Compare cross-platform clients, understand rule-based routing, and review protocol trade-offs—starting with compatibility before changing connection settings.
Open-source ecosystem
Configuration guides
mihomo core reference
Compare protocol trade-offs in the protocol guide
Connection settingsInterface preview
System proxy
TUN mode
Allow LAN connections
Common pitfalls / Diagnose before changing settings
Subscriptions, certificates, and DNS: three common issues
A successful import, an enabled proxy, and an accessible website are separate checkpoints. Keep the exact error message and change one setting at a time—it’s usually easier to find the cause than by switching nodes, cores, and DNS all at once.
Clash subscription update failed
Check the logs first to distinguish a timeout, a server-side rejection, and a configuration parse error. For timeouts, check your network and whether the update request uses the proxy. For access denials, check the subscription’s validity and account status. For parse errors, see whether the response is a login page or an incompatible format. Don’t repeatedly share the full link or rush to clear all your settings. Keep the last working configuration, then test one change at a time. For steps, see the Subscription FAQ.
Certificate errors after enabling the proxy
A certificate error doesn’t necessarily mean you need to install a new certificate. Check your system clock and time zone, then compare results with the proxy disabled and with a different node to determine whether the issue is local or along the connection path. Standard HTTPS proxying doesn’t require the client to decrypt website traffic; an untrusted root certificate can alter your system’s trust chain. Don’t hide the problem by disabling certificate verification. Note the exact error code and follow the certificate troubleshooting steps.
DNS routing doesn’t match expectations
The system proxy only affects apps that honor proxy settings; it doesn’t guarantee that the core handles every DNS query. Browser Secure DNS, the system resolver cache, and other VPNs can all change the path. To troubleshoot, identify which app made the request, then check whether core DNS is enabled, whether TUN is capturing traffic, and whether the resolver is reachable. A single test page can’t show where all traffic goes. Check the logs and connection records, and see the DNS and Network FAQ.
Configuration Explorer
Clash features and configuration boundaries
First, understand what the graphical client handles and what the core processes; then decide whether you need more complex settings. The snippets below illustrate configuration fields—they are not complete, import-ready subscriptions.
RULES / Route traffic by destination
Rule-based routing: order matters more than volume
Rule mode checks destination domains, addresses, or rule sets against the configuration from top to bottom, then sends each match to its assigned policy. It works well for everyday setups that need both direct connections and proxy traffic, without repeatedly switching the entire system between modes. Before adding a custom rule, confirm that its policy name exists and that an earlier rule won’t take precedence. Unlike proxy tools with a single on/off switch, the Clash ecosystem relies on policies and rules working together. You’ll need to understand each rule set’s coverage, update source, and final fallback.
TUN receives traffic through a virtual network interface, making it useful for apps that ignore system proxy settings—but enabling it won’t automatically solve every connection issue. Desktop clients may require service mode or specific system permissions, and routing and DNS must be configured to match. If the device also runs another VPN, a virtual machine, or corporate network software, check for interface and route conflicts before expanding the capture scope. TUN operates closer to the network layer than a system proxy, so troubleshooting is more involved. Start with the system proxy for ordinary web access and enable TUN only when needed.
mihomo is a core developed as a continuation of the Clash Meta project. The graphical client handles configuration editing, tray controls, and system integration. They are different software layers: seeing a protocol name in the interface doesn’t mean the bundled core supports its configuration fields. When migrating an older configuration, check the protocol type, rule providers, and DNS settings, then test resolution with the new core. Compared with the original Clash, mihomo supports additional protocols and rules—but new features also mean configuration compatibility needs to be checked again. Don’t judge compatibility by the client’s name alone.
# View the core's available command-line help
mihomo -h
# Test the local configuration syntax
mihomo -t -f config.yaml
Subscription management: separate remote and local changes
A subscription link retrieves a remote configuration; it isn’t the client itself, and it may not include complete rules or policy groups. Before importing, confirm that the provider supplies a Clash-compatible format. After updating, check that the intended configuration is active. Editing a remote configuration directly may be overwritten by the next update. A safer option is to use the client’s override or merge feature to preserve local settings. Subscription conversion involves access credentials embedded in the link, so choose your method carefully and avoid submitting the full link to unfamiliar web services.
# Identify the main sections of a configuration
proxies: []
proxy-groups: []
rules:
- MATCH,DIRECT
Cross-platform clients: similar interfaces, different permissions
The same configuration can run into different system restrictions on different devices. On desktop, check system proxy settings, background services, and startup behavior. On mobile, check VPN permissions, background activity, and battery-saving restrictions. When downloading, match the operating system and processor architecture first, then compare the core, subscription overrides, and rule management. Clash Plus is a good starting point; for more desktop integration, compare options such as Clash Verge Rev. Don’t assume menus work the same way across platforms—even similarly named features may behave differently.
# Common desktop client settings
System proxy
TUN mode
Launch at startup
Service mode
Allow LAN connections
SS, VMess, Trojan, VLESS, Hysteria2, and TUIC have different design goals and transport foundations. Real-world performance also depends on server configuration, packet loss, and device performance. QUIC-based options can work well on some networks, but require UDP traffic to be allowed and may use more battery on mobile devices. Check core support first, then compare connection setup time, long-connection stability, and background battery use instead of relying on a single speed test. The protocol guide explains trade-offs by use case—protocol names alone don’t guarantee performance.
# Common values for the node type field
# ss / vmess / trojan / vless
# hysteria2 / tuic
# Match the remaining fields to the server configuration
The reference content rotates every 9 seconds. It pauses when you select a tab, use the keyboard, or focus it. With reduced motion enabled, it stays still.
