Cross-platform guides · Get started in 5 minutes · Beginner to advanced

Clash Tutorial
Cross-Platform Setup Guide

Covers Windows, macOS, Android, iOS, and Linux — from installing the client to importing subscriptions and enabling TUN global proxy, all in one place.

Windows

Windows Setup Guide

Supports Windows 10 / 11 on x64 and ARM64. Clash Verge Rev is recommended.

Recommended client: Clash Verge Rev (top pick)
Built with Tauri + Rust and the Mihomo core — low resource usage, full feature set, and active community maintenance
TUN global proxy One-click subscription import Visual rule editor Real-time latency tests
Download
1

Download and Install Clash Verge Rev

Go to the download page and pick the installer for your CPU: most PCs use x64 (.exe); ARM devices like Surface Pro X use ARM64 (.exe). Double-click the installer, follow the prompts, and finish — no extra setup needed.

System requirements: Windows 10 / 11 (WebView2 is built into Windows 11). If installation fails on Windows 10, install the WebView2 runtime from Microsoft first.
2

First Launch and Interface Overview

After installation, launch Clash Verge Rev from the Start menu or desktop shortcut. The main interface has several core sections:

Proxies — node selection and policy group switching; Profiles — subscription and config management; Logs — live traffic and rule-hit records; Settings — global options (System Proxy, TUN mode, launch at startup, etc.).

On first launch, the app may request administrator rights to install the TUN driver — this is normal. Click Yes to allow.
3

Import a Subscription Link or Config File

In the left sidebar, click Profiles, then the + button in the top-right corner:

Option 1 (subscription link): Choose Import URL, paste the Clash subscription URL from your provider into the field, click Download, and the app will parse and load the node list automatically.

Option 2 (local config file): Choose Import File, locate your local .yaml or .yml config, and confirm the import.

Right-click the profile card and set Auto-update interval to 24 hours to keep node info current.
4

Select a Node and Enable System Proxy

Switch to the Proxies page to see policy groups and nodes from your provider. Click the lightning icon (⚡) in the top-right to latency-test all nodes and pick the lowest-latency working one.

Go back to Settings and turn on System Proxy. Once enabled, your browser will route international traffic through the selected proxy node.

Games / CLI tools through proxy: Enable TUN Mode in Settings and run as administrator for global transparent proxying — game clients, git, npm, and more will all use the proxy.
FlClash Beginner-friendly

A Flutter cross-platform client with a clean, intuitive UI. One-click subscription import and a low learning curve — ideal for first-time Clash users.

Clash Nyanpasu

Also built with Tauri, with Clash and Mihomo core switching plus rich custom script extensions — suited for advanced users.

Clash for Windows Archived · Not recommended

Once the most popular Windows Clash client. The author removed the repo in 2023 and stopped maintenance — no security updates. Migrate to Clash Verge Rev.

macOS

macOS Setup Guide

Supports Apple Silicon (M1/M2/M3) and Intel Macs. Requires macOS 10.15 Catalina or later.

Recommended client: Clash Verge Rev (top pick)
Native Apple Silicon (arm64) and Intel (x64) builds, under 50 MB RAM, with stable TUN mode
Native Apple Silicon TUN Mode Mihomo Core
Download
1

Choose the Right Build and Download

Go to the download page and choose based on your Mac:

M1 / M2 / M3 Mac (late 2020 onward) → download Apple Silicon (.dmg)
Intel Mac (before 2020) → download Intel x64 (.dmg)

Not sure which chip you have? Click the Apple menu → About This Mac and check Processor/Chip: "Apple M" means Silicon; "Intel Core" means Intel.
2

Install and Bypass Gatekeeper

Double-click the downloaded .dmg and drag Clash Verge Rev into the Applications folder.

Because the app is not notarized by Apple, first launch may be blocked. Fix: open System Settings → Privacy & Security, find the "Clash Verge Rev was blocked" notice at the bottom, and click Open Anyway.

If Open Anyway is missing, run sudo xattr -rd com.apple.quarantine /Applications/Clash\ Verge\ Rev.app in Terminal to remove the quarantine flag.
3

Import a Subscription Link

Launch Clash Verge Rev, click Profiles in the sidebar, then + → Import URL. Paste the Clash subscription URL from your provider and click Download.

After import, click the profile card to activate it — the node list will update on the Proxies page.

4

Enable System Proxy or TUN Mode

On the Proxies page, select a node, then go to Settings and turn on System Proxy. macOS network settings update automatically — Safari, Chrome, and other browsers take effect immediately.

