Mihomo client Complete tutorial on installation, configuration and use
This tutorial explains in detail the installation, configuration and usage process of Mihomo eco-related clients, covering the entire process including download preparation, subscription import, node selection, agent activation, rule distribution, TUN mode configuration and troubleshooting of common problems.
Usage process overview
The complete process of using the Clash client can be divided into four stages: preparation stage (downloading the client, obtaining subscriptions), installation stage (granting system permissions), configuration stage (importing subscriptions, selecting nodes), and usage stage (enabling proxy, verifying connection). The tutorial unfolds in this order.
Download the corresponding platform client and obtain the subscription link from the airport
Complete the client installation and grant necessary system permissions
Import subscription configuration and select available nodes
Enable the agent and verify the network connection status
Preparation before installation
Before starting the installation, you need to confirm your system platform, select the appropriate client version, and prepare the subscription link (usually provided by the airport service provider).
winver, or right-click "This PC" → Properties. Most PCs are x64 (Intel/AMD); Snapdragon laptops are arm64.
uname -m. For x86_64, choose the amd64 package; for aarch64, choose the arm64 package. Ubuntu/Debian uses .deb; Fedora/CentOS uses .rpm.
Recommended client:Clash Verge Rev is preferred on desktop (Tauri architecture, low memory footprint); Android preferred FlClash(Designed by Material You, consistent cross-platform experience).
The subscription link is usually provided by the airport (agent service provider), with a similar format https://example.com/subscribe?token=xxxxx. Log in to the airport backend, find the "Subscription" or "Clash Subscription" tab, and copy the link for later use.
Complete tutorial on desktop
Take Clash Verge Rev as an example, available for Windows, macOS and Linux. The operation logic of other clients (such as FlClash, Mihomo Party) is basically the same.
Double-click the .exe or .msi installation package. The first time you run it, a "Microsoft Defender SmartScreen Blocked..." prompt will pop up. This is because the open source software has not purchased a paid digital signature.
- Click in the prompt window"More information"
- Click on the appearing "Run anyway"Button
- Complete the installation according to the installation wizard
Double-click the .dmg file and drag the application icon to the Applications folder. When opening the prompt "Unable to verify developer" for the first time:
- Go toSystem Settings → Privacy and Security
- Scroll down to the bottom and find the blocked application prompt
- Click"Open anyway"And enter the password
sudo dpkg -i clash-verge-rev_*.deb
# Fedora / CentOS / RHEL system
sudo rpm -i clash-verge-rev-*.rpm
# AppImage (universal format, installation-free)
chmod +x Clash.Verge_*.AppImage
./Clash.Verge_*.AppImage
If prompted that webkit2gtk is missing, execute:sudo apt install libwebkit2gtk-4.1-0
- Open the Clash Verge Rev client
- Click on the left navigation bar"Configure"(Profiles) Tag
- Click on the upper right corner"New"button or "+" Icon
- Select"Import from URL"（Import from URL）
- Paste your subscription link in the pop-up window
- (Optional) Give the configuration a name, such as "Airport A"
- Click"Save"or"Import"
- Wait for the download to complete, and the new configuration will appear in the configuration list
- Right-click the configuration → select"Enable" (or click to activate)
Before updating your subscription, be sureTurn off the client's "system agent" switch. If the proxy is turned on to update the subscription, an infinite loop will be formed (the subscription request itself also tries to go through the proxy), resulting in Download Error.
Right-click configuration → select"Automatic update"Or turn on "Automatic update subscription" in the settings. The recommended interval is 24 hours to ensure that node information is refreshed in time.
- Click on the left"Agent"(Proxies) label
- Click"All delayed tests"Icon (lightning sign)
- Wait for the speed test to be completed, the delay value will be displayed next to the node name
- Choose nodes with low latency (usually < 300ms) and stable
- Click on the node to make it selected (usually highlighted)
Get started with Clash Verge Rev v2.4.7Real TLS handshake delayReplacing HTTP request delay, the speed measurement is more accurate. Latency only represents handshake speed, not actual bandwidth.
Delay reference:< 100ms is extremely fast; 100-300ms is normal; > 500ms is slow or unstable.
