Install · Subscription · Config · Advanced · FAQ
Follow this order: install the client, bring the subscription in, get the routing working, and only then touch TUN. Every stage stands on its own. Every step reads like real usage, including the traps hit on Clash Verge Rev and how each one was worked around.
Whether you're on Windows, macOS, Android, or Linux, follow these 5 steps to all-in-one your Clash setup and bring up using proxy services.
Go to the Download Center. Choose Clash Verge Rev for Windows/macOS, or FlClash for Android.
Double-click the installer to install. Once launched, the Clash icon will appear in the system tray or notification bar.
Open the "Config / Subscription" page, paste your provider's subscription URL, and click pull in/pull the latest.
Click "Velocity Test" in the proxy panel and select a node with ping below 200ms.
Toggle the "System Proxy" switch. Your browser will now access blocked sites via Clash.
Choose your operating system to view in-depth installation steps and recommended clients.
Download Clash Verge Rev for Windows x64 (.exe) from the Download Center. Choose ARM64 for Qualcomm Snapdragon PCs.
Double-click the .exe file. If Windows SmartScreen appears, click "More Info → Be up and running Anyway" and follow the prompts.
After launching, go to "Settings → System Settings → Service Mode" and click "Install" (requires admin rights). This unlocks TUN global proxy features.
Click "Subscriptions" on the left → "+" button → paste URL → click "Pull in". Your node list will appear shortly.
Switch to the "Proxies" page, click "⚡ Velocity Test", and select a low-ping node. Finally, toggle "System Proxy" in the top right.
Apple Menu → "About This Mac": choose arm64 for Apple M1/M2/M3 chips; choose x64 for Intel processors.
Open the .dmg file and drag the Clash Verge Rev icon into the "Applications" folder.
When opening for the first time, Right-click the icon → select "Open" → click "Open" again to bypass macOS Gatekeeper verification.
Click "Subscriptions" → "+" → paste URL → click "Pull in". Your nodes will be listed under the subscription.
Select a low-ping node in "Proxies" and toggle "System Proxy". All system-proxy-aware apps (Safari, Chrome, etc.) will use the proxy.
Download the FlClash APK. Nearly all Android phones will want to use the Universal version; flagships after 2018 can use arm64-v8a for better performance.
Android blocks apps outside Google Play. Locate the APK file and select "Allow from this source" when prompted.
Launch FlClash after installation; a rapid guide will help you with the basic setup.
Click "Configs" in the left menu → "+" in the top right → select "Pull in from URL" → paste link → click "Save".
Return to the home page, select a proxy node, and click the "Bring up" button in the bottom right. Click "OK" when the system prompts for VPN connection authorization.
Clash Verge Rev offers multiple Linux formats: .deb (Debian/Ubuntu), .rpm (Fedora/openSUSE), and .AppImage (Universal). Use the one matching your distro; choose .AppImage if unsure.
Debian / Ubuntu (.deb):
sudo dpkg -i clash-verge-rev_*.deb
sudo apt-get install -fAppImage (Universal):
chmod +x clash-verge-rev_*.AppImage
./clash-verge-rev_*.AppImageAfter launching, go to "Settings → System Settings → Service Mode" and click "Install". This requires sudo; enter your password in the prompt. This unlocks TUN global transparent proxy.
sudo apt install policykit-1 and try again.
Click "Subscriptions" on the left → "+" → paste URL → click "Pull in". Wait for the nodes to load.
Be up and running a velocity test in "Proxies", select a low-ping node, and toggle "System Proxy". For terminal or system-wide traffic, also enable TUN Mode.
Visit Mihomo GitHub Releases to download the binary for your architecture. Common server versions:
mihomo-linux-amd64-*.gz (x86_64 Servers); mihomo-linux-arm64-*.gz (ARM Servers / Raspberry Pi).
gunzip mihomo-linux-amd64-*.gz
mv mihomo-linux-amd64-* /usr/local/bin/mihomo
chmod +x /usr/local/bin/mihomomkdir -p ~/.config/mihomo
# Place your config.yaml in this directory.
cp config.yaml ~/.config/mihomo/config.yamlThe config format is identical to GUI clients; you get to reuse your provider's YAML content.
