Clash Configuration File

1. What Is a Clash Configuration File?

Clash configuration files usually use the .yaml format. Save the file with the .yaml extension, and then import it into Clash. proxy entries, proxy groups, and routing rules. Clients such as Mihomo and Clash Verge Rev read these fields and establish connections according to the configuration.

TerminologyClash and community lists often call each item under proxies a “node.” In this guide, “proxy entry” means that client-side item; a purchased service is normally delivered as a config file, share link, or subscription URL.

All server addresses in this guide use documentation-only IP ranges or the example domain example.com. UUIDs, passwords, public keys, and tokens are demonstration values and do not represent real proxy entries, so they cannot be used to connect directly.

Important These examples are intended to demonstrate field structure. In actual use, replace the server, port, authentication data, TLS settings, transport type, and path with the real server parameters.

2. What Does a Complete Configuration Contain?

Top-level field	Purpose	Notes
mixed-port	Provides both HTTP and SOCKS proxy entry points.	The example uses 7890; you may replace it with any unused local port.
proxies	Stores specific proxy entries such as VMess, VLESS, and Trojan.	Every proxy entry name must be unique, and each proxy entry can contain only one server value.
proxy-groups	Manually selects proxy entries, performs automatic latency tests, or provides failover.	Referenced proxy entry names must exactly match the names under proxies.
rules	Determines which traffic connects directly, is rejected, or uses a proxy group.	Rules are matched from top to bottom and normally end with MATCH.

3. VMess TCP (Without TLS)

Use this when the server explicitly uses VMess over TCP without TLS. Do not add ws-opts to a TCP proxy entry.

VMess TCP (Without TLS) YAML

# Local mixed proxy port: provides both HTTP and SOCKS5 inbound access
mixed-port: 7890

# Whether LAN devices may connect to this proxy; false allows local use only
allow-lan: false

# Operating mode: rule routes traffic from top to bottom according to the rules below
mode: rule

# Log level: info is suitable for daily use; temporarily switch to debug when troubleshooting
log-level: info

# Whether to enable IPv6; keep false if the current network does not support IPv6
ipv6: false

# Proxy proxy entry list: each list item represents one independent proxy proxy entry
proxies:
  - name: "🇺🇸 Example · VMess TCP"
    type: vmess

    # Example server address: 192.0.2.0/24 is reserved for documentation and is not a real proxy entry
    server: 192.0.2.10

    # Example server port; the actual value must match the server configuration
    port: 10001

    # VMess user ID; it must be a complete 8-4-4-4-12 UUID
    uuid: "11111111-1111-4111-8111-111111111111"

    # Modern VMess normally uses 0; a nonzero value enables the legacy AlterID mechanism
    alterId: 0

    # VMess cipher; auto is a commonly compatible setting
    cipher: auto

    # Whether this proxy entry may forward UDP traffic
    udp: true

    # TCP is used when ws/http/h2/grpc is not specified; it is written explicitly here for clarity
    network: tcp

    # TLS is disabled in this example, so servername, SNI, and certificate options are unnecessary
    tls: false

# Proxy group: selects a proxy entry or DIRECT in the Clash client
proxy-groups:
  - name: "PROXY"

    # select means the user manually chooses the active proxy entry
    type: select

    # The names referenced here must exactly match the name values under proxies above
    proxies:
      - "🇺🇸 Example · VMess TCP"
      - DIRECT

# Routing rules: matched from top to bottom; matching stops after the first hit
rules:
  # Connect directly to the local loopback range
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve

  # Connect directly to private LAN IPv4 ranges
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

  # Connect directly to the local IPv6 loopback address
  - IP-CIDR6,::1/128,DIRECT,no-resolve

  # Send all remaining unmatched traffic to the PROXY group
  - MATCH,PROXY

4. VMess WebSocket + TLS

Suitable for VMess proxy entries accessed through a domain, CDN, or reverse proxy. Host, the path, and SNI must match the server.

