Client downloads for Apple silicon Macs and iPhone. Choose the right build for your device, then follow the steps to import a subscription and configure rule-based routing.
PROXY / ROUTING / CONFIG
Test your connection with the system proxy first, then enable TUN if needed. The settings mockup is on the left; notes on the right explain when to use each option. Menu names vary by client.
For illustration only. This does not change your device's network settings.
How permissions and helper services are installed depends on the client.
rules:
- DOMAIN-SUFFIX,apple.com,DIRECT
- MATCH,PROXYmixed-port: 7890
allow-lan: false
mode: rule
dns:
enable: true
enhanced-mode: fake-ipPartial settings example; nodes and complete proxy groups are omitted.
Enable this only on trusted networks, and restrict access with authentication and firewall rules.
The system proxy is a good first test on Mac. Import a profile, start the core, then enable the client's system proxy so browsers that follow macOS network settings can connect through its local listening port. This does not route all device traffic: terminal tools, games, and apps that manage their own networking may still connect directly. If a browser works but another app does not, check whether that app uses the system proxy before trying an in-app proxy or TUN. Turn the system proxy off normally when finished to avoid leaving proxy settings pointed at a closed client.
Check connection and verification steps →TUN handles traffic routed through a virtual network interface, making it useful for apps that do not support the system proxy. A macOS client may require a helper service or specific permissions; follow the app's instructions rather than assuming every implementation uses the same network extension. Before enabling TUN, disable other tools that take over routes. After connecting, check rule matches and DNS resolution. TUN expands which traffic can enter the client; it does not automatically switch rule mode to global mode. If the network stops working, turn TUN off to restore the baseline, then check for route conflicts one at a time.
Learn about macOS TUN permissions →For everyday use, start with rule mode, where domains, destination addresses, or rule sets determine how connections are routed. Rules are typically evaluated in order; the first match selects a direct route or policy group, while the final MATCH rule catches anything else. Global mode sends traffic through the selected global policy and is useful for short tests, but it is not inherently faster. To troubleshoot a site, check the matched rule and selected policy in the connection log before editing the relevant entry. Changing nodes alone may not change the route used by that connection.
Review rules and troubleshoot connections →A Clash configuration contains more than a list of nodes: it also defines listening ports, proxy groups, rules, and DNS settings. Before importing, confirm the subscription returns YAML that the client can read, not a webpage or a generic node encoding. When editing by hand, use spaces for indentation and check that every policy group referenced by a rule exists. The snippet on the left shows only selected fields; it is not a complete configuration. Remote updates may overwrite local edits, so maintain persistent custom rules with the client's supported override or merge feature. Keep a recoverable copy of the original before making changes.
Learn about subscription formats and conversion →LAN sharing lets other devices on the same network connect to the proxy port on your Mac. In addition to enabling allow-lan, check the bind address, firewall rules, and connectivity between devices. Other devices must use your Mac's current LAN address, not their own loopback address. A mixed port accepts both HTTP and SOCKS connections, but each app still needs the right protocol selected. Never expose the listening port directly to the public internet, and disable sharing on public networks. If sharing is necessary, use authentication and restrict allowed sources; disable access again when you leave a trusted network.
Check ports and firewall settings →BUILD TARGETS
Check your device and processor first, then compare client features. Clash Plus is the recommended starting point across platforms. Other clients may suit existing workflows or users who need a particular interface; check each app's documentation for supported platforms and features.
Choose an arm64 or Apple silicon build for an Apple silicon Mac, and x86_64 for an Intel Mac. Find your processor in Apple menu > About This Mac; don't infer the architecture from the macOS version or the computer's appearance.
Compare the system requirements and helper-service notes for Clash Plus, Clash Verge Rev, and FlClash. A native build does not guarantee the system proxy is working: after installation, import a profile and test the connection.
Go to downloadsInstall Clash Plus on iPhone or iPad through its App Store listing. The official website is clashplus.io. When you connect for the first time, approve the VPN configuration prompt, then return to the app to check the active profile and policy selection.
Background operation and network switching work differently on mobile than on desktop. Before sharing a subscription, check which fields the app supports. Mac-specific local file paths, process rules, and desktop helper-service settings cannot simply be copied over.
Go to downloadsStart with Clash Plus, or compare Clash Verge Rev, FlClash, and Clash Nyanpasu. If you're looking for a Clash for Windows alternative, check configuration compatibility, maintenance status, and service mode—not just the interface.
