Drawing No. RUMEN-01 · Kickoff Sheet · Scale 1:1
This site organizes Clash setup like a construction blueprint: start with the installers for all five platforms, follow the step-by-step diagrams for subscription import and system proxy setup, then use the rule-based routing section to configure local direct connections and overseas proxying in one pass. Every step is indexed, sourced, and verifiable.
Each of the five platforms maintains its own client lineup. Click a platform to jump straight to its section on the downloads page, where clients are ranked by maintenance activity and paired with a system requirements table.
The left side lists the detail contents, the right shows the matching panel. Each panel explains what the capability solves, how to enable it, how it differs from similar approaches, and includes essential config snippets where needed.
Rule-based routing is what sets Clash apart from blanket "global proxy" tools: as each connection is established, the engine matches the rule list top to bottom, using rule types like DOMAIN-SUFFIX, GEOIP, and RULE-SET to decide whether it goes direct, through the proxy, or gets blocked. Local sites stay on direct connections for native speed and login behavior, sites outside your region route through the proxy as needed, and ad domains get cut off outright — all three outcomes are configured once and keep working, with no manual toggling required. The rule list is plain text you can read and edit; match order follows write order, with a catch-all MATCH line at the end, so behavior is always predictable.
rules:
- DOMAIN-SUFFIX,openai.com,PROXY
- GEOIP,CN,DIRECT
- MATCH,PROXYA subscription link from your provider is essentially a fully hosted config, packaging the node list, policy groups, and rule list into a single URL. Paste it into the client's "Profiles" page and everything loads in one pull — no need to copy server addresses and ports by hand. Subscriptions support scheduled auto-updates, so changes on the provider's side sync automatically; multiple subscriptions can coexist and switch with one click without interfering with each other. Compared to manually maintaining node parameters, subscriptions remove the step most prone to error from everyday use. Import steps are laid out panel by panel in section two of the getting started guide.
System proxy mode registers an HTTP/SOCKS proxy address with the OS (default 127.0.0.1:7890), so browsers and most apps that respect system settings route through Clash automatically — it's lightweight, low-overhead, and the go-to choice for everyday use. But some programs — CLI tools, game clients, apps that ignore system proxy settings — bypass this entirely. TUN mode exists for exactly that: it creates a virtual network adapter and takes over all traffic at the network layer, so no process can slip past it. On Windows this requires installing a driver in service mode; on macOS it's called "Enhanced Mode"; Android's VpnService tunnel is the equivalent implementation. The tradeoffs and setup steps for each mode are covered in the tutorial and the corresponding handbook chapter.
Testing nodes one by one isn't practical once the list grows. Policy groups organize nodes by purpose: a select group lets you pick manually, a url-test group periodically sends real requests to a test URL and auto-selects the lowest-latency node, and a fallback group automatically switches in order when the primary node fails. Rules reference group names, not specific nodes, so swapping nodes never breaks the rule structure. The client UI lets you test an entire group's latency with one click, with real numbers to back every choice — turning "how do I manage dozens of nodes" from a daily chore into a one-time structural decision.
proxy-groups:
- name: PROXY
type: url-test
url: https://www.gstatic.com/generate_204
interval: 300Clash is an open standard for a core engine and config format, not a single closed-source app: the core is maintained by the mihomo project, while GUI clients like Clash Verge Rev, FlClash, Clash Nyanpasu, and Clash Meta for Android each build on top of it in their own way. Every client reads the same YAML config and honors the same subscription format, so switching clients doesn't mean relearning anything or re-importing your subscription. If a client stops being maintained (Clash for Windows, for instance), moving to an active project is just swapping the interface layer. The code is public and auditable, and updates are community-driven — which is why this site is comfortable recommending it as a long-term setup. See the client comparison page for a side-by-side breakdown.
The full walkthrough lives on the getting started guide; here's just the three main steps, each mapped to a section in the tutorial.
Pick your platform on the downloads page and install the matching client. Windows and macOS users follow the setup wizard; Android requires granting VpnService permission on first launch.
Copy the subscription link from your provider, paste it into the client's "Profiles" page, and once the node list loads, pick an exit node in the policy group.
Turn on the system proxy toggle, switch to rule mode, and visit a site outside your region to confirm it connects; if not, work through the troubleshooting table at the end of the tutorial.
For a tool you'll rely on long-term, how well-maintained the project is matters more than how it looks. Here are four facts you can verify directly in the public repositories.
The original Clash core went open source in 2018, establishing the basic shape of YAML config, policy groups, and rule-based routing. After the original repo was archived, the community fork Clash.Meta picked up development and was renamed mihomo, adding broader protocol support and more rule types — it's now the de facto standard core. This site's tutorials and handbook are all based on mihomo's behavior.
The core handles protocol implementation and rule matching; GUI clients handle the interface, subscription management, and system integration — the two evolve independently. Clients like Clash Verge Rev and FlClash bundle the mihomo core and update it alongside their own releases, so users never manage the core file separately; servers and routers, meanwhile, run the core binary directly against the same config file.
Active clients publish official releases on open-source platforms, with changelogs published in full. The download links on this site's downloads page point to each project's current release, and version info refreshes automatically as new releases go out; clients that are no longer maintained (Clash for Windows, ClashX Meta) are kept archived and clearly labeled — they're not recommended for new installs.
The full source of the core and mainstream clients is publicly hosted — protocol implementation, DNS handling, and rule-matching logic can all be read line by line, or built from source yourself. If you want to inspect the core implementation, use the command below to clone the mihomo core source repository:
git clone https://github.com/MetaCubeX/mihomo.gitThe four questions asked most before getting started — the full categorized Q&A lives on the FAQ page.
Check three things in order: whether the client's system proxy toggle is switched on; whether the current policy group has a working node selected (run a latency test — a timeout means that node is down); and whether a proxy extension in your browser is conflicting with Clash. If all three check out and it's still not working, see the full troubleshooting table under the Troubleshooting category on the FAQ page.
System proxy mode is fine for everyday browsing — lightweight and driver-free. Only turn on TUN mode when a CLI tool, game, or some other app that ignores system proxy settings needs to be routed through the proxy at the network level. See core capability detail F-03 and the corresponding handbook chapter for the full comparison.
Rule mode routes each connection based on the rule list, and is the recommended default; Global mode ignores the rules and routes all traffic through the currently selected node — use it only for temporary troubleshooting; Direct mode sends all traffic straight through without the proxy. Stick with rule mode day to day; the routing logic lives in the rules section of the config file.
Yes. A subscription is just a convenient way to load nodes in bulk — the client also supports writing node parameters directly into the config file (server address, port, protocol, password, and other fields). Field syntax is covered in the proxy nodes chapter of the Config Handbook; for local rule testing only, you can even run with just a DIRECT outbound.
Long-form pieces on troubleshooting, advanced config, and ecosystem choices, newest first — the three most recent are listed here.
All nodes timing out and only some timing out have different root causes. Work through subscription validity, local latency-testing methods, port and protocol parameters, and system time and firewall settings in order, with a clear diagnosis and fix at each step.
Read Full Article →Using local-vs-overseas routing as the example, this piece walks through combining DOMAIN-SUFFIX, GEOIP, and RULE-SET, how top-to-bottom rule matching works, and how MATCH catch-alls and common mistakes lead to rules silently not matching.
Read Full Article →System proxy toggle is on but no traffic is flowing — browsers and terminals fail for completely different reasons. This covers checking for browser proxy extension conflicts, system proxy registration, and the environment variables terminals need set manually, with verification commands included.
Read Full Article →