Why do some sites still fail to load even under a direct-connect rule?

This usually happens when a domain is routed as DIRECT, but the server's location can't reach that site directly. You can add a separate PROXY rule for that domain in the rules section of your config file, placing it before any rule that matches DIRECT or MATCH.

What's the difference between TUN mode and system proxy mode?

System proxy mode only handles traffic from apps that respect the system proxy setting, so some programs may bypass it. TUN mode creates a virtual network adapter at the network layer and handles almost all traffic on the device, offering better compatibility — but it usually requires admin rights or system-level authorization.

Clash Tutorial - Install, Subscribe & Configure

01 Quick Start in 3 Steps

If you just want to get up and running fast, start here — later sections cover each platform in more detail with screenshots.

1

Download and Install the Client Head to the download page for your operating system, grab the right installer, and double-click to install. On Windows / macOS / Linux desktops, the app will appear in your system tray or menu bar once installed.

2

Import Your Subscription Link Open the client, go to the "Subscription" or "Profiles" tab, and paste the subscription URL from your proxy provider (a link starting with http). Click update, and the client will automatically pull in your nodes and rule config.

3

Select a Node and Turn On the Proxy In the "Proxies" tab, pick a low-latency node from the proxy group, then flip on the "System Proxy" or "TUN Mode" switch. Your browser and most apps will now route traffic automatically according to your rules.

02 Installation by Platform

Permission requirements and client choice vary slightly by operating system — here's a breakdown for each platform.

Windows Installation Steps

1

Download the ClientWe recommend Clash Verge Rev (lighter on resources) or Clash for Windows (simpler interface). Download links are on the Windows section of the download page.

2

Install and LaunchDouble-click the .exe to install. If your security software shows a warning, select "Run anyway" (Clash is open source — this warning is usually a false positive caused by an unsigned certificate).

3

Import Your Subscription and ConnectPaste your subscription link on the subscription tab and update, switch to the proxies tab to pick a node, then turn on "System Proxy" — your browser will now use the proxy rules normally.

macOS Installation Steps

1

Download the Core and a Front-EndThis site provides the mihomo command-line core, which needs a GUI front-end like Clash Verge Rev or ClashX. See the macOS section of the download page for details.

2

Trust the Unverified DeveloperIf you see "cannot verify developer" the first time you open it, go to "System Settings → Privacy & Security," find the app, and click "Open Anyway."

3

Authorize the Network ExtensionIf you're using TUN mode, the system will ask to install a network extension or VPN configuration — just click allow. This permission is required for the virtual network adapter to work.

Android Installation Steps

1

Download the APK and Allow InstallationAfter downloading Surfboard, if the system blocks the install, go to "Settings → Security → Allow installs from unknown sources" and grant permission to your file manager or browser individually.

2

Create a Profile and Paste Your SubscriptionOpen the app, create a new profile, paste your subscription link, and save. The app will automatically download the nodes and rule config.

3

Grant VPN Permission and ConnectWhen you tap connect, the system will show a VPN authorization prompt — choose allow. A small key icon in the status bar means you're connected.

iOS Installation Steps

1

Install a Compatible App from the App StoreThere's no official Clash client on iOS, but you can install Shadowrocket, Stash, or Quantumult X — all compatible with Clash's rule syntax. See the iOS section of the download page for details.

2

Add a Profile and Enter Your Subscription URLOpen the profile manager inside the app, choose "Add Profile" or "Import from URL," paste your subscription link, and save.

3

Install the VPN Configuration ProfileThe first time you connect, you'll be taken to Settings to install a VPN configuration profile — confirm the install under "Settings → General → VPN & Device Management."

Linux Installation Steps

1

Choose a GUI Client or Command LineFor desktop environments, we recommend Clash Verge Rev (install the .deb package directly); for servers or headless setups, use the mihomo command-line core. See the Linux section of the download page for details.

2

Place Your Config FilePut the config.yaml file from your subscription provider into the ~/.config/clash/ directory — that's the default path the CLI core reads from.

3

Launch the CoreRun ./mihomo -d ~/.config/clash from the command line to start it. If you want it running persistently in the background, we recommend writing a systemd service unit for auto-start on boot.

03 How to Import a Subscription Link

A subscription URL is a remote address provided by your proxy provider. It usually contains a Base64-encoded or YAML-formatted config file with multiple node entries. Once your client periodically fetches this URL, the node list updates automatically — no need to enter anything manually.

1

Get Your Subscription URLLog into your proxy provider's user dashboard and copy your personal link from the "Subscription" or "My Subscriptions" section. Note that this link usually contains identifying parameters — don't share it with others.

2

Add It to Your ClientDifferent clients label this differently ("Subscription," "Profile," "Config") — find the matching option and paste your link there.

3

Set an Auto-Update IntervalMost clients let you set how often the subscription updates automatically (e.g. every 24 hours), preventing connection failures caused by outdated node info.

Tip:If your subscription consistently fails to update, first check whether your current network can reach that URL directly. Some providers' subscription URLs themselves require a proxy to access — try connecting to any working node manually first, then retry the update.