Choose a device to visit its download page
Clash clients by platform
Graphical clients suit everyday desktop and mobile use; standalone cores are for users who manage their own services. Download pages list package types, architecture options, and maintenance status. Check your device requirements first, then compare features to avoid installing the wrong package because of a similar filename.
Start with Clash Plus, then choose Clash Verge Rev, FlClash, or Clash Nyanpasu based on service mode, subscription overrides, and interface preferences. Clash for Windows is no longer maintained; archived packages are best reserved for environments with specific compatibility requirements, not chosen by default just because the name is familiar.
Check About This Mac to identify whether your device has an Apple chip or an Intel processor, then choose the matching package. Compare Clash Plus, Clash Verge Rev, and FlClash; ClashX Meta is no longer maintained. Check system permissions, proxy capture, and background services separately after installation—a window opening doesn’t confirm that connections work.
Check the processor architecture and system requirements first, then compare the configuration formats supported by Clash Plus, Clash Meta for Android, FlClash, and Surfboard. The first connection usually requires VPN permission. If the connection drops in the background, check battery restrictions and whether another VPN is active before repeatedly switching subscriptions.
Install Clash Plus from the App Store. Product information is available on the official website, clashplus.io. Check configuration compatibility before importing, then allow the VPN configuration when prompted on first connection. If you have connection-switching or background issues, first distinguish between system permissions, subscription status, and node reachability.
Desktop users can compare Clash Verge Rev and FlClash, choose a package for their distribution, and check desktop environment and dependency requirements. For servers, routers, or manually managed services, visit the mihomo core section of the download page. A graphical client and standalone core don’t need to be installed together to work.
Handle installation, configuration, and traffic capture separately. If something goes wrong, check the current step before starting over—you’re more likely to preserve useful clues than by reinstalling from scratch.
01
Import and activate a configuration
Add the link on the client’s configuration or subscription page. Once the update succeeds, select that configuration explicitly. Check that policy groups appear and look for parsing errors. If the response is a web login page, troubleshoot the subscription source first. Full links usually contain access credentials; hide them before sharing screenshots or asking for help.
02
Choose a mode and traffic capture method
For everyday use, start with rule mode, select an available node in the policy group, and enable the system proxy. Configure TUN only if an app that ignores system proxy settings needs traffic capture. Global mode is useful for short diagnostic comparisons, but it isn’t more complete than rule mode and doesn’t replace checking which rules match.
03
Verify the route in connection logs
Visit the target service, then check its domain, matched rule, and selected policy on the connections page. A successful speed test only shows that the test destination was reachable at that moment; it doesn’t prove that every app is being routed. Once verified, keep the working configuration and any necessary local overrides. They provide a clear baseline if a later update causes problems.
The Clash ecosystem isn’t a single product line of installers. The original Clash established the foundations for proxies, policy groups, and rule configuration; subsequent cores and graphical clients have evolved in different directions. Clash Review is a download and selection resource, not a developer of these projects. Recommendations are based on platform support, feature needs, and maintenance status—not on any claim that this site is an official software source.
Understanding these relationships makes release notes easier to interpret. A UI fix may affect only the system tray or window behavior, while a core update can change protocol parsing, rule processing, or DNS behavior. Consider both when choosing a client; an installer’s name or a one-time interface redesign doesn’t tell you everything about its capabilities.
The public mihomo repository includes source code, issue discussions, and release history. The command below only downloads the project source; it won’t install a client or replace the graphical interface on your device.
Clash Meta was later renamed mihomo, so guides may use both names. The old name can help identify a source, but it doesn’t prove that an older configuration works exactly the same with the current core. When reading older articles, separate general concepts from specific fields: policy groups and match order are often still useful, but protocol parameters, DNS behavior, and platform permissions need to be checked again. The end of maintenance for Clash for Windows doesn’t mean the entire Clash ecosystem has stopped evolving.
Open-source collaboration and issue tracking
Public source code lets readers trace implementation details and changes, but open source alone doesn’t guarantee compatibility testing. More useful evidence includes whether an issue can be reproduced, whether logs point to the same component, and whether a fix appears in the release package for the client you use. When reporting an issue, include the operating system, core source, reproduction steps, and redacted logs. Don’t upload a full subscription or personal network details. Similar reports from other users can offer clues, but they aren’t a diagnosis of your device.
Core compatibility and migration
Keep a copy of the original configuration before migrating, then test it in the new client. Passing a syntax check is only the first step: also verify policy group references, rule-set downloads, DNS resolution, and the actual connection route. If the client supports configuration merging, distinguish settings managed by the remote subscription from those in local overrides. Start with the smallest working configuration and restore advanced options one at a time. This makes differences easier to isolate and prevents old cached data from clouding the results.
Update mechanisms and selection criteria
Clients, bundled cores, subscriptions, and rule sets may update separately; updating one won’t automatically update the others. Before upgrading, read the changes relevant to your setup, then test the same destination afterward. For long-term use, prioritize maintenance status, configuration portability, and clear troubleshooting information over the word “new” in a product name. The download page collects installation links, the client comparison explains how to choose, and the protocol guide covers deeper transport and compatibility trade-offs.
Review notes / Recent articles
Rule configuration and troubleshooting
Each article tackles a specific problem: define the symptoms, explain the underlying behavior, then provide steps to verify the result. When changing local settings, keep the original configuration and avoid applying a fix for one issue to every connection.
Covers four common causes—corrupt configuration, port conflicts, core permissions, and missing runtimes—and explains how to find logs, identify the crash point, and restore normal startup.
Examines system clock issues, TLS interception, node problems, and browser cache; explains how certificate errors relate to proxies and provides a step-by-step troubleshooting order.
Breaks down the three-part syntax of a rule, explains top-to-bottom matching and priority, and shows how to troubleshoot rule sets, MATCH fallbacks, and common placement mistakes.