Clash - clash官网|掌控你的网络边界 |clash节点

核心特色 Core Features

为什么选择 Clash？ Why Choose Clash?

不同于传统VPN的全局隧道模式，Clash 采用规则驱动的智能分流，让网络流量管理更加精细化、高效化。

Unlike traditional VPNs with global tunneling, Clash employs rule-driven intelligent routing for more precise and efficient network traffic management.

🧠

智能分流Rule-Based Routing

支持按域名、IP、应用进程自动选择最优路径。国内网站直连访问，海外流量走代理通道，两者互不干扰，实现真正的智能化网络分流体验。

Automatically selects the optimal route by domain, IP, or application process. Domestic sites connect directly while international traffic goes through proxy channels—true intelligent network分流 with zero interference.

🔌

多协议兼容Multi-Protocol Support

入站支持 HTTP / SOCKS5 / TUN 等多种协议，出站全面兼容 Shadowsocks、VMess、Trojan、Snell 等主流代理协议，满足不同网络环境和安全需求。

Inbound supports HTTP, SOCKS5, and TUN protocols. Outbound is fully compatible with Shadowsocks, VMess, Trojan, Snell, and other major proxy protocols to meet diverse network and security requirements.

💻

全平台覆盖Cross-Platform Coverage

覆盖 Windows、macOS、Linux、Android、iOS 以及 OpenWrt 路由器。无论桌面办公、移动出行还是家庭网络环境，Clash 都能提供一致的使用体验。

Covers Windows, macOS, Linux, Android, iOS, and OpenWrt routers. Whether on desktop, mobile, or home network setups, Clash delivers a consistent experience across all platforms.

⚡

高性能 DNSHigh-Performance DNS

配合 Fake-IP 技术大幅减少 DNS 污染风险，显著提升域名解析响应速度。智能DNS策略确保国内外域名各走各的解析通道，兼顾速度与准确性。

With Fake-IP technology, DNS pollution risks are drastically reduced while domain resolution speed is significantly improved. Smart DNS strategies ensure domestic and international domains use separate resolution paths for optimal speed and accuracy.

多端下载 Downloads

选择您的平台 Choose Your Platform

以下为各平台推荐的官方兼容客户端。悬停卡片可查看版本号与校验信息。请务必从可信来源下载。

Below are recommended official-compatible clients for each platform. Hover over cards to see version numbers and checksum info. Always download from trusted sources.

🪟 Windows Clash for Windows v0.20.39 / Clash Verge Rev Clash for Windows v0.20.39 / Clash Verge Rev SHA256: a1b2c3...f7e8 下载 Windows 版Download for Windows

🍎 macOS ClashX / ClashX Pro / Stash for macOS ClashX / ClashX Pro / Stash for macOS SHA256: d4e5f6...a9b0 下载 macOS 版Download for macOS

🤖 Android Clash for Android v2.5.12 Clash for Android v2.5.12 SHA256: c1d2e3...b4a5 下载 Android 版Download for Android

📱 iOS Stash / Shadowrocket（第三方） Stash / Shadowrocket (3rd-party) SHA256: App Store 分发查看 iOS 方案View iOS Options

🐧 Linux Clash Verge Rev / OpenClash Clash Verge Rev / OpenClash SHA256: f1a2b3...c8d9 下载 Linux 版Download for Linux

📡 OpenWrt OpenClash 插件 OpenClash Plugin SHA256: e0d1c2...b6f7 查看路由器版View Router Version

快速上手 Quickstart

三步开启代理 3 Steps to Get Started

无需复杂配置，只需下载、导入、连接三步即可完成。以下是入门指南和配置示例。

No complex setup needed—just download, import, and connect. See the guide and configuration example below.

① 下载安装① Download & Install

选择对应您操作系统的版本，从上方下载区获取安装包，完成安装后启动应用。首次启动会自动生成默认配置目录。

Choose the version matching your operating system from the download section above. Install and launch the app—a default configuration directory will be auto-generated on first run.

② 导入配置② Import Configuration

通过订阅链接一键导入，或手动添加 YAML 配置文件。支持远程 Providers 动态加载代理列表，配置实时生效无需重启。

Import via a subscription link with one click, or manually add a YAML configuration file. Remote Providers support dynamic proxy list loading with real-time生效 without restarting.

③ 启动代理③ Start Proxy

开启系统代理或服务模式，访问测试网址确认连接已生效。TUN 模式下可接管全设备 TCP/UDP 流量实现透明代理。

Enable system proxy or service mode, then visit a test URL to confirm the connection is active. In TUN mode, all device TCP/UDP traffic can be intercepted for transparent proxying.

                # Clash 配置示例 / Configuration Example
                port: 7890
                socks-port: 7891
                mode: rule
                log-level: info
                proxies:
                - {name: "节点A", type: ss, server: example.com, port: 443}
            

高级特性 Premium Features

面向技术用户的深度功能 Deep Features for Tech Users

Clash 不仅适合日常使用，更为开发者和重度用户提供了丰富的高级能力，充分释放网络管理的潜力。

Beyond daily use, Clash offers rich advanced capabilities for developers and power users to fully unlock network management potential.

