Open-source kernel · clients actively maintained on every platform
Client installers and setup guides built on the mihomo kernel, covering Windows, macOS, Android, iOS and Linux, with full instructions for subscription import, proxy mode switching, rule-based routing and TUN mode.
PLATFORM
Each of the five platforms has its own GUI client. Installers, system requirements and kernel archives are listed by platform on the download page. Use the cards below to jump straight to a section, or read the selection guide first if you are not sure which one to install.
Clients such as Clash Plus, Clash Verge Rev and FlClash support system proxy and TUN mode takeover, and run on x64 and ARM64 devices with Windows 10 1809 or later.
Go to downloadShips as separate Apple Silicon and Intel builds, runs from the menu bar, and offers an enhanced mode that captures command-line tools and development environments which ignore the system proxy.
Go to downloadA single APK for phones and tablets, with per-app proxy and VPN mode; pick the ARM64 or ARMv7 build to match your device's CPU architecture.
Go to downloadClash Plus is available on the App Store — install it straight from the store page. It supports on-demand connection and Shortcuts integration, and the official site is clashplus.io.
Go to downloadAvailable as .deb and .rpm packages for the major desktop distributions; for servers and routers, use the compressed archives in the kernel section and pick the build for your architecture.
Go to downloadCORE FEATURES
The mihomo kernel is driven entirely by config.yaml. The six items below are the ones users change most often — and misconfigure most often. Each one lists its config key and accepted values.
TUN mode creates a virtual network adapter in the system and captures traffic that does not follow the system proxy settings — game clients, terminal tools, container environments and similar cases. Once enabled, the kernel handles layer-3 traffic directly, and auto-route together with auto-detect-interface points the routing table at the virtual adapter automatically, so there is no need to edit the gateway by hand. Compared with changing only the system proxy, TUN covers more ground, at the cost of requiring administrator or root privileges and, on Windows, the Wintun driver.
The rules section decides whether each connection goes direct or through a proxy, matching strictly from top to bottom and stopping at the first hit. Putting DOMAIN-SUFFIX first lets you classify a whole domain suffix in one line; IP-CIDR handles bare IP requests, GEOIP catches mainland China address ranges, and MATCH closes the list. Get the order wrong and traffic that should go direct takes a detour through the proxy, or internal addresses get forwarded by mistake. After editing rules, set the log level to debug and watch which rule fires — far faster than trial and error.
Fake-IP mode hands a domain a placeholder address from the 198.18.0.0/16 range and defers real resolution until the moment the connection is established, when the kernel decides by rule which DNS server to query. That removes a full DNS round trip, noticeably shortening the wait on first visits, and sidesteps resolution failures caused by a poisoned local DNS. The trade-off is that some programs needing the real IP get nothing useful, which is what fake-ip-filter is for — exclude LAN domains, NTP, STUN and similar entries.
Subscription links are pulled in through proxy-providers, and the kernel refreshes the node list automatically at the interval you set — no manual re-import. Compared with writing nodes straight into config.yaml, the provider approach decouples node updates from rule configuration: the rule file stays put while the node list follows the subscription. Multiple subscriptions can coexist; reference them as needed with the use field in proxy-groups, or narrow things down with filter to keep only nodes matching a keyword. If a fetch fails, the last working list is kept, so live connections are unaffected.
mixed-port lets HTTP and SOCKS5 share a single port, so browsers, terminal tools and editor plugins all point at 7890 instead of remembering two port numbers. By default it listens on 127.0.0.1 only; to let other devices on your LAN use it, turn on allow-lan, set bind-address to a specific interface address, and add a username and password under authentication so the port is not left open to everyone on the subnet. If the port is already taken, the log reports a listen error — just switch to a free port.
proxy-groups turn a set of nodes into groups that carry meaning: url-test picks the fastest node by latency, fallback steps down the list when the primary is unavailable, select leaves the choice to you, and load-balance spreads requests across several exits. Group names are referenced directly by the rules section, so keep them stable — renaming a group is renaming a route. The interval and tolerance settings under health-check control how often latency is tested and how eagerly the group switches, which keeps it from flapping when the network is jittery.
QUICKSTART
Getting from install to working internet takes just three actions. Each one has a matching entry point in the client interface, and the per-platform walkthroughs live on the guide page.
Open the client's configuration page, paste the subscription URL into the field and click download. Once the new entry appears in the list, select it — the client reloads the configuration and starts the kernel. If the list stays empty, open the subscription URL in a browser first to confirm it returns content, then come back and check what error type the client log reports.
For everyday use, pick rule mode: mainland China domains and IPs go direct while everything else follows the rules section through the proxy. When you need to check whether a rule is misclassifying a site, switch temporarily to global mode so all traffic passes through the proxy, then switch back once you have verified it. In global mode every request goes through the proxy, so leaving it on for long stretches noticeably increases data usage.
Enable the system proxy in settings and programs that respect it — browsers, for example — take effect immediately. Command-line tools and game clients ignore the system proxy, so they need TUN mode to be captured. Once it is on, visit any site to confirm connectivity, then check the connections page for the matched rule and the exit node to make sure routing behaves as expected.
OPEN SOURCE
The client interface and the proxy kernel are two separate projects. Understanding that relationship tells you which side's logs to check when something goes wrong.
The Clash kernel is written in Go. It started out as a rule-driven local proxy with all configuration in a single YAML file — a design that has survived to this day. After the original author archived the project, the community carried development forward on the Clash Meta branch, which became today's mihomo kernel; new protocol support and DNS work land on that branch.
The kernel and the mainstream GUI clients are all released under open-source licenses, with code hosted in public repositories. Rule sets, subscription converters and web dashboards are maintained by different teams, and they interoperate through the standard config.yaml and RESTful API. Any of them can ship a new release on its own schedule without waiting for the others.
A GUI client does not implement proxy protocols itself. It handles configuration editing, node display and on/off control, while the actual connections are made by the mihomo kernel. Drop the same config.yaml into another client and behaviour is largely identical; conversely, when the interface freezes the kernel is usually still running fine, so kernel logs are a more reliable place to troubleshoot than the UI.
Kernel and client versions evolve independently, and some clients let you swap in a different kernel build, so upgrading the kernel does not mean reinstalling the whole app. Rule sets and GeoIP data are fetched periodically through providers rather than shipped inside the installer, so how current your rule library is depends on the update interval in your configuration — set it shorter to pick up new rules sooner.
Clone the mihomo kernel source
FAQ
The four entries below come up most often during first-time setup. Expand one to see the cause and the order to work through; the guide page lists more, grouped by platform.
NOTES
Notes on configuration details and troubleshooting walkthroughs, newest first; the full list is on the notes archive page.
A rule-by-rule breakdown of the rules section and its matching order: from DOMAIN, DOMAIN-SUFFIX and IP-CIDR through to GEOIP and the MATCH catch-all, explaining how top-down short-circuit matching works and the mistakes people make.
Read the full article →How to keep configuration consistent across phone, computer and tablet: comparing automatic subscription sync, self-hosted config hosting and manual export/import on use cases, maintenance cost and conflict handling.
Read the full article →A node timeout is often not the node's fault. Work through seven areas in order — subscription updates, DNS resolution, port conflicts, system proxy, rule matches, kernel logs and network environment — to find the real cause fast.
Read the full article →