VMess WebSocket + TLS YAML

# Local mixed proxy port: provides both HTTP and SOCKS5 inbound access
mixed-port: 7890

# Whether LAN devices may connect to this proxy; false allows local use only
allow-lan: false

# Operating mode: rule routes traffic from top to bottom according to the rules below
mode: rule

# Log level: info is suitable for daily use; temporarily switch to debug when troubleshooting
log-level: info

# Whether to enable IPv6; keep false if the current network does not support IPv6
ipv6: false

# Proxy proxy entry list: each list item represents one independent proxy proxy entry
proxies:
  - name: "🇺🇸 Example · VMess WS TLS"
    type: vmess

    # Example entry domain; example.com domains are used only for documentation
    server: edge.example.com
    port: 443

    # VMess user UUID; this value only demonstrates the format
    uuid: "11111111-1111-4111-8111-111111111112"
    alterId: 0
    cipher: auto
    udp: true

    # Use ws for WebSocket transport
    network: ws

    # Enable TLS
    tls: true

    # Server name used during the TLS handshake; it must match the server certificate
    servername: edge.example.com

    # false enables certificate verification and is normally recommended in production
    skip-cert-verify: false

    # Emulates a common browser TLS fingerprint; support depends on the current Mihomo core
    client-fingerprint: chrome

    # WebSocket-specific options
    ws-opts:
      # WebSocket request path; it must exactly match the server configuration
      path: "/vmess-demo"

      # WebSocket request headers
      headers:
        # Host must be a valid domain; do not use placeholder text such as YOUR_HOST
        Host: edge.example.com

# Proxy group: selects a proxy entry or DIRECT in the Clash client
proxy-groups:
  - name: "PROXY"

    # select means the user manually chooses the active proxy entry
    type: select

    # The names referenced here must exactly match the name values under proxies above
    proxies:
      - "🇺🇸 Example · VMess WS TLS"
      - DIRECT

# Routing rules: matched from top to bottom; matching stops after the first hit
rules:
  # Connect directly to the local loopback range
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve

  # Connect directly to private LAN IPv4 ranges
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

  # Connect directly to the local IPv6 loopback address
  - IP-CIDR6,::1/128,DIRECT,no-resolve

  # Send all remaining unmatched traffic to the PROXY group
  - MATCH,PROXY

5. VLESS TCP + TLS

VLESS uses a UUID but does not use the VMess fields alterId or cipher.

VLESS TCP + TLS YAML

# Local mixed proxy port: provides both HTTP and SOCKS5 inbound access
mixed-port: 7890

# Whether LAN devices may connect to this proxy; false allows local use only
allow-lan: false

# Operating mode: rule routes traffic from top to bottom according to the rules below
mode: rule

# Log level: info is suitable for daily use; temporarily switch to debug when troubleshooting
log-level: info

# Whether to enable IPv6; keep false if the current network does not support IPv6
ipv6: false

# Proxy proxy entry list: each list item represents one independent proxy proxy entry
proxies:
  - name: "🇺🇸 Example · VLESS TLS"
    type: vless

    # Example domain; it does not point to a real proxy service
    server: vless.example.com
    port: 443

    # VLESS user UUID; VLESS does not use alterId or cipher
    uuid: "22222222-2222-4222-8222-222222222221"

    # Allow UDP forwarding
    udp: true

    # The encryption field for standard VLESS is normally an empty string
    encryption: ""

    # Use native TCP transport
    network: tcp

    # Enable TLS
    tls: true

    # TLS server name; it must match the certificate and server configuration
    servername: vless.example.com

    # Example browser TLS fingerprint
    client-fingerprint: chrome

    # false means certificate verification is not skipped
    skip-cert-verify: false

# Proxy group: selects a proxy entry or DIRECT in the Clash client
proxy-groups:
  - name: "PROXY"

    # select means the user manually chooses the active proxy entry
    type: select

    # The names referenced here must exactly match the name values under proxies above
    proxies:
      - "🇺🇸 Example · VLESS TLS"
      - DIRECT

# Routing rules: matched from top to bottom; matching stops after the first hit
rules:
  # Connect directly to the local loopback range
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve

  # Connect directly to private LAN IPv4 ranges
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

  # Connect directly to the local IPv6 loopback address
  - IP-CIDR6,::1/128,DIRECT,no-resolve

  # Send all remaining unmatched traffic to the PROXY group
  - MATCH,PROXY

6. VLESS Reality

Reality requires a UUID, SNI, public key, and Short ID, and is commonly used with Vision flow control.

