Tutorial

Setup Guide for All Platforms

From download and install to subscription import and troubleshooting — covering Windows, macOS, Android, and iOS end-to-end.

Download Client First

Install Clash Verge Rev (Recommended)

Download the Installer

Visit the download page to get the Windows build of Clash Verge Rev. Most users should pick the x64 version. If you see "This app can't run on your PC", make sure you downloaded the correct architecture (x64/arm64).

Complete Installation

Double-click the .exe installer and follow the prompts. If your antivirus flags it, temporarily disable it during installation, then re-enable afterwards.

Note

If the app opens to only a tray icon with no window, you may be missing the WebView2 component. Download and install WebView2 Runtime from Microsoft, or download the installer with fixed_webview2 in its filename.

Import Subscription URL

Open Clash Verge Rev, click Profiles on the left sidebar, paste your provider's subscription URL in the input box at the top, then click Import. After importing, click the config to highlight and activate it.

Enable System Proxy

Click Settings on the left, then toggle System Proxy on. Set proxy mode to Rule for smart routing — direct connect locally, proxy for everything else.

Tip

TUN mode (virtual NIC) proxies all TCP/UDP traffic including UWP apps that bypass system proxy. Requires running as administrator.

Windows Troubleshooting

Cause

Core-to-frontend communication failure, usually caused by firewall blocking local port communication.

Solution

Open Windows Firewall settings, disable and re-enable it. Or add an exception rule for Clash Verge Rev.

Cause

Multiple network adapters or subnets conflicting with the configured rules.

Solution

Go to Network & Internet Settings → Change adapter options, disable or remove unused virtual adapters, keep only your main NIC, then retry.

Cause

Clash exited abnormally (power cut, BSOD, etc.) without disabling system proxy, leaving the proxy switch on with nothing listening.

Solution

Go to Windows Settings → Network & Internet → Proxy → Manual proxy setup, and turn off "Use a proxy server".

Cause

Windows UWP sandbox blocks localhost access, so apps can't reach the local proxy listener.

Solution

In Clash Verge Rev, go to Settings → UWP Loopback Tool, find the app and check it, then click Save Changes. Or use TUN mode to bypass this entirely.

Error Log

                    An attempt was made to access a socket in a way forbidden by its access permissions.
                  

Solution

Open PowerShell or Command Prompt as Administrator and run:

net stop hns
net start hns

Cause

The Visual C++ runtime library is missing from the system.

Solution

Download and install the VC++ x64 Redistributable (suitable for most 64-bit Windows users).

Windows icon cache is stale. Run this command to clear it and restart Explorer:

                    del /A "%userprofile%\AppData\Local\IconCache.db" 2>nul & taskkill /f /im explorer.exe & start explorer.exe
                  

Install ClashX Pro / Clash Verge Rev

Download the Package

Go to the download page to get ClashX Pro (.dmg) or Clash Verge Rev (Apple Silicon: aarch64, Intel: x64).

Install and Trust the Developer

Double-click the .dmg and drag the app to Applications. On first launch, if you see "developer cannot be verified", go to System Settings → Privacy & Security → Security → click "Open Anyway".

macOS 15+ Users

Some newer system versions may require running sudo xattr -rd com.apple.quarantine /Applications/ClashX\ Pro.app in Terminal to remove the quarantine flag.

Import Subscription URL

Click the cat icon in the menu bar → Config → Remote config → Manage, add your subscription URL and click Download. Once downloaded, click the config name to activate it.

Enable System Proxy / Enhanced Mode

Click the menu bar icon → Set as system proxy. To proxy all traffic (including Terminal, games), enable Enhanced Mode — you'll need to enter your admin password to install the network extension.

macOS Troubleshooting

Option 1: System Settings → Privacy & Security → click "Open Anyway".

Option 2 (Recommended): Run in Terminal:

sudo xattr -rd com.apple.quarantine /Applications/ClashX\ Pro.app

Check if the icon is hidden due to a crowded menu bar. Hold Command and drag the icon to a visible area. Or use a menu bar manager like Bartender.

Disable Enhanced Mode, then go to System Settings → Network and delete the virtual interface added by ClashX. Reconnect and try again. Consider updating to the latest version.