04 Config File Structure Explained

At the heart of Clash is a text file called config.yaml, written in YAML, which declares ports, nodes, proxy groups, and rules. Understanding its structure helps you read subscription content and even fine-tune rules yourself. Here's a simplified example:

# Basic listening port and run mode
mixed-port: 7890
mode: rule
log-level: info

# Node list: each entry is one proxy server
proxies:
  - { name: "HK-01", type: vmess, server: example.com, port: 443 }

# Proxy groups: organize nodes and set a selection method
proxy-groups:
  - { name: "PROXY", type: url-test, proxies: ["HK-01"], url: "http://www.gstatic.com/generate_204", interval: 300 }

# Rules: decide where each request finally goes
rules:
  - DOMAIN-SUFFIX,github.com,PROXY
  - GEOIP,CN,DIRECT
  - MATCH,PROXY

Key Field Reference

Field	Purpose
mixed-port	The local listening port supporting both HTTP and SOCKS5 — your browser or system proxy setting usually points here.
mode	Run mode: `rule` (route by rules, most common), `global` (send everything through one node), `direct` (all direct, for temporarily disabling the proxy).
proxies	The node list — each entry describes one proxy server's connection details (protocol, address, port, encryption, etc.).
proxy-groups	Groups nodes together and sets a selection strategy: `select` for manual selection, `url-test` to auto-pick the lowest latency, `fallback` for failover, `load-balance` for load balancing.
rules	The rule list, matched from top to bottom — the first match wins, so order matters.

Tip:Most subscription links generate a full proxies and proxy-groups section automatically — most users only need to fine-tune the rules section to customize their routing. For a full reference of every field and its possible values, see the Config Docs Center.

05 Full Rule Syntax Reference

Rules follow a consistent format: TYPE,MATCH_VALUE,TARGET. The target can be the name of a proxy group, or DIRECT or REJECT.

Rule Type	Example	Description
DOMAIN	DOMAIN,ad.example.com,REJECT	Exact match on a full domain, excluding subdomains.
DOMAIN-SUFFIX	DOMAIN-SUFFIX,github.com,PROXY	Matches a domain and all its subdomains — the most commonly used rule type.
DOMAIN-KEYWORD	DOMAIN-KEYWORD,ad-track,REJECT	Matches if the domain contains the given keyword — often used to block ad or analytics domains in bulk.
GEOIP	GEOIP,CN,DIRECT	Matches by the country or region of the target IP — routing mainland China IPs directly is the most common use case.
IP-CIDR	IP-CIDR,192.168.0.0/16,DIRECT	Matches by IP range — commonly used to route LAN or private network addresses directly.
DST-PORT	DST-PORT,443,PROXY	Matches by target port number — useful for distinguishing traffic types by port.
PROCESS-NAME	PROCESS-NAME,chrome.exe,PROXY	Matches by the process name that made the request — only supported on desktop platforms (Windows/macOS/Linux).
MATCH	MATCH,PROXY	The catch-all rule that matches any traffic not caught by earlier rules — it must be the last line in the rule list.

Tip:Rules are matched from top to bottom, and matching stops at the first hit — so more specific rules that need priority should go first, with broad catch-alls like GEOIP,CN,DIRECT and MATCH placed last. For advanced usage like Rule Providers, see the Advanced Configuration Guide.

06 Troubleshooting Common Issues

Here are the three issues beginners run into most often. For the full troubleshooting list — 20+ issues covering installation, connection, subscriptions, configuration, and account security — see the dedicated FAQ page.

Connected to Clash but can't access the internet?+

First, check whether the current node is working: run a latency test in the proxy group, and switch nodes if it times out or fails. Next, confirm that system proxy or TUN mode is actually turned on. Finally, check whether your firewall or security software is blocking Clash's network requests.

Subscription update fails or says it can't connect to the server?+

First make sure the subscription URL was copied in full with no extra spaces. Then check whether your current network can reach that URL directly — if the subscription URL itself requires a proxy to access, connect to any working node first, then update the subscription, or try again on a different network.

Is the Clash client itself free?+

Yes, both the Clash client and the mihomo core are free, open-source software. The client itself doesn't include any proxy nodes, though — you'll need to get a subscription link with node access from a proxy provider separately.

Didn't find your answer?Check out the full FAQ for the complete categorized list, or head to the Advanced Configuration Guide to learn about TUN mode, proxy groups, and other advanced features.

07 Glossary

When you're new to Clash, you'll run into some unfamiliar terms — here are the most essential ones. For the full glossary — 30+ terms covering protocols, rules, network modes, and more — see the dedicated Glossary page.

Node / ProxyThe connection details for a single proxy server, including address, port, protocol, and encryption method.

SubscriptionA remote URL whose content is a config file containing multiple nodes, which your client can automatically update on a schedule.

Proxy GroupA group of nodes with a selection method assigned: manual selection, automatic latency testing, failover, or load balancing.

RuleDecides which proxy group a given type of network request ultimately goes through, or whether it's sent direct or blocked.

Clash Tutorial — From Installation to Rule Configuration