Using Clash as a Multi-Protocol Proxy Hub: A Complete Setup Guide

Clash acts as a centralized proxy engine that unifies VMess, Shadowsocks, Snell, SOCKS5, and ShadowsocksR protocols behind a single rule-based routing interface, with platform-specific GUIs for Windows and macOS. This guide explains how to deploy Clash as a multi-protocol proxy hub using the tools maintained in the bannedbook/fanqiang repository.

The fanqiang repository distributes Clash-based solutions that abstract protocol complexity into user-friendly applications. Whether you need personal proxy access or a LAN-wide gateway, Clash's modular architecture—separating the core engine from platform front-ends—provides a consistent experience across operating systems.

Clash Architecture: How the Components Work Together

Clash's design separates proxy logic from user interface concerns. Understanding this separation helps troubleshoot issues and optimize your deployment.

The Core Engine

The Clash Core handles connection management and rule evaluation. According to the fanqiang source documentation, it natively supports:

• VMess (V2Ray protocol)
• Shadowsocks (multiple cipher suites)
• Snell (Surge proprietary protocol)
• SOCKS5 (generic proxy)
• ShadowsocksR (legacy Shadowsocks variant)

Important limitation: The core does not support VLESS. Nodes advertised as VLESS will be misidentified as VMess and will time out【1†L8-L9】.

Platform Front-Ends

Platform	Application	Technology	Key Feature
Windows	ClashDotNetFramework	.NET 5 WPF GUI	Integrated subscription management, one-click system proxy
macOS	ClashX	Native Cocoa app	Menu bar control, keyboard shortcuts, Apple Silicon support
macOS (Pro)	ClashX Pro	Enhanced ClashX	LAN gateway mode, traffic statistics, rule profiling

The Windows front-end (ClashDotNetFramework) is built on .NET 5 and distributed as a portable archive with required DLLs【1†L5-L7】. ClashX for macOS provides native integration with system network preferences, including automatic proxy configuration【2†L5-L8】.

Installing Clash on Windows and macOS

Windows Setup (ClashDotNetFramework)

Download and extract the release archive, then install the .NET 5 runtime if not present:

# The repository provides a packaged distribution at:

# https://github.com/bannedbook/fanqiang/blob/master/windows/ClashDotNetFramework.md

# Typical extraction yields:

Clash.DotNet/
├── ClashDotNetFramework.exe   # Main executable

├── clash-win64.exe            # Core engine binary

├── config.yaml                # Default configuration stub

└── locales/                   # UI translations

Launch ClashDotNetFramework.exe. The GUI automatically creates its configuration directory on first run【1†L25-L35】.

macOS Setup (ClashX)

Download the .dmg from the releases page, drag to Applications, and grant network permission when prompted. The first launch creates ~/.config/clash/ with this structure:

~/.config/clash/
├── config.yml          # Active configuration (auto-managed)

├── Country.mmdb        # GeoIP database for rule matching

└── cache.db            # Subscription cache

Critical warning from the source: Do not manually edit the port number in config.yml【2†L75-L76】. The UI manages this value; manual changes cause connection failures.

Configuring Multi-Protocol Proxy Access

Adding a Subscription URL

Clash consumes Clash-compatible subscription links—typically provided by V2Ray service providers ("airports"). The subscription contains base64-encoded YAML with node definitions.

Windows workflow:

1. Obtain subscription URL from your provider
2. In ClashDotNetFramework: Config → Remote → Paste URL → Download
3. Select the imported profile from the dropdown【1†L55-L63】

macOS workflow:

1. Copy subscription URL to clipboard
2. ClashX menu → Config → Remote Config → Manage → Add
3. Click the new config to activate【2†L54-L60】

Both platforms convert the remote YAML into the local config.yml format automatically.

Understanding the Configuration Format

Here's a minimal config.yml structure that Clash generates and reads:

# ~/.config/clash/config.yml (macOS path; Windows uses internal storage)

mixed-port: 7890           # HTTP+SOCKS5 combined listener

allow-lan: false           # Set true for gateway mode

mode: rule                 # rule/direct/global

log-level: info
external-controller: 127.0.0.1:9090  # REST API for external UIs

proxies:
  - name: "vmess-node-1"
    type: vmess
    server: example.com
    port: 443
    uuid: a-b-c-d
    alterId: 0
    cipher: auto
    tls: true
  - name: "ss-node-2"
    type: ss
    server: backup.example.com
    port: 8388
    cipher: aes-256-gcm
    password: "secret"

proxy-groups:
  - name: "Auto"
    type: url-test
    proxies:
      - vmess-node-1
      - ss-node-2
    url: http://www.gstatic.com/generate_204
    interval: 300

rules:
  - DOMAIN-SUFFIX,company.com,DIRECT
  - GEOIP,CN,DIRECT
  - MATCH,Auto

The proxies section populates automatically from subscriptions. Manual editing is only needed for advanced customization.