Install Clash for Android (CFA)

Download and Install APK

Go to the download page to get the CFA package. Most users should choose the Universal build; 64-bit devices can use arm64-v8a. Tap the downloaded file in your file manager to install — you may need to enable "Install from unknown sources" in Settings → Security first.

Import Subscription

Open CFA, tap the + icon in the top-right → URL, paste your provider's subscription URL → Create. After adding, tap Update to download the latest nodes, then tap the profile name to activate it.

Start the Proxy

Tap the Start button on the main screen. The system will prompt for VPN connection permission — tap Allow. A VPN icon in the status bar confirms it's running.

Tip

Enable DNS Resolution in Settings → Clash → DNS to prevent DNS leaks. Use the Per-App Proxy feature to control which apps go through the proxy.

Android Troubleshooting

The APK file is incomplete. Re-download it. If the issue persists, try the Universal build which is compatible with all architectures.

Check the following:

• Is another VPN app running in the background? (Android only allows one VPN at a time)
• Is the subscription imported and active? (Node list should not be empty)
• Try removing leftover VPN profiles from Settings → Network & Internet → VPN

Make sure proxy mode is set to Rule, not Global. If a specific app still has issues, add it to Per-App Proxy and set it to direct connect.

Install Shadowrocket

Important Note

There is no official Clash iOS client. Shadowrocket is a third-party tool ($2.99) compatible with Clash config format. It requires a non-CN App Store account (e.g. US) to purchase and download.

Switch to a Non-CN Apple ID

Sign out of your current account in the App Store, then sign in with a US Apple ID. If you don't have one, you can register (US address required) or borrow one just for the purchase, then switch back — your purchased apps will remain.

Purchase and Download Shadowrocket

Search for "Shadowrocket" in the US App Store, priced at $2.99. Also consider the free alternative Stash, which has similar features and supports Clash rules.

Import Subscription URL

Open Shadowrocket, tap + in the top-right → select type "Subscribe" → paste the subscription URL → Done. The app will parse and show the node list automatically.

Quick Import

Copy the subscription URL first, then open Shadowrocket — it will automatically detect it and ask if you want to add it. Just tap Add.

Enable Proxy

Back on the home screen, toggle the "Not Connected" switch at the top. Allow the VPN configuration prompt. When the icon turns green and "VPN" appears in the status bar, you're connected.

iOS Troubleshooting

Make sure the subscription URL starts with http:// or https:// and hasn't expired. Try opening it in a browser to confirm it returns valid YAML content.

Check: ① Is the top switch green (enabled)? ② Is the selected node reachable (test latency from the node list)? ③ Is proxy mode set to Rule or Global? If all nodes time out, contact your proxy provider.

A persistent iOS VPN will consume some extra battery. Turn off the switch when not needed. Configure routing rules so only necessary traffic goes through the proxy.

Advanced Guide

Go Deeper with Clash

Master config syntax, rule writing, and troubleshooting to get the most out of Clash.

Config Syntax Guide

Overall Config File Structure

Clash uses YAML format with these core fields:

# Basic network settings
port: 7890          # HTTP proxy port
socks-port: 7891    # SOCKS5 proxy port
mixed-port: 7892    # Mixed port (HTTP + SOCKS5)
allow-lan: false    # Allow LAN device access
mode: rule          # Proxy mode: rule / global / direct
log-level: info     # Log level: silent / error / warning / info / debug
external-controller: 127.0.0.1:9090  # Web UI control port

dns:
  enable: true
  enhanced-mode: fake-ip
  nameserver:
    - 223.5.5.5
    - 8.8.8.8

proxies: [...]        # Node list
proxy-groups: [...]   # Proxy groups
rules: [...]          # Routing rules

Proxy (proxies) Configuration Examples

Shadowsocks

proxies:
  - name: "SS-HongKong"
    type: ss
    server: hk.example.com
    port: 8388
    cipher: aes-256-gcm
    password: "your_password"

VMess + WebSocket + TLS

  - name: "VMess-US"
    type: vmess
    server: us.example.com
    port: 443
    uuid: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
    alterId: 0
    cipher: auto
    tls: true
    network: ws
    ws-opts:
      path: /ray

Trojan

  - name: "Trojan-JP"
    type: trojan
    server: jp.example.com
    port: 443
    password: "your_password"
    sni: jp.example.com

