REV. v2.0.4 · 2026-07-17

COMPLETE CLASH GUIDE · UNDERSTANDING CLASH

More than just usable — understand what Clash is actually doing.

This is Clash's official tutorial page clashoffice.com/en/tutorial.html: we're not going to walk you through clicking buttons in one specific client — every client's interface will eventually get a redesign, but the core concepts behind Clash won't change. Once you understand what nodes, proxy groups, rules, and the core actually mean, and how a request gets processed, you can pick up any Clash-core-based client instantly.

What It Is Core Concepts How It Works Choosing a Mode General Workflow Config File FAQ

PROJECT: Complete Clash Guide
DWG NO.: CLSH-2026-03
LEVEL: Beginner → Advanced
TIME: ~10 minutes
SITE: clashoffice.com

OVERVIEW · What It Is

First, Let's Clarify: What Exactly Is Clash

Clash is a rule-based proxy forwarding framework: it's not the name of one specific piece of software, but an entire standard covering a core plus a config format. The various differently-named clients you'll find in app stores or download pages (Clash for Windows, Clash Verge Rev, Surfboard, etc.) are essentially different "shells" wrapped around the same open-source core (nowadays maintained mainly by the community as mihomo). Once you understand the concepts at the core level, no shell will feel unfamiliar.

A Rule Engine, Not a Blunt VPN

A traditional VPN is usually an all-or-nothing switch that routes your entire device's traffic through one encrypted tunnel. Clash's core idea is fine-grained, rule-based routing — at the same moment, mainland China sites go direct, overseas services blocked in mainland China (like Google) go through the proxy, and known ad domains get blocked outright, all three at once, without interfering with each other.

The Core and the Client Are Two Separate Things

The core is a headless background process responsible for listening to traffic, matching rules, and connecting to nodes. The client simply calls into the core and visualizes its state. In theory, the same config file can migrate seamlessly between any clients that support the Clash core.

Open Source, Cross-Platform, Protocol-Agnostic

The code is public and auditable, covering Windows, macOS, Linux, Android, and iOS, while supporting mainstream protocols like Shadowsocks, VMess, and Trojan — all built on the same underlying rule-matching logic, so you only need to learn it once.

GLOSSARY · Core Concepts

Eight Terms That Turn Config Files From Gibberish Into Something Readable

No matter which client you use, you'll eventually run into these eight terms in its interface — understand what they mean first, and everything after that is just a matter of "which button on which screen."

CoreCORE

The background process (like mihomo) that actually handles network traffic and executes rule matching. It has no GUI and is the shared engine behind every client.

ClientGUI CLIENT

The "shell" app that lets you visually operate the core — switch nodes, edit rules, view traffic — without processing any network requests itself.

NodePROXY

A server that forwards traffic on your behalf, corresponding to one entry in your subscription, containing an address, port, protocol, and key/credential info.

Proxy GroupPROXY GROUP

A bundle of multiple nodes with a defined selection method: manual selection, automatic latency testing, failover, or load balancing.

RuleRULES

A list of conditions that determine whether a piece of traffic should go direct, through the proxy, or be rejected — matched top to bottom, stopping at the first hit.

SubscriptionPROFILE

A link provided by your node provider. The client periodically fetches it to automatically generate a node list and base rules, with no manual maintenance required.

DashboardDASHBOARD

A visual panel connected to the core's control port, used to view real-time traffic, switch nodes, and check rule-hit logs.

Inbound MethodINBOUND

The two ways the core receives traffic — system proxy or TUN mode — which determine which apps' requests actually get proxied.

HOW IT WORKS · The Mechanics

What Happens Inside Clash When You Open a Web Page

Putting the eight concepts above together, a single request generally goes through the following six stages from start to finish.

App Sends a Request

A browser or app requests a domain. This step happens regardless of whether a proxy is in use — every networked program goes through it.

Inbound Capture

The system proxy or TUN mode hands this request to the core. Traffic without a matching inbound method enabled never reaches Clash at all.

DNS Resolution

Resolves the target address per the nameserver config; with fake-ip enabled, this step returns a virtual IP, though matching is still based on the domain.

Rule Matching

Compares against the rules list top to bottom, stopping at the first match, to decide whether this traffic goes direct, through the proxy, or gets rejected outright.

Routed to a Proxy Group

A matched rule usually points to a proxy group rather than a specific node — one more selection step is needed.

Node Selection and Forwarding

A specific node is picked based on the proxy group type (manual / auto latency test / load balance), the traffic is encrypted and forwarded, and the response returns along the same path.

MODES · Choosing a Mode

Rule / Global / Direct — Stop Picking Blindly

Almost every client puts a mode switch somewhere prominent, and the three modes behave very differently — picking the wrong one can easily look like "the proxy is broken."