🌐

TUN 透明代理TUN Transparent Proxy

通过创建虚拟网卡设备接管全设备 TCP/UDP 流量，实现真正意义上的透明代理，无需逐应用设置代理参数即可让所有网络请求经过规则引擎处理。

Creates a virtual network interface to intercept all device TCP/UDP traffic, achieving true transparent proxy without per-app proxy settings—all network requests pass through the rule engine automatically.

🔧

RESTful APIRESTful API

提供完整的 RESTful API 接口，支持配置文件热更新、流量统计查询、代理节点动态切换。方便集成到自动化脚本或第三方管理面板中实现远程控制。

Provides a complete RESTful API for hot config reloading, traffic statistics queries, and dynamic proxy node switching. Easily integrates with automation scripts or third-party management dashboards for remote control.

⚙️

Proxy Groups 策略组Proxy Groups

支持 Fallback、Load Balance、URL-Test 等多种策略组模式。可根据延迟测试结果自动选择最佳节点，或实现负载均衡分发流量，确保高可用性。

Supports Fallback, Load Balance, URL-Test, and other strategy group modes. Automatically selects the best node based on latency tests or distributes traffic via load balancing to ensure high availability.

📜

强大规则引擎Powerful Rule Engine

支持 Rule Set、JavaScript 脚本扩展等高度自定义规则。远程 Providers 可动态加载代理列表，实现规则与节点信息的实时同步更新，灵活度极高。

Supports Rule Set, JavaScript scripting extensions, and highly customized rules. Remote Providers dynamically load proxy lists for real-time syncing of rules and node info with extreme flexibility.

安全与隐私 Security & Privacy

开源透明，数据由您掌控 Open Source, Your Data Your Control

Clash 基于 GPL-3.0 开源许可证发布，所有代码接受社区审计。配置文件和日志完全留存在您的本地设备，绝无隐私泄露风险。

Clash is released under the GPL-3.0 open-source license with full community auditability. All configuration files and logs remain strictly on your local device—zero privacy leakage risk.

🔓

开源基因Open Source DNA

基于 GPL-3.0 许可证，源代码完全公开在 GitHub 上，接受全球开发者的审查与贡献，确保没有任何隐藏后门或恶意代码注入的可能。

Under the GPL-3.0 license, all source code is publicly available on GitHub,接受 global developer review and contributions, ensuring no hidden backdoors or malicious code injection possibilities.

💾

数据本地化Data Localization

所有配置数据、连接日志和缓存信息均存储在您的本地设备上，不会上传至任何云端服务器。您对数据拥有完全的控制权和处置权，隐私安全有保障。

All configuration data, connection logs, and cache info are stored locally on your device—never uploaded to any cloud server. You have full ownership and control over your data with guaranteed privacy.

🛡️

加密传输建议Encryption Recommendations

强烈建议优先使用 AEAD 加密协议（如 Shadowsocks AEAD、VMess AEAD），并定期更新客户端版本与规则集，以获得最新的安全补丁和协议优化保护。

We strongly recommend prioritizing AEAD encryption protocols (e.g., Shadowsocks AEAD, VMess AEAD) and regularly updating client versions and rule sets for the latest security patches and protocol optimizations.

社区与生态 Community & Ecosystem

活跃的开源社区 Vibrant Open Source Community

Clash 拥有庞大的用户群体和活跃的开发者社区。众多衍生项目（如 Mihomo 内核）和订阅服务商共同构成了繁荣的生态系统。

Clash boasts a large user base and an active developer community. Numerous derivative projects (such as the Mihomo kernel) and subscription providers form a thriving ecosystem together.

50k+

GitHub StarsGitHub Stars

200+

贡献者Contributors

30+

衍生项目Derivative Projects

10M+

全球用户Global Users

常见问题 Frequently Asked Questions

您可能关心的问题 Questions You May Have

以下整理了6个类别中最常被问到的问题，每个回答均按步骤详细拆解，帮助您全面了解Clash的各项能力与使用方式。

Below are the 6 most frequently asked question categories, each broken down into step-by-step answers to help you fully understand Clash's capabilities and usage.

❶ Clash与传统VPN的区别是什么？（产品对比类） ❶ What's the difference between Clash and traditional VPNs? (Product Comparison)