TUN Mode: To route all network traffic (including terminal commands and non-browser apps) through the proxy, enable TUN Mode in Settings. First launch requires permission to install the virtual network adapter driver.
ClashX Meta Beginner-friendly

A native macOS menu bar client with minimal controls — click the icon to toggle the proxy. Supports Intel and Apple Silicon; great for users who do not need advanced config.

FlClash

A Flutter cross-platform client with a clean UI and native Apple Silicon and Intel builds. Easy to learn for users who prefer Flutter-style interfaces.

Android

Android Setup Guide

Supports Android 5.0+. ClashMeta for Android is recommended; phones from 2016 onward should use the ARM64 build.

Recommended client: ClashMeta for Android (top pick)
Mihomo core with full rule-based routing and all advanced Clash features. Download ARM64 for phones from 2016 onward.
Mihomo Core Full rule engine TUN Mode
Download
1

Choose Architecture and Download APK

Go to the download page: phones made after 2016 use ARM64 — download ARM64-v8a (.apk). If unsure, get the Universal build, which works on all devices.

Enable unknown sources before installing: go to Settings → Security → Install unknown apps and allow your browser or file manager to install APKs. Paths vary slightly by manufacturer.
2

Install and Grant VPN Permission

After download, tap the APK and confirm installation. On first launch, ClashMeta requests VPN permission — tap OK / Allow. This is required for the proxy to work.

3

Import a Subscription Link

In ClashMeta, tap the + icon in the bottom-right and choose URL:

Paste the Clash subscription URL from your provider into the Subscription URL field, add a name, tap Save, and the app will download and parse nodes automatically.

You can also long-press a subscription link → Share → Import to ClashMeta, or copy the link and paste the URL in the app. After import, set auto-update to 24 hours.
4

Select a Node and Start the Proxy

On the Proxies page, expand a policy group and pick a low-latency node. Tap the lightning icon (⚡) to test speed.

Return to the main screen and tap Start (or the top toggle). A VPN icon in the status bar means the proxy is active.

TUN Mode (supported on some Android versions only): enable TUN in Settings to capture all app traffic — useful when apps that ignore the system proxy still need to route through your nodes.
FlClash Beginner-friendly

Flutter UI with a near-native Android feel and very low barrier to entry — a good starting point for first-time Clash users. ARM64 and ARMv7 builds available.

iOS

iOS Setup Guide

Paid App Store apps required. US Apple ID needed. Stash or Shadowrocket recommended.

📌 Important for iOS: Due to Apple policy, proxy apps on iOS must be distributed through the App Store. Mainstream options are paid and require a US Apple ID (these apps are not available in many regional stores). You can register a US Apple ID without a credit card — see Step 1 below. Shadowrocket costs only $2.99 and offers excellent value.
1

Register a US Apple ID (No Credit Card Required)

Open appleid.apple.com in a browser, click Create Your Apple ID, and select United States for country/region. Enter your name and date of birth (must be 18+).

Use an address in a state with no sales tax (Oregon is common): ZIP 97201, street can be any value, payment method None. Verify your email to complete registration.

Use a dedicated email for this US account to avoid mixing it with your main Apple ID. No credit card is needed to buy apps — use gift cards or redemption codes at checkout.
2

Switch to Your US Account in the App Store and Purchase

On iPhone, open the App Store, tap your profile icon, scroll down to sign out, then sign in with your new US Apple ID.

Search for and purchase your chosen client:

Stash ($3.99) — most capable, best Clash YAML support, popular with power users
Shadowrocket ($2.99) — most popular, clean UI, quick to learn
Quantumult X ($7.99) — strong scripting and debugging for advanced users

3

Import a Subscription Link (Shadowrocket Example)

Open Shadowrocket, tap + in the top-right, choose Subscribe, paste the Clash subscription URL from your provider, tap Done, and the app will parse the node list.

With Stash: open the app → Profiles → Add Profile → URL, paste the subscription link and download. Stash fully supports Clash YAML with the best rule compatibility.

After copying a subscription link in Safari, tap the Shadowrocket or Stash prompt to import in one tap — no manual paste needed.
4

Select a Node and Enable VPN

Pick a low-latency node in the proxy list, return to the main screen, and toggle the switch. When prompted to add a VPN configuration, tap Allow and confirm with Face ID / Touch ID.

A VPN indicator in the status bar means the proxy is active and international services are reachable.

