mihomo core · Open-source clients, regularly updated
Explore clients for every platform, subscription imports and rule routing on Clash Core Hub, then follow the setup steps.
Categories are grouped by outbound type and don't reflect the order in the configuration file. Rules are matched from top to bottom, so MATCH should be last.
Check your operating system and processor architecture, then choose a desktop client. Find installers, system requirements and maintenance status on the downloads page.
For everyday desktop use, start with Clash Plus or compare Clash Verge Rev and FlClash. Check your system architecture before installing. When enabling a service or TUN, follow the prompts to grant administrator permissions so permission issues aren't mistaken for a broken configuration.
Go to downloads →Choose an installer for Apple Silicon or Intel. Approve the app on first launch, then configure the system proxy. To route more app traffic, you can set up TUN; check each client's instructions for its helper service and authorization steps.
Go to downloads →On Android, compare Clash Plus, Clash Meta for Android and FlClash. After importing a configuration, approve the system VPN request. If the connection drops in the background, check battery optimization and background activity limits before removing and reimporting the subscription.
Go to downloads →Use the downloads page to find Clash Plus in the App Store, and verify the developer details. Import a supported configuration and approve VPN access, then check the proxy group. Mobile systems handle network traffic differently from desktop system proxies, so follow the client's instructions.
Go to downloads →On desktop Linux, choose Clash Verge Rev or FlClash and select a package for your distribution. Server and router users can explore the mihomo core section and manage configuration directories, service permissions and startup themselves. A graphical client and a core package are different kinds of software.
Go to downloads →The client handles imports, toggles and the user interface; the core processes connections. Before switching clients, export custom rules and check that the new client supports your existing configuration fields. Archived projects can help explain older workflows, but for everyday use, prioritize actively maintained projects.
Browse all clients →Understand each configuration module instead of turning on every option at once. These are field snippets to merge into an existing configuration. Proxy is only a proxy group name, not a built-in proxy node.
In rule mode, rules are checked in configuration order, and matching typically stops at the first match. Domain suffixes work well for specific sites, IP ranges for local network addresses, and geographic rules require the relevant databases. Unlike global mode, which sends traffic to a single global outbound, rule mode can keep services in mainland China on a direct connection while routing selected sites through a proxy group. To troubleshoot, check the matched rule in the log, then check the proxy group's current selection. Changing nodes alone won't fix an incorrect rule order. MATCH at the end catches any remaining connections.
rules:
- IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
- DOMAIN-SUFFIX,github.com,Proxy
- GEOIP,CN,DIRECT
- MATCH,Proxy
This snippet requires an existing Proxy group and available GEOIP data.
See how rule matching order works →Proxy groups separate rules from the nodes they use. Rules refer only to a group name, so you can switch nodes later without editing each rule. A select group is for manual choice; automatic testing and failover groups need a test URL and update interval. Compared with putting node names directly in every rule, groups are easier to maintain and less affected by subscription renames. The example below shows a group with only a direct option. To select a proxy outbound after merging it into your configuration, add existing node names or reference a defined proxy provider.
proxy-groups:
- name: Proxy
type: select
proxies:
- DIRECT
TUN routes connections through a virtual network interface, making it useful for apps that ignore system proxy settings. It changes how traffic reaches the core; it doesn't replace rules, nodes or DNS configuration. Unlike a system proxy, TUN affects routing and requires elevated permissions. First confirm that a regular proxy works, then install the service or grant system authorization. If local network access stops working, check route exclusions and the scope of DNS hijacking. Network stack support varies by operating system, so adapt the settings below to your platform's documentation.
tun:
enable: true
stack: mixed
auto-route: true
auto-detect-interface: true
dns-hijack:
- any:53
DNS resolves domain names to addresses and affects whether the core can match rules by domain. fake-ip mode maps requests to virtual addresses to retain their domain names, making it useful with TUN, though some local network devices and apps may need exceptions. Core-managed DNS centralizes resolution instead of relying directly on system DNS, but requires a working upstream and traffic interception path. If a page won't load, first determine whether the problem is DNS resolution or the connection, then adjust settings. The example below shows basic fields only; don't use it to replace an existing full DNS strategy.
dns:
enable: true
enhanced-mode: fake-ip
fake-ip-range: 198.18.0.1/16
nameserver:
- https://dns.alidns.com/dns-query
A complete configuration subscription imported into a client is not the same thing as the node collection managed by the core's proxy-providers. A full configuration may include rules, groups and DNS; a provider usually supplies nodes for proxy groups to reference. Files generated from a full subscription may be overwritten on update. Keep lasting changes in the client's supported override or merge feature. Scheduled updates can maintain a node collection without repeated manual imports, but you should still check the source and update logs. The example uses a local file and includes no remote subscription URL.
proxy-providers:
local-nodes:
type: file
path: ./providers/local.yaml
The local file must exist and contain a valid proxies list. The proxy group must also reference local-nodes with use.
