How to Set Up a Clash Client on Windows, macOS and Linux Please publish the content exactly as provided. Keep both in-body links dofollow and do not add any other outbound links.

The hard part of getting a rule-based routing tool running is almost never the software itself. It is the twenty minutes of small platform-specific friction that nobody writes down: a security prompt that hides its “run anyway” button, a downloaded app the system refuses to open, a package format that installs fine but never appears in the applications menu.

This walkthrough covers all three desktop platforms end to end. Install first, then the first-run sequence that takes you from an empty dashboard to traffic that demonstrably follows your rules, then autostart and the log locations you will want when something misbehaves.

Nothing here assumes prior experience with routing engines. If you can install a normal desktop application and copy a URL, you have everything you need.

Before You Install: Two Things to Have Ready

Get these in place first and the rest goes quickly.

• A subscription or profile URL. This is the link, usually ending in something like ?flag=clash, that supplies your node list and a starting ruleset. Without it the app installs perfectly and then has nothing to route to.
• An administrator account. You do not need it for a plain install, but you will need it the first time you enable TUN mode, because creating a virtual network adapter is a privileged operation on every platform.

It is also worth knowing which architecture your machine is, since download pages usually list several builds and picking the wrong one is the single most common stumble.

Installing on Windows

1. Download the installer for your architecture. Most desktops and laptops are x64. Machines running Windows on ARM need the arm64 build, which will not run on x64 hardware and vice versa.
2. Run the installer. Windows SmartScreen may show a blue “Windows protected your PC” panel. This appears for any application whose publisher reputation has not yet accumulated in Microsoft’s system — including brand-new releases of well-established projects. Click More info, then Run anyway. If you do not click “More info” first, the only visible button is “Don’t run”, which is what trips most people up.
3. Accept the default install location unless you have a reason not to. Some antivirus products behave better with applications in the standard Program Files path.
4. If your antivirus quarantines the binary, add an exclusion for the install folder. Routing tools bind local ports and, in TUN mode, install a network adapter, and both behaviours can score badly in heuristic scanners.
5. Launch the app. Windows Defender Firewall will ask whether to allow it on private and public networks. Allow at least private networks, or local listeners will be blocked.

If you plan to use TUN mode, expect one extra prompt on first activation: a UAC dialog while the virtual adapter driver is registered. On a small number of systems that driver needs a reboot before the adapter becomes usable.

Installing on macOS

Pick the Right Build First

macOS downloads generally come in two flavours. The aarch64 build targets Apple Silicon — every M-series Mac. The x64 build targets Intel Macs. An Intel build will run on Apple Silicon through Rosetta if it is installed, but you gain nothing and lose efficiency, so match the build to the hardware.

If you are unsure, open the Apple menu, choose About This Mac, and read the chip line.

Install and Get Past Gatekeeper

1. Open the downloaded .dmg and drag the application into your Applications folder. Running it from the mounted disk image works once and then confuses the updater, so move it properly.
2. Try to open it. macOS will very likely refuse, saying the developer cannot be verified. This is Gatekeeper responding to the quarantine flag that Safari and other browsers attach to every download.
3. Open System Settings → Privacy & Security, scroll to the Security section, and click Open Anyway next to the message about the blocked app. Confirm in the dialog that follows.
4. If the app still refuses to launch, clear the quarantine attribute directly from Terminal and try again:

xattr -dr com.apple.quarantine /Applications/YourApp.app

Recent macOS releases have tightened this flow, and the “Open Anyway” entry sometimes only appears immediately after a failed launch attempt. If you cannot find it, try opening the app once more and then look again.

Installing on Linux

Linux gives you three practical options, and which one you want depends mostly on whether you prefer your package manager to handle updates.

Debian, Ubuntu and Derivatives

sudo apt install ./clash-client_x.y.z_amd64.deb

Using apt install ./file.deb rather than dpkg -i lets the package manager resolve dependencies in the same step, which avoids the classic half-installed state.

Fedora, RHEL and openSUSE

sudo dnf install ./clash-client-x.y.z.x86_64.rpm

AppImage

The AppImage runs on essentially any distribution with no installation at all. Two steps get it working:

1. Make it executable: chmod +x ./YourApp.AppImage
2. Run it directly: ./YourApp.AppImage

The trade-off is desktop integration. An AppImage does not register itself, so it will not appear in your applications menu and will not have an icon until you either install a helper that manages AppImages or write a small launcher entry yourself:

[Desktop Entry]
Type=Application
Name=Clash Client
Exec=/home/you/Apps/YourApp.AppImage
Icon=/home/you/Apps/icon.png
Categories=Network;
Terminal=false

Save that as ~/.local/share/applications/clash-client.desktop and it will show up alongside your other applications. Note that on some newer distributions AppImages need FUSE 2 installed, or they exit immediately with a mount error.

First Run: From Empty Dashboard to Routed Traffic

The interface differs slightly between builds, but the sequence is broadly the same in any modern clash client, so the walkthrough below transfers even if your buttons sit in different places. This is the part worth doing in order, because several steps depend on the one before.

