Configuration reference · Field definitions · Runtime behaviorClash Config Reference Fields and Behavior
Clash and Mihomo documentation for routing rules, DNS, TUN, and services, with field references and configuration examples for setup and troubleshooting.
Introduction
4 documentsWhat Is Clash?
What does the Clash core do, and how does it differ from a graphical client? Trace traffic through inbound, outbound, and routing rules, then explore DNS, policy groups, Providers, RESTful API, and the open-source and Premium editions.
Getting Started
To run the Clash core on its own, download a prebuilt binary or compile from source with Go. Choose a build for your device, then check GOPATH, the running version, and GOOS and GOARCH for cross-compilation.
Running Clash as a Service
Want Clash to run in the background and start at boot? Set up the binary and config.yaml as a systemd service, run daemon-reload, then start the service and check its status. A Docker example offers another way to run it.
Frequently Asked Questions
Are Clash nodes failing on a router or in a container, is Premium unable to connect, or do you see a RULE-SET error? Check GOAMD64 architecture, rule matching, and DNS hijacking according to the symptom, and consider the effect of rule complexity.
Configuration
7 documentsIntroduction to Clash Configuration
When reading Clash YAML, follow requests from Inbound through routing rules to Outbound. Then check the TYPE, ARGUMENT, and POLICY syntax in rules and what no-resolve does.
Configuration Quick Start
Not sure where config.yaml belongs, or need to use another configuration? Check the default directory and the -d and -f startup options, then review IPv6 brackets, quotes around DNS wildcard domains, and matching precedence.
Inbound Proxies
To send browser, local-network, or transparent-proxy traffic into Clash, choose an HTTP(S), SOCKS5, mixed-port, Redirect, TProxy, or TUN entry point, then set its listening port and allow-lan.
Outbound Proxies
When adding a node manually in the original Clash core, find the format for Shadowsocks, SSR, VMess, SOCKS5, HTTP, Snell, or Trojan, then check the authentication, encryption, TLS, UDP, and plugin fields.
Rules
To connect directly, reject a request, or use a specific node, start with rule order and policy groups. Choose a matching method from DOMAIN, GEOIP, IP-CIDR, RULE-SET, SCRIPT, or MATCH, and check no-resolve.
Clash DNS
Are domains resolving incorrectly, requests taking the wrong route, or local domains unreachable? Use the resolution results to check Clash DNS settings for nameserver, fallback, fake-ip, nameserver-policy, and IPv6.
Configuration Reference
When writing or checking Clash YAML, use the full configuration skeleton to find field locations and syntax. Fill in local ports, modes, logs, the control interface, DNS, TUN, nodes, policy groups, Providers, and rules as needed.
Proxy Protocols
14 documentsHTTP / HTTPS Outbound Proxy
Configure HTTP outbound proxies in the Clash ecosystem using current Mihomo fields, including CONNECT tunnels, proxy authentication, HTTPS upstreams, and certificate verification.
SOCKS5 Outbound Proxy
Configure SOCKS5 outbound proxies in the Clash ecosystem using current Mihomo fields, including TCP CONNECT, UDP Associate, authentication, and TLS wrapping.
Shadowsocks (SS)
Configure Shadowsocks outbound proxies in the Clash ecosystem using current Mihomo fields, including ciphers, UDP over TCP, and plugin transports.
ShadowsocksR (SSR)
Configure ShadowsocksR outbound proxies in the Clash ecosystem using current Mihomo fields, including stream ciphers, Protocol, Obfs, and compatibility limits for legacy nodes.
VMess
Configure VMess outbound proxies in the Clash ecosystem using current Mihomo fields, and verify the user ID, protocol version, encryption, UDP, transport, and TLS parameters.
VLESS
Configure VLESS outbound proxies in the Clash ecosystem using current Mihomo fields, with clear distinctions between UUID, Vision, VLESS Encryption, Reality, UDP, and transport settings.
