Clash ClientDownloads & Setup Guide

rules:
  - DOMAIN-SUFFIX,github.com,PROXY
  - GEOIP,CN,DIRECT
  - MATCH,PROXY

Rules are checked from top to bottom, and the first match determines the connection policy. Put specific domain rules first, then regional rules for direct connections, and use MATCH last to catch everything else. PROXY in this example must be a defined proxy group; DIRECT is the built-in direct policy. Unlike switching all traffic to one global exit, rule mode routes traffic based on its destination. After editing, reload the configuration and check the matched rule on the Connections page. Subscription updates may overwrite direct edits, so keep long-term rules in a client-supported override location.

proxy-groups:
  - name: PROXY
    type: select
    proxies:
      - AUTO
      - DIRECT
  - name: AUTO
    type: url-test
    use:
      - subscription
    url: https://www.gstatic.com/generate_204
    interval: 300

Proxy groups separate a set of nodes from the targets referenced by rules. Use select for manual choice and url-test to automatically pick a candidate based on checks against a specified test URL; an automatic group is not guaranteed to be fastest for every site. This example references a proxy provider named subscription, which you must define before use. You can point PROXY to AUTO for everyday use, then select a different route for specific needs. Changing a proxy group changes the exit, not the matching logic, unlike rewriting rules one by one. Group names must match the names used in rules, and groups must not reference each other in a loop.

tun:
  enable: true
  stack: mixed
  auto-route: true
  auto-detect-interface: true
  dns-hijack:
    - any:53

TUN receives traffic through a virtual network interface, making it useful for apps that do not use the system proxy. It typically requires administrator privileges or the client's service mode. Unlike a system proxy, TUN involves routing, interfaces, and DNS interception, so make sure a standard proxy connection works before enabling it. Automatic routing in this example changes how traffic enters the client; support depends on the operating system and client. If another VPN is running, check for route conflicts first. To turn TUN off, use the client's control to restore networking rather than force-quitting the process. If local network access stops working, check routes and firewall settings too.

dns:
  enable: true
  listen: 127.0.0.1:1053
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  nameserver:
    - https://dns.alidns.com/dns-query

DNS settings determine how domain names are resolved and can affect domain-based routing. In fake-ip mode, the core returns a mapped address first, then handles the connection using the destination domain; this is not the real address of the remote site. The example shows only basic fields. Choose upstream servers based on what is reachable on your network. Enabling a DNS listener does not mean the system is using it; check how the client takes over DNS as well. If certain apps have issues, configure fake-ip-filter as needed instead of disabling DNS entirely. Troubleshoot in order: check the DNS result, then the rule and exit.

proxy-providers:
  subscription:
    type: file
    path: ./providers/subscription.yaml

proxy-groups:
  - name: PROXY
    type: select
    use:
      - subscription

A subscription may contain a complete configuration with rules and proxy groups, or just a list of nodes; these formats require different import methods. GUI clients usually accept a full subscription URL on the Configuration page. proxy-providers organize node sources separately. This example reads a local provider file, which must contain nodes in the expected format. Check the provider's instructions to identify the format before choosing an import method. If an update fails, check whether the URL is still valid, whether the response contains configuration data, and whether your network can reach it. Subscription URLs may include credentials, so redact the full link before sharing screenshots or logs.

mixed-port: 7890
allow-lan: false
bind-address: 127.0.0.1
mode: rule
log-level: info

Clients on different platforms can use similar YAML configurations, but system proxy settings, background operation, and permissions vary. mixed-port provides a shared listener for HTTP and SOCKS; whether the client applies system settings automatically depends on the client. This example listens on the local device only, which is suitable for checking a single-device connection first. When migrating a configuration, check for port conflicts, file paths, and supported core fields. Do not apply desktop service settings directly to a phone. Before choosing a client, check system architecture and maintenance status, then compare interface features. The download center lists clients and installers.