The examples above are for teaching only. They do not show the device's current state or a real client screenshot.
Local Overrides
local override
mode: rule allow-lan: false
Merged YAML Example
mixed-port: 7890mode: ruleallow-lan: false
Green lines mark overridden fields; the exact merge behavior depends on the client implementation.
Configuration example · Confirm field support before checking the effective configuration
Confirm the platform and architecture before installing
Clash Download Platforms
Desktop packages, mobile apps, and standalone cores each have their own requirements. Choose the device first, then compare configuration management and traffic interception.
First confirm the processor architecture in your system information. Start with Clash Plus, then compare how Clash Verge Rev and FlClash manage configurations; legacy clients are useful only for understanding older configuration environments.
For first-time setup, verify that the system proxy is being honored. If you need to intercept apps that ignore system proxy settings, then check the services and permissions required by TUN; there is no need to enable every feature at once.
Choose a package for your device architecture and check the system requirements. The download page lists Clash Plus, Clash Meta for Android, FlClash, and Surfboard; configuration compatibility cannot be determined from the file extension alone.
Read the system VPN authorization prompt when starting a connection. If the connection drops after the screen locks, check background activity and battery restrictions first; if another VPN is running, check for an interception conflict.
Use the download page to open Clash Plus in the App Store and review the current system requirements and app details. The project website is clashplus.io; compare its supported platforms before installing.
When importing, confirm whether the app expects a complete configuration or node information, then add the VPN configuration as prompted by the system. Desktop steps such as service installation and port listening should not be copied directly to a phone.
Check whether your Mac uses Apple Silicon or Intel under “About This Mac,” then choose the matching package. Clash Plus, Clash Verge Rev, and FlClash are useful starting points for comparison; archived projects require a separate assessment of their maintenance status.
Read each system authorization notice when network extensions or helper services are involved. If the app will not start, check the installation source, architecture, and system compatibility first; disabling system security protections is not a standard step.
Desktop users can compare Clash Verge Rev and FlClash and choose a package for their distribution. Verify the architecture, desktop environment, and dependencies before installing; different package formats do not determine whether proxy protocols are supported.
Server and router users can explore the standalone Mihomo core. The core itself is not a graphical client; users must manage configuration paths, startup services, log retention, and network permissions.
Downloading a client only prepares the tool; it does not automatically provide a working proxy service. Before configuring, obtain a valid subscription or node parameters from a trusted source. Back up the old configuration before migrating, and avoid letting multiple clients modify the system proxy at once, or closing one may still leave networking broken.
Four common setting categories follow the same configuration chain. The explanations and examples are aligned line by line, so there is no need to guess what fields mean across multiple pages.
Rule mode: choose an exit by connection target
Clash routing rules associate matching conditions such as domains and destination addresses with an action. In rule mode, connections are checked in order; more specific conditions usually come first, with a fallback at the end. A rule can target a proxy group, node, or built-in action, so the mode field alone cannot solve connection problems without the full configuration.
Global mode changes how connections that have already entered the core choose an exit; it does not mean every app on the device has been intercepted. Instead of simply switching the mode label in the interface, check connection records to confirm the matched rule and actual exit before changing the order.
This only demonstrates rule structure: everything goes DIRECT, with no proxy nodes. It is not a recommended routing plan.
mode: global
This only demonstrates the mode field. The actual exit must be selected in the global policy; whether an app enters the core still depends on the system proxy or another interception method.
DNS Handling: Separate Resolution from the Connection Path
DNS converts domain names into address information needed for connections and can affect whether the core matches rules by domain. Fake-IP mode preserves the domain association through virtual address mapping, but the app's queries and subsequent connections must enter the appropriate processing path. Adding DNS fields alone does not mean the operating system, browser, or LAN devices will automatically use them.
When troubleshooting Clash DNS leaks, check the system resolver, browser secure DNS, TUN DNS interception, and upstream request exit separately. If a LAN service depends on real addresses, configure exclusions based on the symptoms rather than adding every domain to the filter list to silence one error.
The upstream addresses only illustrate list syntax; choose them according to your network and privacy requirements. This snippet does not include system DNS interception or upstream connection policies.
Proxy Groups: Separate Rule Targets from Node Selection
A proxy group receives a rule target and passes the connection to a selected node or action within the group. Rules can then keep referring to the same group name instead of being edited every time a node changes. Manual selection is useful for validating a configuration first; automatic testing and failover groups also require a test URL, interval, and health-check conditions, not just a different type name.
Names in Clash proxy groups must exactly match their rule references; spaces, capitalization, and duplicates all affect recognition. A test result shows reachability to the specified target, not proof that every website is accessible. On the first import, confirm that the group contains selectable options and that the selected option is the one you expect.
