Official Free Usage Tutorial

From Installation to Routing,
Illustrated Step-by-Step.

Five chapters of illustrated guides: Clash / Mihomo client installation, subscription link import, proxy mode selection, enabling TUN global transparent proxy, and advanced rule configuration. Free, open-source, and beginner-to-expert ready.

1
Install Client
2
Import Subscription
3
Enable Proxy
4
TUN Global Takeover
5
Advanced Config
Chapter 01

Install Client

Choose the appropriate client for your device OS; we recommend the primary versions first. If unsure of your architecture, choose Clash Verge Rev for Windows/macOS and FlClash for Android.

Windows
Recommended: Clash Verge Rev
macOS
Recommended: Clash Verge Rev
Android
Recommended: FlClash
iOS
Shadowrocket / Stash
Linux
Clash Verge Rev / Mihomo

Windows

1

Get Installer from Download Page

Go to the Download Page → Windows and select Clash Verge Rev. Most PCs use Windows x64; Qualcomm Snapdragon PCs (Surface Pro X, etc.) should use ARM64.

2

Run the Installer

Double-click the downloaded .exe file. If a SmartScreen warning appears, click "More Info → Run Anyway". After installation, a Clash Verge Rev icon will appear on your desktop.

3

Install WebView2 (May be required for Win10)

Windows 11 includes WebView2. If Win10 prompts about a missing runtime on startup, the installer will guide you to download it, or you can manually install the Microsoft Edge WebView2 Runtime from Microsoft's website.

Antivirus False Positives: Because Clash Verge Rev doesn't have a purchased code signing certificate, some antivirus software may flag it. Add the installation directory to your allowlist or add an exclusion in Windows Security under "Virus & threat protection → Exclusions".

macOS

1

Confirm Chip Architecture

Click the Apple menu in the top left → About This Mac. If you see "Apple M1/M2/M3/M4", choose ARM64; if you see "Intel Core", choose x64.

2

Open DMG and Drag to Applications

Double-click the .dmg file and drag the Clash Verge Rev icon into the Applications folder to complete installation.

3

Bypass Security Restrictions on First Start

If prompted "cannot be opened because it is from an unidentified developer," go to System Preferences → Privacy & Security and click "Open Anyway," or execute sudo xattr -rd com.apple.quarantine /Applications/Clash\ Verge\ Rev.app in Terminal.

Android

1

Select the Correct Architecture APK

Most mainstream phones after 2016 (Snapdragon / Dimensity / Kirin) are arm64-v8a—prioritize this version. If installation fails, try the universal package. Go to the Download Page → Android.

2

Allow Installation from Unknown Sources

Android blocks non-Play Store installations. On the first install, a prompt will appear for "Allow from this source"; tap "Settings → Allow" to proceed with the APK installation.

3

Grant VPN Permissions

When first launching FlClash / ClashMeta, the system will request VPN permissions; tap "Allow". Some domestic ROMs also require "Auto-start" permissions to prevent the app from being killed in the background.

iOS

Overseas Apple ID Required: Shadowrocket, Stash, and Quantumult X are not available on the Mainland China App Store. You must switch to a US or HK Apple ID for purchase. See detailed registration steps in the Download Page → iOS section.
1

Switch to Overseas Apple ID

Tap the profile icon in the top right of the App Store, sign out of your China account, and sign in with your overseas Apple ID. You only need to switch within the App Store, not in System Settings.

2

Search and Purchase App

Search for Shadowrocket or Stash and pay approximately $2.99–$3.99 (using gift card balance). One-time purchase, permanent use, no device limit (free re-download on devices bound to the same Apple ID).

3

Grant VPN Configuration Permissions

On first launch and config addition, the system will prompt to "Allow Add VPN Configuration"; tap "Allow" and verify with Face ID / Passcode.

Chapter 02

Import Subscription Config

A subscription link is an HTTPS URL that allows the client to automatically pull node lists and rules. Copy the link from your provider's control panel and import it.

