mihomo core·GPL-3.0 open source·Routing rules
Choose a client for your platform and explore subscription imports, routing rules, and configuration guides in Chinese.
CONFIGURATION / CONFIGURATION OPTIONS
The client provides the interface; the core handles connections. First check how traffic reaches the core, then review rules and DNS. Changing several settings at once makes problems harder to pinpoint.
Rule mode sends different destinations through different routes; it doesn't mean every connection uses a proxy. The core checks rules from top to bottom and applies the policy for the first match. Put specific domain rules before broader ones, and leave the catch-all rule last. For your first setup, use the proxy groups provided by your subscription, then check the connection list to confirm the domain, matched rule, and final route. This snippet demonstrates syntax only: LAN domains and private IP addresses connect directly, and so does all other traffic. It does not create proxy nodes. To use an actual proxy, set the target policy to a proxy group already defined in your configuration; referencing a nonexistent name will cause problems.
mode: rule
rules:
- DOMAIN-SUFFIX,lan,DIRECT
- IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
- MATCH,DIRECTThe system proxy works only when an app uses the system's proxy settings. Some terminal tools and games don't. TUN receives traffic through a virtual network interface and can cover more apps, but actual coverage depends on routes, exclusions, and system permissions. Before enabling it, make sure the regular proxy works, then install the required service or grant permissions as prompted by your client. This mihomo snippet isn't a complete configuration. If you already have a TUN section, merge these fields rather than adding a duplicate. After enabling TUN, check for conflicts with LAN access, DNS, and other VPN software. If something goes wrong, restore the previous settings and troubleshoot one item at a time.
tun:
enable: true
stack: mixed
auto-route: true
auto-detect-interface: true
dns-hijack:
- any:53DNS translates domain names into IP addresses; proxy rules decide where connections go. Check how they work together. Enabling DNS in the core doesn't automatically route every system and browser lookup through it: an app's encrypted DNS, system resolver settings, and TUN interception can all change the path. fake-ip mode maps domains to reserved addresses, which can preserve domain information, but some LAN services may need exceptions. The local listener shown below also requires the system or client to send requests to the specified port. First verify that DNS resolution works, then check the connection rules. A single DNS toggle can't tell you whether DNS is leaking.
dns:
enable: true
listen: 127.0.0.1:1053
enhanced-mode: fake-ip
fake-ip-range: 198.18.0.1/16
fake-ip-filter:
- "*.lan"
- "localhost"
nameserver:
- https://dns.alidns.com/dns-queryRules usually point to a proxy group, which then selects a node or another policy. A manual selection group is useful for initial testing because it fixes the route and avoids automatic switching during troubleshooting. A latency-testing group chooses from candidates based on responses from a test URL; handshake time isn't download speed and doesn't predict how every site will perform. The selection group below uses built-in direct and reject policies, so it illustrates the structure without external nodes. For real use, add node names from your subscription and make sure every group referenced by a rule matches its configured name exactly. Check capitalization, spaces, and nested references.
proxy-groups:
- name: Manual Select
type: select
proxies:
- DIRECT
- REJECT
rules:
- MATCH,Manual SelectThis snippet illustrates the fields; it isn't a replacement for a complete subscription configuration. A client may generate the configuration file through its interface. Check where overrides belong before editing, or a subscription update may overwrite your changes.
Desktop and mobile devices
Choose a package for your operating system and processor architecture. The interface, background permissions, and traffic-routing methods vary by platform.
mihomo
Handles proxy protocols, rule matching, and connections. The interface alone doesn't tell you what the core supports.
Check your configuration and core support
Node protocols, transport methods, and server settings must match. Subscription format compatibility doesn't mean every field is supported.
PACKAGE INDEX / PLATFORM DOWNLOADS
Choose your operating system, then check the processor architecture and system requirements. The download page lists clients, maintenance status, and installation guides; features depend on each project.
Start with desktop clients such as Clash Plus and Clash Verge Rev. After installation, import your subscription and enable the system proxy. If service installation or a virtual network adapter requires permission, follow the prompts. Don't confuse a node problem with a permissions issue.
Go to downloadsChoose the right installer for Apple Silicon or Intel. After opening the client, check its menu bar status and system proxy settings. System authorization during installation and proxy group selection during connection are separate steps.
Go to downloadsCompare options such as Clash Plus and Clash Meta for Android. Your first connection requires Android's VPN permission; for extended background use, check battery optimization settings too. If the connection drops after switching networks, first make sure the client is still running, then check the subscription and nodes.
Go to downloadsThe download page links to Clash Plus on the App Store and to the official site at clashplus.io. After installing, follow the in-app steps to import a configuration and allow the VPN connection. Check that the active configuration is enabled; seeing a VPN status on your device doesn't guarantee that a particular site matches a proxy rule.