1. Open the Profiles page and import your subscription. Paste the URL into the import field and confirm. The app fetches the file, parses it, and lists it as a profile card. If the import fails, the usual causes are a URL that has expired or one that returns a format the parser does not recognise.
2. Activate the profile. Importing and using are separate actions in most clients — click the card to make it the active configuration. The Proxies page stays empty until you do.
3. Set an update interval. While you are on the Profiles page, give the profile a refresh schedule. Node lists change, and a stale profile produces connection failures that look like network problems.
4. Open the Proxies page and look at your policy groups. You will typically see groups of different types: select for manual choice, url-test for automatic lowest-latency selection, fallback for failover in a fixed order, and load-balance for spreading connections across nodes.
5. Test latency. There is a button on that page that fires a test request through each node and reports round-trip time. Run it once so you have real numbers instead of guessing from node names.
6. Pick a node or group. For a select group, choose a node with good latency. For a url-test group, leave it alone — that is its whole job.
7. Turn on interception. On the dashboard, enable either System Proxy or TUN Mode. Start with system proxy; it needs no elevation and is enough if your traffic is browser-based. Switch to TUN when you need terminal tools, containers or games routed as well.
8. Verify before you trust it. Do not assume the toggle worked. The next section covers how to confirm.

Steps four through six are where a desktop GUI earns its place over running the core by itself: switching groups, reading latency and seeing which rule matched a live connection are all one click, versus editing YAML and restarting a daemon. If a step behaves differently in your build, the project’s own guide pages — clash-vergerev.co publishes one alongside its downloads — are quicker to check than guessing at the setting.

Confirming That Routing Actually Works

Three checks, in increasing order of usefulness.

• Load a page. The crudest test. It tells you the app is not completely broken and very little else.
• Watch the connections log. Open the connections view, then generate traffic. Each entry shows the destination, the rule that matched, and the outbound node. This is the real test, because it shows you the decision rather than the result.
• Check a DIRECT rule. Visit something you expect to bypass the proxy — a router admin page, an internal host — and confirm it appears in the log marked DIRECT. If your split routing is misconfigured, this is where it shows.

If nothing at all appears in the connections view while you are actively browsing, interception is not working. Under system proxy, the application you are testing is probably ignoring the setting. Under TUN, the adapter likely failed to come up — check the log for a permission error.

The rules viewer is the companion to this. It lists your active ruleset in evaluation order, which matters because matching stops at the first hit. A broad DOMAIN-KEYWORD rule sitting above a specific DOMAIN rule will shadow it, and the connections log shows you exactly that happening — which is far more useful than reading the config file and trying to simulate it in your head.

Setting Up Autostart

Once the setup is stable, have it launch with the system.

• All platforms — check the app’s own settings first. Most clients expose a “launch at startup” toggle plus a “start minimised to tray” option, and the built-in toggle handles the platform details for you.
• Windows — the toggle writes a registry Run entry or a Startup folder shortcut. If it is not taking effect, confirm the app is not disabled under Task Manager’s Startup apps tab.
• macOS — verify the entry landed in System Settings under General → Login Items.
• Linux — add a .desktop file to ~/.config/autostart/, or create a user systemd service if you want restart-on-failure behaviour.

One caution: if you enable both autostart and TUN mode, you may get an elevation prompt at every login unless the client installs a privileged helper service. Most do, but it is worth confirming rather than discovering it every morning.

Where the Files Live

When something needs diagnosing, these are the paths to open.

PlatformConfig and profilesLogsWindows%APPDATA%\ClientName\a logs subfolder in the same directorymacOS~/Library/Application Support/ClientName/~/Library/Logs/ClientName/Linux~/.config/ClientName/~/.local/share/ClientName/logs/

Exact folder names vary by build, but the parent directories are standard. Most clients also expose a live log view in the interface, which is easier than tailing a file. Raise the level to debug while you are diagnosing, then drop it back to info — debug logs grow quickly.

Questions That Come Up Early

My subscription imported but the Proxies page is empty.

The profile is imported but not activated. Go back to Profiles and click the card to select it. If it is already selected, open the log — a parse error partway through the file can leave you with a profile that exists but contains nothing usable.

Everything routes, but my local network devices stopped working.

Private address ranges are being sent to a remote node instead of staying local. Add explicit DIRECT rules above your final MATCH rule:

rules:
  - GEOIP,PRIVATE,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - DOMAIN-SUFFIX,local,DIRECT
  - MATCH,PROXY

Can I keep several profiles and switch between them?

Yes. Profiles are independent, so a common pattern is one for work with strict split rules and one general-purpose profile. Switching is a click, and each keeps its own ruleset and update schedule.

Do I have to uninstall before updating?

No. Installers upgrade in place and profiles live outside the application directory, so they survive. Back up your config folder before a major version jump anyway — it takes ten seconds and occasionally saves an afternoon.

Wrapping Up

The install itself is five minutes on any of the three platforms. The friction is all in the security layers — SmartScreen, Gatekeeper, package formats — and each has a specific, known answer rather than a workaround.

What actually separates a working setup from a frustrating one is the verification habit: import, activate, test latency, enable interception, then open the connections log and watch a real request get matched to a real rule. Do that once at setup and you will recognise instantly when something has drifted, instead of guessing at symptoms weeks later.