Clash Meta (now commonly known as Mihomo) stands as the most actively maintained and feature-rich core branch in the Clash ecosystem. Built upon the foundation of the original Clash Premium kernel, it significantly expands capabilities in DNS strategies, rule engines, and protocol support. In this guide, we will break down the complete configuration architecture of Clash Meta for 2026, covering everything from DNS-over-HTTPS and TUN mode to RULE-SET optimization and automated Provider management, helping you build a high-performance, future-proof proxy environment.

1. Key Differences: Clash Meta vs. Original Clash

Before diving into the configuration, it is crucial to understand why Clash Meta has become the industry standard over the legacy Clash Premium branch. Since the original project ceased maintenance in late 2023, the community-driven Meta branch has evolved far beyond its predecessor.

Protocol Expansion: Clash Meta provides native support for modern protocols like VLESS, Reality, Hysteria2, and TUIC v5. This allows users to leverage the latest in anti-detection and high-speed transmission technologies without needing external patches or complex workarounds.

Advanced DNS Logic: It supports DNS-over-HTTPS (DoH), DNS-over-TLS (DoT), and DNS-over-QUIC (DoQ) with sophisticated routing. This means you can finally achieve a true "split-DNS" setup where domestic domains resolve through local ISPs while foreign domains use encrypted, leakage-proof resolvers.

Optimized Rule Engine: With the introduction of RULE-SET external rule providers and on-demand loading, Clash Meta drastically reduces memory overhead when handling massive blocklists. It also enables background updates for rules, ensuring your routing logic never goes out of date.

2. Configuration Foundation: YAML Structure

Clash Meta utilizes the YAML format for its configuration. The default path is typically ~/.config/clash/config.yaml on macOS/Linux and %APPDATA%\clash\config.yaml on Windows. A professional-grade configuration includes the following top-level fields:

# Basic Clash Meta configuration skeleton
port: 7890
socks-port: 7891
mixed-port: 7892
allow-lan: false
mode: rule
log-level: info
ipv6: false

dns:
  enable: true
  # DNS detailed logic (see Section 3)

proxies:
  # Manual proxy node list

proxy-groups:
  # Policy groups and routing logic

rules:
  # Traffic routing rules

proxy-providers:
  # Automated subscription management

rule-providers:
  # External rule set sources
// TIP We strongly recommend using mixed-port to listen for both HTTP and SOCKS5 traffic simultaneously. This simplifies setup across different applications. Always use mode: rule for production to ensure efficient traffic splitting.

3. DNS Strategy: Encrypted Resolution & Split Routing

DNS is arguably the most misunderstood part of proxy configuration. A poor DNS setup leads to slow domestic loading or DNS pollution on foreign sites. Clash Meta solves this through granular control.

3.1 Basic Encrypted DNS Setup

dns:
  enable: true
  ipv6: false
  listen: 0.0.0.0:1053
  # Use trusted local resolvers as fallback
  default-nameserver:
    - 1.1.1.1
    - 8.8.8.8
  # Enhanced mode: fake-ip is highly recommended
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  # Primary resolvers for international traffic
  nameserver:
    - https://dns.cloudflare.com/dns-query
    - https://dns.google/dns-query
  # Fallback for blocked domains
  fallback:
    - https://1.1.1.1/dns-query
    - https://dns.quad9.net/dns-query
  fallback-filter:
    geoip: true
    geoip-code: US
    ipcidr:
      - 240.0.0.0/4

fake-ip mode is the gold standard for Clash Meta. It assigns a virtual IP to every domain locally, deferring the actual resolution to the proxy server. This eliminates DNS leakage and significantly speeds up the initial connection phase.

3.2 Policy-Based DNS (nameserver-policy)

To ensure local services resolve via local ISPs (for lower latency) while international services use encrypted DNS, use the nameserver-policy field:

dns:
  nameserver-policy:
    # Local domains use ISP or Google Public DNS
    "geosite:cn,category-ads-all": https://dns.alidns.com/dns-query
    # Google services use dedicated Google DNS
    "geosite:google": https://dns.google/dns-query

4. Proxies and Policy Groups: Flexible Routing

Define your server nodes under the proxies field. Clash Meta supports nearly every modern protocol. Here is an example of Hysteria2 and VLESS Reality nodes:

proxies:
  - name: "HK-Hysteria2-Premium"
    type: hysteria2
    server: hk.example.com
    port: 443
    password: "your-secret-password"
    sni: hk.example.com
    skip-cert-verify: false