VLESS Reality YAML

# Local mixed proxy port: provides both HTTP and SOCKS5 inbound access
mixed-port: 7890

# Whether LAN devices may connect to this proxy; false allows local use only
allow-lan: false

# Operating mode: rule routes traffic from top to bottom according to the rules below
mode: rule

# Log level: info is suitable for daily use; temporarily switch to debug when troubleshooting
log-level: info

# Whether to enable IPv6; keep false if the current network does not support IPv6
ipv6: false

# Proxy proxy entry list: each list item represents one independent proxy proxy entry
proxies:
  - name: "🇺🇸 Example · VLESS Reality"
    type: vless

    # 198.51.100.0/24 is reserved for documentation and is used only to demonstrate the format
    server: 198.51.100.20
    port: 443

    # Example VLESS user UUID
    uuid: "22222222-2222-4222-8222-222222222222"

    udp: true
    encryption: ""
    network: tcp

    # Reality proxy entries still use the TLS configuration entry
    tls: true

    # Camouflage target name specified by the server; it must match the server configuration
    servername: www.example.com

    # Common flow-control value for Reality + Vision
    flow: xtls-rprx-vision

    # Reality normally requires a client fingerprint
    client-fingerprint: chrome

    # Reality-specific options
    reality-opts:
      # Example public key used only to show the field location; it does not correspond to a real server
      public-key: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

      # Short ID is normally a hexadecimal string and must match the server
      short-id: "0123456789abcdef"

# Proxy group: selects a proxy entry or DIRECT in the Clash client
proxy-groups:
  - name: "PROXY"

    # select means the user manually chooses the active proxy entry
    type: select

    # The names referenced here must exactly match the name values under proxies above
    proxies:
      - "🇺🇸 Example · VLESS Reality"
      - DIRECT

# Routing rules: matched from top to bottom; matching stops after the first hit
rules:
  # Connect directly to the local loopback range
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve

  # Connect directly to private LAN IPv4 ranges
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

  # Connect directly to the local IPv6 loopback address
  - IP-CIDR6,::1/128,DIRECT,no-resolve

  # Send all remaining unmatched traffic to the PROXY group
  - MATCH,PROXY

7. Trojan TCP + TLS

Trojan uses password authentication and is commonly deployed over TLS.

Trojan TCP + TLS YAML

# Local mixed proxy port: provides both HTTP and SOCKS5 inbound access
mixed-port: 7890

# Whether LAN devices may connect to this proxy; false allows local use only
allow-lan: false

# Operating mode: rule routes traffic from top to bottom according to the rules below
mode: rule

# Log level: info is suitable for daily use; temporarily switch to debug when troubleshooting
log-level: info

# Whether to enable IPv6; keep false if the current network does not support IPv6
ipv6: false

# Proxy proxy entry list: each list item represents one independent proxy proxy entry
proxies:
  - name: "🇺🇸 Example · Trojan TLS"
    type: trojan

    # Example domain
    server: trojan.example.com
    port: 443

    # Trojan uses password authentication, not a UUID
    password: "example-trojan-password"

    # Whether to allow UDP
    udp: true

    # Trojan normally uses TLS; SNI must match the server certificate settings
    sni: trojan.example.com

    # Certificate verification is recommended
    skip-cert-verify: false

    # Example client TLS fingerprint
    client-fingerprint: chrome

    # TCP is used when ws or grpc is not enabled
    network: tcp

# Proxy group: selects a proxy entry or DIRECT in the Clash client
proxy-groups:
  - name: "PROXY"

    # select means the user manually chooses the active proxy entry
    type: select

    # The names referenced here must exactly match the name values under proxies above
    proxies:
      - "🇺🇸 Example · Trojan TLS"
      - DIRECT

# Routing rules: matched from top to bottom; matching stops after the first hit
rules:
  # Connect directly to the local loopback range
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve

  # Connect directly to private LAN IPv4 ranges
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

  # Connect directly to the local IPv6 loopback address
  - IP-CIDR6,::1/128,DIRECT,no-resolve

  # Send all remaining unmatched traffic to the PROXY group
  - MATCH,PROXY

8. Shadowsocks

The Shadowsocks cipher and password must exactly match the server.

Shadowsocks YAML

# Local mixed proxy port: provides both HTTP and SOCKS5 inbound access
mixed-port: 7890

# Whether LAN devices may connect to this proxy; false allows local use only
allow-lan: false

# Operating mode: rule routes traffic from top to bottom according to the rules below
mode: rule

# Log level: info is suitable for daily use; temporarily switch to debug when troubleshooting
log-level: info

# Whether to enable IPv6; keep false if the current network does not support IPv6
ipv6: false

# Proxy proxy entry list: each list item represents one independent proxy proxy entry
proxies:
  - name: "🇺🇸 Example · Shadowsocks"
    type: ss

