Clash Setup Guide

Understand & Choose an Operating ModeMODE

The client offers three traffic-handling modes: Rule mode matches traffic against the rules in config.yaml one by one to auto-route it — mainland China direct, everything else via proxy, ads blocked, all decided automatically — and it's the recommended mode for everyday use; Global mode ignores all rules and forces every connection through the same proxy node, mainly useful for briefly testing whether a specific node actually works; Direct mode turns the proxy off entirely, equivalent to the network state before Clash was installed, useful for A/B testing or saving data temporarily.

One concept that's easy to confuse is TUN mode — it's not another option in the list above, but a separate choice about "how traffic gets intercepted." The system proxy only works for apps that respect system proxy settings (browsers, most regular software), but some command-line tools, games, and background services ignore it entirely. That's when you need TUN mode: the client creates a virtual network adapter that intercepts all traffic at the network layer. It's more thorough, but the first time you enable it requires extra authorization (see the platform-specific instructions in "Turn On the System Proxy" below). Beginners should stick with the system proxy first and only consider enabling TUN if a specific app just won't route through the proxy.

Turn On the System ProxyCONNECT

The core logic of the system proxy is the same on every platform — it forwards network requests from the system or apps to the local port Clash listens on (default 127.0.0.1:7890). What differs is where the toggle lives and where the config file is stored, covered platform by platform below.

Windows Right-click the tray icon and check "System Proxy" in the menu to turn it on; uncheck it to turn it off. If you want TUN mode, the first time you enable it you'll be prompted to run as administrator once to register the virtual adapter driver — after that, it works automatically on normal startup. The config file lives at %USERPROFILE%\.config\clash\config.yaml by default, and you can open or back it up with any text editor.

macOS Click the menu bar icon and choose "Set as System Proxy" to turn it on. For TUN mode, go to System Settings → Privacy & Security → VPN & Network Extensions, find the corresponding extension, and allow it — then restart the client for TUN to take effect. This is a macOS-level security restriction, and not finding this setting the first time is the most common sticking point. The config file lives at ~/.config/clash/config.yaml.

Android Open the app, import your subscription link on the "Profiles" page, then go back to the home screen and tap the floating "Connect" button. Android's standard VPN permission dialog will pop up — tap "OK" to establish a local VPN tunnel and start forwarding traffic. Some Android skins (especially MIUI, ColorOS, and Funtouch OS) aggressively kill background VPN processes to save power, so add Clash to your battery optimization whitelist in system settings — otherwise it may disconnect on its own after a while.

iOS Due to App Store review policies, there's no official native Clash app for iOS — most people use a third-party client compatible with Clash's rule format (like Stash or Shadowrocket). Add your subscription link on the app's "Profile" page and turn the connection on; you can then check status or disconnect manually under Settings → General → VPN & Device Management. Wording varies slightly between apps, but the flow for importing a subscription and toggling the connection is basically the same.

Linux GUI versions (like clash-verge) work the same way as on Windows/macOS — right-click the tray icon to turn on the system proxy. For headless setups (like a cloud server), there's no tray icon to click, so you'll need to edit the config file manually and run it as a systemd service, then set proxy environment variables in your shell so command-line tools route through it too:

Verify It's WorkingVERIFY

After the three steps above, take a minute to confirm the proxy is actually working — don't just assume it is:

Method 1 · IP lookup: Visit any IP lookup site in your browser. If the exit IP's location matches the node you're connected to (e.g., you connect to a Hong Kong node and see a Hong Kong IP), the system proxy is working.

Method 2 · Connections panel: Open the client's "Connections" panel to see in real time which rule and node each connection is using — the most direct way to verify routing is working as expected.

Method 3 · Connected but a specific site won't load: This is the most common case that looks broken but usually isn't — the domain is just being matched to DIRECT by a rule (common with newer or niche domains not yet covered by a rule set). Check the Connections panel to see which rule matched. If it's a misclassification, add a DOMAIN-SUFFIX rule in your custom rules to force it through the proxy (see the rule syntax below). If it already matched a proxy rule but still won't load, the node itself is probably down or too slow — switch to Global mode and test other nodes to rule that out.