传统VPN采用全局隧道模式：当您连接传统VPN后，设备上所有网络流量——无论是访问国内电商网站还是浏览国外社交平台——都会被无差别地通过加密隧道转发到VPN服务器。这种一刀切的方式导致访问国内网站时速度变慢、延迟增高，因为数据包需要先绕行至VPN服务器再返回国内目标站点，造成了不必要的网络迂回和带宽浪费，同时也增加了VPN服务器的负载压力。
Clash采用规则驱动的智能分流机制：Clash 的核心优势在于其强大的规则引擎，它可以基于域名、目标IP地址段、甚至发起网络请求的应用程序进程名称来做出精细化的路由决策。例如您可以设定规则让所有访问国内域名列表中的网站直接走本地网络出口，而将访问海外服务的流量自动匹配到代理通道上，两者同时工作且互不干扰，实现了真正意义上的网络流量智能调度。
灵活性与可控性的显著差异：传统VPN一旦开启就会接管全部网络连接，用户无法对单个应用或特定网站进行差异化设置。而Clash支持Proxy Groups策略组、负载均衡和延迟自动测试等高级功能，您可以为不同的网络目标指定不同的代理节点，甚至可以编写JavaScript脚本实现高度自定义的路由逻辑，这种灵活性是传统VPN方案所无法提供的。
性能表现上的本质区别：由于传统VPN对所有流量一视同仁地加密和转发，当您同时访问国内外服务时，国内网站的响应速度会受到明显影响。Clash通过智能分流让国内流量直接走本地网络，仅在需要时才调用代理通道，从而最大程度地保留本地网络的原始速度，用户几乎感知不到代理层的存在，整体网络体验更加流畅自然。
适用场景的差异性分析：传统VPN更适合需要全局匿名化或公司内网接入的场景，其目标是创建一个完整的私有网络隧道。而Clash更适合日常混合网络使用场景——即用户需要同时高效访问国内外资源，并希望对流量进行细粒度管理的情况，这也是大多数个人用户和开发者实际面临的网络需求。
总结选择建议：如果您追求的是对网络流量的精准控制、希望国内国外访问速度互不影响、并且愿意花少量时间了解规则配置，那么Clash无疑是更优的选择。它兼具开源透明、社区活跃、跨平台兼容等优势，是传统VPN的理想替代方案和升级方向，尤其适合对网络质量有较高要求的技术用户群体。

Traditional VPNs use a global tunnel approach: When connected to a traditional VPN, all device network traffic—whether accessing domestic e-commerce sites or browsing international social platforms—is indiscriminately forwarded through an encrypted tunnel to the VPN server. This one-size-fits-all method causes slower speeds and higher latency for domestic sites, as data packets must detour through the VPN server before returning to the target, creating unnecessary network迂回 and bandwidth waste while increasing server load.
Clash employs rule-driven intelligent routing: Clash's core advantage lies in its powerful rule engine, which makes精细 routing decisions based on domain names, target IP address ranges, or even the application process name initiating the request. For example, you can set rules so that all domestic-domain traffic goes directly through your local network while international service requests are automatically matched to proxy channels—both working simultaneously without interference, achieving true intelligent network traffic调度.
Significant differences in flexibility and control: Once a traditional VPN is activated, it takes over all network connections without allowing per-app or per-site differentiation. Clash supports Proxy Groups, load balancing, and automatic latency testing, allowing you to assign different proxy nodes to different network targets and even write JavaScript scripts for highly customized routing logic—flexibility that traditional VPN solutions simply cannot offer.
Essential performance distinctions: Because traditional VPNs encrypt and forward all traffic equally, domestic site response times suffer noticeably when accessing both domestic and international services simultaneously. Clash's intelligent routing lets domestic traffic go directly through the local network, invoking proxy channels only when needed, thereby preserving the原始 speed of your local connection with minimal perceptible proxy overhead for a smoother overall experience.
Use case differentiation analysis: Traditional VPNs are better suited for scenarios requiring global anonymization or corporate intranet access, aiming to create a complete private network tunnel. Clash is more suitable for everyday mixed-network scenarios—where users need efficient access to both domestic and international resources with fine-grained traffic management, which is precisely what most individual users and developers actually need.
Summary and recommendation: If you seek precise control over network traffic, want domestic and international speeds to remain unaffected by each other, and are willing to invest a small amount of time learning rule configuration, then Clash is undoubtedly the superior choice. It combines open-source transparency, an active community, and cross-platform compatibility—making it an ideal alternative and upgrade path from traditional VPNs, especially for tech-savvy users with high network quality demands.

❷ 什么是订阅链接？如何获取和使用？（配置获取类） ❷ What is a subscription link? How to obtain and use it? (Configuration Acquisition)

订阅链接的基本概念解释：订阅链接是一种由代理服务提供商生成的专属URL地址，它包含了加密的代理节点信息、服务器地址、端口号、加密方式和密码等配置数据。当您在Clash客户端中填入这个链接后，客户端会自动解析其中的信息并将其转换为可用的代理节点列表，无需用户手动逐个添加每个节点的详细参数，大大简化了配置流程并降低了入门门槛。
订阅链接的合法获取途径：您需要从可信赖的代理服务提供商处获取订阅链接，通常是在购买其服务后通过用户后台面板生成专属链接。部分开源社区也会分享免费的公共订阅资源，但使用免费订阅时需格外注意安全风险。请务必通过HTTPS加密通道获取订阅链接，避免在不安全的网络环境中明文传输包含敏感节点信息的URL地址。
在Clash客户端中导入订阅链接的方法：打开您所使用的Clash客户端（如Clash for Windows、Clash Verge Rev等），在配置管理或订阅管理界面中找到"添加订阅"或"导入配置"选项，将完整复制的订阅链接粘贴到输入框中并保存。客户端会自动发起HTTP请求下载远程配置文件，解析后即可在代理节点列表中看到所有可用节点。
订阅自动更新的机制说明：大多数Clash兼容客户端都支持订阅自动更新功能，您可以设置定时更新的时间间隔（如每6小时或每天更新一次）。启用此功能后，客户端会定期向订阅链接发起请求以获取最新的节点信息和配置变更，确保您始终使用服务商提供的最新节点列表，避免因节点过期或信息变更导致的连接失败问题。
订阅链接安全性的深度考量：订阅链接本身包含您的节点配置信息，一旦泄露他人即可直接使用您的代理资源。因此务必妥善保管订阅链接，不要将其公开发布在社交平台或公共代码仓库中。建议定期在服务商后台刷新订阅链接以轮换密钥，同时使用支持TLS加密的订阅地址来防止中间人攻击和数据篡改风险。
常见问题排查与解决思路：如果订阅导入后节点列表为空，首先检查订阅链接是否完整无误、网络是否能正常访问该URL。若提示解析失败，可能是配置文件格式不兼容，可尝试在客户端设置中切换解析引擎或联系服务商获取Clash专用格式的订阅链接。部分企业网络或校园网环境可能封锁了订阅服务器的端口，此时需要更换网络环境后再试。