1

Get Subscription Link

Log in to your provider's dashboard, find the "Subscription" or "One-Click Import" area, and copy the Clash format URL (typically starting with https:// and including a token parameter).

2

Add Subscription in Client

Clash Verge Rev: Left menu → "Subscriptions" → top right "New" → Paste link → Save & Update.
FlClash / CMFA: Home → "Config" → "Add" → Paste link → Confirm.

3

Wait for Nodes to Load

The client will immediately pull the config from the remote server, usually within 1–5 seconds. Once the node list appears, the import is successful. We recommend enabling "Auto-update" (every 24 hours).

Do Not Share Your Subscription Link: The URL is your account's access credential. Do not share screenshots or send it to others, as it may lead to traffic theft or account suspension.

Basic Configuration Structure

The subscription pulls a YAML format file consisting of several core parts:

config.yaml (Simplified Example) 
# 混合代理端口
mixed-port: 7890

# 代理节点列表（由订阅自动填充）
proxies:
  - name: "香港 01"
    type: vmess
    server: hk01.example.com
    port: 443

# 策略组（选择节点的逻辑）
proxy-groups:
  - name: "🚀 节点选择"
    type: select
    proxies: ["香港 01", "DIRECT"]

# 分流规则
rules:
  - DOMAIN-SUFFIX,google.com,🚀 节点选择
  - GEOIP,CN,DIRECT
  - MATCH,🚀 节点选择
Chapter 03

Enable Proxy

After importing the subscription, select a node and enable "System Proxy" to allow your browser and most apps to use the proxy.

1

Select Node

Go to the "Proxy" or "Nodes" page and tap the node name you wish to use (usually the one with lowest latency). Some clients support "Auto-select" policies to switch to the fastest node automatically.

2

Enable System Proxy

Find the "System Proxy" switch on the main interface and turn it on. The system will then automatically forward HTTP/HTTPS traffic to Clash. Visit a blocked website to verify success.

3

Test Connection

Open your browser and visit google.com or YouTube. Successful access means the proxy is active. If issues occur, check node latency in the client; nodes showing timeout are unusable.

Proxy Mode Descriptions

Mode Use Case Browser CLI / Gaming Recommended
Rule Mode Direct for domestic, Proxy for international ✓ ✗ ✓ Daily Use
Global Mode All traffic through proxy ✓ ✗ △ Testing
Direct Mode Proxy off, no nodes used ✗ ✗ — Debugging
TUN Mode Global system takeover including games/CLI ✓ ✓ ✓ Advanced
Chapter 04

TUN Global Takeover

System Proxy only affects apps that support proxy protocols. TUN Mode creates a virtual network card to capture all traffic at the system layer, including Games, Steam, CLI tools, etc.

1

Run Client as Administrator

TUN mode requires administrator privileges to create a virtual network card. Windows: Right-click the client icon → "Run as Administrator". macOS: The system will automatically pop up an authorization dialog; enter your password to confirm.

2

Enable TUN Mode

In Clash Verge Rev, go to "Settings" → "Clash Core" → toggle the TUN Mode switch; or switch to "TUN" mode directly at the top of the main interface. Once enabled, a new virtual network card named Clash will appear in your system network settings.

3

Verify Global Takeover

Open your terminal and run curl -v https://google.com. If it returns successfully, it means your terminal traffic is being proxied. Steam downloads and online gaming latency will also benefit from TUN's global proxying.

TUN vs. System Proxy: You don't need both enabled simultaneously. TUN mode covers all scenarios of System Proxy. For daily use, just enabling TUN is sufficient. If you don't need to proxy games or the terminal, System Proxy offers lower overhead and better battery life.
# 在配置文件中手动启用 TUN（可选，客户端开关优先） tun: enable: true stack: mixed # 推荐：混合 TCP/UDP dns-hijack: - "any:53" # 劫持 DNS 防止泄漏 auto-route: true auto-detect-interface: true
Chapter 05

Advanced Config

Master rule sets, DNS leak prevention, and custom policy groups to make Clash truly work for you.

