Clash Configuration Guide
From Zero to Full Proxy Deployment

Quick Start: Deploy Proxy in Three Steps

Regardless of which Clash client you use, the core process is identical: Download client → Import subscription link → Select node and enable proxy. The entire process usually takes less than 3 minutes.

Subscription Link Import Details

A subscription link is a configuration file address provided by a proxy service. When Clash accesses this URL, it downloads a complete YAML configuration containing all nodes, proxy groups, and rules, which is then saved locally.

Import Methods for Each Client

Recommended Subscription Update Interval

Most service nodes change every 1–7 days. Setting the auto-update interval to 24 hours ensures your nodes are always current without overloading the server.

config.yaml File Structure

Clash configuration files are in YAML format, typically named config.yaml. It consists of top-level fields separated by indentation; the order of fields does not affect parsing.

# Clash config.yaml — top-level structure

mixed-port: 7890          # HTTP + SOCKS5 mixed port
allow-lan: false          # Allow LAN devices to use proxy
mode: rule               # rule | global | direct
log-level: info           # silent | error | warning | info | debug
external-controller: 127.0.0.1:9090   # REST API port

dns:
  # DNS settings — see DNS section below

proxies:
  # Proxy node definitions

proxy-groups:
  # Proxy group policies

rules:
  # Traffic routing rules

Global Parameters Overview

Proxy Nodes

The proxies field defines all proxy nodes. Each node starts with - name: and specifies the protocol via the type field. Clash supports all mainstream proxy protocols:

Shadowsocks Node Example

proxies:
  - nameHK-01 Hong Kong Node
    type: ss
    server: hk.example.com
    port: 8388
    cipher: aes-128-gcm
    password: "your-password"
    udp: true

VMess Node Example

  - nameJP-02 Japan Node
    type: vmess
    server: jp.example.com
    port: 443
    uuid: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
    alterId: 0
    cipher: auto
    tls: true
    network: ws
    ws-opts:
      path: "/ws"
      headers:
        Host: jp.example.com

Trojan Node Example

  - nameUS-03 USA Node
    type: trojan
    server: us.example.com
    port: 443
    password: "your-trojan-password"
    sni: us.example.com
    skip-cert-verify: false
    udp: true

Proxy Groups (proxy-groups)

proxy-groups combine multiple nodes into a policy group for flexible traffic control. Rules reference the proxy group name rather than specific nodes. Clash supports several group types:

Typical Group Configuration Examples

proxy-groups:

  # Main select group — user picks manually
  - nameNode Selection
    type: select
    proxies:
      - Auto Select
      - HK-01 Hong Kong Node
      - JP-02 Japan Node
      - US-03 USA Node
      - DIRECT

  # Auto lowest-latency group
  - nameAuto Select
    type: url-test
    proxies:
      - HK-01 Hong Kong Node
      - JP-02 Japan Node
      - US-03 USA Node
    url: "http://www.gstatic.com/generate_204"
    interval: 300   # test every 300 seconds
    tolerance: 50   # switch if latency diff > 50ms

  # Fallback for services requiring specific region
  - nameFallback
    type: fallback
    proxies:
      - HK-01 Hong Kong Node
      - JP-02 Japan Node
    url: "http://www.gstatic.com/generate_204"
    interval: 120

Rule-based Splitting

The rules field defines traffic routing policies, matched from top to bottom. Once a rule matches, its policy is executed immediately, and further matching stops. Each rule follows this format:

Type, Match Value, Policy Name[, no-resolve]

Rule Type

Rule Examples: Common Splitting Configurations

rules:
  # Block ads and tracking domains
  - DOMAIN-KEYWORD,ads,REJECT
  - DOMAIN-SUFFIX,doubleclick.net,REJECT

  # Direct: LAN addresses
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve

  # Proxy: common overseas services
  - Node Selection
  - Node Selection
  - Node Selection
  - Node Selection
  - Node Selection

  # Direct: mainland China IPs
  - GEOIP,CN,DIRECT

  # Default: proxy all remaining traffic
  - Node Selection

Use Rule Provider to reference external rule sets

Mihomo (Clash Meta core) supports rule-providers, allowing rule sets to be loaded from remote URLs to avoid manually maintaining large domain lists in config.yaml:

rule-providers:
  reject:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/reject.txt"
    path: ./ruleset/reject.yaml
    interval: 86400

rules:
  - RULE-SET,reject,REJECT
  - Node Selection

DNS Configuration & Leak Protection

Clash includes a built-in DNS module to resolve domains for proxy traffic. Proper DNS configuration prevents DNS leaks (where your ISP can see which domains you visit), avoids DNS pollution, and improves resolution speed.

