mihomo core · Open-source clients
Clash Wiki helps you choose a client and learn about subscription imports, rule-based routing, and mihomo configuration.
The client provides the interface; the core handles connections and applies rules. Understand the difference before choosing an installer or configuration method.
CLIENT / PLATFORM
Check your operating system and processor architecture before comparing clients. The downloads page lists installers, requirements, and archive status for each platform; this page does not link directly to installers.
Start with Clash Plus, then compare Clash Verge Rev, FlClash, and Clash Nyanpasu. For a first connection, import a configuration and enable the system proxy. Consider TUN only if you need to handle apps that ignore system proxy settings. Before downloading, check your processor type under “About” in system settings—don’t infer the architecture from the computer’s brand.
Go to downloadsApple Silicon and Intel require different installers. Compare Clash Plus, Clash Verge Rev, and FlClash; ClashX Meta is available as an archived option. Check your chip under “About This Mac,” then follow the client’s prompts to grant network permissions. After installation, check the proxy status of your active network service to prevent settings left behind by an older client from interfering with connections.
Go to downloadsCompare Clash Plus, Clash Meta for Android, FlClash, and Surfboard. Android clients typically use system VPN permission to route traffic, unlike desktop clients that configure browser proxy settings. On first launch, grant permission, then choose a configuration and proxy group. If the connection drops when the screen locks, check battery optimization and background activity restrictions. Configuration formats vary between clients.
Go to downloadsThe downloads page links to Clash Plus on the App Store and to the official site at clashplus.io. After installing, follow the app’s prompts to import a configuration and allow it to add a VPN configuration. If you have connection issues, first check that your subscription is compatible with the app, then review your policy selection and system VPN status. Don’t copy desktop instructions for installing services, setting listening ports, or configuring firewalls.
Go to downloadsFor desktop Linux, choose between Clash Verge Rev and FlClash. Check your distribution’s package format and processor architecture first. Servers, routers, and similar environments typically run the mihomo core directly, so you’ll need to manage the configuration directory, process permissions, and service startup yourself. Terminal apps may not honor the desktop system proxy; set proxy environment variables or specify a proxy address as documented by each app.
Go to downloadsCONFIG / GLOSSARY
First understand how traffic reaches the core, then see how rules choose an outbound route. The snippets below explain individual fields; they are not complete, runnable configurations. Proxy is an example policy group name that must be defined separately.
Rule-based routing sends different connections through different outbound routes. In the configuration file’s rules list, match connections by domain suffix, keyword, or destination address. The core checks rules from top to bottom; the first match determines the policy, and later rules are ignored. Rules and proxy groups serve different purposes: a rule selects a group, while the group selects the actual proxy node. Put specific domain rules before broader ones, and usually place MATCH last. To troubleshoot, check which rule a connection matched before changing rule order or the group’s selection.
mode: rule
rules:
- DOMAIN-SUFFIX,github.com,Proxy
- DOMAIN-KEYWORD,adservice,REJECT
- GEOIP,CN,DIRECT
- MATCH,ProxyProxy mode determines how connections entering the core are routed. Rule applies the rules list, making it suitable for routing connections by destination. Global sends connections to the global policy selection; Direct connects without a proxy. Switch modes in the client’s mode selector or set the mode field in the configuration. Proxy mode and system proxy are separate controls: the former determines how the core handles a connection; the latter determines whether an app sends it to the core. Switching to Global does not capture every app—check traffic that never enters the proxy separately.
# Options: rule / global / direct
mode: rule
mixed-port: 7890
allow-lan: falseTUN uses a virtual network interface to capture traffic, including traffic from some apps that ignore system proxy settings. Desktop clients usually offer a switch in network or TUN settings; enabling it may require a service component or administrator privileges. In the configuration, auto-route sets routes automatically, while dns-hijack captures specified DNS requests. TUN handles traffic capture; it does not replace rules or proxy groups, and it may conflict with other VPNs. When enabling it for the first time, keep your existing configuration, check routes and DNS, then test the target app. Avoid changing several network settings at once.
tun:
enable: true
stack: mixed
auto-route: true
auto-detect-interface: true
dns-hijack:
- any:53DNS resolves domain names to addresses used for connections. Fake-IP returns a mapped address first, allowing the core to associate later connections with the original domain for rule-based routing. Enable a DNS resolver in the configuration’s dns section and set enhanced-mode to fake-ip. Fake-IP is not a proxy mode, and enabling it alone won’t capture every system DNS query. Apps with built-in encrypted DNS may use a separate path, so check how their traffic is handled. Before making changes, confirm which resolver handles requests. If a particular device or app has issues, adjust fake-ip-filter as needed instead of broadening the filter indiscriminately.
dns:
enable: true
enhanced-mode: fake-ip
fake-ip-range: 198.18.0.1/16
nameserver:
- https://dns.alidns.com/dns-querySubscriptions fetch and update configuration content; rule providers store reusable match conditions. A full configuration subscription may include proxies, groups, and rules. proxy-providers and rule-providers manage proxy collections and rule collections respectively—they are not interchangeable. Clients usually let you import a link from the configuration or subscription page. Define rule providers in the configuration, then reference them with RULE-SET. Subscription updates may overwrite manual edits, so use the client’s supported override mechanism for settings you want to keep. Subscription URLs may contain access credentials; remove them before sharing logs, screenshots, or configuration files.
rule-providers:
local-direct:
type: file
behavior: domain
format: yaml
path: ./rules/local-direct.yaml
rules:
- RULE-SET,local-direct,DIRECT
- MATCH,ProxyAn external controller uses the core’s control API to inspect connections, view logs, and switch proxy groups—useful when you want to manage the core in a browser. In the configuration, external-controller sets the listening address and external-ui points to the local dashboard files. The controller port is not the same as mixed-port; it is not a browser proxy port. For local use, bind to the loopback address. For remote access, set authentication and restrict network access. Desktop clients may manage these fields themselves; check the client’s documentation before changing them to avoid overwriting settings used internally.
external-controller: 127.0.0.1:9090
external-ui: ./ui
# Add compatible dashboard files to the ./ui directory firstAuto-advance stops when you click or focus with the keyboard. Use the arrow keys to switch entries, Home to go to the first, and End to go to the last.
