How to Test for Clash DNS Leaks and Configure fake-ip for DNS Leak Protection
Learn how to tell whether DNS queries are bypassing the proxy. Compare fake-ip, nameserver-policy, and TUN interception, with a ready-to-use DNS configuration snippet.
Clash ecosystem · clients and configuration guides
Clash MirrorDownloads & Guides
Find Clash clients for every platform and follow clear setup steps to import subscriptions, configure rules, and verify your connection.
- Open Source
- Choose by Platform
- Settings Explained
Configuration Workspace
Clash Rules, Subscriptions & Network Settings
The client provides the interface; the core parses configuration and routes traffic. Understand what each setting controls before changing it. Change one setting at a time to make problems easier to trace.
Rule-Based Routing: Rules Are Checked in Order
Rule mode checks domains, addresses, or rule sets in order, then sends matching traffic to the assigned policy. Unlike global mode, it lets proxied and direct connections take different routes. First confirm that the policy group exists, then put specific rules before the catch-all rule. After making changes, check the connection list to see which rules actually matched—don't rely only on whether a webpage loads. The snippet below shows the rule structure only. PROXY must refer to an existing policy group; this is not a complete configuration to import on its own.
mode: rule
rules:
- DOMAIN-SUFFIX,example.com,PROXY
- IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
- MATCH,PROXYTUN Mode: Capture More Traffic
Some apps ignore system proxy settings. In that case, TUN can capture their traffic through a virtual network interface. TUN and the system proxy are separate settings, and enabling TUN does not mean every connection will use a proxy—rules still decide where traffic goes. Desktop clients may require service mode or elevated permissions; on phones, the system must grant VPN access. When setting up TUN for the first time, keep the system proxy working and test TUN separately. Avoid running multiple traffic-capture tools at once. This mihomo snippet shows an example; choose stack and routing options based on your system's support.
tun:
enable: true
stack: mixed
auto-route: true
auto-detect-interface: trueSubscription Management: Import, Then Activate
A subscription URL may return a complete configuration or only a list of proxy nodes. Check the format provided, import it through the client's profile or configuration page, then select and activate it. Auto-update fetches new content; it doesn't guarantee that the currently selected policy will work. Subscriptions make changing node lists easier to maintain than entering each node by hand, but remote updates may overwrite local edits. For custom rules, use the client's override or merge features where available, and keep a copy of the original configuration. Never share a subscription URL publicly.
# Keep local settings separate from remote configuration
mode: rule
log-level: info
mixed-port: 7890
allow-lan: falseDNS Settings: Check Where Queries Go
DNS resolution happens before a connection is established. If a node connects but domain names don't load, check the DNS path before repeatedly switching nodes. fake-ip returns reserved IP addresses so the core can associate connections with domain names, but DNS queries still need to reach the core. Unlike simply changing the system DNS server, this approach depends on the client, TUN interception, and rules working together. The snippet below shows enabled options and an address range; it is not a complete DNS leak protection setup. Back up your configuration first, then test DNS resolution and the actual connection route separately.
dns:
enable: true
enhanced-mode: fake-ip
fake-ip-range: 198.18.0.1/16Sync Across Devices: Share Rules, Not Environments
The same subscription can work across multiple compatible clients, but ports, service permissions, network interfaces, and file paths are usually device-specific. A safer approach is to reuse nodes and rules while configuring traffic capture separately on each device. This reduces path errors and port conflicts compared with copying an entire configuration directory. Clients may also differ in their support for overrides, rule sets, and core options. Check import warnings before migrating and keep a working backup for the destination device. Syncing configuration does not sync connection status or guarantee identical features across clients.
# Local settings to check on each device
mixed-port: 7890
allow-lan: false
external-controller: 127.0.0.1:9090What Do System Proxy, Rule Mode, and TUN Each Control?
The system proxy determines where apps that follow system settings send traffic. Rule mode determines how connections reaching the core are routed. TUN provides another way to capture traffic. These controls operate at different layers. Enabling rule mode does not automatically route every app through the proxy, and enabling TUN does not override direct rules in your configuration. When troubleshooting, check in this order: whether traffic is being captured, which rule matched, and where its policy sends it. This is more effective than changing several settings at once.
The window on this page is an illustration of settings, not proof that a device is connected. Labels may vary by client, and the mixed port depends on the active configuration. For complete installation steps, see the setup guide. For service permissions, routing conflicts, or restoring network access, consult the full documentation for your platform.
Platform Guides
Choose a Clash Client for Your Platform
Check your operating system and processor architecture before choosing a client. The download page lists installers, requirements, and maintenance status by platform; this page helps you find the right section.
Windows
View downloads macOS
View downloads Android
View downloads iOS
View downloads Linux
View downloads
View downloads macOS
View downloads Android
View downloads iOS
View downloads Linux
View downloads
Windows: Check Service Permissions First
Start with Clash Plus, or compare its workflow with clients such as Clash Verge Rev and FlClash. For typical browser traffic, test the system proxy first; if you need TUN, check that its service is installed and has the required permissions. If a port is already in use after installation, quit the old client. Don't let two apps change the system proxy at the same time. Clients that are no longer maintained are best treated as migration references; for ongoing use, consider projects that are still maintained.
macOS: Choose the Right Chip Architecture
Choose an installer that matches your Apple Silicon or Intel Mac. If macOS displays a security warning on first launch, verify the source and use the approval option in System Settings. Avoid disabling system-wide security just to run one app. After enabling the proxy, check the actual proxy address in network settings. When switching clients, turn off traffic capture in the old app before quitting to prevent leftover settings from complicating troubleshooting.