If the configuration file contains proxy groups (Proxy Groups), you will see multiple groups, common types:
- Select (manual selection): Manually click to select the node
- URLTest (automatic selection): Automatically select the node with the lowest latency
- Fallback (failover):Automatically switch to the backup node when the primary node fails
- LoadBalance (load balancing):Multi-node offloading
- Return to clientHomepageorSettingsPage
- Find"System agent"(System Proxy) switch
- Turn on the switch (usually turns green or highlighted)
- At this time, the system traffic will pass through the Clash proxy
- Open the browser and visit
ip.sboripinfo.io - Check whether the displayed IP address is the IP of the proxy node
- Check whether the geographical location is the country/region where the node is located
- If the IP is still a local IP, check whether the proxy switch is really turned on
Clash usually provides three modes, which can be switched on the client homepage or settings:
- Rule (rule):Diversion according to rules, domestic direct connection, foreign proxy (recommended for daily use)
- Global (global):All traffic goes through the proxy, suitable for testing node connectivity
- Direct (direct connection):All traffic does not go through the proxy, which is equivalent to turning off the proxy
Android complete tutorial
For the Android platform, it is recommended to use FlClash (designed by Material You) or Clash Meta for Android (more comprehensive functions). The following takes FlClash as an example.
- Download the APK file of the corresponding architecture (most mobile phones choose arm64-v8a)
- Click the APK file to install
- If prompted "Applications from this source are not trusted", clickSettings
- Open on jump page"Allow installation of unknown applications"Switch
- Return to continue the installation and open the application after completion
- Xiaomi MIUI: Settings → Application settings → Application management → Three dots in the upper right corner → Install unknown application
- Huawei EMUI:Settings → Security → More security settings → Install external source applications
- OPPO ColorOS：Settings → Application Management → Three dots in the upper right corner → Special application permissions → Install unknown applications
- Native Android:Settings → Apps and Notifications → Special App Permissions → Install Unknown Apps
- Open FlClash App
- Click on the bottom"Configure"(Profiles) Tag
- Click on the lower right corner"+"Floating button
- Select"Add from URL"
- Paste the subscription link and click"OK"
- Wait for synchronization to complete (usually a few seconds)
- Click the configuration to activate it (there will be a check mark)
FlClash supports WebDAV synchronization configuration to multiple devices. Configure a WebDAV server (Nut Cloud, Nextcloud, etc.) in settings to synchronize subscriptions and node selections across devices.
- Click on the bottom"Agent"(Proxies) label
- Select an available node (you can click the speed test icon to check the delay first)
- Return"Home"Label
- Click on the large Start buttonorConnection switch
- The first connection will pop up"Connection request"Tips
- Check"I trust this app", click "OK"
- The VPN icon appears in the notification bar, indicating that the proxy is enabled
- Open the browser and visit ip.sb to verify whether the IP has changed
FlClash and Clash Meta for Android support sub-application proxies. You can choose from the settings:
- Only allow mode:Only the checked App uses the proxy, and other direct connections
- Only deny mode:Checked Apps do not use proxies (such as games, banking apps), others use proxies
General operations after import
Whether using desktop or Android After completing the subscription import, the client usually needs to go through three steps of node selection, agent activation and rule verification before it can enter the regular use state.
It is recommended to manually select a known available node for testing. It is not recommended to directly determine client exceptions without verifying node availability. Use the latency testing feature to filter for low latency nodes.
System proxy or TUN is usually enabled on desktop; VPN connection is usually enabled on Android. If permissions are not granted (such as Windows administrator permissions, macOS system extensions, Android VPN authorization), the proxy capability may not take effect.
It is recommended to open common web pages (such as Google, YouTube) for basic testing. Then switch rule mode, global mode or other configurations as needed to observe whether the access results are as expected.
TUN Mode, Rule Diversion and DNS Optimization
For users with advanced needs, you can enable TUN mode to globally take over traffic, customize rule distribution, and optimize DNS configuration to prevent pollution.
Function:Create a virtual network card to take over all traffic of the device (including UDP) and solve the problem of command line tools (Git, npm, Docker), games and UWP applications not using the system proxy.