    # 203.0.113.0/24 is reserved for documentation
    server: 203.0.113.30
    port: 8388

    # The cipher must exactly match the server
    cipher: chacha20-ietf-poly1305

    # Example Shadowsocks authentication password
    password: "example-shadowsocks-password"

    # Enable UDP forwarding
    udp: true

    # Whether to carry UDP over TCP; standard servers normally keep this false
    udp-over-tcp: false

# Proxy group: selects a proxy entry or DIRECT in the Clash client
proxy-groups:
  - name: "PROXY"

    # select means the user manually chooses the active proxy entry
    type: select

    # The names referenced here must exactly match the name values under proxies above
    proxies:
      - "🇺🇸 Example · Shadowsocks"
      - DIRECT

# Routing rules: matched from top to bottom; matching stops after the first hit
rules:
  # Connect directly to the local loopback range
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve

  # Connect directly to private LAN IPv4 ranges
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

  # Connect directly to the local IPv6 loopback address
  - IP-CIDR6,::1/128,DIRECT,no-resolve

  # Send all remaining unmatched traffic to the PROXY group
  - MATCH,PROXY

9. SOCKS5

SOCKS5 can be used without authentication or with a username and password.

SOCKS5 YAML

# Local mixed proxy port: provides both HTTP and SOCKS5 inbound access
mixed-port: 7890

# Whether LAN devices may connect to this proxy; false allows local use only
allow-lan: false

# Operating mode: rule routes traffic from top to bottom according to the rules below
mode: rule

# Log level: info is suitable for daily use; temporarily switch to debug when troubleshooting
log-level: info

# Whether to enable IPv6; keep false if the current network does not support IPv6
ipv6: false

# Proxy proxy entry list: each list item represents one independent proxy proxy entry
proxies:
  - name: "🇺🇸 Example · SOCKS5"
    type: socks5

    # Example SOCKS5 server address
    server: 192.0.2.40
    port: 1080

    # Delete the username and password lines when the server does not require authentication
    username: "example-user"
    password: "example-password"

    # Enable this only when the SOCKS5 server supports UDP
    udp: true

    # This example uses plain SOCKS5 without TLS
    tls: false

# Proxy group: selects a proxy entry or DIRECT in the Clash client
proxy-groups:
  - name: "PROXY"

    # select means the user manually chooses the active proxy entry
    type: select

    # The names referenced here must exactly match the name values under proxies above
    proxies:
      - "🇺🇸 Example · SOCKS5"
      - DIRECT

# Routing rules: matched from top to bottom; matching stops after the first hit
rules:
  # Connect directly to the local loopback range
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve

  # Connect directly to private LAN IPv4 ranges
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

  # Connect directly to the local IPv6 loopback address
  - IP-CIDR6,::1/128,DIRECT,no-resolve

  # Send all remaining unmatched traffic to the PROXY group
  - MATCH,PROXY

10. HTTPS Proxy

In Mihomo, both HTTP and HTTPS outbound proxies use type: http; HTTPS is enabled with tls: true.

HTTPS Proxy YAML

# Local mixed proxy port: provides both HTTP and SOCKS5 inbound access
mixed-port: 7890

# Whether LAN devices may connect to this proxy; false allows local use only
allow-lan: false

# Operating mode: rule routes traffic from top to bottom according to the rules below
mode: rule

# Log level: info is suitable for daily use; temporarily switch to debug when troubleshooting
log-level: info

# Whether to enable IPv6; keep false if the current network does not support IPv6
ipv6: false

# Proxy proxy entry list: each list item represents one independent proxy proxy entry
proxies:
  - name: "🇺🇸 Example · HTTPS Proxy"
    type: http

    # In Mihomo, both HTTP and HTTPS outbound proxies use type: http
    server: proxy.example.com
    port: 443

    # Example proxy authentication; delete these two lines for a server without authentication
    username: "example-user"
    password: "example-password"

    # true enables TLS between the client and proxy server, making it an HTTPS proxy
    tls: true

    # TLS SNI, normally the domain listed in the proxy server certificate
    sni: proxy.example.com

    # false performs normal TLS certificate verification
    skip-cert-verify: false

# Proxy group: selects a proxy entry or DIRECT in the Clash client
proxy-groups:
  - name: "PROXY"

    # select means the user manually chooses the active proxy entry
    type: select

    # The names referenced here must exactly match the name values under proxies above
    proxies:
      - "🇺🇸 Example · HTTPS Proxy"
      - DIRECT

# Routing rules: matched from top to bottom; matching stops after the first hit
rules:
  # Connect directly to the local loopback range
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve

  # Connect directly to private LAN IPv4 ranges
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

  # Connect directly to the local IPv6 loopback address
  - IP-CIDR6,::1/128,DIRECT,no-resolve

  # Send all remaining unmatched traffic to the PROXY group
  - MATCH,PROXY

11. Hysteria2

Hysteria2 is based on QUIC and normally requires a password, SNI, certificate verification, and bandwidth hints.