Basic concept of subscription links: A subscription link is a专属 URL generated by proxy service providers, containing encrypted proxy node information including server addresses, ports, encryption methods, and passwords. When you填入 this link into a Clash client, it automatically parses the information and converts it into a usable proxy node list, eliminating the need for manual entry of each node's detailed parameters and significantly lowering the entry barrier.
Legitimate ways to obtain subscription links: You should obtain subscription links from trusted proxy service providers, typically through their user dashboard after purchasing their service. Some open-source communities also share free public subscription resources, but extra caution regarding security risks is necessary when using free subscriptions. Always obtain subscription links via HTTPS encrypted channels to avoid transmitting sensitive node information in plaintext over insecure networks.
How to import a subscription link into a Clash client: Open your Clash client (such as Clash for Windows, Clash Verge Rev, etc.), navigate to the configuration management or subscription management section, find the "Add Subscription" or "Import Config" option, paste the完整 copied subscription link into the input field, and save. The client will automatically send an HTTP request to download the remote configuration file, and after parsing, all available nodes will appear in the proxy node list.
Mechanism of automatic subscription updates: Most Clash-compatible clients support automatic subscription updates, allowing you to set update intervals (e.g., every 6 hours or daily). With this feature enabled, the client periodically requests the subscription link for the latest node information and configuration changes, ensuring you always use the most up-to-date node list provided by the service provider and avoiding connection failures due to expired nodes or information changes.
In-depth security considerations for subscription links: Subscription links contain your node configuration information; if leaked, others could directly use your proxy resources. Therefore, keep subscription links strictly confidential and never publish them on social platforms or public code repositories. Regularly refresh your subscription link in the provider's dashboard to rotate keys, and use TLS-encrypted subscription addresses to prevent man-in-the-middle attacks and data tampering.
Common troubleshooting and solutions: If the node list is empty after importing a subscription, first check whether the link is完整 and correct and whether the URL is accessible from your network. If parsing fails, the configuration file format may be incompatible—try switching the parsing engine in client settings or contact the provider for a Clash-specific subscription link. Some corporate or campus networks may block the subscription server's port, requiring a network environment change before retrying.

❸ 如何手动编辑YAML配置文件？（技术操作类） ❸ How to manually edit YAML configuration files? (Technical Operations)

YAML基本语法规范入门：YAML是一种人类可读的数据序列化格式，Clash使用它作为配置文件的标准格式。编写YAML时需要特别注意缩进规则——必须使用空格而非Tab键进行缩进，且同一层级的键必须保持相同的缩进深度。注释使用井号（#）开头，字符串值通常不需要引号，但包含特殊字符时建议使用双引号包裹以避免解析错误。配置文件的顶层结构包含端口设置、代理节点定义、规则组等核心区块。
配置文件整体结构解析：一个标准的Clash YAML配置文件通常包含以下核心区块：port（HTTP代理端口）、socks-port（SOCKS5代理端口）、mode（运行模式，通常为rule）、log-level（日志级别）、proxies（代理节点列表）、proxy-groups（策略组定义）、rules（分流规则）等。每个区块都有其特定的语法要求和嵌套结构，理解这些区块的层级关系是手动编辑配置的基础前提。
代理节点配置的详细方法：在proxies区块下，每个节点以列表项的形式定义，使用短横线加空格开头。每个节点必须包含name（自定义名称）、type（协议类型如ss/vmess/trojan）、server（服务器地址）、port（端口号）等必填字段。不同类型的协议还有各自的专属参数，例如Shadowsocks节点需要cipher和password字段，而VMess节点则需要uuid和alterId等字段，务必参照官方文档填写正确的参数名称。
规则组与分流规则的配置要点：proxy-groups区块用于定义策略组，每个策略组包含name、type（如select/url-test/fallback）和proxies列表。在rules区块中，每条规则由匹配类型（如DOMAIN-SUFFIX、GEOIP、IP-CIDR等）、匹配目标和策略组名称三部分组成。规则的匹配顺序从上到下依次执行，命中即停止，因此需要将更具体的规则放在前面，泛匹配规则放在末尾以确保分流逻辑的正确性。
配置文件的测试与验证步骤：编辑完成后，建议使用YAML在线验证工具检查语法正确性，重点关注缩进是否一致、是否存在重复键或缺失的必填字段。然后在Clash客户端中加载该配置文件并观察日志输出，如果出现报错信息，根据错误提示定位到具体的行号和字段进行修正。可以逐步添加规则并测试每条规则是否按预期匹配生效，确保整体分流逻辑无误。
配置文件的备份与恢复建议：在每次进行较大修改之前，务必备份当前可正常工作的配置文件。可以将配置文件纳入Git版本控制进行管理，这样不仅能追溯每次修改的历史记录，还能在出现问题时快速回滚到之前的稳定版本。同时建议将敏感信息（如服务器地址和密码）与规则配置分离存储，使用环境变量或外部引用的方式提高安全性和可维护性。