Linux

Linux Setup Guide

Supports Debian / Ubuntu (DEB) and Fedora / RHEL (RPM). Clash Verge Rev GUI client recommended.

Recommended client: Clash Verge Rev (top pick)
Tauri GUI with DEB and RPM packages for amd64, arm64, and x86_64 — no command line required
Graphical UI DEB / RPM TUN Mode
Download
1

Download the Package and Install

Go to the download page and pick the package for your distro:

Debian / Ubuntu / Linux Mint.deb (amd64 or arm64)
Fedora / RHEL / openSUSE.rpm (x86_64)

bash — Debian/Ubuntu install commands
# Install DEB package (Debian/Ubuntu) $ sudo dpkg -i clash-verge-rev-linux-amd64.deb # Fix missing dependencies if prompted $ sudo apt-get install -f ✓ Installation complete # For RPM-based distros (Fedora/RHEL) $ sudo rpm -ivh clash-verge-rev-linux-x86_64.rpm
2

Launch the App and Import a Subscription

After install, launch from the app menu or run clash-verge-rev in Terminal. Same flow as Windows / macOS: Profiles → + → Import URL, paste the subscription link, and download.

If you hit WebKit / GTK dependency issues on Ubuntu, run sudo apt install libwebkit2gtk-4.1-0 and try again.
3

Enable System Proxy

In Settings, turn on System Proxy. The client configures GNOME / KDE proxy settings (HTTP / SOCKS5). On other desktops, set proxy manually to 127.0.0.1:7890 (HTTP) / 127.0.0.1:7891 (SOCKS5).

Terminal through proxy: add export https_proxy=http://127.0.0.1:7890 to ~/.bashrc or ~/.zshrc so git, curl, pip, and other CLI tools use the proxy. Or enable TUN mode to capture all traffic automatically.
FlClash Beginner-friendly

Clean Flutter UI, small package size, fewer GTK dependencies, and good compatibility across Linux distros. amd64 .deb available.

Advanced Configuration (ADVANCED)

Master the Core Features

Learn these capabilities to get 100% out of Clash

TUN Mode: Global Transparent Proxy

Intercept all TCP/UDP traffic at the driver level via a virtual NIC — fixes games, git, npm, and other apps that ignore system proxy. Enable TUN Mode in Settings; first launch needs admin rights to install the driver.

Learn more

YAML Rule-Based Routing

Clash routes traffic via the rules field in YAML configs. Supports DOMAIN-SUFFIX, IP-CIDR, GEOIP, and more, plus community rule sets (rule-providers) — ready to use without manual upkeep.

View examples

DNS Anti-Poisoning Setup

Enable DoH / DoT encrypted DNS in YAML to prevent poisoning and hijacking. Route domestic domains to local DNS (e.g. 114.114.114.114) and international domains to encrypted DNS (e.g. 8.8.8.8) for faster, cleaner resolution.

Learn about DNS setup

Subscription Management and Auto-Update

One subscription URL holds all node info. Declare sources in YAML via proxy-providers with update intervals. Client auto-update (24 hours recommended) keeps nodes current without manual refresh.

Subscription import tips

Latency Tests and Node Optimization

Built-in latency tests support URL-Test (auto-pick lowest latency) and Fallback (failover). Set policy group type to url-test in config and the client will periodically test and switch to the best node.

View config examples

Security and Open-Source Transparency

The Clash core (Mihomo) is fully open source (Apache-2.0) on GitHub for anyone to audit. Clients include no data collection or ads; traffic flows only between your machine and configured nodes. Always download from this site or official GitHub — avoid unknown repacks.

View source on GitHub
Config Example (CONFIG EXAMPLE)

A Minimal Working YAML Config

If your provider does not offer a Clash-format subscription, use the structure below to write a config manually and import it into your client.

config.yaml — Minimum viable Clash config
# ---- Global Settings ---- mixed-port: 7890 # HTTP/SOCKS5 mixed port allow-lan: false mode: rule # rule / global / direct log-level: info # ---- DNS (Anti-poisoning) ---- dns: enable: true enhanced-mode: fake-ip nameserver: - 114.114.114.114 # Domestic DNS - https://1.1.1.1/dns-query # DoH # ---- Proxies ---- proxies: - name: "🇭🇰 Hong Kong 01" type: vmess server: hk1.example.com port: 443 uuid: your-uuid-here network: ws tls: true # ---- Subscription (auto-update nodes) ---- proxy-providers: my-subscription: type: http url: https://your-sub-url.com/clash interval: 86400 # Auto-update every 24 hours # ---- Rules (traffic routing) ---- rules: - DOMAIN-SUFFIX,google.com,PROXY - DOMAIN-SUFFIX,youtube.com,PROXY - DOMAIN-KEYWORD,bilibili,DIRECT - GEOIP,CN,DIRECT # China IPs go direct - MATCH,PROXY # Everything else via proxy
Frequently Asked Questions (FAQ)

