mihomo core · clients for every platform
Start by importing a subscription, then use the configuration notes to understand traffic routing rules and TUN mode.
profileAdd a configuration source, then check your proxy groups.
modeChoose Rule, Global, or Direct for your use case.
rulesPROXYThe first matching rule determines the outbound route.
tunUnderstand virtual interfaces and which traffic they capture.
Get connected first, then fine-tune your configuration.
Open the download page for your operating system and check your processor architecture. On desktop, install the app and launch it once. On mobile, follow the system prompts to allow network access. Keep the default settings and avoid running multiple proxy clients at the same time.
Add your configuration source on the configuration or subscription page, then activate it after updating. Check that proxy groups and outbound entries appear. Subscription URLs may contain access credentials, so keep them private and out of public screenshots.
Select an available outbound, enable the system proxy or turn on TUN if needed, then visit your destination. Check the connection list and logs to confirm traffic reaches the client and matches the expected rule. If something fails, check configuration loading first, then DNS and outbound settings.
A subscription supplies configuration; the client applies it. These are separate steps. Installing the client does not give you a working outbound connection. If the list is empty after import, first check whether the subscription returns a configuration format your client supports. Then continue with the connection steps. The full guide walks through the interface and verification in order; see the configuration reference for field details.
Choose your platform first, then narrow down the architecture and client.
New to Clash? Start with Clash Plus. For a comparison of interfaces, system integration, and maintenance status, see the client selection guide. Clients may use similar configuration syntax, but subscription management, service installation, permissions, and override settings vary. The download page brings platform options together; check both system requirements and installer architecture before installing.
Good for everyday desktop use and routing traffic in development environments. Compare Clash Plus, Clash Verge Rev, FlClash, and Clash Nyanpasu. The discontinued Clash for Windows is retained as an archived option; see the client selection guide for migration advice.
Before installing, check your system architecture. The system proxy mainly works with apps that honor proxy settings. Whether command-line tools use a proxy also depends on their own options and environment variables, so a successful browser test alone is not enough to confirm they are proxied.
Go to downloadsChoose the installer for Apple Silicon or Intel. Clash Plus, Clash Verge Rev, and FlClash offer different interfaces. The download page explains the archived status and usage limitations of ClashX Meta.
If setup involves system extensions, network permissions, or helper services, review each prompt from the client. Before switching clients, disable the old client's system proxy and traffic interception to avoid conflicts when testing the new setup.
Go to downloadsChoose from Clash Plus, Clash Meta for Android, FlClash, or Surfboard. Check your device architecture and configuration format before importing a subscription. Confirm the supported rule fields for each app separately.
Connections usually require system VPN permission. Running another VPN app at the same time can cause conflicts. Background restrictions can also interrupt persistent connections, so check both the system's battery settings and the client's status.
Go to downloadsThe download page links to Clash Plus on the App Store and lists the official website, clashplus.io. After installing, add a configuration in the app and follow the system prompts to allow a VPN connection.
Don't assume desktop configuration options will all work the same way on mobile. Check which subscription formats the app supports before importing. After connecting, use the app's logs to confirm proxy selection rather than relying only on the connection icon in the status bar.
Go to downloadsFor a graphical desktop client, see Clash Verge Rev and FlClash. If you're managing a server, router, or self-hosted service, see the mihomo core section. Desktop apps and the command-line core have different installation, startup, and configuration paths.
Before installing, check your distribution's package format, processor architecture, and runtime dependencies. Running the core directly also means managing the process, configuration path, and permissions yourself. Learn about listening ports and service logs before setting it to start at boot.
Go to downloadsStart with real configuration fields to understand outbound decisions, DNS resolution, and traffic interception.
Rule mode routes different requests through different policies, instead of sending all traffic down the same path. The rules in the configuration are checked from top to bottom; the first match determines the policy. Put specific domain rules before broad fallback rules. The example on the right sends GitHub domains and subdomains to PROXY and connects everything else directly. Unlike Global mode, this makes it easier to handle local services and remote sites separately. The result still depends on rule order, available domain information, and the proxy group selection. After making changes, check the matched rule in the connection list rather than relying on the toggle state alone.
Explore rule syntax →mode: rulerules: - DOMAIN-SUFFIX,github.com,PROXY - MATCH,DIRECTDNS resolution affects both connectivity and whether domain-based rules have the information they need to match. Fake-IP mode returns a mapped address for a domain; when the core handles the subsequent connection, it associates that address with the original domain. This is not the real address of a remote server. The example on the right shows only related fields; you'll also need suitable upstream resolvers and network access. Compared with returning real addresses directly, Fake-IP helps preserve domain associations, though some local network services and apps may need exceptions. If you run into compatibility issues, identify the specific domain and narrow the change rather than replacing all DNS settings at once.