- Clash Verge Rev：Settings → TUN mode → Turn on the switch
- Windows：You need to run the client as an administrator
- macOS：For the first time, you need to allow system expansion in System Settings → Privacy and Security
- Linux：Requires root permissions or CAP_NET_ADMIN capability
- TUN mode and system agent can be turned on at the same time without conflicting with each other
- After opening, some games may detect the virtual network card and refuse to run
- If you encounter network abnormalities, you can try to turn off TUN to troubleshoot problems
Clash's rules determine which traffic goes through the proxy and which traffic is directly connected. Common rule types:
- DOMAIN (precise domain name):
DOMAIN,google.com,Proxy- google.com Go through proxy - DOMAIN-SUFFIX (domain name suffix):
DOMAIN-SUFFIX,google.com,Proxy- *.google.com full agent - DOMAIN-KEYWORD (keyword):
DOMAIN-KEYWORD,google,Proxy- Including google domain name proxy - GEOIP (geographic location):
GEOIP,CN,DIRECT- Domestic IP direct connection - IP-CIDR (IP segment):
IP-CIDR,192.168.0.0/16,DIRECT- LAN direct connection - MATCH (secure rules):
MATCH,Proxy- Other traffic goes through proxy
Right-click the subscription configuration → Edit Rules → You can add custom rules in the graphical interface, and the rules will be inserted before the subscription rules. Extension scripts (JavaScript) can also be used to dynamically modify rules.
See the homepage tutorial for detailsExtended configuration and scriptsChapter.
Properly configuring DNS can prevent operator DNS pollution and ensure accurate domain name resolution. Mihomo supports fake-ip mode (recommended) and redir-host mode.
Mihomo immediately returns a 198.18.0.0/16 For fake IPs within the range, rule matching is completed at the domain name stage, with lower latency and more accurate diversion.
- proxy-server-nameserver：Specialize in parsing proxy node domain names and use domestic DNS to ensure they are not contaminated
- nameserver：To resolve overseas domain names, it is recommended to use DoH (DNS over HTTPS)
- fake-ip-filter：Whitelist, these domain names skip fake-ip (such as LAN domain names)
See the homepage tutorial for detailsDNS anti-pollution configuration details。
Diagnosis and solutions to common problems
This article summarizes the troubleshooting ideas and solutions for the most common problems encountered during use, such as connection failure, slow speed, and the inability of some applications to connect to the Internet.
Common reasons:
- The client turns on the system proxy or TUN mode to update the subscription, forming an infinite loop
- The subscription link itself is invalid or closed by the airport
- The current network cannot access the subscriber server (blocked)
- Firewall intercepts client network requests
Solution:
- Turn off the client's system proxy and TUN mode
- Click again to update the subscription
- Confirm whether the subscription link is correct (whether it is complete when copying)
- Contact the airport customer service to confirm whether the subscription is valid
- Try to use a mobile hotspot to change the network environment
Troubleshooting steps:
- Confirm that the node is available:Manually switch to other nodes on the proxy page, or click Latency Test
- Confirm that the agent is enabled:Check whether the system proxy/VPN switch is really turned on
- Confirm the rule mode:In Rule mode, confirm that Google is acting as a proxy (can temporarily switch to Global mode for testing)
- Check DNS:Visit ip.sb to see if the IP has changed; if it has not changed, the proxy has not taken effect
- Browser cache:Clear the browser cache and cookies and try again
- Firewall:Check whether the system firewall blocks the client
Common reasons:
- This application does not use the system proxy (such as command line tools, some games)
- Windows UWP applications are restricted by Loopback
- The application itself detects the proxy/virtual network card and refuses to run
Solution:
- Enable TUN mode: Can take over applications that do not use system proxy
- UWP Apps (Windows):Use "UWP Loopback tool" in Clash Verge Rev settings to lift restrictions
- Command line tool: Manually configure the agent environment variables (see below)
- Game refuses to run:Some anti-cheating games detect virtual network cards and need to turn off TUN mode
git config --global http.proxy http://127.0.0.1:7897
# npm configuration agent
npm config set proxy http://127.0.0.1:7897
# Temporary environment variables (Linux/macOS)
export http_proxy=http://127.0.0.1:7897