Enabling System-Wide Proxy Routing

Basic System Proxy Mode

Both front-ends register Clash as the system HTTP/HTTPS proxy, diverting all application traffic through the selected node.

Windows activation:

Settings → Display → Language → System Proxy → Enable

Alternatively, click the system tray icon and toggle "Set as system proxy"【1†L71-L73】.

macOS activation:

ClashX menu → Settings → System Proxy → Enable

Verify in System Preferences → Network → Advanced → Proxies that HTTP and HTTPS proxy are set to 127.0.0.1:7890【2†L63-L64】.

Selecting Proxy Nodes and Modes

After enabling system proxy, choose your traffic routing strategy:

Mode	Behavior	Use Case
Rule	Routes per domain/IP rules (GEOIP, DOMAIN-SUFFIX)	General browsing, bypasses Chinese sites
Global	All traffic through selected proxy	Testing, guaranteed tunneling
Direct	No proxy, direct connection	Troubleshooting, maximum speed

Select individual nodes or "Auto" (url-test) in the Proxy menu. The url-test group automatically selects the lowest-latency node every 5 minutes.

Advanced: Using Clash as a LAN Gateway

ClashX Pro on macOS supports Enhanced Mode to function as a transparent gateway for other devices—effectively turning your Mac into a routing appliance.

Gateway Mode Prerequisites

• Static IP assignment on the Mac (e.g., 192.168.88.2/24)
• Router with configurable DHCP gateway option
• ClashX Pro (paid version with Enhanced Mode)

Configuration Steps

1. Assign static IP on Mac:

   
   System Preferences → Network → Advanced → TCP/IP
   Configure IPv4: Manually
   IP: 192.168.88.2
   Subnet Mask: 255.255.255.0
   Router: [your router's IP, e.g., 192.168.88.1]
   

2. Configure router DHCP:

   • Default gateway: 192.168.88.2 (the Mac's IP)
   • DNS servers: 192.168.88.2 or external (1.1.1.1, 8.8.8.8)

3. Enable Enhanced Mode in ClashX Pro:

   
   ClashX menu → Enhanced Mode → Enable
   Ensure "Set as system proxy" remains checked
   Select desired proxy node in Proxy menu
   

4. Reboot router to push new DHCP settings to LAN clients【3†L71-L77】

After reboot, any device obtaining IP via DHCP will route through the Mac. The ClashX Pro instance handles protocol selection and rule evaluation transparently—no client-side proxy configuration required【3†L46-L53】.

Key Repository Files for Reference

File	Purpose	Direct Link
windows/ClashDotNetFramework.md	Windows installation, subscription import, troubleshooting	View
macos/ClashX.md	macOS setup, configuration paths, system proxy activation	View
game/Mac电脑使用ClashX Pro作为网关旁路由给其它设备翻墙.md	Complete LAN gateway tutorial with DHCP configuration	View

These documentation files in the bannedbook/fanqiang repository are actively maintained and reflect tested configurations for production use.

Summary

Using Clash as a multi-protocol proxy hub provides these advantages:

• Unified protocol support — VMess, Shadowsocks, Snell, SOCKS5, and ShadowsocksR in one configuration
• Platform-native front-ends — ClashDotNetFramework for Windows, ClashX/ClashX Pro for macOS
• Flexible deployment modes — Personal system proxy or LAN-wide gateway with Enhanced Mode
• Rule-based routing — Automatic traffic splitting by destination (GEOIP, domain, IP CIDR)
• Subscription automation — Remote config polling keeps node lists current without manual editing

The architecture separates concerns cleanly: the core engine manages connections and rules, while platform UIs handle OS integration and visualization.

Frequently Asked Questions

Does Clash support VLESS protocol?

No. According to the fanqiang repository documentation, Clash misidentifies VLESS nodes as VMess, causing connection timeouts【1†L8-L9】. Use VMess, Shadowsocks, or other supported protocols instead.

Where is the configuration file stored on macOS?

The active configuration is at ~/.config/clash/config.yml. However, the documentation warns against manually editing the port number—changes here will break connectivity【2†L75-L76】. Use the ClashX UI for modifications.

Can I run Clash on a headless server without GUI?

The fanqiang repository focuses on GUI front-ends, but the underlying clash binary (included in distributions) runs standalone with config.yml. Extract the core binary from any release and run ./clash -d /path/to/config/dir for server deployments.

Why does Enhanced Mode require ClashX Pro specifically?

Enhanced Mode modifies system-level packet routing to capture traffic from other devices. This requires kernel-level network extensions that Apple restricts to signed, notarized applications. ClashX Pro includes these entitlements; the free ClashX does not【3†L46-L53】.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}