User Guide

Complete Clash Usage Guide

A step-by-step walkthrough covering installation, configuration, and usage from scratch.

Approx. 10 min read Beginner Friendly Updated for 2026
01

What is Clash

Clash is a rule-based network proxy engine. Unlike simple proxy tools, it performs fine-grained traffic splitting according to rules you define—giving you total control over what is proxied, what connects directly, and what is rejected.

Core Engine

Clash / Mihomo is the command-line core responsible for actual traffic processing and rule matching.

GUI Client

Clash Verge Rev, FlClash, etc., are graphical front-ends with built-in core engines. Most users can use these directly.

Subscription / Config File

A YAML file containing node information and routing rules, provided by your service provider and updated regularly.

Rule Engine

Automatically determines the exit strategy for each traffic flow based on domains, IPs, processes, regions, and more.

Clash itself does not provide nodes — Clash is simply a routing engine. You must first have a service provider that provides nodes, then import those nodes into Clash using a subscription link.
02

Install Client

Choose the appropriate client for your operating system. We recommend Clash Verge Rev, as it's available for Windows, macOS, and Linux, is feature-complete, and actively maintained.

  1. Go to the Download Page and download the Clash Verge Rev x64 (.exe) installer.
  2. Double-click the installer and follow the prompts to complete the installation (default path is fine).
  3. Windows Defender may show a warning on the first launch; click "Run anyway".
  4. Once installed, find the Clash Verge Rev icon in the taskbar and right-click to access all features.
Windows 11 includes WebView2 Runtime by default. If Windows 10 prompts for missing components, please install Microsoft WebView2 Runtime first.
  1. Go to the Download Page. Choose Apple Silicon (.dmg) for M-series Macs or Intel x64 (.dmg) for Intel Macs.
  2. Open the .dmg file and drag Clash Verge Rev into the "Applications" folder.
  3. If macOS warns of an "unverified developer" on the first launch, go to System Settings → Privacy & Security and click "Open Anyway".
  4. After launch, the Clash icon will appear in the top right of the menu bar.
Unsure about your chip type? Click the Apple menu in the top left → About This Mac. If "Chip" starts with "Apple M", it's Apple Silicon.
  1. Go to the Download Page. Choose ARM64-v8a (.apk) for phones released after 2016, or the universal version if unsure.
  2. Enable "Allow installation from unknown sources" in your phone's "Settings → Security".
  3. Open the downloaded APK file and tap Install.
  4. Launch ClashMeta for Android and grant VPN permissions.
  1. iOS proxy apps are distributed through the App Store as paid apps. Visit the iOS section of the Download Page for links and availability details.
  2. Search for and purchase Stash ($3.99) or Shadowrocket ($2.99) in the App Store.
  3. Open the app after installation and grant VPN permissions as prompted.
03

Import Subscription

A Subscription URL is a web address provided by your proxy service provider that contains all node information. When you paste it into the client, Clash automatically downloads and parses the configuration file.

Copy Subscription URL

Find your Clash subscription link from your provider's dashboard or email and copy the full URL.

Add to Client

Open Clash Verge Rev, go to the "Profiles" page, click the "+" in the top right, paste the link, and click "Import".

Enable Config File

Click the newly imported profile card in the subscription list to set it to "Active". It's in effect when the status in the top right turns green.

Security Tip: Your subscription link contains your account credentials; do not share it. We recommend enabling the client's auto-update feature (24-hour interval suggested) to keep node information current.
04

Proxy Modes

Clash offers three proxy modes for different scenarios:

Rule Mode Recommended

Automatically routes each connection based on the rules in your config file — for example, routing LAN and trusted domains directly while sending everything else through the proxy. The most flexible mode and suitable for most users.

Global Mode

Forces all traffic through the proxy, bypassing all rules. Useful for temporary global proxy needs, but can increase latency for local sites and is not recommended for long-term use.

Direct Mode

Connects all traffic directly without using a proxy. Equivalent to disabling the proxy; useful for temporarily turning off Clash without quitting the app.

05

Rule Configuration

Rules are the core capability of Clash. Each rule consists of three parts: Matching Type, Matching Value, and Proxy Group. They are matched from top to bottom, and the first match determines the strategy executed.

config.yaml — Rules Example 
rules:
  # 进程名匹配 — Docker 直连
  - PROCESS-NAME,docker,DIRECT

  # 域名后缀匹配 — 走代理节点
  - DOMAIN-SUFFIX,openai.com,Proxy
  - DOMAIN-SUFFIX,google.com,Proxy

  # IP 段匹配 — 局域网直连
  - IP-CIDR,192.168.0.0/16,DIRECT
  - IP-CIDR,10.0.0.0/8,DIRECT

  # GeoIP — 中国 IP 直连
  - GEOIP,CN,DIRECT

  # 兜底规则 — 其余流量走代理
  - MATCH,Proxy

Common Rule Types

Type Matches Example
DOMAIN Exact full domain match DOMAIN,www.google.com,Proxy
DOMAIN-SUFFIX Domain suffix (including subdomains) DOMAIN-SUFFIX,google.com,Proxy
DOMAIN-KEYWORD Domain contains keyword DOMAIN-KEYWORD,google,Proxy
IP-CIDR IP range (CIDR format) IP-CIDR,8.8.8.8/32,Proxy
GEOIP IP's country/region GEOIP,US,DIRECT
PROCESS-NAME Process name (Desktop only) PROCESS-NAME,chrome,Proxy
MATCH Final fallback rule (must be last) MATCH,Proxy
06

TUN Mode

System Proxy can only handle traffic sent through system proxy settings (primarily browsers). Game clients, terminal tools, and some Electron apps often bypass it. TUN Mode creates a virtual network interface at the driver level to intercept all TCP/UDP traffic, achieving true global transparent proxying.