YAML basic syntax introduction: YAML is a human-readable data serialization format that Clash uses as its standard configuration file format. When writing YAML, pay special attention to indentation rules—you must use spaces rather than Tab characters for indentation, and keys at the same level must maintain identical indentation depth. Comments begin with the hash (#) character; string values generally don't require quotes, but双引号 wrapping is recommended when special characters are present to avoid parsing errors. The top-level structure includes port settings, proxy node definitions, rule groups, and other core blocks.
Overall configuration file structure analysis: A standard Clash YAML configuration file typically contains these core blocks: port (HTTP proxy port), socks-port (SOCKS5 proxy port), mode (operating mode, usually "rule"), log-level (logging verbosity), proxies (proxy node list), proxy-groups (strategy group definitions), and rules (routing rules). Each block has specific syntax requirements and nesting structures; understanding the hierarchical relationships among these blocks is the foundational prerequisite for manual configuration editing.
Detailed method for proxy node configuration: Within the proxies block, each node is defined as a list item starting with a dash and space. Every node must include required fields such as name (custom identifier), type (protocol type like ss/vmess/trojan), server (server address), and port (port number). Different protocol types have their own专属 parameters—for example, Shadowsocks nodes require cipher and password fields, while VMess nodes need uuid and alterId fields. Always refer to official documentation for correct parameter names.
Key points for rule groups and routing rules: The proxy-groups block defines strategy groups, each containing name, type (such as select/url-test/fallback), and a proxies list. In the rules block, each rule consists of a match type (e.g., DOMAIN-SUFFIX, GEOIP, IP-CIDR), a match target, and a strategy group name. Rules are evaluated top-to-bottom with first-match-wins semantics, so more specific rules should be placed earlier and catch-all rules at the end to ensure correct routing logic.
Configuration testing and verification steps: After editing, use an online YAML validation tool to check syntax correctness, focusing on consistent indentation and the absence of duplicate keys or missing required fields. Then load the configuration in a Clash client and observe the log output; if error messages appear, locate the specific line number and field based on the error提示 and correct them. Gradually add rules and test whether each matches as expected to ensure overall routing logic correctness.
Backup and recovery recommendations: Before making any significant modifications, always back up the currently working configuration file. Consider managing configurations with Git version control, which not only tracks the history of every modification but also allows quick rollback to a previous stable version if issues arise. Additionally, separate sensitive information (such as server addresses and passwords) from rule configurations, using environment variables or external references to enhance security and maintainability.

❹ TUN模式是什么？如何正确开启？（高级功能类） ❹ What is TUN mode? How to enable it correctly? (Advanced Features)

TUN模式的工作原理深度解析：TUN模式通过在内核层面创建一个虚拟的网络接口设备（TUN虚拟网卡），将设备上所有应用程序发出的TCP和UDP数据包在操作系统协议栈层面进行拦截和接管。这意味着无需为每个应用程序单独配置代理设置，所有网络请求——包括那些本身不支持代理配置的应用程序——都会被自动引导至Clash的规则引擎进行处理，从而实现真正意义上的全设备透明代理。
开启TUN模式所需的系统权限说明：TUN模式需要较高的系统权限来创建和管理虚拟网络接口。在Windows系统上通常需要以管理员身份运行Clash客户端；在macOS上需要授予网络扩展权限并通过系统偏好设置进行授权；在Linux系统上则需要root权限或配置适当的capabilities。部分移动端操作系统（特别是iOS）对TUN接口的访问有更严格的限制，可能需要使用特定的SDK或企业证书才能实现类似功能。
各主流平台的具体开启方法：在Clash for Windows中，进入设置页面找到TUN模式开关并启用，首次使用时会提示安装虚拟网卡驱动，按照向导完成即可。在Clash Verge Rev中，同样在设置界面开启TUN模式，并可选择自动配置系统DNS以避免DNS泄漏。在macOS上使用ClashX Pro时，需要在偏好设置中勾选"增强模式"来激活TUN功能，系统会弹出权限确认对话框需要用户手动批准。
虚拟网卡配置与路由表设置要点：开启TUN模式后，Clash会自动修改系统的路由表，将特定IP段或全部流量的下一跳指向虚拟网卡。您可以在配置文件中通过tun区块自定义虚拟网卡的IP地址范围、MTU值以及需要代理的CIDR网段。正确配置这些参数对于避免网络冲突和确保流量正确分流至关重要，建议保持默认值除非您对网络底层原理有深入了解。
DNS配合设置防止泄漏：TUN模式接管了全部网络流量后，DNS解析也需要相应配置以防止DNS泄漏导致隐私暴露。建议在TUN模式下同时启用Clash内置的DNS服务器，使用Fake-IP模式或配置可信的上游DNS服务器。这样所有的DNS查询请求也会通过虚拟网卡进入Clash进行处理，确保域名解析结果与后续的代理路由决策保持一致，避免出现DNS与流量路径不匹配的问题。
常见故障排除与诊断技巧：如果开启TUN模式后网络完全中断，首先检查虚拟网卡驱动是否安装成功、是否有IP地址冲突。可以尝试关闭防火墙或安全软件的网络过滤功能以排除干扰。使用ping或traceroute命令测试连通性，观察数据包是否经过虚拟网卡。查看Clash日志中的TUN相关输出信息，通常可以快速定位到配置错误、权限不足或驱动兼容性问题，根据日志提示进行针对性修复即可恢复网络连接。

