The Clash YAML Config, Section by Section

However complex a subscription looks, every Clash config is built from the same few top-level sections. Learn this map once and no profile will ever look cryptic again.

Global fields

mixed-port: 7890          # shared HTTP+SOCKS port
allow-lan: false          # accept LAN clients?
bind-address: "*"         # listen address when allow-lan is on
mode: rule                # rule / global / direct
log-level: info           # log verbosity
ipv6: false               # resolve and connect IPv6?
external-controller: 127.0.0.1:9090   # API address
secret: ""                # API secret

These control overall core behavior - the client's switches (port, mode, Allow LAN) simply edit them.

The dns section

dns:
  enable: true
  enhanced-mode: fake-ip   # or redir-host
  nameserver:
    - 1.1.1.1
  fallback:
    - https://1.1.1.1/dns-query

Governs how the core resolves names - directly affecting routing accuracy and pollution resistance. See Custom DNS.

proxies: node definitions

proxies:
  - name: "HK 01"
    type: trojan          # ss / vmess / trojan / snell / socks5 / http
    server: hk1.example.com
    port: 443
    password: xxxx
    sni: hk1.example.com
    udp: true

One entry per node. Fields vary by protocol, but name / type / server / port are always present. name is the node's unique identifier - proxy groups reference nodes by it.

proxy-groups: strategies

proxy-groups:
  - name: "Select"
    type: select
    proxies: ["Auto", "HK 01", "DIRECT"]

How nodes get used - the four types are covered in Proxy Group Types. Groups can reference groups, forming a tree.

rules: routing

rules:
  - DOMAIN-SUFFIX,google.com,Select
  - GEOIP,CN,DIRECT
  - MATCH,Select

Matched top-down; syntax in Rule Basics.

Optional sections at a glance