Clash clientsDownloads and guides

mode: rule
rules:
  - DOMAIN-SUFFIX,github.com,PROXY
  - DOMAIN-KEYWORD,google,PROXY
  - GEOSITE,category-ads-all,REJECT
  - GEOIP,LAN,DIRECT
  - GEOIP,CN,DIRECT
  - MATCH,PROXY

Rule-based routing sends different traffic to different outbound policies, which is useful for handling developer tools, websites, and LAN services at the same time. Rules are checked from top to bottom; the first match determines the policy. Put more specific domain rules first and leave MATCH as the fallback at the end. In this example, PROXY must be defined as a policy group in the full configuration; DIRECT and REJECT are built-in policies. After making changes, check the matching rule on the Connections page to pinpoint the cause instead of repeatedly switching global modes. Domain-set rules also depend on the relevant rule data being available.

A subscription retrieves a configuration from a specified URL, so you don't have to maintain outbound details by hand. On the client's Profiles page, choose Add or Import and paste a compatible link from your provider. Once downloaded, make it the active profile. A successful import only confirms that the configuration was retrieved; you still need to check policy groups and connection status. The client manages the update interval, and providers may have their own refresh schedule. Subscription URLs often contain personal access credentials. Keep them private and redact them from logs or screenshots before sharing. The example URL shows the format only; it does not provide a working service.

tun:
  enable: true
  stack: mixed
  auto-route: true
  auto-detect-interface: true

TUN routes traffic through a virtual network interface and can cover apps that ignore system proxy settings. Before enabling it, confirm that your current subscription connects successfully, then follow the client prompts to install a service or grant network permissions. The stack setting selects a network stack; implementations and available options depend on the core and operating system, so don't judge performance by the name alone. Watch for route conflicts when using other VPNs, virtual machines, or container networks. If LAN access stops working, check routes and DNS, then adjust settings one at a time so you can identify the cause.

mixed-port: 7890
allow-lan: false
bind-address: "127.0.0.1"

# The GUI client sets the system proxy in the operating system
# LAN sharing also requires changes to the listening scope and firewall

System proxy and Allow LAN serve different purposes. The system proxy setting lets apps on this device that follow system settings use the proxy port; Allow LAN lets other devices connect to a service listening on this device. For local use, keep the listener bound to localhost. To share access, enable LAN access as described by your client, then check the bind address, proxy authentication, and firewall scope. On other devices, enter this computer's LAN address and port. Never expose a listening proxy directly to the public internet. Terminal tools may also need environment variables, so the system proxy toggle alone doesn't confirm that they are connected.

mode: rule
log-level: info
ipv6: false

# Manage local settings through the client's override feature
# Don't edit source files directly if subscription updates will replace them

Configuration overrides can preserve local settings such as ports, log levels, and custom rules across subscription updates. Clients that support overrides may offer configuration merging, scripts, or a dedicated override feature, but their behavior for appending lists and replacing fields can differ. Back up the original configuration first. Change one easy-to-verify field, inspect the resulting configuration, then add anything else. Where rules are inserted affects matching order, and replacing DNS or policy groups wholesale can break dependencies in the subscription. When switching clients, check how each one handles overrides rather than copying snippets blindly.