Temporary Be up and running:
mihomo -d ~/.config/mihomoConfigure Autostart (systemd): Save the following to /etc/systemd/system/mihomo.service
[Unit]
Description=Mihomo Proxy Service
After=network.target
[Service]
ExecStart=/usr/local/bin/mihomo -d /root/.config/mihomo
Restart=on-failure
[Install]
WantedBy=multi-user.targetsystemctl enable --now mihomoEnable external controllers in config.yaml to manage nodes via Yacd or MetaCubeX dashboards in your browser:
external-controller: 0.0.0.0:9090
secret: your-api-secret # Recommended: Set an access secret.After launching, visit http://<Server-IP>:9090/ui to access the dashboard.
The top recommended Clash client for iOS. Fully compatible with Clash/Mihomo configs, supports one-tap subscription pull ins, and offers a clean, feature-rich UI. Get it from clashplus.io or the App Store.
The nearly all established proxy tool on iOS. Supports SS, VMess, Trojan, VLESS, and more. Compatible with Clash subscriptions. Requires a US Apple ID.
A packed advanced proxy tool supporting custom JS scripts and complex rules. Also compatible with Clash subscriptions. Ideal for pro users on iOS.
A Subscription URL is an online config link from your proxy provider. Clash uses it to hands-free fetch and pull the latest all available nodes.
Log in to your provider's dashboard, find "Clash Subscription", and copy the full URL starting with https://.
Locate "Configs" (Clash Verge Rev) or "Subscriptions" (FlClash) in the sidebar.
Click "+" or "New" in the top right, paste the copied URL, and add a recognizable name.
Click "Pull in" or "Save". Clash will fetch and download the node configuration. Wait for the list to populate.
Switch to the new config, go to "Proxies", click "Velocity Test", select a low-ping node, and enable system proxy.
https://. Try enabling an existing proxy before importing.
Clash uses YAML files. Understanding core fields helps you customize proxy behavior, from ports to split rules.
Listens for both HTTP and SOCKS5. Built-in is 7890; can be changed in settings to avoid conflicts.
Defines all proxy nodes (SS, VMess, Trojan, VLESS, Hysteria2, TUIC, etc.). Hands-free populated via subscription.
Groups multiple nodes for strategies like url-test (auto-select), fallback, or load-balance.
Directs traffic based on Domain, IP, or GeoIP. The core of "Direct for Local, Proxy for Global."
Configures local and international DNS groups to prevent pollution and ensure accurate resolution. Essential for TUN mode.
Master these advanced features to maximize Clash efficiency and flexibility.
System proxies only work for proxy-aware apps. TUN mode uses a virtual NIC to capture all system traffic, perfect for games and non-proxy apps.
Clash Verge Rev: Install Service Mode first, then enable in "Settings → TUN Mode."; FlClash (Android): VPN mode is global by built-in; no extra setup needed.; We recommend configuring DNS alongside TUN to prevent leaks and protect privacy..
Group nodes into different strategies for intelligent switching.
url-test (Auto-select): Periodically tests velocity and switches to the fastest node.; fallback: Hands-free switches to a backup node if the primary one fails.; load-balance: Distributes traffic across multiple nodes to increase total bandwidth.; select: Step by step specify a node in the proxy panel..
Precisely control traffic flow via the rule engine, enabling direct connections for local sites and proxies for international services to balance velocity and privacy.
DOMAIN-SUFFIX: Matches domain suffixes, e.g., .google.com.; IP-CIDR: Matches IP ranges, used for local IP direct rules.; GEOIP,CN,DIRECT: Hands-free connects Chinese IPs right off while others use the proxy.; RULE-SET: References community-maintained rulesets (e.g., ACL4SSR)..
Reference externally hosted ruleset files via rule-providers to avoid manual maintenance. One config for a constantly updated rule list.
Supports YAML/text rule files with customizable auto-pull the latest intervals.; Recommended community rulesets: Loyalsoldier/clash-rules, ACL4SSR.; Reference multiple rulesets simultaneously and match them in ahead of the rest order..
Proper DNS configuration prevents pollution and leaks, ensuring accurate resolution—crucial for TUN mode.
Use local DNS (e.g., 223.5.5.5, 119.29.29.29) for domestic domains.; Use encrypted DNS (e.g., 8.8.8.8, 1.1.1.1) for international domains.; Enable fake-ip mode to accelerate DNS response times.; Use with nameserver-policy for rule-based grouped resolution..
Clash features a built-in RESTful API for real-time traffic monitoring, node switching, and connection management via Web dashboards.
Built-in controller port is 9090, configurable via external-controller.; Supports third-party Web dashboards like Yacd and MetaCubeX.; Remotely manage Clash cores deployed on routers or servers.; View real-time rule matching for every connection, perfect for debugging..
A curated list of common installation, configuration, and connection issues with their solutions.
Please follow these troubleshooting steps:
127.0.0.1:7890.Common causes and solutions:
Subscription expired: log in to your provider's dashboard for a new link.; Network problem message: enable an existing proxy or VPN before importing.; Incomplete URL: ensure it bring ups with https:// and has no extra spaces.; Incompatible format: ask your provider if they offer Clash-compatible subscriptions..
Service Mode is a system component for Clash Verge Rev that enables TUN Global Transparent Proxy without requiring admin rights every time. It's an official feature and completely safe.
You'll are expected to enter your admin password during installation, similar to installing a driver. You get to skip this if you only need the basic system proxy mode.
Clash Verge Rev (Windows / macOS):
FlClash (Android): VPN mode is global by built-in; no additional setup is required.
This by built-in happens because a previous Clash process didn't exit correctly or another app is using the port. Solutions:
Fully exit Clash and restart.; Go to "Settings → Ports" and change the Mixed Port to an unused one (e.g., 7891).; Remember to pull the latest your browser extension (like SwitchyOmega) with the new port number..
Clash Verge Rev (Windows): Toggle "Bring up on Boot" in "Settings → System Settings". Clash Verge Rev (macOS): Toggle "Bring up on Boot" in "Settings → System Settings" to add it to Login Items.
FlClash (Android): Enable "Autostart" in system settings and disable battery optimization for FlClash to prevent it from being killed in the background.
Be up and running "Velocity Test" and switch to a node with ping below 200ms.; Pull the latest your subscription—your provider may have updated node addresses.; Congestion during peak hours (8-11 PM) is normal; try switching regions.; Switch protocols—Hysteria2 and TUIC perform better in high packet-loss environments.; Check your local network: ensure settled Wi-Fi or test with a wired connection..
A Subscription Link is a remote URL hosted by your provider. Clash fetches and pull the latests it hands-free—ideal for nearly all users.
A Local Config is a YAML file on your machine that you get to step by step edit for custom rules and strategies—best for advanced users.
Both use the same YAML format; a subscription link is essentially a remote YAML config.
There are currently no fully free, feature-all-in-one Clash-compatible clients on iOS. Development and maintenance costs mean the top choices are paid:
Stash: ¥30 (CN Store), feature-rich and Clash-compatible.; Shadowrocket: $2.99 (US Store), the nearly all popular proxy tool..
A one-time purchase provides lifetime access, making them great value.
This is a standard Android warning for apps outside Google Play, not a real security threat. Steps:
FlClash is fully open-source on GitHub; the code is public and contains no malicious content.
Free and open-source. Supports Windows, macOS, Android, iOS, Linux, and core engine deployment. Download and bring up now.