Hysteria2 YAML

# Local mixed proxy port: provides both HTTP and SOCKS5 inbound access
mixed-port: 7890

# Whether LAN devices may connect to this proxy; false allows local use only
allow-lan: false

# Operating mode: rule routes traffic from top to bottom according to the rules below
mode: rule

# Log level: info is suitable for daily use; temporarily switch to debug when troubleshooting
log-level: info

# Whether to enable IPv6; keep false if the current network does not support IPv6
ipv6: false

# Proxy proxy entry list: each list item represents one independent proxy proxy entry
proxies:
  - name: "🇺🇸 Example · Hysteria2"
    type: hysteria2

    # Example domain
    server: hy2.example.com
    port: 443

    # Hysteria2 authentication password
    password: "example-hysteria2-password"

    # Upload and download bandwidth hints; adjust them for the real network and server requirements
    up: "20 Mbps"
    down: "100 Mbps"

    # TLS SNI
    sni: hy2.example.com

    # false enables certificate verification
    skip-cert-verify: false

    # Hysteria2 is based on QUIC and commonly uses h3 as ALPN
    alpn:
      - h3

    # Do not set obfs or obfs-password when obfuscation is not used
    # obfs: salamander
    # obfs-password: "example-obfs-password"

# Proxy group: selects a proxy entry or DIRECT in the Clash client
proxy-groups:
  - name: "PROXY"

    # select means the user manually chooses the active proxy entry
    type: select

    # The names referenced here must exactly match the name values under proxies above
    proxies:
      - "🇺🇸 Example · Hysteria2"
      - DIRECT

# Routing rules: matched from top to bottom; matching stops after the first hit
rules:
  # Connect directly to the local loopback range
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve

  # Connect directly to private LAN IPv4 ranges
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

  # Connect directly to the local IPv6 loopback address
  - IP-CIDR6,::1/128,DIRECT,no-resolve

  # Send all remaining unmatched traffic to the PROXY group
  - MATCH,PROXY

12. TUIC v5

TUIC v5 uses a UUID and password; do not also configure the v4 token.

TUIC v5 YAML

# Local mixed proxy port: provides both HTTP and SOCKS5 inbound access
mixed-port: 7890

# Whether LAN devices may connect to this proxy; false allows local use only
allow-lan: false

# Operating mode: rule routes traffic from top to bottom according to the rules below
mode: rule

# Log level: info is suitable for daily use; temporarily switch to debug when troubleshooting
log-level: info

# Whether to enable IPv6; keep false if the current network does not support IPv6
ipv6: false

# Proxy proxy entry list: each list item represents one independent proxy proxy entry
proxies:
  - name: "🇺🇸 Example · TUIC v5"
    type: tuic

    # Example TUIC server domain
    server: tuic.example.com
    port: 443

    # TUIC v5 uses UUID + password
    uuid: "44444444-4444-4444-8444-444444444444"
    password: "example-tuic-v5-password"

    # TLS SNI
    sni: tuic.example.com

    # false enables certificate verification
    skip-cert-verify: false

    # UDP relay mode: native or quic; it must be supported by both the server and core
    udp-relay-mode: native

    # Example QUIC congestion-control algorithm
    congestion-controller: bbr

    # Whether to enable QUIC 0-RTT; enabling it can reduce handshake latency
    reduce-rtt: true

    # Request establishment timeout in milliseconds
    request-timeout: 8000

# Proxy group: selects a proxy entry or DIRECT in the Clash client
proxy-groups:
  - name: "PROXY"

    # select means the user manually chooses the active proxy entry
    type: select

    # The names referenced here must exactly match the name values under proxies above
    proxies:
      - "🇺🇸 Example · TUIC v5"
      - DIRECT

# Routing rules: matched from top to bottom; matching stops after the first hit
rules:
  # Connect directly to the local loopback range
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve

  # Connect directly to private LAN IPv4 ranges
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

  # Connect directly to the local IPv6 loopback address
  - IP-CIDR6,::1/128,DIRECT,no-resolve

  # Send all remaining unmatched traffic to the PROXY group
  - MATCH,PROXY

13. TUIC v4

TUIC v4 uses a token; do not also configure the v5 UUID and password.