In-depth analysis of TUN mode工作原理: TUN mode creates a virtual network interface device (TUN virtual NIC) at the kernel level, intercepting and taking over all TCP and UDP packets from every application at the operating system protocol stack level. This means that without individually configuring proxy settings for each application, all network requests—including those from applications that don't natively support proxy configuration—are automatically directed to Clash's rule engine for processing, achieving true全设备 transparent proxying.
System permissions required for enabling TUN mode: TUN mode requires elevated system privileges to create and manage virtual network interfaces. On Windows, the Clash client typically needs to run as Administrator; on macOS, network extension permissions must be granted through System Preferences; on Linux, root privileges or appropriately configured capabilities are required. Some mobile operating systems (especially iOS) have stricter restrictions on TUN interface access, potentially requiring specific SDKs or enterprise certificates to achieve similar functionality.
Specific enabling methods for major platforms: In Clash for Windows, go to Settings, find the TUN mode toggle and enable it—on first use, you'll be prompted to install the virtual NIC driver; follow the wizard to complete installation. In Clash Verge Rev, similarly enable TUN mode in Settings and optionally configure automatic system DNS to prevent DNS leaks. On macOS with ClashX Pro, check "Enhanced Mode" in Preferences to activate TUN functionality; the system will弹出 a permission confirmation dialog requiring manual user approval.
Key points for virtual NIC configuration and routing table setup: After enabling TUN mode, Clash automatically modifies the system routing table, pointing specific IP ranges or all traffic's next hop to the virtual NIC. You can customize the virtual NIC's IP address range, MTU value, and CIDR ranges to proxy through the tun block in the configuration file. Correctly configuring these parameters is crucial for avoiding network conflicts and ensuring proper traffic分流; it's recommended to keep defaults unless you have in-depth knowledge of network底层 principles.
DNS coordination to prevent leaks: After TUN mode takes over all network traffic, DNS resolution must also be configured accordingly to prevent DNS leaks that could expose privacy. It's recommended to simultaneously enable Clash's built-in DNS server in TUN mode, using Fake-IP mode or configuring trusted upstream DNS servers. This way, all DNS query requests also pass through the virtual NIC into Clash for processing, ensuring域名 resolution results remain consistent with subsequent proxy routing decisions and avoiding DNS-traffic path mismatches.
Common troubleshooting and diagnostic techniques: If the network完全 stops working after enabling TUN mode, first check whether the virtual NIC driver installed successfully and whether there are IP address conflicts. Try disabling firewall or security software network filtering to排除 interference. Use ping or traceroute commands to test connectivity and observe whether packets pass through the virtual NIC. Check Clash logs for TUN-related output—this usually quickly identifies configuration errors, insufficient permissions, or driver compatibility issues, allowing targeted fixes based on log prompts to restore network connectivity.

❺ 免费订阅节点安全吗？有哪些风险？（安全风险类） ❺ Are free subscription nodes safe? What are the risks? (Security Risks)