Policy Groups

Policy groups (proxy-groups) define how traffic selects a node. Common types:

S

select — Manual Selection

Manually pick a node in the client interface. Ideal for scenarios requiring a fixed region, such as unlocking specific streaming platforms.

U

url-test — Fastest Node Auto-select

Regularly tests all nodes and automatically selects the one with the lowest latency. Perfect for users who don't want to manage nodes manually. Set interval: 300 (seconds) to control testing frequency.

F

fallback — Fault Tolerance

Uses nodes in order and automatically switches to the next if the current one is unavailable. Ideal for high-stability needs like long downloads or live streaming.

Custom Rules

In the rules section of the configuration file, rules are matched from top to bottom with decreasing priority:

Rule Examples 
rules:
  # 域名完全匹配
  - DOMAIN,google.com,🚀 节点选择

  # 域名后缀匹配（常用）
  - DOMAIN-SUFFIX,youtube.com,🚀 节点选择
  - DOMAIN-SUFFIX,baidu.com,DIRECT

  # 关键词匹配
  - DOMAIN-KEYWORD,google,🚀 节点选择

  # IP 段（国内 IP 直连）
  - GEOIP,CN,DIRECT

  # 最终兜底规则（必须存在）
  - MATCH,🚀 节点选择

DNS Leak Prevention

Default system DNS might bypass the proxy for resolution, leading to DNS leaks (exposing your real IP). Enable Clash's built-in DNS in the config:

DNS Config Example 
dns:
  enable: true
  listen: 0.0.0.0:1053
  enhanced-mode: fake-ip   # 防 DNS 泄漏推荐
  nameserver:
    - https://doh.pub/dns-query      # 国内 DoH
    - https://dns.alidns.com/dns-query
  fallback:
    - https://1.1.1.1/dns-query      # 境外 DoH（走代理）
    - https://8.8.8.8/dns-query
  fallback-filter:
    geoip: true
    geoip-code: CN
fake-ip Mode: We recommend enabling fake-ip in TUN mode as it provides the best protection against DNS leaks. If certain LAN services experience issues, you can switch back to redir-host.
FAQ

FAQ

Don't panic when encountering these issues—there's likely a known solution.

Subscription update failed with a network error?
If the subscription link itself requires a proxy to access (overseas servers), manually add a working node and enable the proxy before updating. Alternatively, try updating without "System Proxy" enabled (some providers are accessible domestically).
Node latency is normal, but the browser can't access sites?
1. Ensure "System Proxy" is enabled (green icon). 2. Check if your browser has independent proxy settings overriding the system (Chrome follows by default; Firefox might use custom PAC). 3. Try switching nodes—some node IPs might be blocked.
LAN device sharing stopped working after enabling TUN?
TUN mode creates a virtual network card and takes over routing, which might interfere with LAN sharing. Solution: Add IP-CIDR,192.168.0.0/16,DIRECT and IP-CIDR,10.0.0.0/8,DIRECT to your rules so LAN traffic bypasses the proxy.
How to make the client start on boot?
Clash Verge Rev: Go to "Settings" → "App Settings" → enable "Start on Boot". macOS: Same as above, or add manually in "System Settings → General → Login Items". Android: Allow FlClash to auto-start in system "Auto-start Manager" and disable "Battery Optimization".
Steam download is slow in Rule mode—direct or proxy?
In System Proxy mode, Steam downloads typically use a direct connection; speeds depend on the CDN node. To force Steam through the proxy (for acceleration via overseas nodes), enable TUN mode and add DOMAIN-SUFFIX,steamcontent.com,🚀 Node Select to your rules. Note that proxy bandwidth will be the bottleneck; check your plan's limits.
Latency didn't change after switching nodes—still connected to the old one?
Some established TCP sessions won't switch immediately; they need to close naturally (usually within seconds). You can manually close all existing connections on the client's "Connections" page to force an immediate switch.