# Using Clash as a Multi-Protocol Proxy Hub: A Complete Setup Guide

> Unlock a multi-protocol proxy hub with Clash. This guide shows you how to set up Clash to unify VMess, Shadowsocks, SOCKS5, and more using bannedbook/fanqiang tools.

- Repository: [如何翻墙/fanqiang](https://github.com/bannedbook/fanqiang)
- Tags: how-to-guide
- Published: 2026-09-06

---

**Clash acts as a centralized proxy engine that unifies VMess, Shadowsocks, Snell, SOCKS5, and ShadowsocksR protocols behind a single rule-based routing interface, with platform-specific GUIs for Windows and macOS.** This guide explains how to deploy Clash as a multi-protocol proxy hub using the tools maintained in the `bannedbook/fanqiang` repository.

The `fanqiang` repository distributes Clash-based solutions that abstract protocol complexity into user-friendly applications. Whether you need personal proxy access or a LAN-wide gateway, Clash's modular architecture—separating the core engine from platform front-ends—provides a consistent experience across operating systems.

## Clash Architecture: How the Components Work Together

Clash's design separates proxy logic from user interface concerns. Understanding this separation helps troubleshoot issues and optimize your deployment.

### The Core Engine

The **Clash Core** handles connection management and rule evaluation. According to the `fanqiang` source documentation, it natively supports:

- **VMess** (V2Ray protocol)
- **Shadowsocks** (multiple cipher suites)
- **Snell** (Surge proprietary protocol)
- **SOCKS5** (generic proxy)
- **ShadowsocksR** (legacy Shadowsocks variant)

**Important limitation:** The core **does not support VLESS**. Nodes advertised as VLESS will be misidentified as VMess and will time out【1†L8-L9】.

### Platform Front-Ends

| Platform | Application | Technology | Key Feature |
|----------|-------------|------------|-------------|
| Windows | ClashDotNetFramework | .NET 5 WPF GUI | Integrated subscription management, one-click system proxy |
| macOS | ClashX | Native Cocoa app | Menu bar control, keyboard shortcuts, Apple Silicon support |
| macOS (Pro) | ClashX Pro | Enhanced ClashX | LAN gateway mode, traffic statistics, rule profiling |

The Windows front-end (`ClashDotNetFramework`) is built on .NET 5 and distributed as a portable archive with required DLLs【1†L5-L7】. ClashX for macOS provides native integration with system network preferences, including automatic proxy configuration【2†L5-L8】.

## Installing Clash on Windows and macOS

### Windows Setup (ClashDotNetFramework)

Download and extract the release archive, then install the .NET 5 runtime if not present:

```bash

# The repository provides a packaged distribution at:

# https://github.com/bannedbook/fanqiang/blob/master/windows/ClashDotNetFramework.md

# Typical extraction yields:

Clash.DotNet/
├── ClashDotNetFramework.exe   # Main executable

├── clash-win64.exe            # Core engine binary

├── config.yaml                # Default configuration stub

└── locales/                   # UI translations

```

Launch `ClashDotNetFramework.exe`. The GUI automatically creates its configuration directory on first run【1†L25-L35】.

### macOS Setup (ClashX)

Download the `.dmg` from the releases page, drag to Applications, and grant network permission when prompted. The first launch creates `~/.config/clash/` with this structure:

```bash
~/.config/clash/
├── config.yml          # Active configuration (auto-managed)

├── Country.mmdb        # GeoIP database for rule matching

└── cache.db            # Subscription cache

```

**Critical warning from the source:** Do not manually edit the port number in [`config.yml`](https://github.com/bannedbook/fanqiang/blob/main/config.yml)【2†L75-L76】. The UI manages this value; manual changes cause connection failures.

## Configuring Multi-Protocol Proxy Access

### Adding a Subscription URL

Clash consumes **Clash-compatible subscription links**—typically provided by V2Ray service providers ("airports"). The subscription contains base64-encoded YAML with node definitions.

**Windows workflow:**
1. Obtain subscription URL from your provider
2. In ClashDotNetFramework: **Config → Remote → Paste URL → Download**
3. Select the imported profile from the dropdown【1†L55-L63】

**macOS workflow:**
1. Copy subscription URL to clipboard
2. ClashX menu → **Config → Remote Config → Manage → Add**
3. Click the new config to activate【2†L54-L60】

Both platforms convert the remote YAML into the local [`config.yml`](https://github.com/bannedbook/fanqiang/blob/main/config.yml) format automatically.

### Understanding the Configuration Format

Here's a minimal [`config.yml`](https://github.com/bannedbook/fanqiang/blob/main/config.yml) structure that Clash generates and reads:

```yaml

# ~/.config/clash/config.yml (macOS path; Windows uses internal storage)

mixed-port: 7890           # HTTP+SOCKS5 combined listener

allow-lan: false           # Set true for gateway mode

mode: rule                 # rule/direct/global

log-level: info
external-controller: 127.0.0.1:9090  # REST API for external UIs

proxies:
  - name: "vmess-node-1"
    type: vmess
    server: example.com
    port: 443
    uuid: a-b-c-d
    alterId: 0
    cipher: auto
    tls: true
  - name: "ss-node-2"
    type: ss
    server: backup.example.com
    port: 8388
    cipher: aes-256-gcm
    password: "secret"

proxy-groups:
  - name: "Auto"
    type: url-test
    proxies:
      - vmess-node-1
      - ss-node-2
    url: http://www.gstatic.com/generate_204
    interval: 300

rules:
  - DOMAIN-SUFFIX,company.com,DIRECT
  - GEOIP,CN,DIRECT
  - MATCH,Auto

```

The `proxies` section populates automatically from subscriptions. Manual editing is only needed for advanced customization.