Proxy Groups (proxy-groups)

Proxy groups define node selection strategies — manual, auto-test, load balancing, and more:

proxy-groups:
  # Manual selection
  - name: "🚀 Select"
    type: select
    proxies:
      - "🔄 Auto"
      - "SS-HongKong"
      - "VMess-US"
      - DIRECT

  # Auto speed test (picks lowest latency)
  - name: "🔄 Auto"
    type: url-test
    url: http://www.gstatic.com/generate_204
    interval: 300
    tolerance: 50
    proxies:
      - "SS-HongKong"
      - "VMess-US"
      - "Trojan-JP"

Tip

Proxy groups also support fallback (auto-switch on failure) and load-balance. Subscription configs from providers usually come with pre-configured groups — just import and go.

Writing Routing Rules

Rule Type Quick Reference

Rule Type	Matches	Example
`DOMAIN`	Exact full domain	`DOMAIN,www.google.com,PROXY`
`DOMAIN-SUFFIX`	Domain suffix (recommended)	`DOMAIN-SUFFIX,google.com,PROXY`
`DOMAIN-KEYWORD`	Domain contains keyword	`DOMAIN-KEYWORD,google,PROXY`
`IP-CIDR`	IP address range	`IP-CIDR,8.8.8.8/32,PROXY`
`GEOIP`	IP geolocation country code	`GEOIP,CN,DIRECT`
`MATCH`	Catch-all (last rule)	`MATCH,PROXY`

Inline Rules Example

Rules are matched in order — the first match wins:

rules:
  # Ad blocking
  - DOMAIN-KEYWORD,adservice,REJECT
  - DOMAIN-SUFFIX,doubleclick.net,REJECT

  # Direct connect
  - DOMAIN-SUFFIX,baidu.com,DIRECT
  - DOMAIN-SUFFIX,taobao.com,DIRECT
  - DOMAIN-SUFFIX,qq.com,DIRECT
  - GEOIP,CN,DIRECT

  # Proxy for overseas
  - DOMAIN-SUFFIX,google.com,🚀 Select
  - DOMAIN-SUFFIX,youtube.com,🚀 Select
  - DOMAIN-SUFFIX,github.com,🚀 Select

  # Catch-all
  - MATCH,🚀 Select

Rule Provider (External Rule Sets)

Rule Provider lets you load rule sets from a remote URL — great for managing large rule collections:

rule-providers:
  reject:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/reject.txt"
    path: ./ruleset/reject.yaml
    interval: 86400

  proxy:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/proxy.txt"
    path: ./ruleset/proxy.yaml
    interval: 86400

rules:
  - RULE-SET,reject,REJECT
  - RULE-SET,proxy,🚀 Select
  - GEOIP,CN,DIRECT
  - MATCH,🚀 Select

Recommended Practice

Using community-maintained rule sets (e.g. Loyalsoldier/clash-rules) greatly reduces config work, provides broader coverage, and rules auto-update on a schedule.

Troubleshooting

Common Issues Quick Reference

Diagnose step by step:

Confirm your internet is working (can you reach domestic sites?)
Check system time accuracy (VMess requires time within 90 seconds of the server)
Update your subscription (server addresses may have changed)
Contact your provider to verify account status and data balance

YAML is strict about formatting. Common issues:

Using Tab indentation (YAML only allows spaces)
Strings containing : not wrapped in quotes
Full-width colon used instead of ASCII colon

Paste your config into yamllint.com to quickly find the line with the formatting error.

Some apps (game clients, UWP apps, terminal tools) bypass system proxy. Enable TUN mode:

Windows: Enable TUN Mode in Clash Verge — requires admin rights
macOS: Enable Enhanced Mode in ClashX Pro
Android: Make sure the VPN switch in Clash for Android is on

The default port 7890 may be taken by another program. Change the port in your config:

mixed-port: 7893   # Change to any available port

On Windows, use netstat -ano | findstr :7890 to find the PID using the port.

Enable fake-ip mode and configure fallback DNS in your config:

dns:
  enable: true
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  nameserver:
    - 223.5.5.5
    - 119.29.29.29
  fallback:
    - tls://8.8.8.8:853
    - tls://1.1.1.1:853
  fallback-filter:
    geoip: true
    geoip-code: CN