  - name: "US-VLESS-Reality"
    type: vless
    server: us.example.com
    port: 443
    uuid: "your-uuid"
    network: tcp
    tls: true
    reality-opts:
      public-key: "your-public-key"
      short-id: "your-short-id"

Organize these nodes into proxy-groups. Common types include select (manual choice), url-test (auto-speed test), fallback (auto-failover), and load-balance:

proxy-groups:
  - name: "Main Proxy"
    type: select
    proxies:
      - "Auto Speed"
      - "HK-Hysteria2-Premium"
      - "US-VLESS-Reality"
      - DIRECT

  - name: "Auto Speed"
    type: url-test
    proxies:
      - "HK-Hysteria2-Premium"
      - "US-VLESS-Reality"
    url: http://www.gstatic.com/generate_204
    interval: 300
    tolerance: 50

5. RULE-SET: The Core of Precise Split Routing

Hardcoding thousands of rules into your main config is inefficient. Clash Meta’s rule-providers allow you to pull optimized rule sets from remote URLs, keeping your configuration clean and always up to date.

rule-providers:
  ads:
    type: http
    behavior: domain
    url: "https://example.com/ruleset/ads.txt"
    path: ./ruleset/ads.yaml
    interval: 86400

  local:
    type: http
    behavior: domain
    url: "https://example.com/ruleset/local.txt"
    path: ./ruleset/local.yaml
    interval: 86400

  proxy:
    type: http
    behavior: domain
    url: "https://example.com/ruleset/proxy.txt"
    path: ./ruleset/proxy.yaml
    interval: 86400

In your rules section, reference these sets. Remember that order matters—rules are processed from top to bottom:

rules:
  - RULE-SET,ads,REJECT
  - RULE-SET,local,DIRECT
  - RULE-SET,proxy,Main Proxy
  - GEOIP,US,DIRECT
  - MATCH,Main Proxy
// WARN Always place REJECT rules at the top to block ads and trackers immediately. Place the MATCH rule at the very bottom as a catch-all for any traffic that doesn't fit previous criteria.

6. Automated Subscription Management (Providers)

Most users rely on subscription links from service providers. Clash Meta’s proxy-providers feature allows the core to fetch, parse, and update these nodes automatically without manual intervention.

proxy-providers:
  premium-sub:
    type: http
    url: "https://api.your-provider.com/sub?token=xyz"
    path: ./providers/premium.yaml
    interval: 3600
    health-check:
      enable: true
      url: http://www.gstatic.com/generate_204
      interval: 300

By using proxy-providers, your node list updates in the background every hour (interval: 3600). You can then use the use field in your policy groups to dynamically include these nodes.

7. TUN Mode: System-Wide Transparency

Standard proxy settings often miss traffic from CLI tools, Docker, or games. TUN mode creates a virtual network interface that intercepts all system TCP/UDP traffic, providing a truly transparent proxy experience.

tun:
  enable: true
  stack: mixed      # mixed is recommended for 2026
  dns-hijack:
    - any:53
  auto-route: true
  auto-detect-interface: true
// TIP The mixed stack uses the system stack for TCP (performance) and gVisor for UDP (compatibility). This is the most balanced setting for modern workstations.

8. Verification and Troubleshooting

Once configured, follow these steps to ensure everything is working correctly:

1. Syntax Validation: Check the startup logs for any ERROR level messages. YAML is sensitive to indentation, so ensure your nesting is consistent.

2. Connection Test: Run curl -I https://www.google.com in your terminal. If you receive a 200 OK, your routing and DNS are functioning. If it times out, verify your fallback DNS settings.

3. Rule Hit Analysis: Use the Clash Meta RESTful API (usually at http://127.0.0.1:9090) to view real-time connections. This will show you exactly which rule each traffic stream is hitting.

4. Rule Set Failures: If remote rule sets fail to download, ensure your interval is reasonable and check if your network can reach the provider URLs without the proxy being active first (or use a local file path as a backup).

9. Choose a Professional GUI Client for a Seamless Experience

While manual YAML configuration offers ultimate control, maintaining these files can be tedious and error-prone. For users who want the full power of Clash Meta without the manual labor, a well-designed graphical client is the best path forward.

Our Clash Client integrates the Clash Meta core with a beautiful, intuitive interface. It offers one-click subscription imports, visual rule management, real-time latency monitoring, and an easy toggle for TUN mode. Whether you are on Windows, macOS, Android, or iOS, our client handles the complexity of YAML nesting in the background, letting you focus on what matters: a fast, secure, and unrestricted internet.

Ready to experience the next level of proxy performance? Visit our download page to get the latest stable version and start your optimized internet journey today.

→ Download Clash Client now and experience the future of proxy networking