Mode	Behavior	Best For
Rule Mode	Automatically routes different traffic based on the `rules` list	Everyday use — recommended as the default mode
Global Mode	Ignores rules; all traffic goes through the same proxy group	Temporarily testing a node, or suspecting a rule missed some traffic
Direct Mode	Ignores nodes; all traffic goes direct with no proxy at all	Troubleshooting to confirm whether an issue lies with the proxy itself

Swipe to view the full table

System Proxy (HTTP/SOCKS) Only takes over apps that read the system proxy settings, typically covering browsers and other common apps. Simple to set up with minimal overhead — the default choice for most scenarios.

TUN Mode Takes over all traffic at the virtual network adapter layer, covering games, CLI tools, and other apps that don't read system proxy settings. More thorough, but requires higher system permissions.

GENERAL WORKFLOW · The Five Steps

It's the Same Five Steps, No Matter Which Client You Use

The descriptions below deliberately avoid naming specific menu items in any one client — different software may place things in different spots, but the underlying concepts are the same.

1

Pick and install a client that supports the Clash core

Go to thedownload page, and pick the installer for your operating system. Core-only users can skip the client entirely and pair it with a Dashboard panel.
2

Get a Subscription Link or Config File

Provided by your node provider — usually a subscription URL, or a config.yaml file you can import directly.
3

Import and Load the Config

Most clients have an "import subscription" or "add config" option — paste the link or select a local file to pull in nodes and rules.
4

Choose a Mode and Enable an Inbound Method

For everyday use, we recommend Rule mode, then enabling the system proxy or TUN mode — only then will browser and app traffic actually get taken over.
5

Verify It's Working

Visit a URL known to work as a test, or check the connection logs in the Dashboard panel to confirm the connection hit the expected rule — that means the config is working.

CONFIG FORMAT · Config File Structure

The Four Core Fields of config.yaml, Explained

No matter how complex the content auto-generated by a subscription link looks, it's essentially a combination of these four field types. Understand them and you can edit rules yourself without relying on a client's UI.

portBasic Port Settings Defines the mixed HTTP / SOCKS5 proxy port, and whether LAN access is enabled — useful when sharing the proxy with other devices on your client.

proxiesNode List Each node's server address, port, protocol type (Shadowsocks / VMess / Trojan, etc.) and credentials. A subscription link fills in this section automatically.

proxy-groupsProxy Group Bundles multiple nodes into a group and specifies the selection method: manual selection, auto latency test, failover, and so on. Rules reference proxy groups, not individual nodes.

rulesRouting Rules Based on domain, IP range, or GEOIP location, decides whether a piece of traffic should go direct, through the proxy, or be rejected — matched top to bottom, stopping at the first hit.

# config.yaml — some node entries omitted port: 7890 allow-lan: false mode: rule proxy-groups: - name: "Node-Select" type: select proxies: [HK-01, SG-02, JP-03] rules: - DOMAIN-SUFFIX,google.com,Node-Select - GEOIP,CN,DIRECT - MATCH,Node-Select

FAQ · Troubleshooting

Can't Connect, or Rules Not Working? Check These First

Most common issues can be resolved below — click a question to expand the troubleshooting steps.

Q1What's the Real Difference Between Clash and a Regular VPN?

A VPN typically sets up one encrypted tunnel at the OS level — all your traffic goes through it or none does. Clash is an application-layer rule engine that can decide the destination of every single piece of traffic by domain or IP range; direct, proxied, and rejected can all be in effect simultaneously, with much finer granularity.

Q2No Internet Access at All After Enabling the Proxy?

First confirm the node actually works (you can test node latency in the dashboard). If the node is fine but you still can't get online, it's usually a conflict between the system proxy / TUN mode and another network tool (another VPN, firewall software, etc.) — try disabling other proxy-related tools and try again.

Q3Why Are Some Sites Still Not Going Through the Proxy?

This usually means a rule matched DIRECT. Check the policy for that domain or IP range in the rules field of your config — if it really should be proxied, point that rule to a proxy group instead; you can also temporarily switch to Global mode to check whether it's a rules issue.

Q4How Often Does a Subscription Link Need Updating?

The subscription content (node list) update frequency is set by your node provider. Most clients support setting an auto-update interval — we recommend enabling it so you don't forget to refresh after nodes expire.

Q5TUN Mode or System Proxy — Which Should I Use?

System proxy only takes over apps that read the system proxy settings (like browsers); TUN mode takes over all traffic at the network adapter layer, covering games, CLI tools, and other apps that don't read system proxy settings, but requires higher system permissions. For regular web browsing, system proxy is enough.

Q6Noticeable Battery Drain or Heat on Android / iOS?

Prioritize low-latency, stable nodes and avoid frequent auto-speed-testing; also lower the log level (to warning or error) to noticeably reduce background resource usage.

Concepts Sorted — Now Go Grab an Installer From the Download Page.

Installers for all five platforms are already listed on the download page. Install a client, then configure it using the general workflow above.

Go to Download Page