The example uses only the built-in DIRECT action to demonstrate name references. To use a proxy, define valid nodes separately or add a proxy collection according to the core's syntax.
Configuration Overrides: Preserve the Source of Local Settings
A subscription update may replace the downloaded configuration, so edits made directly to the subscription source may not persist. If the client supports local overrides, store personal settings such as the port and mode separately and apply them when generating the runtime configuration. This is a configuration management feature, not a universal core syntax supported by every client.
Merge behavior needs particular attention: scalar fields may be replaced, mappings may merge recursively, and lists may be replaced wholesale or inserted in order. The homepage demonstrates only simple fields; it does not imply that nodes and rule lists merge the same way. After editing, inspect the final effective configuration and confirm that custom content remains after a subscription update.
# Local override snippet, handled by the client
mode: rule
allow-lan: false
allow-lan: false limits proxy access from the LAN; it is not a complete firewall policy. Check the listening address and system permissions separately.
From Configuration File to Connection Verification
Clash Tutorial in Three Steps
Build one connection path you can explain before adding complex rules. The complete workflow is on the quick-start page; here, each step keeps its verification goal.
Add a URL from a trusted source in the client's configuration or subscription manager, or import a local YAML file. A subscription URL, a single-node share link, and a complete configuration are different input types. If the entry point does not match, confirm the format instead of repeatedly pasting it into different fields.
After importing, check that the configuration is selected, proxy groups appear, and node fields are recognized. A successful download only means that content was retrieved; it does not mean the core has loaded it. Subscription URLs may contain access credentials, so remove sensitive data from screenshots, logs, and support requests.
Start with rule mode and choose the expected exit in the proxy group. On desktop, begin by verifying the system proxy; on mobile, grant VPN permission through the app's flow. The system proxy affects only apps that honor it. TUN expands the interception range but requires coordination among routing, permissions, and DNS.
Do not treat “Allow LAN access” as necessary for this device to access the internet. Do not run multiple proxy clients while testing the same connection either. Keep one interception entry point, record the current settings, and change only one item at a time so you can identify the cause of each change.
First confirm that basic networking works with the proxy off. Then make a new test request and inspect the target, rule, and exit in the client's connection log. Opening a webpage in a browser does not prove that every app is intercepted, and existing long-lived connections may temporarily keep their original path.
If a request times out, check local connectivity, subscription validity, node parameters, DNS, and the interception method in that order. Re-test after switching networks to avoid mistaking an unreachable test address for a failed node. When finished, properly disable the system proxy or VPN and confirm that direct access has returned.
Similar project names do not mean the projects are maintained by the same team. Download choices, configuration compatibility, and issue reports should all be directed to the specific project and the component actually in use.
From the Clash Configuration System to Mihomo
Clash rules and YAML configuration conventions are used by multiple clients, followed by different core branches and interface projects. Mihomo is an open-source core project in this ecosystem. The Clash Meta name in older materials is related to it, but that does not mean every app with Clash in its name uses the same core.
When a field from an older guide errors in a newer environment, check the core documentation and change notes first, then confirm whether the client rewrites the configuration. An interface supporting a file import does not mean it can execute every protocol, DNS option, or experimental field inside it; the same subscription can produce different runtime configurations in two clients.
Review Interface and Core Updates Separately
A client update may change subscription editing, system services, or override behavior, while a core update may affect protocol implementation and rule behavior. Before updating, save the original configuration, override files, and necessary logs. Afterward, recheck key connections; avoid changing the client, core, and subscription format at the same time without a backup.
Open-source code provides a way to understand implementation and track issues, but repository activity should not be treated as a direct measure of connection quality. Assess maintenance using project announcements, release notes, and known issues. Even archived software that still launches carries compatibility and maintenance risks after system upgrades.
Choose references by problem layer: check the client documentation for installation and permission issues, the core documentation for field parsing errors, the service source for subscription update problems, and DNS plus connection logs for website reachability. Separating these layers is usually more effective than repeatedly reinstalling or copying an unfamiliar full configuration.
After completing the basic workflow, read the guide for the specific problem you encounter. First identify the layer where the symptom occurs, then choose the setting to adjust.
Explains virtual address mapping through the DNS lookup and connection process, including Fake-IP requirements, LAN compatibility issues, and the configuration boundaries of fake-ip-filter.
Distinguishes interface crashes from core startup failures, then checks system architecture, runtime dependencies, permissions, and configuration files in order, with guidance on preserving logs and restoring settings from a backup.
Trace the issue layer by layer from local connectivity and subscription validity to node parameters, DNS, and proxy interception. Distinguish an unreachable test address from an actual connection failure and avoid repeated reinstalls.