Find Clash Android clients, subscription setup steps, and protocol selection guides in one place. The first connection starts with system VPN permission, followed by importing a configuration, choosing a policy, and checking proxy status.
PLATFORM ENTRY
SYSTEM CAPABILITIES
Start with Android VPN permission and learn what each network function in the Clash client does. Select a feature on the left to view its purpose, location, and key parameters on the right.
The Android client uses the system-provided VpnService to create a local virtual network interface. When the proxy starts for the first time, Android displays a connection request; select OK before app traffic can enter the Clash core for matching. Granting permission only allows the client to take over the network interface—it does not mean a working proxy has been selected. After connecting, check the active Profile, policy group, and DNS status. If no VPN indicator appears at the top of the screen, return to the client and restart the service, then check whether the device manufacturer restricts background activity.
interface: VpnService · permission: user-confirmed · scope: local traffic
A Profile is a complete collection of proxies, policy groups, DNS settings, and rules. Typically, paste the subscription URL on the configuration page, download it, select the relevant entry, and then choose a policy on the proxy page. Updating a subscription fetches the remote content again, so local manual edits may be overwritten. Put changes that must persist in the client’s override feature or maintain a separate configuration. Multiple Profiles can be saved separately for work, mobile networks, and testing; after switching, confirm the active policy group again.
profile: YAML · update: remote subscription · override: client-side
Rule mode matches domains, IP addresses, processes, or rule sets in the order defined by the configuration, then sends traffic to the corresponding policy group. Rules near the top take effect first, while MATCH usually handles anything left unmatched. Compared with global mode, rule mode keeps direct services on their normal path and sends only selected traffic through the proxy. When troubleshooting routing, first check the matched rule in the connection log, then inspect the policy group it points to instead of repeatedly switching proxies.
mode: rule · evaluation: top-down · fallback: MATCH
The DNS module determines where domains are resolved and can affect the accuracy of rule matching. Fake-IP mode first returns a mapped address, then matches rules by the domain mapping when the connection is established, making it useful when DNS and connection handling need to be managed together. Some LAN devices, special apps, or address-detection mechanisms may need to be added to a filter list. If a connection is active but websites will not load, check DNS server reachability, enhanced mode, IPv6 settings, and system private DNS in order. Avoid changing several variables at once.
dns-enhanced-mode: fake-ip · mapping: domain-to-address · cache: local
TUN mode takes over programs that do not follow system HTTP or SOCKS proxy settings, including some terminal tools, games, and standalone network components. It creates a virtual interface at the operating-system network layer and sends traffic to the core for processing. Before enabling it, confirm that a standard system proxy is not already sufficient; the broader the takeover, the greater the impact of configuration errors on the entire network. On mobile devices, also review background keep-alive, battery optimization, and on-demand connectivity checks to reduce repeated reconnects and wakeups.
stack: mixed · route: auto · dns-hijack: configured endpoints
PLATFORM DOWNLOADS
Installers and client options are grouped by operating system. Confirm the device platform and processor architecture first, then open the download page for the relevant client, system requirements, and installation method.
Built for everyday desktop use. The download page lists Clash Plus, Clash Verge Rev, FlClash, Clash Nyanpasu, and archived clients. Confirm the system architecture before installing, then import a subscription and enable the system proxy after the first launch.
Go to downloadsSeparate downloads are available for Apple Silicon and Intel devices. If macOS blocks the first launch, open Privacy & Security settings and approve it. Menu bar clients work well for persistent use; policies and subscriptions are still managed inside the client.
Go to downloadsAfter installation, complete system VPN authorization, import a subscription, and choose a policy group. Background restrictions vary by manufacturer, so check battery optimization, background activity, and persistent VPN status during extended use.
Go to downloadsOpen the Clash Plus page in the App Store. After installation, add a configuration in the app; the system displays a VPN request when the connection starts. Switch policies, check connection status, and update configurations within the client.
Go to downloadsDesktop users can choose a graphical client, while servers and routers are often better suited to using the mihomo core directly. Before downloading, confirm the distribution, processor architecture, and package format, and plan where configuration and service management will live.