Android: Check Permissions and Background Restrictions
Approve the system VPN prompt the first time you connect, then check battery optimization and background activity restrictions. If the connection drops when you switch apps, check whether Android is stopping the client before importing the subscription again. Per-app proxying can limit which apps are routed, but inclusion and exclusion rules vary between clients, so read the description before selecting apps. In most cases, another VPN app will also compete for the same connection slot.
iOS: Install from the App Store
The download page links to Clash Plus on the App Store and lists the official site, clashplus.io, for reference. After importing a configuration, follow the system prompts to add a VPN configuration, then return to the client and check the active profile and policy. The VPN indicator only confirms that the tunnel is connected; it doesn't mean every domain is proxied. Check rules and connection details to see where traffic actually goes.
Linux: Desktop Clients and the Core Are Different
Desktop users can start with Clash Verge Rev or FlClash, then choose a package for their distribution. Server and router users can explore the mihomo core, but will need to manage startup options, configuration directories, and service permissions themselves. Before changing routes on a remote device, keep an admin connection open and have a rollback plan. A desktop toggle does not automatically create a server-side service configuration.
Getting Started
Import a Clash Subscription and Test Your Connection
Follow these three steps to get started. First establish a connection you can verify; then explore automatic selection, advanced rules, and multi-device setup. This keeps installation issues separate from rule issues.
-
01 / IMPORT
Import and Activate a Configuration
Add the subscription URL on the profile or subscription page, wait for it to download, then select it as the active configuration. First check that nodes and policy groups are present, then review any import errors. If the download fails, check whether the URL has expired, the network is reachable, or the format is supported. Repeatedly refreshing won't fix a configuration syntax error.
-
02 / ROUTE
Choose a Policy and Traffic Capture Method
For your first setup, select rule mode and choose an available node in the policy group that handles proxied traffic. On desktop, enable the system proxy; on phones, approve VPN access. Test TUN only if the target app ignores the system proxy. Keep the default LAN access restrictions—don't expose the controller interface just to make connecting easier.
-
03 / VERIFY
Test the Connection and Matched Rules
Open the site you want to reach and check its domain, matched rule, and policy chain in the connection list. Loading one page doesn't mean every app is routed; a successful node test doesn't guarantee DNS is working. Then test a destination that should connect directly, confirm the routing is as expected, and enable other features one at a time.
Connection Failed? Preserve the Evidence First
Note the client, platform, traffic capture method, and first error in the logs. Temporarily revert complex overrides to a working state, then troubleshoot one item at a time. If internet access still fails after quitting the client, check whether the system proxy points to a local port. If only domain names fail, check DNS. Back up your configuration before replacing it so you don't lose the only way to reproduce the problem.
The setup guide follows the first-connection process and is designed to walk you through each step. The full documentation is organized by Windows, macOS, Android, iOS, and Linux, making it easier to look up installation permissions, platform limitations, and configuration options. If you encounter terms such as fake-ip, policy groups, or rule sets, check the glossary before returning to the current step.
Open Source Projects and How They Relate
The Clash Ecosystem and the mihomo Core
Check licenses, distinguish between projects, then review update status. Similar client names don't mean the projects share a maintainer, core, or configuration features.
GPL-3.0
The open-source license listed in the mihomo repository. Check each graphical client and bundled component's project documentation for its own license.
Project History: Names Don't Reveal Maintenance Status
The original Clash provided the configuration and routing foundations for rule-based proxies. Different forks and graphical clients emerged as the ecosystem grew. Even after the original project stopped being maintained, its name may still appear in installers, guides, and subscription documentation. When choosing a client, look beyond a familiar name: check the specific project's maintenance status, platform support, and configuration compatibility. Fields mentioned in older guides may not apply to the core you're using today.
How the Core and Interface Work Together
mihomo evolved from the Clash Meta project and handles network logic such as configuration parsing, protocol connections, rule matching, and DNS. Graphical clients build on the core to provide subscription imports, controls, logs, and service management. A client interface update doesn't necessarily change core behavior; conversely, new core options may need client support before they're easy to use.
Open Source: Know the Boundaries by Checking the Source
Open-source repositories are useful for checking licenses, configuration examples, and issue discussions, but not every problem belongs to the core. Diagnose system permissions, background restrictions, and interface import failures at the appropriate layer. Before filing an issue, reproduce it with a minimal, redacted configuration and describe both the expected and actual behavior. Cloning the source is for development and review; it doesn't install the software or provide a ready-to-use subscription.
Updates: Maintain the Client and Subscription Separately
Client updates change the application; subscription updates change remote configuration content. Neither can replace the other. Before upgrading, back up local overrides and your current working configuration. Afterward, check traffic capture, rule matching, and DNS behavior. Clash Mirror organizes download links and guides; it is not affiliated with upstream projects. Check each project's documentation for details on features and releases. Find download links on the client downloads page.
Browse the mihomo Source Code
Git must be installed on your machine first. This command only clones the repository; it does not change your system proxy.
git clone https://github.com/MetaCubeX/mihomo.gitConfiguration Guides
Clash Guides and Troubleshooting
The latest three guides cover DNS, mobile battery drain, and the core ecosystem. Narrow down the cause based on what you're seeing, then adjust settings one at a time. When changing traffic capture, test each change and keep a way to roll back.
Clash Draining Your Phone Battery? Check Background Activity, DNS Polling, and Power Settings
Excessive battery drain on mobile may be caused by frequent wake-ups, automatic subscription updates, log levels, or TUN stack selection. Follow a step-by-step checklist and apply practical power-saving settings.
How the mihomo Core Relates to Graphical Clients Like Clash Verge and FlClash
Trace the evolution from the original Clash through Clash Meta to mihomo, and learn how the core and graphical frontends divide responsibilities, how their licenses differ, and which core each client uses.