Open-source core · YAML configuration, explained field by field

Clash Config GuideUbuntu and cross-platform clients

From choosing a client to config.yaml fields, understand mihomo one layer at a time.

  • Chinese documentation
  • Rule-based routing
  • Ubuntu setup

Configuration syntax and the open-source core ecosystem

PLATFORM / CLIENT

Choose a system-specific download

Choose your operating system first, then check your processor architecture. Desktop apps, mobile network extensions, and command-line cores have different installation methods, but their configuration principles can be applied across platforms.

Windows

For a desktop setup, start with Clash Plus, then compare options such as Clash Verge Rev and FlClash based on your needs. Import a configuration and enable the system proxy to connect apps that respect system proxy settings to the local port. If you need to route traffic from more apps, consider TUN mode and its required permissions.

Check your processor architecture in system information before installing. If an older client is still running in the background, quit it and check the proxy port to avoid two cores listening at once. Store app connection issues may also be caused by loopback restrictions; whether a page opens in a browser does not tell you how every app is connected.

macOS

Choose an installer for Apple Silicon or Intel. Start by comparing Clash Plus, Clash Verge Rev, and FlClash. The menu bar toggle usually controls the system proxy; check the configuration page and logs separately to confirm that the core has loaded the current configuration.

On first launch, grant the permissions requested by the system. Network extension approval is separate from simply launching the app. Before switching clients, disable the proxy and background services in the previous one. The archived ClashX Meta download can be useful for compatibility reference; for ongoing use, prefer an actively maintained option.

Android

Choose from Clash Plus, Clash Meta for Android, FlClash, or Surfboard, and check which configuration formats each supports. Most mobile clients route traffic through the system VPN interface. On first connection, approve the system prompt; typically, only one VPN service can handle traffic at a time.

If background connections drop, first check battery optimization and background activity restrictions, then check your subscription and DNS. Per-app routing can also depend on client settings: an app excluded from traffic capture won't enter the YAML rule chain, even if rules are present. Check both settings layers when troubleshooting.

iOS

The download page links to Clash Plus on the App Store and lists its official site, clashplus.io. After installation, import a configuration supported by the app and follow the system prompts to add a VPN configuration. Desktop port, service management, and permission instructions don't directly apply to phones; use the settings provided by the app.

A successful import only means the app accepted the configuration; it doesn't guarantee that every protocol field works the same way. If a particular connection fails, check the node type and client compatibility first, then review the selected proxy group. Network changes, on-demand connections, and background behavior can also matter. Track these separately rather than changing several settings at once.

Linux / Ubuntu

Ubuntu desktop users can start with Clash Verge Rev or FlClash and install the package that suits their distribution. For servers or routers, mihomo can be deployed separately. A GUI client handles the tray, configuration management, and system integration; a standalone core requires you to set its working directory, configuration path, and service startup method.

GNOME's system proxy mainly affects desktop apps that respect that setting; terminal programs may need proxy environment variables configured separately. With systemd, check that the service account can read the configuration, that logs show no port binding errors, and that TUN permissions are in place. Don't run every program as an administrator as a workaround.

CONFIG / FIELD NOTES

config.yaml configuration explorer

Read in this order: accept requests, resolve domains, choose an outbound, then match rules. The snippets below show how fields relate; they are not complete configurations with working nodes.

YAML uses indentation to express structure, so both field names and their location matter. Back up the current file before editing, change one category of settings at a time, then validate the syntax with the client or a core test. The configuration shown in the UI, the subscription file on disk, and the merged runtime configuration may differ. When troubleshooting, check what was actually loaded.

general is a section label used in this guide for basic fields; it is not a top-level key to add to your file. The other tabs correspond to actual configuration sections. Understand what each section does before adding fields; this makes conflicts easier to spot than pasting together multiple examples. Check each client's documentation for its defaults and override behavior.

general

Ports, mode, and logs

mixed-port: 7890
allow-lan: false
mode: rule
log-level: info

Basic fields determine how the core accepts requests. mixed-port is shared by HTTP and SOCKS5; if you change it, update the proxy address in apps where it's set manually. allow-lan controls whether local network connections are accepted; on a personal computer, it's usually best to leave this off. Set mode to rule to enable rule-based routing. Start with info for the log level, and add detail if needed. These fields belong at the YAML root—don't wrap them in a general section, or the core won't be configured as expected.

Read the guide →

OPEN SOURCE / CONTEXT

The Clash ecosystem and the mihomo core

Understanding how the software components relate is more useful than memorizing client names. Open-source repositories are a place to review code, release notes, and issue discussions; confirm specific capabilities against the core you're actually using.

