Clash for AppleDownload & Setup Guides

RULES / FIRST MATCH

Choose an endpoint for each destination

Rules are checked from top to bottom, and the first match selects a proxy group. Put rules for specific domains before catch-all rules. Select rule mode in the client, then check the connection log to see which rule matched. Editing a file without reloading it won't change the running configuration. On Apple platforms, routing also depends on whether the connection reaches the client; apps outside the system proxy won't be matched by these rules. Unlike global mode, rule mode can keep local network traffic and selected sites on a direct connection. If your subscription already includes rules, add your own through the client's override feature to avoid losing them on the next update.

# This snippet uses built-in policies only
mode: rule
rules:
  - DOMAIN-SUFFIX,example.com,DIRECT
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - MATCH,REJECT

The example uses REJECT as a catch-all to illustrate rule order. In practice, replace it with a defined proxy group.

PROXY GROUPS / SELECTION

When to choose manually and when to run a test

Proxy groups organize nodes into selectable endpoints. Use a manual group to stick with a specific route; a URL-test group selects a candidate based on its probe results. Test duration doesn't indicate actual browsing speed across all sites. In an Apple client, expand the proxy group on the Proxies page to see the current selection and run a test. Supported fields depend on the kernel in use. Nested proxy groups make it easy to switch between manual and automatic selection, rather than choosing nodes one by one. When renaming a group, update any rules that reference it to avoid errors when loading the configuration.

# DIRECT is a built-in policy; add configured nodes to the candidate list
proxy-groups:
  - name: PROXY
    type: select
    proxies:
      - DIRECT
rules:
  - MATCH,PROXY

TUN / NETWORK STACK

Check permissions before routing system traffic

The system proxy works mainly with apps that respect proxy settings. TUN uses a virtual network interface to capture more connections, including those from apps that ignore the system proxy. A macOS client may require a helper service or approval for a network extension, depending on how it works. iOS usually creates a tunnel through the system VPN configuration; this doesn't mean desktop TUN fields can be used directly. Before switching modes, disable other tools that route network traffic and keep a copy of your current configuration. If local network access breaks, check routes and exclusions instead of repeatedly switching nodes.

# Requires client support and the necessary system permissions
tun:
  enable: true
  stack: mixed
  auto-route: true
  auto-detect-interface: true
  dns-hijack:
    - any:53

DNS / RESOLUTION

Separate DNS failures from proxy connection failures

A DNS lookup failure and a proxy connection timeout are different problems. First check the logs to see whether the destination address was resolved, then find out which route the DNS request took. A browser error alone doesn't tell you whether a node is at fault. Supported clients can use mihomo's separate DNS configuration; check the client documentation to see whether those fields are available on Apple mobile devices. Compared with relying on system DNS, a separate configuration gives you more control over the resolution path, but also involves upstream reachability, caching, and rule matching. Reload the configuration and start a new connection after making changes so cached results don't affect your test.

# Choose upstreams based on reachability on your current network
dns:
  enable: true
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  nameserver:
    - https://1.1.1.1/dns-query

SUBSCRIPTION / LIFECYCLE

Full configurations and proxy providers are different

Client subscriptions usually import a full configuration, while proxy providers supply only a collection of nodes. These are different import options. After pasting a link on the configuration page, check that it downloaded successfully, that the configuration is selected, and that its proxy groups appear. Import buttons may have different names on Apple platforms, but the checks are the same. Use a separate override to keep personal rules instead of editing a remote configuration directly, and note your customizations before updating a subscription. Subscription URLs may contain access credentials; store them in a trusted client and hide the full link when sharing logs or screenshots.

proxy-providers:
  local-nodes:
    type: file
    path: ./providers/local.yaml
proxy-groups:
  - name: PROXY
    type: select
    use:
      - local-nodes
rules:
  - MATCH,PROXY

Prepare a local file with a valid proxies list first; this snippet does not provide any proxy nodes.