Trojan
Configure Trojan outbound proxies in the Clash ecosystem using current Mihomo fields, and verify passwords, mandatory TLS, SNI, certificates, Reality, UDP, and transport settings.
Snell
Configure Snell outbound proxies in the Clash ecosystem using current Mihomo fields. Verify psk, version, udp, obfs-opts, and smux, then use the minimal YAML and authentication checks to diagnose compatibility issues.
AnyTLS
Configure AnyTLS in Clash with current Mihomo fields: password, sni, client fingerprint, idle-session, and TLS checks, plus minimal YAML and handshake troubleshooting.
Hysteria
Configure Hysteria 1.x outbound proxies in the Clash ecosystem using current Mihomo fields, including authentication, transport modes, bandwidth, port hopping, and QUIC parameters.
Hysteria2
Configure Hysteria2 outbound proxies in the Clash ecosystem using current Mihomo fields, including authentication, port hopping, obfuscation, congestion control, and Realm parameters.
TUIC
Configure TUIC outbound proxies in the Clash ecosystem using current Mihomo fields. Distinguish v4 from v5 authentication and verify TLS, QUIC, UDP relay, and connection parameters.
WireGuard
Configure WireGuard outbound proxies in the Clash ecosystem using current Mihomo fields, including the local interface, Peer, Allowed IPs, MTU, and remote DNS.
Transport Configuration
Use current Mihomo fields to connect Clash VMess, VLESS, and Trojan entries with the correct network, matching opts, TLS settings, and protocol boundaries.
Premium
9 documentsIntroduction to Premium
Need TUN, eBPF, Rule Providers, or Script, and unsure whether the open-source core is enough? Compare the enhanced features in Clash Premium, userspace WireGuard, and profiling capabilities, then check how to obtain it.
Feature: TUN Device
Before using Clash Premium TUN to capture TCP, UDP, and ICMP, check auto-route, auto-redir, system/gvisor, and DNS hijacking settings. Confirm the operating-system limitations before enabling it.
Feature: eBPF Redirect to TUN
Before sending traffic into TUN with eBPF redirect-to-tun on Linux, verify the interface and kernel dependencies. Then check for conflicts with tun.auto-route and Tailscaled and review the available fallback options.
Feature: Rule Providers
To reuse a rule set, choose the domain, ipcidr, or classical format, fill in behavior, url, interval, and path under rule-providers, then reference it with RULE-SET.
Feature: Script
For script-based routing, write Python3 main(ctx, metadata) in Script mode, use resolve_ip, geoip, and rule_providers for matching, and check the IP-resolution requirements.
Feature: Script Shortcuts
To reuse script conditions in Clash Premium Rule mode, compare Expr with Starlark and define shortcuts with Script Shortcuts. Check the available variables, functions, and no-resolve usage.
Feature: Userspace WireGuard
When configuring a Clash Premium userspace WireGuard node, verify private-key, public-key, preshared-key, and the addresses, then set remote DNS, MTU, and UDP.
Feature: Profiling Engine
Is Clash Premium hitting a performance bottleneck that regular logs cannot explain? Start with where to configure and enable tracing, then learn what you can analyze from the profiling output.
Experimental Features
Before enabling experimental Clash features, check support in your core version and where the settings belong, then test in an environment you can roll back. Do not treat one version's experimental behavior as a stable guarantee.
Runtime
1 documentsAdvanced Usage
3 documentsRule-Based WireGuard
Want only selected traffic to use WireGuard? Disable its default route, then use interface-name, DIRECT, and DOMAIN rules to send requests through wg0. Check AllowedIPs, MTU, and endpoint.
Rule-Based OpenConnect
Need some requests to use OpenConnect without letting the VPN take over the default route? Check the interface name and routing table, then add that interface, the DIRECT policy, and the target rules to Clash routing.
Integrating Clash into a Golang Program
When handling proxy connections in a Go program, read metadata from the Clash SOCKS listener and ConnContext, then connect the Direct outbound, DialContext, and relay for bidirectional forwarding.