Complete Clash Proxy Config Guide
From installation to accessing Google in 5 minutes. Perfect for beginners. Follow this guide for a full Clash setup.
Clash in 5 Minutes
The Clash configuration process involves four steps, followed in order. If you have a subscription link, it takes less than 5 minutes.
Step 1 Install Client
Select the appropriate version for your OS from the download page and install:
Step 2 Import Subscription URL
Once the client is open, you need to import your proxy node subscription link into Clash.
Go to 'Subscription' or 'Config'
In Clash Verge Rev, click Subscription on the left; for Android, tap Config at the bottom.
Paste Subscription URL
Click 'New' or 'Import from URL', paste your link from your provider, and give it a name (e.g., 'My Proxy').
Click 'Update' to Download
Click 'Update Subscription'. Clash will download the node information. Once successful, you'll see your nodes in the proxy list.
Activate the Config
Click the subscription card to activate it. Clash will now use the nodes and rules from this configuration.
Step 3 Select Proxy Mode
Clash offers multiple modes. We recommend Rule Mode for most users:
Automatically switch: Direct for local sites, proxy for international sites. Best balance for daily use.
All network traffic is routed through the proxy, including local websites and apps.
Clash stays running, but no traffic goes through the proxy. Equivalent to pausing. Useful when you temporarily don't need a proxy.
Step 4 Turn on System Proxy
After selecting a mode, enable 'System Proxy' to route your device's traffic through Clash.
Toggle 'System Proxy'
In Clash Verge Rev, find the 'System Proxy' toggle on the home page and turn it on.
Verify Success
Visit google.com. If it opens, you're all set! If not, try switching to a different node.
Check Logs (Optional)
View the 'Logs' or 'Connections' page to see real-time traffic routing and troubleshoot issues.
What is a Subscription?
A Subscription URL is a special web address containing proxy node configurations. Clash uses this link to automatically download and sync your node list.
- Needs manual input of server, port, and password for each node
- Must manually delete and re-add nodes if they expire
- No auto-sync when provider updates node info
- One link for all nodes, simple import
- Click 'Update' to sync latest node info
- Syncs instantly if provider changes node details
https://. Providers offer these in your user dashboard for easy copying.How to Get a Link?
Clash itself doesn't provide nodes. You need to purchase them from a third-party provider. Here's how:
Sign up with a Provider
Choose a provider (often called an 'airport') based on node locations, bandwidth, and price (usually $2–$10/month).
Purchase a Plan
Select a plan that fits your data needs (monthly or annual) and complete payment.
Locate your Subscription Link
In your dashboard, look for 'One-click Import' or 'Clash Subscription Link' and copy the URL.
Import into Clash
Go back to your Clash client and follow Step 2 to paste and import.
Updates & Management
Providers update nodes (adding capacity or replacing blocked nodes). We recommend updating your subscription regularly.
Manual Update
Click 'Update' in the client to pull the latest configuration immediately.
Auto Update
Most clients allow setting update intervals (e.g., every 12 or 24 hours) for hands-off management.
Manage Multiple Links
You can add links from different providers and switch between them in the proxy list.
Proxy Modes Explained
Rule Mode (Recommended)
Rule Mode is the core feature of Clash and the best choice for most users.
Clash uses a set of domain and IP rules to automatically decide where to route each request:
Global Mode
All network traffic is routed through the proxy, including local websites and apps.
Direct Mode
Clash stays running, but no traffic goes through the proxy. Equivalent to pausing. Useful when you temporarily don't need a proxy.
In-depth TUN Mode Analysis
TUN Mode is Clash's most powerful advanced feature, operating at the network layer rather than just the application layer. It's the top choice for gaming, UDP proxying, and preventing DNS leaks.
System Proxy vs TUN: Key Differences
There is a fundamental difference between standard 'System Proxy' and TUN Mode:
- Browsers & apps with proxy support
- Apps without proxy settings
- UDP traffic (Gaming, Calls)
- CLI tools (curl, wget, etc.)
- Some system service traffic
- All browsers and apps
- Apps without built-in proxy support
- Full UDP traffic proxying
- CLI tools auto-proxied
- All system network traffic
How TUN Mode Works
TUN mode creates a virtual network interface (usually utun or Meta) in the OS, routing all traffic to this interface for the Clash core to handle.
Best Use Cases for TUN Mode
Gaming Acceleration
Games (Steam, Epic, Blizzard, etc.) use UDP which standard proxies often miss. TUN mode proxies all game traffic, reducing latency and packet loss for a better intl. gaming experience.
Unlock Streaming
Streaming platforms like Netflix, Disney+, and YouTube Premium detect your IP. TUN mode ensuring all traffic (including UDP) follows your proxy rules for smooth playback.
Developer Tools
CLI commands like git clone, npm install, and docker pull often bypass system proxies. TUN mode transparently accelerates these tools without extra config.
Prevent DNS Leaks
In standard mode, DNS queries might bypass the proxy. TUN mode intercepts all DNS requests, and with Fake-IP, it completely prevents DNS leaks.
How to Enable TUN Mode
Run as Administrator
Right-click the icon and choose 'Run as Administrator'. Or enable 'Launch as Admin' in settings.
Go to 'Settings' → 'Clash Core'
In the main interface, navigate to Settings and look for the 'Clash Core' or 'TUN Mode' options.
Toggle TUN Mode
Switch on 'TUN Mode'. Windows will ask for UAC permission to install the virtual network driver; click 'Yes'.