TUIC v4 YAML

# Local mixed proxy port: provides both HTTP and SOCKS5 inbound access
mixed-port: 7890

# Whether LAN devices may connect to this proxy; false allows local use only
allow-lan: false

# Operating mode: rule routes traffic from top to bottom according to the rules below
mode: rule

# Log level: info is suitable for daily use; temporarily switch to debug when troubleshooting
log-level: info

# Whether to enable IPv6; keep false if the current network does not support IPv6
ipv6: false

# Proxy proxy entry list: each list item represents one independent proxy proxy entry
proxies:
  - name: "🇺🇸 Example · TUIC v4"
    type: tuic

    # Example TUIC v4 server domain
    server: tuic-v4.example.com
    port: 443

    # TUIC v4 uses a token; do not configure it together with the v5 uuid/password
    token: "example-tuic-v4-token"

    # TLS SNI
    sni: tuic-v4.example.com
    skip-cert-verify: false

    # UDP relay mode
    udp-relay-mode: native

    # QUIC congestion-control algorithm
    congestion-controller: bbr

    # Request timeout in milliseconds
    request-timeout: 8000

# Proxy group: selects a proxy entry or DIRECT in the Clash client
proxy-groups:
  - name: "PROXY"

    # select means the user manually chooses the active proxy entry
    type: select

    # The names referenced here must exactly match the name values under proxies above
    proxies:
      - "🇺🇸 Example · TUIC v4"
      - DIRECT

# Routing rules: matched from top to bottom; matching stops after the first hit
rules:
  # Connect directly to the local loopback range
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve

  # Connect directly to private LAN IPv4 ranges
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

  # Connect directly to the local IPv6 loopback address
  - IP-CIDR6,::1/128,DIRECT,no-resolve

  # Send all remaining unmatched traffic to the PROXY group
  - MATCH,PROXY

14. WireGuard

WireGuard requires a client private key, server public key, tunnel address, and allowed IP ranges.

WireGuard YAML

# Local mixed proxy port: provides both HTTP and SOCKS5 inbound access
mixed-port: 7890

# Whether LAN devices may connect to this proxy; false allows local use only
allow-lan: false

# Operating mode: rule routes traffic from top to bottom according to the rules below
mode: rule

# Log level: info is suitable for daily use; temporarily switch to debug when troubleshooting
log-level: info

# Whether to enable IPv6; keep false if the current network does not support IPv6
ipv6: false

# Proxy proxy entry list: each list item represents one independent proxy proxy entry
proxies:
  - name: "🇺🇸 Example · WireGuard"
    type: wireguard

    # Example server address
    server: 203.0.113.50
    port: 51820

    # Example IPv4 address used by the client inside the WireGuard tunnel
    ip: 10.66.66.2

    # Example client private key, used only to demonstrate the field format and not for real use
    private-key: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="

    # Example server public key, used only to demonstrate the field format
    public-key: "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB="

    # Target ranges allowed through the tunnel
    allowed-ips:
      - "0.0.0.0/0"

    # Allow UDP
    udp: true

    # Example maximum transmission unit; adjust it for the actual network if problems occur
    mtu: 1408

    # Uncomment and replace this only when the server requires a pre-shared key
    # pre-shared-key: "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC="

# Proxy group: selects a proxy entry or DIRECT in the Clash client
proxy-groups:
  - name: "PROXY"

    # select means the user manually chooses the active proxy entry
    type: select

    # The names referenced here must exactly match the name values under proxies above
    proxies:
      - "🇺🇸 Example · WireGuard"
      - DIRECT

# Routing rules: matched from top to bottom; matching stops after the first hit
rules:
  # Connect directly to the local loopback range
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve

  # Connect directly to private LAN IPv4 ranges
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

  # Connect directly to the local IPv6 loopback address
  - IP-CIDR6,::1/128,DIRECT,no-resolve

  # Send all remaining unmatched traffic to the PROXY group
  - MATCH,PROXY

15. SSH

SSH outbound can authenticate with a password or private key. This example uses password authentication.