## Enabling System-Wide Proxy Routing

### Basic System Proxy Mode

Both front-ends register Clash as the system HTTP/HTTPS proxy, diverting all application traffic through the selected node.

**Windows activation:**

```

Settings → Display → Language → System Proxy → Enable

```

Alternatively, click the system tray icon and toggle "Set as system proxy"【1†L71-L73】.

**macOS activation:**

```

ClashX menu → Settings → System Proxy → Enable

```

Verify in **System Preferences → Network → Advanced → Proxies** that HTTP and HTTPS proxy are set to `127.0.0.1:7890`【2†L63-L64】.

### Selecting Proxy Nodes and Modes

After enabling system proxy, choose your traffic routing strategy:

| Mode | Behavior | Use Case |
|------|----------|----------|
| **Rule** | Routes per domain/IP rules (GEOIP, DOMAIN-SUFFIX) | General browsing, bypasses Chinese sites |
| **Global** | All traffic through selected proxy | Testing, guaranteed tunneling |
| **Direct** | No proxy, direct connection | Troubleshooting, maximum speed |

Select individual nodes or "Auto" (url-test) in the **Proxy** menu. The url-test group automatically selects the lowest-latency node every 5 minutes.

## Advanced: Using Clash as a LAN Gateway

ClashX Pro on macOS supports **Enhanced Mode** to function as a transparent gateway for other devices—effectively turning your Mac into a routing appliance.

### Gateway Mode Prerequisites

- Static IP assignment on the Mac (e.g., `192.168.88.2/24`)
- Router with configurable DHCP gateway option
- ClashX Pro (paid version with Enhanced Mode)

### Configuration Steps

1. **Assign static IP on Mac:**
   ```

   System Preferences → Network → Advanced → TCP/IP
   Configure IPv4: Manually
   IP: 192.168.88.2
   Subnet Mask: 255.255.255.0
   Router: [your router's IP, e.g., 192.168.88.1]
   ```

2. **Configure router DHCP:**
   - Default gateway: `192.168.88.2` (the Mac's IP)
   - DNS servers: `192.168.88.2` or external (1.1.1.1, 8.8.8.8)

3. **Enable Enhanced Mode in ClashX Pro:**
   ```

   ClashX menu → Enhanced Mode → Enable
   Ensure "Set as system proxy" remains checked
   Select desired proxy node in Proxy menu
   ```

4. **Reboot router** to push new DHCP settings to LAN clients【3†L71-L77】

After reboot, any device obtaining IP via DHCP will route through the Mac. The ClashX Pro instance handles protocol selection and rule evaluation transparently—no client-side proxy configuration required【3†L46-L53】.

## Key Repository Files for Reference

| File | Purpose | Direct Link |
|------|---------|-------------|
| [`windows/ClashDotNetFramework.md`](https://github.com/bannedbook/fanqiang/blob/main/windows/ClashDotNetFramework.md) | Windows installation, subscription import, troubleshooting | [View](https://github.com/bannedbook/fanqiang/blob/master/windows/ClashDotNetFramework.md) |
| [`macos/ClashX.md`](https://github.com/bannedbook/fanqiang/blob/main/macos/ClashX.md) | macOS setup, configuration paths, system proxy activation | [View](https://github.com/bannedbook/fanqiang/blob/master/macos/ClashX.md) |
| `game/Mac电脑使用ClashX Pro作为网关旁路由给其它设备翻墙.md` | Complete LAN gateway tutorial with DHCP configuration | [View](https://github.com/bannedbook/fanqiang/blob/master/game/Mac电脑使用ClashX%20Pro作为网关旁路由给其它设备翻墙.md) |

These documentation files in the `bannedbook/fanqiang` repository are actively maintained and reflect tested configurations for production use.

## Summary

Using Clash as a multi-protocol proxy hub provides these advantages:

- **Unified protocol support** — VMess, Shadowsocks, Snell, SOCKS5, and ShadowsocksR in one configuration
- **Platform-native front-ends** — ClashDotNetFramework for Windows, ClashX/ClashX Pro for macOS
- **Flexible deployment modes** — Personal system proxy or LAN-wide gateway with Enhanced Mode
- **Rule-based routing** — Automatic traffic splitting by destination (GEOIP, domain, IP CIDR)
- **Subscription automation** — Remote config polling keeps node lists current without manual editing

The architecture separates concerns cleanly: the core engine manages connections and rules, while platform UIs handle OS integration and visualization.

## Frequently Asked Questions

### Does Clash support VLESS protocol?

No. According to the `fanqiang` repository documentation, Clash misidentifies VLESS nodes as VMess, causing connection timeouts【1†L8-L9】. Use VMess, Shadowsocks, or other supported protocols instead.

### Where is the configuration file stored on macOS?

The active configuration is at `~/.config/clash/config.yml`. However, the documentation warns against manually editing the port number—changes here will break connectivity【2†L75-L76】. Use the ClashX UI for modifications.

### Can I run Clash on a headless server without GUI?

The `fanqiang` repository focuses on GUI front-ends, but the underlying `clash` binary (included in distributions) runs standalone with [`config.yml`](https://github.com/bannedbook/fanqiang/blob/main/config.yml). Extract the core binary from any release and run `./clash -d /path/to/config/dir` for server deployments.

### Why does Enhanced Mode require ClashX Pro specifically?

Enhanced Mode modifies system-level packet routing to capture traffic from other devices. This requires kernel-level network extensions that Apple restricts to signed, notarized applications. ClashX Pro includes these entitlements; the free ClashX does not【3†L46-L53】.