Clash Installation & Getting Started Guide

What Is Clash

Clash is an open-source, rule-based network proxy tool with a core written in Go. Many people first hear about Clash while searching for "how to bypass restrictions" or "how to access blocked sites" — but it isn't itself "a proxy service." It's a "dispatcher" that can connect to multiple proxy protocols at once and automatically route requests based on rules.

To understand Clash, just remember three roles:

• Core: the program that actually handles network traffic and rule matching. Originally called clash, the community's enhanced fork was called Clash.Meta, and today's mainstream continuation is mihomo. The core itself has no GUI — it only understands the config file.
• GUI Client: the graphical interface wrapped around the core, such as Clash Verge, Clash for Windows, ClashX, or Stash — letting you point and click instead of hand-editing a config file. The download links on Clash Manual default to GUI clients.
• Configuration File / Subscription: a YAML file describing which proxy nodes are available and what routing rules to apply. Your proxy provider usually gives you a "subscription link," from which the client periodically fetches the latest configuration.

What You Need Before Installing

1. A subscription link or configuration file — usually provided by your proxy service after purchase/registration, looking something like https://example.com/api/v1/client/subscribe?token=xxxx. Without this, installing Clash alone won't connect to any node.
2. Confirm your OS version — Windows 10/11, macOS 11 and later, Android 8.0 and later, iOS 15 and later, and mainstream Linux distributions (Ubuntu / Debian / Arch, etc.) all work fine.
3. Admin permissions ready — system proxy and TUN (virtual network adapter) mode require administrator/root privileges to enable on some systems.

Installing on Windows

1. Go to the download page to get the Windows installer (.exe) and double-click to run the setup wizard.
2. On first launch, the system may show a SmartScreen prompt — choose "More info" → "Run anyway" (this is a normal prompt for unsigned open-source software).
3. Once the client is open, go to Settings and confirm "Run as administrator" is enabled — both TUN mode and the system proxy depend on it.
4. Continue to First-Time Setup below to import your subscription.

Installing on macOS

1. Download the .dmg installer and drag the app icon into the "Applications" folder to install.
2. If you see "cannot verify developer" on first launch, go to System Settings → Privacy & Security and click "Open Anyway." This is macOS's standard block for apps not signed through the App Store, not a sign of a problem.
3. If you want to use TUN mode, the client will request to install a System Extension — just allow it when prompted in System Settings → Privacy & Security. This is supported on both Apple Silicon and Intel Macs.
4. Continue to First-Time Setup below to import your subscription.

Installing on Android

1. Download the .apk installer. Since it's not installed through an app store, the system will prompt "allow installation from unknown sources" — just allow it in the pop-up.
2. On first launch, the client will request "VPN connection" permission (Android uses the VPN API to capture system traffic — this is the standard implementation and doesn't mean your traffic passes through a third-party VPN server). Tap Allow.
3. Paste your subscription link into the client and save it, then return to the main screen and tap the start button to connect to the proxy.

Installing on iOS

1. iOS clients (like Stash or Shadowrocket) usually need to be obtained through your local App Store region, or installed via a TestFlight beta link — check the download page for the exact steps.
2. On first launch, it will ask to add a "VPN Configuration" — this is the only way to capture all traffic under iOS's system restrictions. Tap "Allow" in the system dialog.
3. Import your subscription link inside the app, then return to the main screen and enable the main toggle.

Installing on Linux

On Linux, you'll typically use the core binary directly (no GUI) — best suited for users with some command-line experience:

# 1. Download and extract the core for your architecture (amd64 shown here)
wget https://example.com/mihomo-linux-amd64.gz
gunzip mihomo-linux-amd64.gz
chmod +x mihomo-linux-amd64

# 2. Prepare the configuration directory
mkdir -p ~/.config/mihomo
mv config.yaml ~/.config/mihomo/config.yaml

# 3. Start the core (runs in the foreground, Ctrl+C to stop)
./mihomo-linux-amd64 -d ~/.config/mihomo

You can also use a third-party distro package with a GUI (like a .deb) — the download page provides installers for Debian/Ubuntu-based systems; double-click or run dpkg -i to install and get a graphical interface.

First-Time Setup: Import a Subscription

The interface details differ across platforms, but the first-time setup follows the same four steps:

1. Add your subscription: on the "Subscriptions/Profile" page, paste your subscription link and tap "Download" or "Update" — the client will fetch the node list and rule configuration.
2. Select the config profile: if you have multiple subscriptions saved, switch to the one you just imported to make it your "active configuration."
3. Choose a node / mode: we recommend "Rule Mode" by default, letting Clash route traffic automatically based on your configured rules; you can also manually pick a specific node within a group on the "Proxies" page.
4. Enable the system proxy or TUN mode:
   • "System Proxy": only captures HTTP/HTTPS traffic that apps recognize at the application layer — simple to set up, with the best compatibility. The best choice for beginners.
   • "TUN Mode": creates a virtual network adapter at the system level, capturing nearly all traffic (including UDP and non-proxy-aware programs) for a more thorough result, but requires extra permissions — we recommend getting the system proxy working first before trying this.

Verifying the Proxy Is Working

1. Open a browser and visit a site that shows your IP address, comparing the IP and location before and after enabling the proxy.
2. In the client's "Connections" or "Logs" panel, try visiting a website and check whether a new connection appears, which rule it matched, and whether it went direct or through a proxy node.
3. Run a latency test on the current node in the "Proxies" page to confirm the value is reasonable (generally 20ms–300ms, depending on the node's route) rather than showing a timeout.

If all three checks look right, Clash has successfully taken over your traffic and is routing it by rule — continue on to Advanced Configuration to fine-tune your rules.

Common Beginner Issues

What to Read Next

Once you've got a basic connection working, Clash Manual recommends continuing in this order: