority.

config.yaml – Custom rules example

rules:
  # ── Custom rules (kept at the top for highest priority) ──
  - DOMAIN-SUFFIX,openai.com,US-Streaming      # force through a US node
  - DOMAIN-SUFFIX,netflix.com,US-Streaming
  - DOMAIN-SUFFIX,company-internal.com,DIRECT  # internal network, direct connection
  - DOMAIN-KEYWORD,dev.,DIRECT                 # dev environment, direct connection
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve   # LAN, direct connection

  # ── Everything below comes from the provider's own rule set (left as-is) ──
  - GEOIP,US,DIRECT
  - MATCH,PROXY

Common Rule Types Quick Reference

Type	Example	Description
`DOMAIN`	`DOMAIN,example.com,PROXY`	Exact domain match
`DOMAIN-SUFFIX`	`DOMAIN-SUFFIX,google.com,PROXY`	Match domain and all subdomains
`DOMAIN-KEYWORD`	`DOMAIN-KEYWORD,googleapis,PROXY`	Domain contains keyword
`IP-CIDR`	`IP-CIDR,8.8.8.0/24,PROXY`	Match IP range
`GEOIP`	`GEOIP,US,DIRECT`	Match IP by country/region code
`MATCH`	`MATCH,PROXY`	Catch-all rule for remaining traffic

FAQ

Connected but browser still can't open Google

Local sites got slow

Games / download tools not using proxy

Subscription import keeps failing

iOS proxy disconnects when screen locks

Does Clash Plus monitor my traffic or collect data?

More questions? See our full FAQ page with 30+ detailed answers.