clash for ios Clash iOS Client Download & Installation Guide
You're invited to test the iOS client
Install via TestFlight and the App Store, powered by the mihomo kernel, with subscription import and rule routing.
TF-CLASH-IOS-INVITE
Requires iOS 15.0 or later
- mihomo kernel Meta
- TestFlight distribution
- Open-source ecosystem
Core Feature Index
Six capabilities laid out like index tabs, resembling the interior directory of an invitation letter. Click a stub tab on the left to switch; the letter panel on the right expands the full description of that feature, ending with a config fact you can check directly.
Rule Routing
Rule-based routing is the core capability of Clash-family clients: the rules section in the config file is matched top to bottom, stopping at the first match. You can use DOMAIN-SUFFIX to target an exact domain suffix, GEOIP to split traffic by the destination IP's country, and MATCH as a catch-all at the end. After importing a subscription, the iOS client can use the rule set bundled with it directly, and you can also append custom entries in the config so work traffic, streaming, and downloads each take their own exit — no need to flip proxy toggles by hand.
rules: DOMAIN-SUFFIX / DOMAIN-KEYWORD / GEOIP / MATCH · Matched top to bottom, stops at first hit · Kernel: mihomo
Subscription Management
A subscription packages the nodes and rules a service provides into a single URL. The iOS client supports pasting a subscription link for one-tap import, automatic refresh on a set interval, and running multiple subscriptions that can be enabled independently. Writing config with proxy-providers also decouples node sources from local settings: the subscription only supplies nodes, while routing rules are decided by local overrides, so switching providers doesn't require rewriting the whole config. If a subscription update fails, the client keeps the last successful snapshot instead of dropping connectivity over one failed fetch.
proxy-providers: url / interval / health-check · Keeps last snapshot on failure
TUN Mode
Proxy takeover on iOS relies on the system's NetworkExtension framework, which behaves like TUN mode on desktop: the client creates a virtual network interface, and traffic from every app on the system enters the Clash kernel for rule matching, so there's no need to configure a proxy per app. This is especially useful for apps that ignore system proxy settings — games, terminal tools, and some chat apps. Once enabled, a VPN icon appears in the status bar; that's iOS's standard indicator for NetworkExtension, not proof that all traffic is proxied — where each connection actually goes is still decided rule by rule.
tun: enable / stack: system · iOS NetworkExtension system-wide takeover
Proxy Groups
A proxy group determines where traffic goes once a rule matches. select lets you pick a node manually; url-test periodically measures latency and auto-picks the fastest one; fallback probes nodes in order and switches to a backup when the primary fails; load-balance spreads connections across multiple nodes. The iOS client displays every proxy group defined in the subscription right in the interface, and switching takes effect instantly. With well-organized proxy groups, you can pin streaming to unlock-capable nodes, let everyday browsing auto-select the best node, and route large downloads through a separate group — all without interfering with each other.
proxy-groups: select / url-test / fallback / load-balance
DNS & Fake-IP
DNS determines how accurately domain names resolve, which directly affects rule matching results. The mihomo kernel supports fake-ip enhanced mode: the client first returns a virtual IP from a reserved range so the connection can be established immediately, while the real resolution happens on the proxy side — this noticeably reduces first-packet latency and avoids DNS pollution. The nameserver and fallback fields in the config handle routine resolution and secondary verification of suspicious results, respectively. The iOS client ships with a sensible DNS preset by default, and advanced users can override this section in the config.
dns: enhanced-mode: fake-ip / nameserver / fallback · Reserved range 198.18.0.1/16
External Controller
The mihomo kernel has a built-in RESTful API, exposed on a local port via external-controller, which pairs with a web control panel to view connections, switch proxy groups, and adjust log levels in real time. For iOS users, the client's own interface already covers day-to-day operation; when you run the same config on desktop or a router, the external controller lets multiple devices share one management entry point. The API's fields match desktop exactly, so learning it once carries over to every platform — and it gives you another channel for observing kernel state when troubleshooting.
external-controller: 127.0.0.1:9090 · RESTful API · Same panel everywhere
All-Platform Client Download Entry
Each of the five platforms gets its own boarding pass. iOS goes through the App Store; desktop and Android offer direct installer downloads; router and server users can find the mihomo kernel binary on the download page — the config format is the same across every platform.