Confirm it's Working
You should see a new 'Meta' adapter in your network settings. Traffic from games and CLI tools will now be auto-proxied.
Enable 'Enhanced Mode' or 'TUN Mode'
In the client settings, find 'Enhanced Mode' or 'TUN Mode' and toggle it on.
Enter System Password
macOS will prompt for your password to modify the system routing table. Enter it and click 'OK'.
Verify Interface Creation
Run ifconfig | grep utun in Terminal. If you see a utun interface created by Clash, it's working.
Start VPN on Home Screen
Tap the big start button. Android will ask to 'Allow VPN Connection'; tap 'OK'. TUN on Android is implemented through the VPN API.
Bypass Specific Apps (Optional)
Under 'Settings → Bypass Apps', choose apps that should bypass the proxy (e.g., banking apps) to avoid being blocked.
Fake-IP vs Real-IP: Choosing your DNS Mode
Your DNS strategy affects performance in TUN mode. Clash offers two modes:
Fake-IP Mode
Clash returns a 'fake' IP (e.g., 198.18.x.x) immediately. The app connects instantly, and Clash then resolves the real destination and routes according to your rules.
Real-IP Mode
Clash performs a normal DNS lookup and then decides based on the real IP whether to use the proxy.
Read Before Enabling TUN Mode
Administrator Rights Required
TUN mode modifies system routes. Windows needs 'Run as Admin', macOS needs a system password, and Android needs VPN permission.
Slightly Higher Battery Usage on Mobile
Android's VPN-based TUN uses more CPU than standard proxy mode. We recommend using it while charging or only when needed.
Watch out for Banking & Payment Apps
Some banking apps block access if they detect a VPN or TUN mode. Consider adding them to the 'Bypass List'.
Conflicts with Other VPNs
TUN mode will conflict with other VPN software (WireGuard, OpenVPN, etc.). Disable other VPNs before using Clash's TUN mode.
Why Not Use TUN Mode All the Time?
A great question. TUN's benefits come from deep system access, which has trade-offs. Here's why we don't always recommend it:
System Proxy Mode handles 95% of use cases
Most users just need Google, YouTube, Twitter, or Telegram. Standard proxy mode is more than enough for these without the complexity of TUN.
Total Traffic Control is a Double-Edged Sword
In standard mode, local apps are unaffected. TUN handles everything, so any misconfiguration can break your entire connection, including local sites and company VPNs.
Constant Administrator Privileges
TUN must persistent run with admin/root access. For security, having a long-running process with top-level access is an unnecessary risk for simple daily browsing.
Conflicts with Corporate VPNs
Office VPNs (Cisco, GlobalProtect, etc.) often conflict with TUN's routing, causing issues with internal company resources.
Mobile Battery & Heat
On Android, the user-space processing of all packets increases CPU wakeups, potentially leading to faster battery drain and higher device temperatures.
Fake-IP can Disrupt Local Services
Fake-IP may interfere with local discovery services like mDNS, AirPlay, or local printer discovery that rely on real local IP addresses.
- Standard browsing & YouTube
- Using Telegram, Twitter, etc.
- Connecting to a corporate VPN
- Using banking apps
- Daily mobile use (save battery)
- In-game acceleration (UDP)
- Unlocking streaming (Netflix, Disney+)
- Heavy git / npm / Docker use
- Strict DNS privacy requirements
- Server or Router transparent proxying
Node Speed Testing
In the Clash 'Proxies' page, you can see all available nodes and perform latency tests:
Enter Proxy/Node List
Click 'Proxies' on the left menu to view all node groups (usually organized by region like Japan, Hong Kong, USA, etc.).
Perform Latency Test
Click the 'Speed Test' icon (lightning bolt) for a group. Clash tests all nodes in that group. Lower values are better (under 50ms is excellent, under 150ms is acceptable).
Select a Low-Latency Node
Once testing is done, click a node with low latency to select it. The active node will be highlighted.
Node Selection Strategy
Clash supports various node selection strategies which you can configure in each proxy group:
Manual Select (Select)
The default strategy where you manually click the node you want to use, giving you full control.
Auto Select (URL Test)
Periodically tests all nodes and automatically switches to the one with the lowest latency.
Fallback
Uses nodes in order; if the current node fails, it automatically switches to the next one to ensure connectivity.
Load Balance
Spreads traffic across multiple nodes. Best for multi-connection scenarios like downloading to improve throughput.
Troubleshooting FAQ
Connection Failed
- Check if the selected node is working by performing a speed test
- Try switching to a different node or a different region
- Verify you are in 'Rule' or 'Global' mode (not 'Direct')
- Restart the Clash client and try again
- Check if your subscription has expired or run out of data in your provider's dashboard
- Try 'Update Subscription' to get the latest server details
- Check if your system time is accurate (time errors cause authentication failures)
Local websites are slow when proxy is enabled
- Verify you're using 'Rule Mode' instead of 'Global Mode'. Global mode routes local traffic through the proxy, causing delays.
- If already in Rule Mode, try enabling 'TUN Mode' or 'Fake-IP DNS' in settings
- Check if certain apps are bypassing the system proxy and need individual configuration
Mobile Configuration Notes
Android
Before installing APKs, enable 'Unknown Sources' in security settings. We recommend 'VPN Mode' (TUN) for true system-wide proxying.
iOS
iOS is limited; you must use an App Store app (Stash, Shadowrocket, etc.). Allow 'Add VPN Configuration' on first launch.
Ready to Start?
Download the right Clash client for your platform and follow this guide. Setup takes just 5 minutes.
Download Clash Client Now