免费节点的来源与运营模式分析：互联网上流传的免费代理节点通常来源于个人爱好者搭建的共享服务器、被泄露的商业服务节点信息、或是某些组织为收集用户数据而故意开放的蜜罐节点。这些免费节点背后缺乏可持续的商业模式支撑，运营者可能随时关闭服务且无需对用户承担任何责任，服务器硬件配置和网络带宽也往往非常有限，导致连接质量和稳定性无法得到任何程度的保障。
潜在的严重安全风险揭示：免费节点的运营者完全有能力在服务器端进行深度数据包检测（DPI），记录和收集用户的所有网络活动数据——包括访问的网站域名、传输的未加密内容、甚至是登录凭据等敏感信息。更危险的是，部分恶意节点会主动篡改经过的HTTP流量，注入恶意广告脚本、挖矿代码或钓鱼页面，对用户的设备安全和数据隐私构成直接且严重的实质性威胁。
隐私泄露风险的多维度审视：即使免费节点声称不记录日志，用户也无法验证其真实性。DNS查询记录、连接时间戳、传输数据量等元数据仍可能被收集并用于构建用户画像。如果免费节点位于数据保护法律薄弱的国家或地区，用户的网络行为数据甚至可能被转售给第三方广告商或数据经纪公司，造成难以追溯和弥补的隐私侵害后果。
性能与稳定性方面的固有缺陷：免费节点通常承载着远超其设计容量的用户数量，带宽资源被大量用户争抢导致速度极慢、延迟波动剧烈。在高峰时段连接可能频繁断开，严重影响正常使用体验。此外免费节点很少提供SLA（服务等级协议）保障，用户遇到连接问题时没有任何官方渠道可以寻求技术支持或故障赔偿，只能被动接受服务中断的现实。
如何辨别相对可靠的节点来源：如果确实需要使用免费资源，建议优先选择来自知名开源社区或技术论坛中信誉良好的长期贡献者分享的节点。查看该节点是否提供了透明的服务状态监控页面，是否有活跃的用户反馈渠道。尽量选择支持AEAD加密协议的节点，避免使用明文传输或无加密的代理类型。同时注意观察节点的在线时长和历史稳定性记录，对刚出现不久且来源不明的节点保持高度警惕。
安全使用免费节点的实践建议：如果必须临时使用免费节点，请将其作为备用方案而非主力代理，并避免在处理敏感信息（如网银操作、账号登录、私密通讯）时使用。在Clash配置中将免费节点单独归入一个低优先级的策略组，仅在付费节点不可用时作为兜底。定期更换使用不同的免费节点来源以分散风险，并始终在操作系统和应用程序层面保持最新的安全补丁和防护软件更新状态。

Analysis of free node sources and operational models: Free proxy nodes circulating on the internet typically originate from shared servers set up by individual enthusiasts, leaked commercial service node information, or honeypot nodes deliberately opened by certain organizations to collect user data. These free nodes lack sustainable business model support; operators may shut down services at any time without any accountability to users. Server hardware and network bandwidth are often extremely limited, making connection quality and stability completely unguaranteed.
Revealing potentially severe security risks: Free node operators are fully capable of performing deep packet inspection (DPI) on the server side, recording and collecting all user network activity data—including visited website domains, transmitted unencrypted content, and even login credentials and other sensitive information. More dangerously, some malicious nodes actively tamper with passing HTTP traffic, injecting malicious advertising scripts, mining code, or phishing pages, posing direct and serious实质性 threats to user device security and data privacy.
Multi-dimensional examination of privacy leakage risks: Even if free nodes claim not to log, users cannot verify the truthfulness of such claims. DNS query records, connection timestamps, transferred data volumes, and other metadata may still be collected and used to build user profiles. If free nodes are located in countries or regions with weak data protection laws, users' network behavior data could even be resold to third-party advertisers or data brokerage firms, causing privacy侵害 consequences that are difficult to trace and remedy.
Inherent deficiencies in performance and stability: Free nodes typically承载 far more users than their designed capacity, with bandwidth resources contested by大量 users resulting in extremely slow speeds and剧烈 latency fluctuations. During peak hours, connections may frequently drop, severely impacting normal usage experience. Furthermore, free nodes rarely provide SLA (Service Level Agreement) guarantees; when users encounter connection issues, there are no official channels for technical support or故障 compensation, leaving them to passively accept service interruptions.
How to identify relatively reliable node sources: If free resources must be used, prioritize nodes shared by reputable long-term contributors from well-known open-source communities or technical forums. Check whether the node provides a transparent service status monitoring page and active user feedback channels.尽可能 choose nodes supporting AEAD encryption protocols and avoid proxy types using plaintext transmission or no encryption. Also observe the node's online duration and historical stability record, maintaining high vigilance toward recently emerged nodes with unknown origins.
Practical recommendations for safely using free nodes: If temporary use of free nodes is necessary, treat them as backup options rather than primary proxies and avoid using them when handling sensitive information (such as online banking, account logins, private communications). In Clash configuration, place free nodes in a separate low-priority strategy group, used only as a fallback when paid nodes are unavailable. Regularly rotate among different free node sources to分散 risk, and always maintain the latest security patches and protective software updates at the OS and application level.

❻ Clash如何在不同操作系统上配置使用？（跨平台使用类） ❻ How to configure and use Clash on different operating systems? (Cross-Platform Usage)