Go to downloadsDesktop users can consider Clash Verge Rev or FlClash; first check the package format for your distribution. For servers and routers, consider running the core independently and managing its service, routes, and permissions yourself. Desktop GUI instructions may not apply to headless systems.
Go to downloadsBefore migrating from an older client, back up your subscription source, custom rules, and proxy group selections. Don't run two clients that both control the system proxy or TUN routes; their ports, system settings, and virtual adapters may conflict. Archived clients can help you work with old configurations, but a familiar interface is no reason to overlook maintenance status.
Browse all clients →FIRST CONNECTION / FIRST SETUP
Keep changes to a minimum during initial setup. Get one connection working first, then configure latency testing, custom rules, or broader traffic routing.
On the download page, check your operating system, architecture, and the client's maintenance status. After installation, open the client and make sure you can access its configuration list and connection page. Keep the default listening port on desktop for now; on mobile, be ready to grant VPN permission. If you've used another proxy app on your computer, quit it and check for leftover system proxy settings so the new client doesn't keep sending traffic to an old port.
Add your subscription URL on the configuration or subscription page. After it updates successfully, set it as the active configuration and check that its nodes and proxy groups appear. Downloading a client and getting proxy service are separate things; installing the app won't create working nodes. Subscription URLs often contain access credentials, so don't share them in public screenshots or group chats. If importing fails, first check that the link is valid and the configuration format is supported.
Choose a working node. On desktop, enable the system proxy; on mobile, establish the VPN connection when prompted. Visit a site and check the connection log. Confirm all three steps: the request reaches the core, the correct rule matches, and the route works. A successful startup or a latency test alone doesn't prove that app traffic is being routed. Enable TUN only after the basic setup works, and only if you need it.
Change one setting at a time and note its previous value. If a site won't load, restore the last configuration that worked, then check the subscription, node, mode, traffic routing, and DNS in that order. This is usually more effective than reinstalling the client.
Read the full guide →SOURCE / OPEN SOURCE & MAINTENANCE
Know which project, client, and service you're using. To decide whether a configuration will work, check the actual core, supported fields, and project maintenance status—not just the app's name.
Clash is the name of an early project and is also commonly used as a general term for rule-based proxy clients. After the original project and some older clients stopped being maintained, independently maintained cores and graphical clients continued to develop. mihomo carries forward the Clash Meta technical lineage, with rule matching, proxy protocols, and networking capabilities. Older guides may use different button names or configuration fields from current clients. Check which project a guide refers to rather than assuming that software with the same or a similar name is identical.
Desktop clients typically combine configuration management, policy selection, logs, and system proxy controls in one interface, then call the core to handle connections. A core's support for a field doesn't mean every client exposes a corresponding toggle. Conversely, a client's override features may change settings from the original subscription. When troubleshooting, check the effective configuration in use, not just the source file in an editor. When switching clients, pay close attention to configuration merge order, rule overrides, and local ports.
You can find mihomo's source code, license, and change history in its project repository. Open source makes it easier to study the implementation, report issues, and track fixes, but it doesn't guarantee the quality of third-party subscription services. Clients, node providers, and destination websites are separate parts of the connection. Connection logs can help identify problems, but they don't replace service terms or authorization. Use network tools in accordance with local laws, network policies, and your service provider's terms.
Keep client updates, core updates, subscription updates, and rule-set updates separate. Client updates may change the interface and integrations; core updates may affect supported fields and network behavior; subscription updates change nodes or configuration; and rule-set updates change what gets matched. Keep a recoverable copy of your configuration before updating. Afterwards, test direct connections, proxy connections, LAN access, and DNS separately. If behavior changes, use the change history to narrow down the cause. Avoid replacing the client, nodes, and entire rule set at once before investigating.
Read the complete guide, from core concepts to routine maintenance →
TECHNICAL NOTES / TECHNICAL NOTES
Choose a guide based on what you're seeing. First distinguish port listening, traffic routing, DNS resolution, and remote connections, then check the relevant items. Not every network issue is caused by a node.
Learn what a port-in-use error means, use system commands to find processes occupying ports such as 7890, and change mixed-port or external-controller settings to resolve the conflict.
Read article →Compare how system proxies route traffic only from apps that respect proxy settings, while TUN uses a virtual network adapter to capture traffic. Includes recommendations for games, terminal apps, UWP, and more.
Read article →Troubleshoot in order: subscription validity, node availability, proxy mode, system proxy, DNS resolution, and rule matching to find out why you're connected but can't access the internet.
Read article →