Clash for Linux Client Download & Install Commands
Clash client downloads for every platform plus a Linux install command reference, built on the Mihomo core and covering Ubuntu / Debian / Fedora / Arch, with English-friendly docs for subscription import, rule-based routing, and TUN mode.
$sudo apt install ./clash-verge_2.3.2_amd64.deb
$sudo dpkg -i clash-verge_2.3.2_amd64.deb
$sudo dnf install ./clash-verge-2.3.2-1.x86_64.rpm
$yay -S clash-verge-rev-bin
Rule-based routing
Rule-based routing answers the core question of which traffic goes through the proxy and which connects directly. Clash matches the rules list top to bottom: you can write rules by domain suffix, exact domain, IP range, GeoIP region, process name, and more, with the first match winning and MATCH as the catch-all at the end. Compared to maintaining a whitelist by hand in a browser extension, rules live in a config file that ships with your subscription and works across every device — local traffic stays direct, traffic that needs to go abroad routes through the right exit node, and neither latency nor bandwidth is wasted. Rules are plain one-line-per-entry text, and troubleshooting is just a matter of checking the rule match entries in the logs.
rules:
- DOMAIN-SUFFIX,github.com,PROXY
- DOMAIN-SUFFIX,cn,DIRECT
- GEOIP,CN,DIRECT
- MATCH,PROXYTUN mode
System proxy settings only cover apps that actually respect them — command-line tools, some games, and programs that ignore the system proxy slip through. TUN mode creates a virtual network interface on your system, intercepts all traffic at the network layer, and hands it off to the rule engine, working alongside auto-route to write routing tables automatically and dns-hijack to intercept plaintext DNS queries for true global coverage. On Linux, enabling it requires granting the kernel CAP_NET_ADMIN or running as a privileged service — most GUI clients offer a one-click authorization option. The stack field lets you choose between system, gvisor, or mixed network stack implementations.
tun:
enable: true
stack: system
auto-route: true
dns-hijack:
- any:53Subscription management
Node info is usually delivered by your provider as a subscription link, and copying entries by hand is tedious and prone to going stale. Once you declare a subscription as a remote source via proxy-providers, the client automatically pulls the latest node list at the configured interval and hot-updates the running proxy groups — no manual work needed as nodes are added, removed, or rotated. GUI clients build on this with support for multiple subscriptions at once, one-click updates, local editing, and fallback if an update fails; if a fetch fails, the previous config stays active, so a brief network hiccup won't break your proxy setup. When troubleshooting subscription issues, the first thing to check is whether the response is valid YAML.
proxy-providers:
main:
type: http
url: https://example.com/sub.yaml
interval: 86400
path: ./providers/main.yamlMihomo core
Mihomo is the actively maintained core fork of the Clash ecosystem, developed by the MetaCubeX community. It's compatible with the classic Clash config format while adding more protocols, a more complete DNS setup, and finer-grained rule types. Mainstream clients like Clash Verge Rev on desktop and Clash Meta for Android on mobile all run on it under the hood. The core itself is a single executable, so server and router users can run it directly without a GUI, pairing it with systemd for a persistent background service. The download page offers precompiled builds for amd64, arm64, armv7, and more, covering everything from home routers to cloud VPS instances.
$ mihomo -d ~/.config/mihomo
$ systemctl enable --now mihomoProtocol support
Different providers' nodes use different transport protocols, and how many the core supports determines whether a subscription can be imported in full. Beyond the classic Shadowsocks, VMess, and Trojan, the Mihomo core also supports newer protocols like VLESS, Hysteria2, TUIC, and WireGuard, and can layer on transport-level obfuscation such as WebSocket, gRPC, and Reality. In practice, that means you don't need a separate tool for each protocol — a single config.yaml can mix nodes using different protocols, route them all into the same proxy groups, and apply the same rules, so switching providers never means switching clients.
proxies:
- name: node-01
type: vless
server: example.org
port: 443
network: wsControl API
The core exposes a local RESTful API via external-controller, which GUI clients and web dashboards (like metacubexd and yacd) use to read the connection list, switch nodes, adjust proxy modes, and view live logs. If you're comfortable on the command line, you can call the API directly with curl for automation — scheduling proxy group switches, scripting speed tests, or validating configs in CI are all fair game. The API only listens on 127.0.0.1 by default; to access it over a LAN, you need to explicitly rebind the address and set a secret for authentication so the control port isn't exposed to untrusted devices.
external-controller: 127.0.0.1:9090
external-ui: ui
secret: "your-password"quickstart --preview
Three steps to your first connection
This is a condensed preview of the full setup guide. From install to verification, a fresh machine usually takes under ten minutes.
