Configuration Reference

Config File Overview

The config file is a YAML text file, named config.yaml by default. If you're using a subscription, your provider already generates this for you, so manual editing usually isn't needed — you'll only need to understand its structure if you want to customize routing or DNS behavior. A config file breaks down into four main sections, top to bottom:

# 1. Basic settings: ports, mode, log level
mixed-port: 7890
mode: rule

# 2. Proxy nodes: where traffic can go
proxies: [...]

# 3. Proxy groups: how to pick a node
proxy-groups: [...]

# 4. Rules: which traffic goes where
rules: [...]

One sentence is all you need to remember: proxies define "which roads exist", proxy-groups define "how to pick a road", and rules define "who takes which road".

Proxy Nodes (proxies)

Each node is a list item, and type determines the protocol — fields vary slightly between protocols. Clash Client supports Shadowsocks, VMess, VLESS, Trojan, WireGuard, and other mainstream protocols. Here are the two most common formats:

proxies:
  - name: "Hong Kong 01"
    type: ss
    server: hk01.example.com
    port: 8388
    cipher: aes-256-gcm
    password: "your-password"

  - name: "Tokyo 02"
    type: vmess
    server: jp02.example.com
    port: 443
    uuid: 23ad6b10-8d1a-40f7-8ad0-e3e35cd38297
    alterId: 0
    cipher: auto
    tls: true

If you're using a subscription, you don't need to touch this section at all — the node list updates automatically with your subscription.

Proxy Groups (proxy-groups)

Proxy groups bundle nodes into a single selectable option, and rules reference the group name rather than a specific node. Four commonly used types:

proxy-groups:
  - name: "Node Selection"
    type: select
    proxies: [Auto Select, Hong Kong 01, Tokyo 02]

  - name: "Auto Select"
    type: url-test
    proxies: [Hong Kong 01, Tokyo 02]
    url: "http://www.gstatic.com/generate_204"
    interval: 300

interval: 300 means re-testing speed every 300 seconds; gstatic's 204 page is the most reliable test URL.

Routing Rules (rules)

Rules are matched top to bottom, and the first match wins, so more specific rules should go first, with MATCH as the catch-all at the end. Each rule follows the format "Type,Match,Outbound":

Besides proxy group names, there are two built-in outbound values: DIRECT (bypasses the proxy entirely) and REJECT (blocks the request outright — commonly used for ads).

rules:
  # Ads: reject outright
  - DOMAIN-KEYWORD,adservice,REJECT
  # Specific sites/services: via proxy group
  - DOMAIN-SUFFIX,youtube.com,Node Selection
  - DOMAIN-SUFFIX,github.com,Node Selection
  # Local/trusted domains: direct connection
  - DOMAIN-SUFFIX,internal.example.com,DIRECT
  - GEOIP,US,DIRECT
  # Everything else: via proxy group
  - MATCH,Node Selection

DNS Configuration

DNS determines "how a domain becomes an IP". Misconfiguration can cause DNS pollution or rule mismatches — we recommend using this battle-tested setup directly:

dns:
  enable: true
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  nameserver:
    - 1.1.1.1          # Cloudflare
    - 8.8.8.8          # Google
  fallback:
    - https://1.1.1.1/dns-query
    - https://8.8.8.8/dns-query

Key points: fake-ip mode is fast and highly compatible; nameserver handles everyday domain resolution, while fallback uses encrypted DNS as a safety net for domains prone to DNS pollution.

Ports & Common Settings

Once allow-lan is enabled, any phone or TV on the same Wi-Fi can use it for internet access just by pointing its proxy to "computer IP:7890" — no need to install anything on each device individually.

Full Example

Put all the snippets above together and you get a minimal config that runs right away. Just swap in your own node details:

mixed-port: 7890
allow-lan: false
mode: rule
log-level: info
external-controller: 127.0.0.1:9090

dns:
  enable: true
  enhanced-mode: fake-ip
  nameserver: [1.1.1.1, 8.8.8.8]
  fallback: [https://1.1.1.1/dns-query]

proxies:
  -     name: "Hong Kong 01"
    type: ss
    server: hk01.example.com
    port: 8388
    cipher: aes-256-gcm
    password: "your-password"

proxy-groups:
  - name: "Node Selection"
    type: select
    proxies: [Hong Kong 01]

rules:
  - DOMAIN-KEYWORD,adservice,REJECT
  - GEOIP,US,DIRECT
  - MATCH,Node Selection