See subscription and override maintenance →The system proxy setting tells apps that follow system settings to use a local proxy endpoint. mixed-port sets the port where the core accepts HTTP and SOCKS requests. The two settings need to match; changing the configuration port alone doesn't change the system proxy setting. Unlike TUN, which routes traffic at the network layer, some command-line tools need proxy parameters set separately. For your first setup, keep the client's default port and turn off other proxy tools. The example listens on the local machine only, which suits personal desktop use. Before exposing it to your local network, assess authentication and firewall restrictions.
mixed-port: 7890
allow-lan: false
bind-address: 127.0.0.1
mode: rule
log-level: info
Start with one verifiable connection, then add more complex rules as needed. This quick-start covers only the essentials; the full guides explain settings and platform differences.
Open the client's configuration or subscription page, choose import from URL, paste a subscription URL from a trusted source and save it. To use a local file, import it and confirm it uses a format the client supports. After importing, select the configuration to make it active. Seeing an entry in the list doesn't necessarily mean it's enabled.
Then check the load result and proxy group list. If you see an unsupported field, indentation error or download failure, note the message before making changes; don't overwrite the original file. Subscription URLs may contain access credentials, so hide the full URL in screenshots and reports, and never submit it to an unfamiliar conversion service.
Select rule mode from the mode menu, then open the proxy group referenced by your configuration and choose an available outbound. Group names are defined in the configuration and may not be Proxy. On desktop, turn on the system proxy; on mobile, approve the VPN request in the system prompt. Keep the default DNS and routing settings for now to minimize changes.
Global mode typically sends connections to a global proxy group. It can help with quick comparisons while troubleshooting, but doesn't mean all apps are routed through the core. For apps that ignore the system proxy, set proxy parameters separately, or enable TUN after verifying a regular connection.
Visit a service that should connect directly and a site that should use a proxy, with connection history or runtime logs open. Check the destination domain, matched rule and final outbound against your expectations. A successful node test only shows that its test address is reachable; it doesn't replace testing a website, video or specific app.
If only one app has a problem, check whether it uses a separate proxy or encrypted DNS. If all connections fail, check the subscription, nodes, system time and local network. Once the basic setup is stable, back up the configuration before adding rule sets, DNS overrides or TUN settings.
A Clash client and a node service are separate things. Installing a client doesn't provide usable nodes; the service provider must maintain the server details in your configuration. Before using a service, check its coverage, traffic limits and the rules for network use in your location. This site explains installation and configuration, but can't replace the provider's information about accounts, subscription validity or node availability.
Keep a verified, working backup when updating a configuration. Client upgrades, core updates, subscription refreshes and rule set updates each affect different parts. Avoid doing them all at once while troubleshooting. Note when the problem started, which network you're on and what you changed, then follow the logs layer by layer. This usually narrows things down faster than repeated reinstalls.
Distinguish legacy projects, proxy cores and graphical clients to understand downloads, configuration compatibility and update notices.
Several later projects adopted Clash's rules and configuration format, which is why familiar field names appear across different clients. The original project, community forks and newer graphical interfaces don't share the same release history. Before following a tutorial, check which core and client it covers, then decide whether its settings apply to yours. Legacy clients may preserve older configuration conventions and lack support for newer fields. Button names in old screenshots may not match the current interface.
mihomo is a commonly used core in the Clash configuration ecosystem, handling protocol connections, rule matching and DNS. Graphical clients such as Clash Verge Rev and FlClash build on it to provide configuration management, system proxy controls and a user interface. An interface update doesn't necessarily mean the core changed, and a client that imports a file may not support every field in it. To assess compatibility, check the client's core, supported fields and platform permissions—not just its name.
The mihomo repository is licensed under GPL-3.0; refer to the license text in the project for the specific rights and obligations. Other clients and their dependencies may use different licenses, so the core's license doesn't automatically apply to every app. Check each repository's documentation before reading source code, filing issues or redistributing software. Clash Core Hub is a download directory and Chinese-language resource site, not a representative of the project maintainers. Project names identify software and configuration relationships; they don't imply shared development or official affiliation.
App updates typically change the interface, system integration and packaging dependencies. Core updates may change protocol support and field behavior; subscription and rule set refreshes update configuration data. When an update notice appears, identify which layer it affects, read the release notes and keep a backup. If something breaks after an update, compare the previous and current settings and logs before clearing customizations. The downloads page brings together client links and maintenance status; no single release is presented here as a permanent system requirement.
To verify how a field works or report a core issue, continue to the project repository. The clone command only retrieves source code; it doesn't install a graphical client or configure your device's proxy. Most users can choose a client from the downloads page. For development and build steps, follow the repository documentation.
View the mihomo source repository ↗git clone https://github.com/MetaCubeX/mihomo.gitOnce your basic connection works, explore guides on permissions, mobile imports and rule matching. Each article focuses on one scenario, so you can keep reading with a specific question in mind.
Learn how to handle the Gatekeeper prompt on first launch, network extension and system proxy permissions, and Keychain prompts. Identify what each authorization applies to before troubleshooting permission issues, and avoid reinstalling repeatedly and disrupting your existing setup.
Read the article →Starting with getting a client from the store, this guide covers importing a subscription URL, activating the configuration, approving VPN access and making the first connection. It explains how to distinguish a successful import from a working connection so you can verify the setup.
Read the article →Start with rule matching order, then use GEOIP, GEOSITE, DOMAIN-SUFFIX and rule-providers to organize your rules. Examples using specific domains and local network ranges explain how direct connections, proxies and the final fallback work together.
Read the article →