SSH YAML

# Local mixed proxy port: provides both HTTP and SOCKS5 inbound access
mixed-port: 7890

# Whether LAN devices may connect to this proxy; false allows local use only
allow-lan: false

# Operating mode: rule routes traffic from top to bottom according to the rules below
mode: rule

# Log level: info is suitable for daily use; temporarily switch to debug when troubleshooting
log-level: info

# Whether to enable IPv6; keep false if the current network does not support IPv6
ipv6: false

# Proxy proxy entry list: each list item represents one independent proxy proxy entry
proxies:
  - name: "🇺🇸 Example · SSH"
    type: ssh

    # Example SSH server address
    server: 192.0.2.60
    port: 22

    # SSH login account
    username: "example-user"

    # Example password authentication; delete password when using private-key authentication
    password: "example-ssh-password"

    # Optional: pin the server host key to reduce the risk of connecting to the wrong host
    # host-key:
    #   - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExampleOnly"

# Proxy group: selects a proxy entry or DIRECT in the Clash client
proxy-groups:
  - name: "PROXY"

    # select means the user manually chooses the active proxy entry
    type: select

    # The names referenced here must exactly match the name values under proxies above
    proxies:
      - "🇺🇸 Example · SSH"
      - DIRECT

# Routing rules: matched from top to bottom; matching stops after the first hit
rules:
  # Connect directly to the local loopback range
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve

  # Connect directly to private LAN IPv4 ranges
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

  # Connect directly to the local IPv6 loopback address
  - IP-CIDR6,::1/128,DIRECT,no-resolve

  # Send all remaining unmatched traffic to the PROXY group
  - MATCH,PROXY

16. AnyTLS

AnyTLS uses a password and TLS settings and provides idle-session management options.

AnyTLS YAML

# Local mixed proxy port: provides both HTTP and SOCKS5 inbound access
mixed-port: 7890

# Whether LAN devices may connect to this proxy; false allows local use only
allow-lan: false

# Operating mode: rule routes traffic from top to bottom according to the rules below
mode: rule

# Log level: info is suitable for daily use; temporarily switch to debug when troubleshooting
log-level: info

# Whether to enable IPv6; keep false if the current network does not support IPv6
ipv6: false

# Proxy proxy entry list: each list item represents one independent proxy proxy entry
proxies:
  - name: "🇺🇸 Example · AnyTLS"
    type: anytls

    # Example domain
    server: anytls.example.com
    port: 443

    # AnyTLS authentication password
    password: "example-anytls-password"

    # Whether to allow UDP
    udp: true

    # TLS SNI
    sni: anytls.example.com

    # Example browser TLS fingerprint
    client-fingerprint: chrome

    # false enables certificate verification
    skip-cert-verify: false

    # TLS application-layer protocol negotiation list
    alpn:
      - h2
      - http/1.1

    # Idle-session check interval in seconds
    idle-session-check-interval: 30

    # Idle-session timeout in seconds
    idle-session-timeout: 30

    # Minimum number of idle sessions to keep
    min-idle-session: 0

# Proxy group: selects a proxy entry or DIRECT in the Clash client
proxy-groups:
  - name: "PROXY"

    # select means the user manually chooses the active proxy entry
    type: select

    # The names referenced here must exactly match the name values under proxies above
    proxies:
      - "🇺🇸 Example · AnyTLS"
      - DIRECT

# Routing rules: matched from top to bottom; matching stops after the first hit
rules:
  # Connect directly to the local loopback range
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve

  # Connect directly to private LAN IPv4 ranges
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

  # Connect directly to the local IPv6 loopback address
  - IP-CIDR6,::1/128,DIRECT,no-resolve

  # Send all remaining unmatched traffic to the PROXY group
  - MATCH,PROXY

17. Multiple IPs, Multiple Protocols, and Automatic Latency Testing

Multiple IP addresses cannot be placed in one server field. Create a separate proxy entry for each IP, then add all proxy entry names to the same proxy group. Different protocols may also coexist in one proxies list.

Complete Example: Multiple Proxy Entries + Multiple Protocols + Automatic Latency Testing YAML

# Local mixed proxy port: provides both HTTP and SOCKS5 inbound access
mixed-port: 7890

# Whether LAN devices may connect to this proxy; false allows local use only
allow-lan: false

# Operating mode: rule routes traffic from top to bottom according to the rules below
mode: rule

# Log level: info is suitable for daily use; temporarily switch to debug when troubleshooting
log-level: info

# Whether to enable IPv6; keep false if the current network does not support IPv6
ipv6: false

# Proxy proxy entry list: each IP address or protocol must be defined as an independent proxy entry
proxies:
  # ----------------------------------------------------------
  # Proxy entry 1: VMess + TCP without TLS example
  # ----------------------------------------------------------
  - name: "🇺🇸 Example · VMess 01"