Open-Source Ecosystem & Kernel Background
Clash isn't a single isolated app — it's a whole open-source ecosystem. The four panels below cover its origin, how the ecosystem divides work, how the kernel relates to clients, and how each piece gets updated.
Project History
Clash began as a community-built open-source proxy kernel, and its design of config files plus rule-based routing gradually made it the de facto cross-platform standard. After the original kernel stopped receiving updates, the community built Clash Meta on top of it, which continues today as the actively maintained mihomo project. The iOS clients covered on this site all trace back to that lineage, with a config format compatible with desktop, so a config you've used on a computer can be reused directly on iOS.
Open-Source Ecosystem
The kernel, rule sets, GeoIP databases, subscription-conversion tools, and graphical clients on every platform are all maintained openly by the community. Public source code means implementation details can be reviewed by anyone, and issues are tracked and discussed in the open. Clients in this ecosystem are developed independently of one another but share the same config specification — which is exactly why Clash-family tools can cover desktop, mobile, and router scenarios all at once.
Kernel and Client
The client and kernel form two layers: the kernel (mihomo) handles protocol implementation, rule matching, and DNS resolution, while the client handles the interface, subscription management, and system integration. On iOS, Clash Plus wraps the mihomo kernel inside NetworkExtension, so every toggle you flip in the interface is ultimately carried out by the kernel. Understanding this split tells you whether to check the config file or the client settings when troubleshooting.
Update Cadence
Kernel updates bring protocol and performance improvements; client updates bring interface and system-integration changes — the two move on independent schedules. App Store clients are updated automatically by the store; subscription content refreshes on the interval set in the config; GeoIP and GeoSite databases can be updated alongside kernel releases or set to update independently in the config. Keeping all three reasonably current is the first step to avoiding issues like stale rules or unreachable nodes.
git clone https://github.com/MetaCubeX/mihomo.git
mihomo kernel source repository · Start here if you want to read the implementation or build the kernel binary yourself.
Frequently Asked Questions
The four things people ask most before getting started, each with a quick answer. Full steps and a checklist live in the quick-start tutorial.
-
Which client should I install on iOS?
Clash Plus is recommended: it's listed directly on the App Store, ships with the mihomo kernel, and its official site is clashplus.io. Go to the iOS download.
-
No nodes show up after importing a subscription — what now?
First confirm the subscription link is complete, then trigger a manual refresh; if it's still empty, the link has likely expired or the data quota is used up. See the step-by-step checklist in the tutorial.
-
Is it normal to see a VPN icon in the status bar?
Yes. That's iOS's standard indicator for NetworkExtension — whether traffic actually goes through the proxy or connects directly is still decided rule by rule in the config. See how to verify the connection.
-
Can a desktop config be used directly on iOS?
Yes. The mihomo config format works across platforms, so the same subscription can be imported on a phone, computer, or router alike. See the subscription import steps.
Latest Articles
Long-form pieces on troubleshooting, platform deployment, and advanced configuration, newest first, updated regularly.
Clash Keeps Crashing on Launch: Common Causes and a Step-by-Step Fix
From config syntax errors and port conflicts to kernel version mismatches and system permission limits, this piece ranks launch-crash causes by frequency, gives a step-by-step way to verify and fix each one, and shows how to isolate the problem with a minimal config.
Running mihomo Directly on a Router: Deployment Basics for a Bypass Router Setup
An overview of running the mihomo kernel directly on a main or bypass router: hardware and firmware requirements, choosing the right kernel binary, key points on transparent proxying and DNS hijacking, and a comparison of the two common ways to bring LAN devices online.
Updating GeoIP and GeoSite Databases: Why Routing Rules Go Stale and How to Fix It
Explains the role GeoIP and GeoSite databases play in rule matching, walks through manual replacement and automatic in-config updates, and breaks down the typical symptoms and verification steps for routing errors caused by outdated databases.