Recommended DNS Settings

dns:
  enable: true
  listen: 0.0.0.0:1053       # DNS server port inside Clash
  ipv6: false                 # Disable if IPv6 not needed
  enhanced-mode: fake-ip     # fake-ip | redir-host
  fake-ip-range: 198.18.0.1/16

  # Domains resolved directly (not through fake-ip)
  fake-ip-filter:
    - "*.lan"
    - localhost.ptlogin2.qq.com

  # Upstream DNS servers used by Clash
  nameserver:
    - 114.114.114.114         # CN public DNS
    - 223.5.5.5               # Alibaba DNS

  # Fallback DNS (used for overseas domains)
  fallback:
    - tls://1.1.1.1:853      # Cloudflare DoT
    - tls://8.8.8.8:853      # Google DoT
    - https://1.1.1.1/dns-query

  # Use fallback when geoip is not CN
  fallback-filter:
    geoip: true
    geoip-code: CN
    ipcidr:
      - 240.0.0.0/4           # Poison result range

FakeIP vs. Redir-Host Mode Comparison

TUN Mode Global Proxy

TUN Mode creates a virtual network interface to intercept all TCP/UDP traffic at the OS kernel level, eliminating the need for manual per-app proxy settings. it is the ultimate solution for software that ignores system proxy settings, including games, terminal tools, and Electron apps.

Enable TUN in config.yaml

tun:
  enable: true
  stack: mixed          # mixed (recommended) | system | gvisor
  dns-hijack:
    - any:53           # Intercept all DNS queries
  auto-route: true     # Automatically add routing rules
  auto-detect-interface: true

TUN Stack Mode Selection

How to Enable TUN on Each Client

Advanced Settings

Proxy Provider: Unified Node Management

proxy-providers allow nodes to be dynamically loaded from a URL or local file, perfect for managing multiple services in one place:

proxy-providers:
  airport-a:
    type: http
    url: "https://sub.airport-a.com/clash/subscribe?token=xxx"
    interval: 86400
    path: ./providers/airport-a.yaml
    health-check:
      enable: true
      url: "http://www.gstatic.com/generate_204"
      interval: 300

proxy-groups:
  - nameNode Selection
    type: select
    use:           # Reference provider instead of individual nodes
      - airport-a

Profile Mixin: Override Subscription Config

Clients like Clash Verge Rev support the Mixin feature, allowing you to "mix" custom settings into the final active configuration without modifying the subscription file. This is often used to force-enable TUN mode or override DNS settings:

# Mixin config — merged on top of subscription
mixed-port: 7890
allow-lan: false
tun:
  enable: true
  stack: mixed
  auto-route: true
  auto-detect-interface: true
dns:
  enable: true
  enhanced-mode: fake-ip
  nameserver:
    - 223.5.5.5
    - 114.114.114.114

FAQ

Nodes are empty after importing subscription?

Check the following: Has the subscription link expired? (You'll need to re-copy it if reset). Is the subscription URL accessible? (Some provider URLs are blocked locally; try updating with an existing proxy enabled). Is the subscription in Clash format? (Some providers offer multiple formats like Clash or ShadowsocksR; ensure you choose "Clash").

Some software still cannot bypass the firewall after enabling system proxy?

Some software (such as games, UWP apps, and terminal tools) may not follow system proxy settings. The solution is to enable TUN Mode, which intercepts all traffic at the system kernel level. See the TUN Mode section for details.

Latency test shows the node is available, but actual access is slow?

Latency tests (PING) only reflect the handshake round-trip time and do not represent actual download speeds. Try switching to another node or select the "Auto Select" group to let Clash find the best speed automatically. Also, check if the current node's protocol is being throttled by your local network (Shadowsocks is more prone to QoS; try Hysteria2 or TUIC).

Config file reporting YAML parse error?

YAML is very sensitive to indentation. Please ensure: use 2 spaces for indentation (do not use Tab); string values containing special characters must be wrapped in quotes; list items must have a space after -. It is recommended to use YAML Lint to validate your configuration file syntax online.

How to view real-time Clash connection logs?

Most GUI clients provide built-in log panels: Clash Verge Rev → Sidebar "Logs"; ClashX → Menu Bar → Dashboard → Logs. You can also access the REST API directly at http://127.0.0.1:9090 (requires external-controller configuration) and use panels like Yacd or MetaCubeXD to view connection details.