SOURCE / PRACTICE
Clash Wiki is a resource for client downloads and configuration. Core capabilities are documented by the project; interface steps depend on the client you choose. Similar client names do not guarantee identical settings, maintenance status, or permission requirements.
Clash established a configuration style centered on YAML, proxy groups, and rule-based routing. After the original project was discontinued, the community continued to develop compatible implementations. mihomo follows the Clash Meta project line and continues to evolve support for proxy protocols, rule providers, domain sniffing, and network traffic capture. That’s why Clash Meta in older guides and mihomo in current documentation often refer to the same core development lineage. However, this does not mean every field in an old configuration works the same way today.
A client is an app with a user interface; the core is the program that handles network connections. A client may bundle a particular core or let you switch cores. To determine whether a feature is available, check core support, whether the client exposes the relevant setting, and whether your system meets the permission requirements. An app’s name alone, without details about its runtime environment, is usually not enough to tell whether a configuration will work as-is. Platforms such as iOS have their own network traffic handling mechanisms, so desktop implementation details may not apply.
To verify a field, start with the mihomo configuration documentation, then check the mihomo source repository for notes, release history, and issue discussions. Public source code can help explain implementation and pinpoint problems, but that doesn’t mean every graphical client offers the same options or uses the same labels. This site breaks common concepts into individual entries and keeps full setup instructions in the advanced guide, rather than treating interface steps and low-level parameters as one universal workflow.
When reading examples, distinguish complete files from partial snippets. Policy names used in rules must exist in the configuration; files referenced by rule-providers must be present; and DNS listeners and control APIs need ports not already in use. YAML uses spaces for indentation—never tabs. Before saving, validate the configuration in your client, reload it, and check the logs for success. If the interface still shows the old configuration, check which entry is active instead of importing the same link again.
App, core, and subscription updates affect different layers. An app update may change the interface or service components; a core update may change protocol implementation or field behavior; a subscription update may replace servers, proxy groups, and rules. Before upgrading, keep a working copy of your current configuration and local overrides, and read the relevant release notes. Afterward, test existing connections before enabling new features one at a time. A successful subscription update does not guarantee that a server is available, and a completed installation does not mean the system proxy now handles every app.
For long-term use, let the subscription manage remote content and local overrides handle personal preferences. For example, add rules for a few work domains or keep your preferred local listening address and DNS settings. Override, merge, and processing behavior varies between clients. Check the final generated configuration, not just the partial content in the editor. If you need to merge multiple subscriptions, account for duplicate proxy group names, repeated rules, and outbound dependencies. These topics are covered in the Advanced Configuration Guide; they’re best left until after your first connection.
Break “can’t connect to the internet” into four stages: traffic capture, DNS resolution, rule matching, and outbound routing. Whether the browser uses the system proxy, whether the core sees the connection, whether the domain resolves as expected, and which policy the connection hits are more useful clues than repeatedly changing configurations. If the core has no connection record, check how traffic is captured first. If a record shows the wrong policy, check rule order and group selection. If the policy is correct but the connection still fails, check the subscription, proxy protocol, and outbound network. Change one setting at a time so you can identify the cause from the result.
A latency test measures performance for a specific target, protocol, and set of network conditions; it cannot replace testing the app you actually use. Websites, video apps, and command-line tools may use different DNS resolvers, connection reuse, and transport protocols. To verify a setup, choose a specific app, check its connection record, and confirm the outbound route matches your rules. When sharing troubleshooting details, keep the error type and necessary fields, but remove subscription access parameters, server passwords, and personal network identifiers. For more specific steps, see Frequently Asked Questions.
If you already have a working subscription, install a client that matches your system architecture. Import the subscription on the configuration page and set it as active. Then select Rule mode, choose a proxy node in the group you’ll use, and enable the system proxy or mobile VPN connection. First check that your usual apps can connect, then verify that the rules behave as expected. This order tests configuration validity, traffic capture, and outbound selection separately, making it easier to see where something went wrong instead of enabling every network option and guessing afterward.
Look into TUN only if the target app ignores the system proxy or you need to capture more traffic. Before enabling it, turn off other VPNs that may change routes and note your current DNS and proxy settings. Follow the client’s prompts to install services or grant permissions. If network problems arise, undo your latest changes and restore a known working setup. The Getting Started guide walks through importing, selecting, routing, and testing; the glossary explains terms as you go. They serve a different purpose from the advanced guide.
NOTES / RECENT
Go from common tasks to specific settings. Learn what node measurements mean before choosing one, check core differences before migrating a configuration, and start with subscriptions and proxy modes if you’re new.
Learn what latency test results really mean, how data multipliers affect usage, how regions relate to the services you use, and the trade-offs between Trojan, VLESS, Hysteria2, and other protocols on different networks.
Read article →Compare mihomo and the original Clash core across protocol support, rule provider subscriptions, domain sniffing, TUN stack implementations, and configuration fields. Find out what to change when migrating an older configuration.
Read article →Answers to ten common first-time questions: where to enter a subscription link, how to choose between Rule and Global, why the system proxy isn’t working, and what to do when a configuration update fails—with practical steps for each.
Read article →