Explore DNS fields →dns: enable: true enhanced-mode: fake-ip fake-ip-range: 198.18.0.1/16 fake-ip-filter: - "*.lan"Proxy groups give rules a stable target name and centralize the choice of actual outbound. The select type lets you choose an outbound manually; other group types use their own checks or switching behavior, so don't infer how a group works from its name alone. The example on the right uses the built-in DIRECT and REJECT options to illustrate selection; it is not a working remote proxy configuration. In a real setup, add defined outbound names to the group and make rules reference the same group name. After changing subscriptions, check that those names still exist, or rules may point to outdated targets and prevent the configuration from loading.
Explore proxy group fields →proxy-groups: - name: PROXY type: select proxies: - DIRECT - REJECTTUN uses a virtual network interface to handle traffic routed through it, making it useful for apps that don't honor system proxy settings. It changes how traffic enters the core; whether traffic goes direct or through a proxy is still determined by the outbound mode and rules. TUN is not the same as Global mode. The example on the right shows the mixed stack and auto-route fields. Enabling them may require administrator privileges or client service support. Compared with the system proxy, TUN involves more routing and DNS components and is more likely to be affected by other VPNs, virtual interfaces, or firewalls. First verify that the basic configuration works, then enable TUN and disable settings one at a time if conflicts arise.
Explore TUN settings →tun: enable: true stack: mixed auto-route: true auto-detect-interface: trueUse project documentation, source code, and observed configuration behavior as your references.
The Clash ecosystem includes proxy cores, desktop and mobile clients, and tools for rules and configuration. mihomo continues the technical lineage of Clash Meta as an open-source core compatible with the Clash configuration ecosystem. Compatibility does not mean every legacy field and new feature works identically in every client. When following a tutorial, first check which core the client uses and what it supports.
Graphical clients handle subscription management, interface controls, system integration, and service management. The core handles connections, DNS resolution, and rule decisions. As a result, the same configuration may be edited in different places in different interfaces, and client updates don't necessarily coincide with core updates. If an interface option is missing, first determine whether the limitation is in the core, the client, or an override.
Visit the mihomo open-source repository →The command below clones the mihomo repository for inspecting field implementations, commit history, and build instructions. It does not install a graphical client or generate a working subscription. For everyday use, simply choose a client from the download page.
git clone https://github.com/MetaCubeX/mihomo.gitBefore updating, read the client's release notes and core changes. Check system compatibility, configuration field changes, and known issues rather than comparing version numbers alone. Back up your subscription source, custom rules, and override files before upgrading. Afterward, confirm the configuration loads, then check outbound, DNS, and TUN behavior. The download page marks discontinued clients as archived, helping distinguish legacy compatibility needs from everyday choices.
This site collects client download links and setup guides. It does not provide proxy services or represent the developers of every project in the ecosystem. Example addresses illustrate configuration structure; a working connection requires a legitimate, usable configuration source that you provide. Before use, understand the rules that apply in your location, network policies, and service terms. Remove subscription URLs, credentials, and other personal data before sharing logs.
A client manages and applies configuration; it does not automatically include a working remote proxy outbound. Subscriptions typically provide nodes, proxy groups, and rules, but the contents depend on the provider. After importing, confirm the configuration is active and that its proxy groups include a working outbound. See the subscription import guide for the steps.
First, check whether the failed app's connections appear in the client logs. If they don't, check whether the app respects the system proxy. If they do, check rule matches, proxy selection, DNS, and connection errors in that order. Some system apps also have separate network restrictions; see the guide to the Clash UWP loopback issue.
Yes. Choose an outbound mode based on what you need. TUN determines how traffic enters the core; Rule mode determines where it goes afterward. They are not mutually exclusive. If enabling TUN causes local network access problems, check routing, DNS, and rules instead of sending every request through a proxy. See the Help Center for related issues.
Explore practical configuration scenarios, from core differences to traffic interception.
Learn how TUN virtual interfaces differ from the system proxy, what stack values mean, and how to enable TUN by platform, including required permissions and common fixes.
Read the TUN setup guide →Trace the history and maintenance status of each branch, see which core different clients include, and choose an option for your platform and needs.
Explore the evolution of Clash cores →Explore mihomo additions such as protocol support, rule sets, GEO data handling, and TUN enhancements, with configuration syntax compared against the original Clash.
Compare core features →