Clash Download · All-Platform Clients

Rule-based routing answers the core question of which traffic goes through the proxy and which connects directly: conditions such as domain, GEOIP, IP-CIDR, and process name are matched top to bottom, each hit routes to its specified outbound, and anything unmatched falls into the MATCH catch-all. Compared with manually toggling a global proxy, rule mode is configured once and works long-term — local traffic stays direct while overseas traffic goes to the right policy group. Rule sets support remote subscriptions and local overrides, with local overrides taking precedence, and updating rules never interrupts established connections. Syntax examples and matching priority are covered on the protocol reference page and in the glossary.

Nodes from different providers often speak different protocols — Shadowsocks, VMess, Trojan, VLESS, Hysteria2, TUIC, plus transports like WebSocket and gRPC. Clash manages them all in a single YAML config, so there's no need to install a separate client per protocol. Nodes can be grouped into url-test (auto-pick the fastest by latency), fallback (switch automatically when the primary fails), or load-balance (spread connections across nodes), letting the core select routes automatically with minimal manual intervention. Which protocol suits which network conditions, and how core protocol support differs, is laid out in a full comparison table on the protocol reference page.

Subscriptions take node-list maintenance off your hands: the provider packs every node and its recommended rules into one URL, and pasting it into the client pulls the full configuration. Node additions, removals, and address changes sync automatically on the next update — no copying server parameters by hand. Clients support scheduled auto-updates by the hour or day, and if an update fails they fall back to the previous cached version, so a single failed pull never cuts your connection. The import entry lives in each client's config or subscription page; exact steps and fixes for common import errors are in step two of the guide page and the help center.

A traditional system proxy only affects apps that read the proxy setting — command-line tools, game clients, and UWP apps often bypass it and connect directly. TUN mode creates a virtual network adapter that intercepts all outbound traffic at the network layer and hands it to the core for rule processing, with no per-app configuration and full coverage of programs that ignore the system proxy. Enabling it requires administrator rights on Windows, network-extension approval on macOS, and VpnService on Android — each a one-time authorization. How to lift the Windows UWP loopback restriction and troubleshoot common TUN conflicts is covered in the help center.

DNS poisoning and resolution leaks are the two most common hidden failures in proxy setups: a domain resolves to the wrong IP and breaks rule matching, or plaintext queries go to the local ISP and expose what you're visiting. The built-in DNS module offers two modes — fake-ip returns virtual addresses from a reserved range and defers real resolution to the exit side, making it fast and inherently poison-proof, while redir-host offers better compatibility for scenarios that need real IPs. Upstream queries support DoH / DoT encryption, and domestic and overseas lookups can be split by domain to different resolvers. The trade-offs between the two modes are detailed in the glossary.

Anything a GUI client can do, a script or dashboard can do too: the core exposes a complete RESTful control API on local port 9090, returning connection lists, node latency, traffic statistics, and runtime logs as JSON. Switching nodes, changing modes, or triggering a subscription update is a single HTTP request. Connect an open-source web dashboard such as metacubexd or yacd for visual monitoring without depending on any particular GUI; automation scripts for scheduled speed tests or anomaly alerts need nothing more than curl. The API listens only on the local loopback address by default — configure secret authentication before exposing it externally.