Go to downloadsQUICK START
Install and configure the client before enabling system takeover. Handle one state at a time so it is easier to identify where a problem occurs.
Open the relevant platform from the download page and choose a client that matches the device architecture. On Android, the system displays a VPN request when the first connection starts; Windows and macOS may ask for firewall, network extension, or system proxy permissions. Handle only system-level authorization at this point—do not switch modes or change DNS yet.
Open the Configuration or Profiles page, paste a working subscription URL, and download it. Once the configuration appears, explicitly select it, then open the proxy groups and choose a target policy. If the update fails, first check whether the subscription URL is reachable, the system time is correct, and the current network allows the client to connect.
Use rule mode as a practical starting point, start the system proxy or VPN service, and open the connection log to confirm that traffic is entering. If websites do not load, check the proxy, DNS, matched rule, and system time in order. Change one setting at a time and retest after each change.
OPEN SOURCE CONTEXT
The client interface, proxy core, and configuration data are separate layers. Understanding how they relate makes it easier to identify where a feature comes from and migrate configurations between platforms.
Clash established a widely used YAML configuration structure covering proxy nodes, policy groups, rules, DNS, and traffic takeover. After the original project stopped being maintained, community clients and cores continued to use and extend this structure. Current software names may look similar, but maintainers, interface implementations, and core combinations are not identical. When downloading, verify the client name and underlying core separately.
Open-source repositories make protocol implementations, configuration parsing, issue tracking, and releases available for public review. Desktop and mobile clients typically handle installation, subscription management, system proxies, VPN permissions, and visual controls, while the core handles connections, DNS, rule matching, and traffic forwarding. Settings shown in the client are ultimately converted into configuration the core can read.
mihomo continues Clash Meta’s direction and keeps evolving its protocol support, rule sets, DNS, TUN, and configuration capabilities. Different GUI clients may bundle different cores or allow the core to be replaced. Configuration compatibility does not mean every field has the same interface in every client; before migrating, check supported fields, override mechanisms, and subscription handling.
Client updates, core updates, and subscription updates are three separate paths. Client updates change the interface and platform integration; core updates affect protocol and rule processing; subscription updates replace remotely provided proxies and policy content. When troubleshooting an update, first identify which layer failed. Repeatedly refreshing a subscription cannot fix client permissions or a core that fails to start.
COMMON QUESTIONS
Identify the terms and current state first, then decide what to change. The questions below cover the most common first-use mistakes.
This is the Android VpnService system authorization step. After confirmation, the client can create a local VPN interface and send app traffic to the core for processing. Successful authorization does not guarantee that a proxy is available; you still need to select a configuration and policy group and start the connection. See the glossary for related terms.
After the subscription finishes downloading, confirm that the Profile is selected, a policy has been chosen in the policy group, and the system proxy or VPN service is running. If the log contains no connection entries, the problem is usually with system takeover; if entries appear but requests fail, check the proxy, DNS, and matched rule.
Rule mode determines the outbound path for each type of traffic according to the configuration and is a good everyday starting point. Global mode sends most traffic through the selected policy and is useful for short tests. Direct mode bypasses the proxy and helps determine whether a problem comes from the proxy chain. See the glossary for mode definitions and matching order.
Check these items in order: whether the proxy is working, whether the system time is accurate, whether DNS can resolve domains, whether the expected policy matches the rule, and whether another VPN is occupying the system interface. Change one item at a time and retest. Follow the eight-step troubleshooting checklist for the complete process.
LATEST GUIDES
Recent articles on system proxies, Profile structure, and client comparison. Each title addresses a specific problem, making it easier to continue based on the current state.
System proxies, environment variables, and TUN mode use different traffic-takeover paths. This article explains how to test browsers and terminals and when to switch to more complete traffic interception.
Read the full article →Understand Profiles through their proxy, policy group, rule, and DNS fields, including subscription updates, multiple configurations, overrides, and the state that must be reconfirmed after switching configurations.
Read the full article →Compare popular clients by core, subscription compatibility, interface, platform coverage, and maintenance status to help Android users narrow their choices based on real-world needs.
Read the full article →