Export a backup before migrating an old configuration. After installation, check the local listening port and system proxy again. Archived apps can help you inspect an old setup, but are not recommended as the default for a new device.
Go to downloadsOptions include Clash Plus, Clash Meta for Android, FlClash, and Surfboard. Check the package architecture first, then confirm which subscription formats the app supports. Configurations are not always interchangeable between rule engines.
The first connection requires system VPN permission. If the connection drops when the screen turns off, check background restrictions in your system's battery settings. If it fails only on mobile data, compare with Wi-Fi to determine whether the network is the cause.
Go to downloadsFor desktop Linux, compare Clash Verge Rev and FlClash, and choose a package for your distribution. Server and router users can explore the mihomo core, managing the configuration directory, service startup, and network permissions themselves.
A graphical client and a standalone core work differently: the client provides a configuration interface, while the core requires a clearly defined working directory and service logs. When troubleshooting, check that the process is running and listening on its port before investigating routes and DNS.
Go to downloadsFIRST CONNECTION
Start with the simplest working connection, then add custom rules. Change one type of setting at a time so you can identify what caused a problem.
Open the client's Profiles or Subscriptions page, choose import by URL, and paste a subscription link from a trusted provider. Once the download finishes, set it as the active profile. If you get a webpage, authentication prompt, or format error, fix the subscription first instead of repeatedly toggling the proxy.
A subscription link may contain access credentials; treat it like a password. A successful import only means the profile can be read, not that every node is reachable. Next, check that a policy group has an available proxy to select.
Set proxy mode to Rule and select an available proxy from a policy group in the profile. On Mac, enable the system proxy first and test with a browser that follows system settings. On iPhone, approve the VPN connection prompt and confirm the app shows a connected status.
Keep the subscription's DNS and routing settings unchanged for now. If an app does not use the system proxy, consider TUN only after checking helper-service and permission requirements. Don't run multiple tools that take over network traffic at the same time.
Visit a site you want to test, then check the client's Connections page for the destination domain, matched rule, and selected policy. Distinguish a DNS lookup failure from a connection timeout or an error on the website itself. One latency test is not enough to diagnose the entire network.
Then test familiar sites that should connect directly to make sure rules are not routing them by mistake. If something goes wrong, turn off the connection method you just enabled to restore the baseline. Record the steps to reproduce the issue and follow the troubleshooting guide; don't rush to delete the entire profile.
OPEN SOURCE / MIHOMO
When choosing a client, evaluate the interface project, core, and configuration source separately. Public source code makes implementation easier to inspect, but does not replace checking permissions, profile contents, and service providers.
Graphical clients in the Clash ecosystem are not simply different skins for the same app. The core handles protocol connections, rule matching, and DNS; the interface project manages profiles and interactions such as system proxy settings and service installation. mihomo continues the technical direction of Clash Meta. Check its documentation and release notes for specific protocol and configuration-field support. A client's name is only a clue when assessing compatibility; check which core it actually uses and what features it supports.
The mihomo project is licensed under GPL-3.0. Its public repository includes source code, issue discussions, and release history. This license applies to the core; it should not be assumed to cover every third-party interface or app-store app. To understand how traffic is handled, start with the relevant modules and documentation. For everyday use, choose a client with active maintenance, clear system requirements, and a build for your device's architecture.
Interface, core, and subscription updates are separate sources of change. An interface update may alter permissions or helper-service installation; a core update may change supported fields; a subscription update may replace nodes, policy groups, or rules. Back up your profile and read the release notes before upgrading, then test frequently used sites and direct connections. If a problem appears, roll back the component that changed. That's easier to diagnose than reinstalling the app, resetting DNS, and rewriting rules all at once.
TECHNICAL NOTES
Continue with the guide that fits your task: learn about TUN to route app traffic, compare cores to check configuration compatibility, or review sync options for managing multiple devices.
Learn how TUN routes traffic through a virtual interface, how it differs from the system proxy, and how to install the helper service and approve network permissions on macOS.
Read the technical note →Trace the evolution of Clash cores from the original project to Meta and mihomo. Compare protocol and rule support, TUN implementations, and configuration compatibility to assess what migration involves.
Read the technical note →Compare three approaches—remote profile subscriptions, iCloud Drive file sync, and a private Git repository—their maintenance costs, and which settings need to remain device-specific.
Read the technical note →