DownloadClash

Rule mode matches traffic against conditions like DOMAIN, IP-CIDR, and GEOIP to decide where each connection goes: local sites connect directly, traffic bound for services outside your country routes through a proxy node, and ad domains get blocked outright, with a MATCH rule catching anything left over so requests never fall through the cracks. Compared to a global proxy, rule-based routing keeps local sites at native speed and keeps you logged in, since only traffic that actually needs to leave the country touches a node — latency and data usage stay predictable. The kernel also supports GEOSITE and RULE-SET rule providers, so you can reference community-maintained lists instead of writing thousands of rules by hand.

A subscription link is a remotely updatable node list; the client fetches it on a schedule and merges it into your local config. Setup takes three steps: copy the link, paste it into subscription management, then save and select it. From there, node additions and removals sync automatically — no manual YAML editing required. Clients like Clash Plus and Clash Verge Rev all support multiple subscriptions running side by side with configurable update intervals, so switching providers or replacing a dead node is virtually zero-effort. Treat your subscription URL as a sensitive credential: don't share it with others or commit it to a public repository.

A DNS leak happens when the system resolves domain names outside the proxy, exposing your browsing activity to your local ISP. The mihomo kernel ships with a built-in DNS module: fake-ip mode returns a placeholder address for each domain and resolves the real target once the request reaches the kernel, so resolution never leaves the device. Combined with the nameserver, fallback, and nameserver-policy fields, you can route local and international domains to separate resolver groups, with DoH/DoT encrypted upstream support. The guide page includes a ready-to-use DNS config template — just copy it in to shut the leak down.

Proxy groups organize multiple nodes into a single switchable exit: select for manual choice, url-test for automatic latency-based selection, fallback for failover, and load-balance for load balancing. A common setup is grouping nodes by region (Hong Kong, Japan, US) and having rules reference the group name instead of individual nodes, so swapping a node requires zero rule changes. url-test groups let you customize the test URL and interval to automatically skip high-latency nodes; fallback switches through nodes in order when the primary drops, which suits long-lived stable connections. Groups can be nested — a manual group wrapping an automatic one is a common pattern.

Global mode routes all traffic through a single chosen exit, useful for debugging rules or reaching services that require one consistent exit; direct mode bypasses the proxy entirely, handy for isolating node issues. Mixed port lets HTTP and SOCKS5 requests share a single port (7890 by default), so there's one less port number to remember; enabling "Allow LAN" lets phones and tablets on the same network share your computer's proxy exit directly. Every client's settings page has the matching toggle — see the LAN-sharing article in our technical notes for exact locations.