System Proxy
  • Only handles apps that follow system proxy settings
  • Games and CLI tools often bypass it
  • No extra permissions required
  • Ideal for daily browser usage
TUN Mode
  • Intercepts TCP/UDP traffic from all apps
  • Works for games, terminal, and all apps
  • Requires administrator / root privileges
  • Ideal for gaming and development environments

How to Enable TUN Mode

1
Windows: In Clash Verge Rev, go to "Settings" → "System" and toggle the "TUN Mode" switch. Click "Yes" when the system prompts for UAC permission.
2
macOS: Go to "Settings" → "System" and enable "TUN Mode". For the first use, you'll need to install the Helper tool in system settings as prompted, then enter your system password.
3
Android / iOS: Mobile clients automatically request VPN permissions on launch. Once authorized, global TUN mode is active with no further steps required.
If a proxy node becomes unavailable in TUN mode, you may lose internet access. We recommend including local direct rules and keeping a reliable direct exit in your configuration.
07

Detailed YAML Config

Clash configuration files are in YAML format. A complete config file typically includes these main sections:

config.yaml — Complete Structure Example 
# ── Global Settings ───────────────────────────
mixed-port: 7890        # Combined HTTP + SOCKS5 port
allow-lan: false        # Allow connections from LAN
mode: rule             # rule / global / direct
log-level: info

# ── DNS Settings ──────────────────────────────
dns:
  enable: true
  nameserver:
    - 1.1.1.1            # Cloudflare DNS
    - 8.8.8.8            # Google DNS
  enhanced-mode: fake-ip

# ── Proxy Nodes ───────────────────────────────
proxies:
  - name: "US-01"
    type: vmess
    server: example.com
    port: 443
    uuid: your-uuid-here
    alterId: 0
    cipher: auto
    tls: true

# ── Proxy Groups ──────────────────────────────
proxy-groups:
  - name: "Proxy"
    type: select          # Manual selection
    proxies:
      - US-01
      - DIRECT

  - name: "Auto"
    type: url-test       # Auto-select fastest node
    url: http://www.gstatic.com/generate_204
    interval: 300
    proxies:
      - US-01

# ── Rules ─────────────────────────────────────
rules:
  - GEOIP,US,DIRECT    # Adjust to your country code
  - MATCH,Proxy

Proxy Group Types

TypeDescription
selectManually select a node in the interface
url-testAutomatically tests and selects the node with lowest latency
fallbackChecks in order and uses the first available node
load-balanceLoad balancing across multiple nodes
relayChain proxying, where traffic passes through multiple nodes sequentially
08

Frequently Asked Questions

Received "Configuration file parsing failed" error after importing

Usually caused by an expired or incorrectly formatted subscription link. Please check:

  • Is the link complete? Has it been truncated?
  • Is the link in Clash format? (Not V2Ray / Shadowsocks format)
  • Does the provider offer a separate Clash subscription link? (Rather than a general one)
  • Copy the latest link from your service provider's dashboard.
Browser works, but games / apps have no effect

This is a limitation of System Proxy. Game clients and some apps ignore system proxy settings. You must enable TUN Mode to proxy all traffic. See the "TUN Mode" section above.

Network speed is slow after enabling the proxy

Possible reasons:

  • The selected node is geographically distant; switch to a node with lower latency.
  • Proxy mode is set to "Global", routing all traffic through the proxy including sites in your region. Switch to "Rule Mode" to let Clash route traffic selectively.
  • The node itself has limited bandwidth. Contact your provider or upgrade your plan.
macOS prompt: "Clash Verge Rev is damaged and can't be opened"

This is a macOS Gatekeeper security check. Run the following command in Terminal and then reopen:

sudo xattr -rd com.apple.quarantine /Applications/Clash\ Verge\ Rev.app
No internet access after enabling TUN Mode

Could be a DNS leak or an unavailable node. Please try:

  • Check if the currently selected node is available (latency test) in the client.
  • Disable TUN mode and restore system proxy before troubleshooting node issues
  • Verify that the DNS settings in the configuration file are correct; fake-ip mode is recommended.
How to make a specific app use a direct connection instead of a proxy?

In the rules section of the configuration file, add a process name rule at the very beginning:

- PROCESS-NAME,your-app-name,DIRECT

For Windows, enter the .exe filename (e.g., steam.exe); for macOS, enter the process name (e.g., Steam).

Download Client Get the Clash Client for Your Platform
Core Features Explore Clash's underlying routing capabilities