    # Proxy protocol type
    type: vmess

    # Documentation-only example IP; it does not correspond to a real server
    server: 192.0.2.11

    # Example server port; the actual value must be provided by the proxy entry server
    port: 10001

    # Example VMess UUID, used only to demonstrate the field format
    uuid: "11111111-1111-4111-8111-111111111121"

    # Modern VMess normally uses 0
    alterId: 0

    # Example VMess cipher
    cipher: auto

    # Whether to allow UDP traffic
    udp: true

    # Use native TCP transport
    network: tcp

    # TLS is disabled in this example
    tls: false

  # ----------------------------------------------------------
  # Proxy entry 2: same authentication data with a different example IP
  # Each server must be defined as a separate proxy entry; do not place multiple IPs on one line
  # ----------------------------------------------------------
  - name: "🇺🇸 Example · VMess 02"
    type: vmess
    server: 192.0.2.12
    port: 10001
    uuid: "11111111-1111-4111-8111-111111111121"
    alterId: 0
    cipher: auto
    udp: true
    network: tcp
    tls: false

  # ----------------------------------------------------------
  # Proxy entry 3: Trojan + TCP + TLS example
  # A single proxies list can contain proxy entries using different protocols
  # ----------------------------------------------------------
  - name: "🇯🇵 Example · Trojan"

    # Proxy protocol type
    type: trojan

    # The example.com subdomain is used only for documentation
    server: trojan.example.com

    # Example of a common TLS service port
    port: 443

    # Example Trojan password; it does not correspond to a real account
    password: "example-trojan-password"

    # Whether to allow UDP traffic
    udp: true

    # SNI used for the TLS handshake; it must match the real server certificate
    sni: trojan.example.com

    # false enables verification of the server certificate
    skip-cert-verify: false

    # Use TCP transport
    network: tcp

# Proxy groups: define both an automatic latency-test group and a main selection group
proxy-groups:
  # Automatic latency-test group: periodically tests listed proxy entries and selects a lower-latency proxy entry
  - name: "AUTO"

    # url-test enables automatic selection based on latency tests
    type: url-test

    # Proxy entry names included in testing must exactly match the names under proxies
    proxies:
      - "🇺🇸 Example · VMess 01"
      - "🇺🇸 Example · VMess 02"
      - "🇯🇵 Example · Trojan"

    # Example test URL; replace it with a stable and reachable 204 endpoint in actual use
    url: "https://health-check.example.com/generate_204"

    # Test interval in seconds; 300 means one test every 5 minutes
    interval: 300

    # Keep the current proxy entry when the latency difference is within 50 ms to reduce frequent switching
    tolerance: 50

  # Main proxy group: manually choose the automatic group, an individual proxy entry, or DIRECT in the client
  - name: "PROXY"

    # select means manual selection
    type: select

    # AUTO is the automatic latency-test group above; the other entries are specific proxy entry names
    proxies:
      - "AUTO"
      - "🇺🇸 Example · VMess 01"
      - "🇺🇸 Example · VMess 02"
      - "🇯🇵 Example · Trojan"
      - DIRECT

# Routing rules: matched from top to bottom; matching stops after the first hit
rules:
  # Connect directly to the local loopback range
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve

  # Connect directly to private LAN IPv4 ranges
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve

  # Connect directly to the local IPv6 loopback address
  - IP-CIDR6,::1/128,DIRECT,no-resolve

  # Send all other traffic to the PROXY group
  - MATCH,PROXY

18. Checklist Before Importing

Name:Every proxy entry name must be unique, and names in proxy groups must match exactly.
Address:A server field can contain only one IP address or domain; multiple IPs must be split into separate proxy entries.
Authentication:UUIDs, passwords, tokens, public keys, and private keys must come from the corresponding server and cannot be mixed.
Transport:Do not set ws-opts on TCP proxy entries. For WebSocket proxy entries, verify path and Host.
TLS:After enabling TLS, verify SNI/servername, the certificate, and whether certificate verification is skipped.
Indentation:YAML uses spaces for indentation, not tabs. Fields at the same level must use identical indentation.

19. Frequently Asked Questions

Can proxy entry names contain non-Latin characters, spaces, and flags?

Yes. Put names containing non-Latin characters, spaces, or emoji in double quotes, and ensure proxy-group references match exactly.

Why does ws-opts.headers[Host] invalid appear?

This usually means Host is not a valid domain or a TCP proxy entry incorrectly retains WebSocket options. Remove the entire ws-opts section from a TCP proxy entry.

Can these examples connect directly?

No. This guide uses documentation-only addresses and demonstration credentials solely for understanding and testing YAML structure.

Need to Check a Clash Configuration?

If importing fails, first check YAML indentation, then verify the proxy entry protocol, authentication data, transport layer, and TLS fields.

View VPN and Proxy Plans