Common Clash Setup and Usage Questions

Covers subscription import, node connectivity, TUN mode, rule routing, DNS setup, and more

01 No nodes after import, or all nodes show timeout — what should I do?

First confirm the subscription format: use your provider's Clash subscription (also called Mihomo / Meta), not V2Ray or SS. Wrong format prevents node parsing.

If all nodes time out: ① check your network (can you reach local sites?); ② nodes may be down — contact your provider; ③ rule conflicts may proxy latency tests — switch to Direct mode and test again.

02 Proxy is on but the browser cannot open Google — how do I troubleshoot?

Troubleshoot in order:
① Confirm System Proxy or TUN Mode is on — System Proxy affects browsers; TUN affects all apps;
② Latency-test on Proxies and pick a node under 200ms;
③ Check Logs for google.com rule hits (DIRECT / PROXY) to verify routing;
④ Disable conflicting browser proxy extensions (e.g. SwitchyOmega);
⑤ On Windows, if system proxy does not apply, run the client as administrator.

03 How do I enable TUN mode? Games / git / pip won't use the proxy.

System Proxy only affects apps that honor proxy settings (mostly browsers). Games and CLI tools usually do not.

Fix: enable TUN Mode. In Clash Verge Rev / FlClash Settings, turn on TUN Mode. First run needs admin rights to install the virtual NIC driver (one-time). All TCP/UDP traffic then goes through the rule engine.

On Linux you can also set export https_proxy=http://127.0.0.1:7890 for terminal tools.

04 How do I set up subscription auto-update? How often should I update?

In Clash Verge Rev, right-click the profile card → Auto-update and set the interval (24 hours recommended). The client also checks on each launch.

With YAML proxy-providers, set interval: 86400 (seconds) for auto-update without relying on the client.

Guideline: 24 hours for daily use; 6 hours if nodes fail often; manual Update when your provider announces changes.

05 What is Clash rule-based routing? How do I add custom rules?

Rule-based routing is Clash's core feature: by domain, IP, geo, etc., each request goes through the proxy or direct.

Common rule types:
DOMAIN-SUFFIX,google.com,PROXY — domains ending in google.com use proxy
DOMAIN-KEYWORD,bilibili,DIRECT — domains containing bilibili go direct
GEOIP,CN,DIRECT — China IPs go direct
MATCH,PROXY — catch-all (last rule), everything else via proxy

Use community rule sets (e.g. blackmatrix7/ios_rule_script) via rule-providers for broad, maintained coverage.

06 What is DNS poisoning? How does Clash prevent DNS leaks?

DNS poisoning means ISPs return tampered results, breaking normal domains. Clash's built-in DNS module fixes this:

Enable fake-ip or redir-host and encrypted DNS (DoH / DoT, e.g. https://8.8.8.8/dns-query). All DNS goes through Clash, bypassing ISP poisoning.

Also set nameserver-policy so domestic domains (+.cn) use local DNS (114.114.114.114) and international domains use DoH — anti-poisoning plus fast local resolution.

07 How do I auto-select the best node? What's the difference between url-test and fallback?

Configure policy group types in proxy-groups:

url-test: periodically tests all nodes and uses the lowest-latency one. Good for speed-focused users. Set interval: 300 (seconds) for test frequency.

fallback: uses nodes in order; switches only when the current one fails. Good for stability and a fixed preferred node.

load-balance: spreads traffic across nodes for higher total bandwidth.

Provider subscriptions usually include preset policy groups — no manual setup needed.

08 Is Clash safe? Will it leak my traffic data?

The Clash core (Mihomo) is 100% open source on GitHub (Apache-2.0) and auditable by anyone. Clients include no analytics, telemetry, or ads — traffic flows only between your device and configured proxy nodes, not through third-party servers.

Stay safe: ① download from this site or official GitHub Releases; ② avoid unknown config files (YAML can contain malicious rules); ③ use reputable providers and do not import random subscription links.

Don't have a Clash client yet?

Go to the download page, pick your platform, and get the latest build. Direct downloads from this site — no GitHub access required in restricted regions.