export https_proxy=http://127.0.0.1:7897
Possible reasons:
- The node is blocked or speed-limited (airport overbooking)
- Poor local network environment
- DNS Pollution leads to resolution to wrong IP
- Rule configuration problem (the proxy should be used for direct connection)
Optimization method:
- Replace the node and choose a low-latency and stable one
- Avoid crowded nodes during peak hours (8-11pm)
- Use anti-blockade protocols such as Hysteria2 and VLESS
- Configure DoH/DoT DNS to prevent pollution
- Contact airport customer service to feedback node quality
- Consider changing the airport service provider
Solution steps:
- System Settings → Privacy and Security
- Scroll down to the bottom and find the "Blocked... System extension" prompt
- Click "Allow" and enter the system password
- Re-enable TUN mode in the client
If multiple attempts still fail, try to uninstall the service on the terminal and then reinstall it:
sudo "$APP/Contents/Resources/resources/clash-verge-service-uninstall"
sudo "$APP/Contents/Resources/resources/clash-verge-service-install"
High-frequency problem solving
This situation is usually related to invalid subscription, incorrect link filling, current network inability to access the subscription address, or abnormal configuration format. Suggestions: ① Turn off the system proxy and TUN mode and then renew the subscription; ② Confirm whether the subscription link is complete (do not miss characters when copying); ③ Contact the airport customer service to confirm the subscription status; ④ Check the client log for error messages.
System AgentOnly applications that follow the system proxy settings (such as browsers) can be proxied. Some command line tools (Git, npm, Docker) and games will not be proxied. TUN ModeAll applications can be proxied by creating a virtual network card to take over all traffic (including UDP), but administrator rights are required. Both can be turned on at the same time.
Some proxy modes require higher system permissions, such as TUN mode (need to create a virtual network card), service mode (resident in the background). Windows requires administrator privileges; macOS requires system extensions; Linux requires root or specific capabilities. These prompts are part of the normal authorization process, and relevant functions can only be used after permission.
Windows：Select x64.exe for x64; select arm64.exe for arm64 (Snapdragon notebook). macOS：For Apple Silicon (M1/M2/M3/M4), choose aarch64.dmg; for Intel, choose x64.dmg; for Universal version, both can be used. Linux： For Ubuntu/Debian, choose .deb; for Fedora/CentOS, choose .rpm; for universal, choose AppImage. Android：For mobile phones after 2020, choose arm64-v8a.apk; for old devices, choose armeabi-v7a.apk; for simulators, choose x86_64.apk.
Not available. Clash series clients are pure proxy tools and do not contain any node or server resources. You need to purchase a subscription from the agency service provider (commonly known as "airport"), obtain the subscription link and then import it into the client. When choosing an airport, it is recommended to pay attention to whether it provides new agreements, after-sales support, and whether there is a trial period.
Rule (rule) modeIntelligent distribution according to the configuration file: domestic websites are directly connected, foreign websites use proxies, taking into account speed and traffic, Preferred for daily use。Global (global) modeSend all traffic to the proxy, which is suitable for testing node connectivity or accessing services that require a proxy. Direct (direct connection) modeAll traffic does not go through the proxy, which is equivalent to turning off the proxy.
Recommended steps: ① Visit ip.sb or ipinfo.io and check whether the IP is the node IP; ② Access dnsleaktest.com Run Extended Test to check whether DNS leaks; ③ Access browserleaks.com/ip Check if WebRTC leaks real IP. If the IP is still the local IP, it means that the proxy is not effective. Check whether the switch is turned on and whether the node is available.
The full source code of Clash Verge Rev (GPL-3.0 license) and FlClash is publicly available on GitHub and can be reviewed by anyone. The project is maintained by an active community, and PR merging requires review. The software itselfDoes not contain any nodes or behavior of uploading data, just forward traffic to the proxy node according to the configuration file. The real thing to pay attention to is whether the "airport" (proxy service provider) you use is trustworthy, not the client itself.