How original Clash, Meta, and mihomo relate

Clash introduced a YAML-centered configuration model: listeners accept app requests, nodes define available outbounds, proxy groups organize nodes, and rules determine where connections go. Clash Meta expanded protocol and networking capabilities on that foundation, and its successors continued development under the mihomo name. Clash Meta and mihomo are therefore historically connected, but that doesn't mean every app with Clash in its name includes the same features. When you encounter an unfamiliar field, check which core is running and consult its documentation; this is more useful than repeatedly reimporting a subscription.

Common public implementations of the original Clash are no longer maintained, so defaults, supported protocols, and installation instructions in older guides may not apply to current clients. Before migrating, record the protocols, DNS mode, rule sets, and local overrides you use, then check each one against the new environment. Reading basic YAML structure is only the first step in compatibility; node transport parameters, provider behavior, and operating system integration may still differ. Keep a backup of historical configurations to make migration and troubleshooting easier to compare.

What the GUI and network core each handle

Desktop clients usually handle subscription imports, configuration switching, tray menus, auto-start, and system proxy toggles; the core parses the configuration and handles connections. A UI showing that the client is running doesn't guarantee that a target app is using the proxy, and a running core doesn't mean the system proxy and DNS are configured correctly. On Ubuntu, distinguish the GNOME desktop proxy, terminal environment variables, and TUN routing. Each covers different traffic, so choose the right path for each app to avoid duplicate capture and routing conflicts.

A command-line deployment suits standalone operation, service management, or remote maintenance, but tasks normally handled by a GUI become your responsibility. Decide in advance where the configuration lives, which account runs the service, how to view logs, and how to stop it if something goes wrong. A systemd working directory affects relative paths, and file permissions affect access to rule files. First confirm that the core can load the configuration in the foreground, then set up a background service. This helps separate configuration errors from service management issues.

Updates, subscriptions, and personal rules

Client updates, core updates, and subscription updates are three different operations. A client update may change the UI and system integration; a core update may change field behavior; a subscription update typically refreshes nodes and rules. Identify what you're updating and record the current settings first. In clients that support configuration merging, keeping personal rules in a dedicated override layer is usually easier to maintain than editing a downloaded subscription file. Still, check the merge order to ensure your DNS settings aren't overwritten by another source.

Open-source licenses set the terms for using and distributing code; they don't mean that all clients have the same license or release process. This site organizes configuration guides and download links; it doesn't replace each project's release notes. When reviewing issue discussions, compare the operating system, core type, and reproduction steps rather than relying on similar titles. Before sharing logs or configurations, remove subscription URLs, passwords, and personal network information. The field structure and error context are usually enough for a technical discussion.

Troubleshoot connections layer by layer

Start closest to the app: check whether it uses the system proxy, a manually configured proxy, or TUN. Then check the local port and core, followed by rule matches, the selected proxy group, node connectivity, DNS, and the destination service. A page opening in a browser only confirms that one path works; it doesn't verify other apps or protocols. Change one variable at a time and keep logs from before and after each change to make cause and effect clear.

For DNS issues, distinguish resolution failures from cases where resolution succeeds but the connection fails. For the first, check the request path, upstream availability, and resolution mode; for the second, continue with rules, the outbound, and the destination address. HTTPS certificate warnings shouldn't automatically be blamed on the proxy: system time, certificate chains, packet inspection tools, and the destination service can all be involved. Don't disable certificate validation just to make a page load; keep the error details and troubleshoot layer by layer. For protocol differences and core choices, see the protocol reference. To follow a step-by-step setup, start with the getting started guide.

NOTES / TROUBLESHOOTING

Recent configuration guides

Troubleshoot based on the symptoms you see: identify the layer where the problem occurs before deciding whether to change the configuration.

Troubleshooting

Browser shows a certificate error after enabling a proxy: causes and troubleshooting

Covers certificate warnings caused by system clock drift, interception tools, node hijacking, and DNS poisoning; explains which issues involve Clash, which don't, and how to address them.

Keep the certificate error details and distinguish problems with the destination site from interference along the connection path. Don't hide an issue by disabling security checks.

Troubleshooting

Clash reports a port conflict on startup: find the process and change mixed-port

Use netstat, lsof, and ss on Windows, macOS, and Linux to identify processes using ports such as 7890. Learn how to update system proxy and browser settings after changing the port.

First check whether the process belongs to an old client or background service, then decide whether to stop it or change the port. If you update only the YAML but leave the app pointing to the old proxy address, connections will still fail.

Platform Setup

Deploy mihomo on Ubuntu: desktop clients and a headless systemd setup

Covers installing a GUI client on the Ubuntu desktop and deploying from the command line on a server, including binary placement, config.yaml paths, systemd service files, and permissions required for TUN.

Choose a route based on whether you need a desktop interface. Test the configuration in the foreground, then verify service startup and auto-start separately to avoid mixing up working-directory and permission issues.