Windows平台配置要点详解：在Windows系统上推荐使用Clash for Windows或Clash Verge Rev客户端。下载安装后，首次启动会自动在用户目录下创建配置文件模板。通过界面中的"Profiles"标签页可以导入订阅链接或本地YAML文件，在"Proxies"标签页中查看和管理代理节点，使用"General"页面的开关控制系统代理状态。Windows用户特别需要注意防火墙提示，确保允许Clash通过专用网络和公用网络的防火墙规则，否则可能出现代理无法正常工作的现象。
macOS平台配置的核心步骤：macOS用户可选择ClashX、ClashX Pro或Stash for macOS。安装后菜单栏会出现Clash图标，点击即可快速切换代理模式和节点。通过"配置"选项导入订阅链接后，建议在系统偏好设置中检查网络代理配置是否已被自动修改。ClashX Pro额外提供TUN增强模式，适合需要透明代理的高级用户。macOS的安全机制可能阻止来自非App Store的应用运行，需要在系统偏好设置的"安全性与隐私"中手动允许。
Linux平台配置的灵活方案：Linux环境下可以选择Clash Verge Rev图形客户端，也可以直接使用clash命令行核心程序配合配置文件运行。命令行方式更加轻量和灵活，适合服务器或无桌面环境部署：下载对应架构的clash二进制文件后赋予执行权限，准备好配置文件后通过`./clash -d /path/to/config`命令启动。可以通过配置systemd服务实现开机自启和后台持续运行，方便在VPS或NAS设备上搭建常驻代理网关。
Android移动端配置的简明指引：Android用户推荐使用Clash for Android客户端。安装后进入"配置"页面，通过"新配置"按钮选择"从URL导入"粘贴订阅链接，或选择"从文件导入"加载本地YAML配置文件。在"代理"页面可以查看节点列表和延迟测试结果，通过主界面的开关按钮一键启动或停止代理服务。Android系统可能需要授予VPN权限，首次启动时系统会弹出确认对话框，点击"确定"即可完成授权并建立本地VPN连接。
iOS平台的特殊限制与解决方案：由于iOS系统的沙盒限制，App Store中没有官方Clash客户端，但可以使用支持Clash规则引擎的第三方应用如Stash或Shadowrocket。这些应用在App Store中可能以"网络工具"或"规则代理"的名义上架。安装后配置流程与Android类似：导入订阅链接或配置文件，在应用内开启代理开关，系统会自动配置VPN描述文件。需要注意的是iOS的VPN接口存在一定的性能开销，长时间使用可能会略微增加电量消耗。
OpenWrt路由器配置的家庭网关方案：在OpenWrt路由器上安装OpenClash插件可以实现全屋网络代理覆盖。通过OpenWrt的软件包管理器或手动上传安装包完成插件部署后，在OpenClash管理界面中导入订阅链接并更新内核文件。配置完成后路由器下连接的所有设备无需单独安装客户端即可享受代理服务，特别适合智能家居设备、游戏主机等无法安装代理软件的场景。但需要注意路由器的CPU性能是否足够处理加密解密运算，低端路由器可能因性能不足导致网速大幅下降。

Detailed Windows platform configuration essentials: On Windows, Clash for Windows or Clash Verge Rev are recommended clients. After downloading and installing, the first launch automatically creates a configuration file template in the user directory. Through the "Profiles" tab, you can import subscription links or local YAML files; the "Proxies" tab lets you view and manage proxy nodes; the "General" page's toggle controls the system proxy status. Windows users should特别注意 firewall prompts, ensuring Clash is allowed through firewall rules for both private and public networks—otherwise, the proxy may fail to function properly.
Core steps for macOS platform configuration: macOS users can choose ClashX, ClashX Pro, or Stash for macOS. After installation, a Clash icon appears in the menu bar for quick proxy mode and node switching. After importing a subscription link via the "Configuration" option, check in System Preferences whether network proxy settings have been automatically modified. ClashX Pro additionally offers TUN enhanced mode, suitable for advanced users needing transparent proxy. macOS security mechanisms may block apps from outside the App Store; manually allow them in System Preferences under "Security & Privacy."
Flexible Linux platform configuration approaches: In Linux environments, you can choose the Clash Verge Rev graphical client or directly use the clash command-line core program with a configuration file. The CLI approach is lighter and more flexible, suitable for server or headless deployments: download the clash binary for your architecture, grant execute permissions, prepare the config file, and start with `./clash -d /path/to/config`. You can configure a systemd service for auto-start on boot and persistent background running, making it convenient to set up a resident proxy gateway on VPS or NAS devices.
Concise Android mobile configuration guide: Android users are recommended to use the Clash for Android client. After installation, go to the "Configuration" page, tap "New Configuration," and choose "Import from URL" to paste a subscription link or "Import from File" to load a local YAML config file. The "Proxy" page displays the node list and latency test results; use the main interface toggle to start or stop the proxy service with one tap. Android may require VPN permission—on first launch, the system will弹出 a confirmation dialog; tap "OK" to complete authorization and establish the local VPN connection.
iOS platform special limitations and solutions: Due to iOS sandboxing restrictions, there is no official Clash client on the App Store, but third-party apps supporting the Clash rule engine—such as Stash or Shadowrocket—can be used. These apps may be listed under "Network Tools" or "Rule Proxy" categories. After installation, the configuration流程 is similar to Android: import a subscription link or config file, enable the proxy toggle within the app, and the system automatically configures a VPN profile. Note that iOS's VPN interface has some performance overhead, and prolonged use may slightly increase battery consumption.
OpenWrt router configuration for whole-home gateway solution: Installing the OpenClash plugin on an OpenWrt router enables whole-home network proxy coverage. After deploying the plugin via OpenWrt's package manager or manual upload, import the subscription link and update the kernel files in the OpenClash management interface. Once configured, all devices connected to the router can enjoy proxy services without individual client installation—ideal for smart home devices, game consoles, and other scenarios where proxy software cannot be installed. However,注意 whether the router's CPU performance is sufficient for encryption/decryption operations; low-end routers may experience significant speed degradation due to insufficient processing power.

掌控你的网络边界 Master Your Network Edge