Configuration reference · Field definitions · Runtime behaviorClash Configuration Docs Reference and Advanced Topics
Browse Clash and Mihomo configuration references covering subscription imports, proxy modes, routing rules, DNS, TUN, services, and security. Examples and concept guides make it easier to find the right setup or troubleshooting path.
Introduction
4 documentsWhat Is Clash?
Understand Clash as a cross-platform rule-based proxy core, compare the open-source and Premium editions, and review inbound, outbound, routing, DNS, policy groups, Providers, and RESTful API capabilities.
Getting Started
Prepare the Clash core by downloading a prebuilt binary or compiling it from source with Go, including GOPATH, version checks, and GOOS/GOARCH cross-compilation basics.
Running Clash as a Service
Deploy the Clash binary and config.yaml as a systemd service, run daemon-reload, enable startup, inspect service status, and learn the basic Docker image workflow.
Frequently Asked Questions
Review common Clash core questions about GOAMD64 architecture, router and container node failures, rule-matching complexity, Premium connectivity, RULE-SET errors, and DNS hijacking.
Configuration
7 documentsIntroduction to Clash Configuration
Learn how a Clash YAML configuration connects Inbound, Outbound, and rule-based routing, including the TYPE, ARGUMENT, POLICY, and no-resolve syntax used by rules.
Configuration Quick Start
Learn the default config.yaml location, the -d and -f startup options, IPv6 bracket notation, and quoting and precedence rules for DNS wildcard matching.
Inbound Proxies
Review Clash inbound listeners for HTTP(S), SOCKS5, mixed-port, Redirect, TProxy, and TUN, including listening ports, allow-lan, transparent-proxy fields, and their appropriate use.
Outbound Proxies
Compare outbound formats in the original Clash core for Shadowsocks, SSR, VMess, SOCKS5, HTTP, Snell, and Trojan, including authentication, encryption, TLS, UDP, and plugin fields.
Rules
Follow the matching order for DIRECT, REJECT, nodes, and policy groups, and review DOMAIN, GEOIP, IP-CIDR, RULE-SET, SCRIPT, MATCH, and no-resolve behavior.
Clash DNS
Understand how Clash DNS connects nameserver, fallback, fake-ip, nameserver-policy, and IPv6 so you can diagnose poisoned responses, routing mistakes, and local-domain failures.
Configuration Reference
Use a Clash YAML reference skeleton covering local ports, operating modes, logs, the control API, DNS, TUN, nodes, policy groups, Providers, and common rules fields.
Proxy Protocols
14 documentsHTTP / HTTPS Outbound Proxy
Configure HTTP outbound proxies in the Clash ecosystem using current Mihomo fields, including CONNECT tunnels, proxy authentication, HTTPS upstreams, and certificate verification.
SOCKS5 Outbound Proxy
Configure SOCKS5 outbound proxies in the Clash ecosystem using current Mihomo fields, including TCP CONNECT, UDP Associate, authentication, and TLS wrapping.
Shadowsocks (SS)
Configure Shadowsocks outbound proxies in the Clash ecosystem using current Mihomo fields, including ciphers, UDP over TCP, and plugin transports.
ShadowsocksR (SSR)
Configure ShadowsocksR outbound proxies in the Clash ecosystem using current Mihomo fields, including stream ciphers, Protocol, Obfs, and compatibility limits for legacy nodes.
VMess
Configure VMess outbound proxies in the Clash ecosystem using current Mihomo fields, and verify the user ID, protocol version, encryption, UDP, transport, and TLS parameters.
VLESS
Configure VLESS outbound proxies in the Clash ecosystem using current Mihomo fields, with clear distinctions between UUID, Vision, VLESS Encryption, Reality, UDP, and transport settings.
Trojan
Configure Trojan outbound proxies in the Clash ecosystem using current Mihomo fields, and verify passwords, mandatory TLS, SNI, certificates, Reality, UDP, and transport settings.
Snell
Configure Snell outbound proxies in the Clash ecosystem using current Mihomo fields. Verify psk, version, udp, obfs-opts, and smux, then use the minimal YAML and authentication checks to diagnose compatibility issues.
AnyTLS
Configure AnyTLS in Clash with current Mihomo fields: password, sni, client fingerprint, idle-session, and TLS checks, plus minimal YAML and handshake troubleshooting.
Hysteria
Configure Hysteria 1.x outbound proxies in the Clash ecosystem using current Mihomo fields, including authentication, transport modes, bandwidth, port hopping, and QUIC parameters.
Hysteria2
Configure Hysteria2 outbound proxies in the Clash ecosystem using current Mihomo fields, including authentication, port hopping, obfuscation, congestion control, and Realm parameters.
TUIC
Configure TUIC outbound proxies in the Clash ecosystem using current Mihomo fields. Distinguish v4 from v5 authentication and verify TLS, QUIC, UDP relay, and connection parameters.
WireGuard
Configure WireGuard outbound proxies in the Clash ecosystem using current Mihomo fields, including the local interface, Peer, Allowed IPs, MTU, and remote DNS.
Transport Configuration
Use current Mihomo fields to connect Clash VMess, VLESS, and Trojan entries with the correct network, matching opts, TLS settings, and protocol boundaries.
Premium
9 documentsIntroduction to Premium
Compare Clash Premium with the open-source core and review TUN, eBPF, Rule Providers, Script, userspace WireGuard, the profiling engine, and how these features were distributed.
Feature: TUN Device
Learn how Clash Premium TUN captures TCP, UDP, and ICMP, and verify auto-route, auto-redir, system/gvisor, DNS hijacking, and operating-system limitations.
Feature: eBPF Redirect to TUN
Configure eBPF redirect-to-tun on Linux, check kernel dependencies and known limits, and understand conflicts with tun.auto-route and Tailscaled plus the available fallback.
Feature: Rule Providers
Load rule-providers locally or remotely, verify behavior, url, interval, path, and RULE-SET, and distinguish domain, ipcidr, and classical formats.
Feature: Script
Use Python3 main(ctx, metadata) in Script mode to control rule matching, including resolve_ip, geoip, rule_providers, and IP-resolution requirements.
Feature: Script Shortcuts
Define Script Shortcuts in Clash Premium Rule mode, compare Expr with Starlark, and review common variables, functions, and no-resolve usage.
Feature: Userspace WireGuard
Build a Clash Premium userspace WireGuard node using private-key, public-key, preshared-key, remote DNS, MTU, UDP, and address fields.
Feature: Profiling Engine
Use the Clash Premium profiling engine's tracing switch and output when regular logs cannot explain a runtime bottleneck, and verify where performance sampling is enabled.
Experimental Features
Understand where and how to enable and verify experimental Clash features. Because support may change by core version, confirm compatibility in a reversible environment before deployment.
Runtime
1 documentsAdvanced Usage
3 documentsRule-Based WireGuard
After disabling WireGuard's default-route capture, use interface-name, DIRECT, and DOMAIN rules to send traffic through wg0, then verify AllowedIPs, MTU, and endpoint.
Rule-Based OpenConnect
Bring an OpenConnect interface into Clash rule-based routing, verify the interface name, routing table, DIRECT policy, and target rules, and prevent the VPN from replacing the default route unexpectedly.
Integrating Clash into a Golang Program
Use a Go example to connect Clash's SOCKS listener, ConnContext, and Direct outbound, read connection metadata, and relay traffic in both directions with DialContext and relay.