Install the client
Grab the installer that matches your system from the download page: Linux users can pick deb / rpm for their distro or go through the AUR, while other platforms can download the installer directly or get it from an app store. On first launch after installation, the client generates a default config in your user directory.
Import your subscription
Copy the subscription link from your provider and paste it into the client's config page to import. Once it succeeds, the node list and proxy groups appear automatically; if parsing fails, first check whether the link opens directly in a browser and returns YAML text.
Turn on the proxy and verify
Switch the proxy mode to Rule, turn on the system proxy toggle, pick an available node in a proxy group, then visit a site outside your region to confirm it works. For a command-line check, use curl against the 127.0.0.1:7890 port directly.
apt search clash
Get the client for your platform
All five platforms have actively maintained GUI clients, all built on the same Mihomo core underneath, so a single subscription works across every device.
Linux
deb / rpm packages and AUR builds — Clash Verge Rev is the recommended pick, and it can be set to autostart via systemd.
Go to downloads →Windows
Clash Plus, Clash Verge Rev, and more to choose from, with support for system proxy mode and service-mode installs.
Go to downloads →macOS
Separate installers for Intel and Apple Silicon — grab the build that matches your chip.
Go to downloads →Android
Clash Plus and Clash Meta for Android — arm64 devices should go with the matching architecture APK.
Go to downloads →iOS
Clash Plus is distributed through the App Store; the download page has the store link and install steps.
Go to downloads →git log --oneline
Built on open code
From the core to every client, this toolchain is developed in public repositories — every commit, issue, and release is there for anyone to check.
Project history
Clash started out as a rule-based proxy core written in Go, and its clean YAML config format and flexible proxy group system made it the de facto standard among tools of its kind. When the original repository was archived, the config format and ecosystem didn't die with it — the community kept building on top of it, leading to today's setup: the Mihomo core paired with several actively maintained GUI clients.
How the core and clients relate
Think of the core as the engine and the client as the dashboard: Mihomo handles protocol implementation, rule matching, and traffic forwarding, while clients like Clash Verge Rev, FlClash, and Clash Meta for Android handle subscription management, the UI, and system integration. Because they all share the same config format, a single subscription can move between clients on different platforms without any changes.
Open-source ecosystem
The core and mainstream clients are all released under free software licenses such as GPL-3.0, with code hosted on public platforms where anyone can review the implementation, file issues, or build from source. Release builds are compiled automatically by each repository's CI pipeline, with every version tied to a matching source tag — that's the baseline that makes recommending them possible.
Update cadence
The core and each client ship on independent release schedules: the core tracks protocol changes and new rule types, while clients track UI and platform updates. Links on this site's download page always point to each project's latest release rather than a pinned old version; rule databases like GeoIP and GeoSite are also updated automatically by the core on a configurable schedule, with no manual file swaps required.
git clone https://github.com/MetaCubeX/mihomo.git
grep -i question
Top FAQs
The four questions new users get stuck on most often, answered in a sentence, with the full explanation in the linked doc.
How does Mihomo relate to Clash?
Mihomo is the actively maintained core fork of the Clash ecosystem, compatible with the original config format, and it's what mainstream clients run on under the hood. See the glossary for more detail.
Subscription import keeps failing — what now?
First confirm the link opens in a browser and returns YAML text, then work through link, format, and syntax issues in order — the steps are in the setup guide.
Port 7890 already in use, so startup fails?
Use ss or lsof to find the process holding the port, decide whether to kill it or change mixed-port instead, and remember to update your system proxy settings after changing the port — details in the full manual.
What permissions does TUN mode need?
On Linux, the kernel needs CAP_NET_ADMIN or the client needs to run as a privileged service — most GUI clients offer one-click authorization. Setup steps are in the full manual.
tail -n 3 notes.log
Latest technical notes
Hands-on notes on troubleshooting and advanced topics, each one starting from a real error message and ending with commands and configs you can actually use.
Clash Subscription Link Down or Failing to Parse: A Checklist From 404s to YAML Errors
Don't rush to swap subscription links when import fails — work through link reachability, response format, User-Agent restrictions, YAML syntax, and client compatibility one by one to find the real cause.
Clash Mixed Port and LAN Proxy Sharing: Configuring allow-lan and Connecting Devices
A clear breakdown of what mixed-port and allow-lan actually do, a walkthrough of letting phones and streaming boxes on your LAN share one machine's proxy, plus notes on bind addresses and firewall rules.
Clash Port Already in Use: Tracking Down 7890 Conflicts and Changing the Listen Port
When startup throws address already in use, use ss, lsof, or netstat to find the process holding the port, decide whether to kill it or change the port instead, and update your system proxy settings to match.