Clash X Tutorial

How It Works

ClashX is a rule-based proxy client. Unlike traditional VPNs (global encrypted tunnels), ClashX operates at the application layer (System Proxy) or network layer (TUN Mode), using preset rule lists to determine where each network request should go.

Configuration File (YAML)

The core of ClashX is the config.yaml file. This file defines three main parts:

• Proxies: Defines proxy server information (IP, port, encryption method).
• Proxy Groups: Groups nodes together, e.g., "Auto Select", "Manual Select", "Apple Services", etc.
• Rules: Defines traffic matching logic, e.g., DOMAIN-SUFFIX,google.com,Proxy.

Download App

Visit the download page, select the version for your system and download.

Install App

1. Double-click the downloaded .dmg file
2. Drag the Clash X icon to the "Applications" folder
3. Find Clash X in the "Applications" folder and double-click to open

Grant Permissions (Visual Guide)

ClashX is not Apple-signed, so macOS will show a security warning on first launch. This is standard behavior for all unsigned macOS apps — it does not mean ClashX is unsafe. Follow these steps:

① Double-click to open — Security alert appears

This dialog appears for all unsigned apps — it's a normal macOS response.

👉 Click "Done" (do NOT click "Move to Trash")

② System Settings → Privacy & Security

Open System Settings → Privacy & Security, scroll down to find "ClashX was blocked to protect your Mac".

👉 Click "Open Anyway"

③ Confirm opening

Final macOS confirmation. After this, ClashX will open without warnings.

👉 Click "Open Anyway"

④ Install helper tool

ClashX needs a helper tool to configure the system proxy. Without it, system proxy won't work.

👉 Click "Install", then enter your Mac password

sudo xattr -rd com.apple.quarantine /Applications/ClashX.app

Launch Clash X

After opening the app, you will see the Clash X icon (a cat icon) in the menu bar. Click the icon to see the main menu.

Initial Setup

1. Click the menu bar icon
2. Select "Config" → "Open Config Folder"
3. Place your configuration file (.yaml) in this folder
4. Return to the menu and select your config file under "Config"

Add Subscription Link

Subscription links are the most convenient configuration method and can automatically update node information.

Update Subscription

Subscription links can be updated regularly to get the latest node information:

Switch Proxy Mode

Click the Clash X icon in the menu bar and select the desired mode under "Outbound Mode".

Rule Explanation

Rules are used to determine which traffic should go through proxy and which should go direct. Common rule types:

Custom Rules

Edit the configuration file and add custom rules in the rules section:

rules:
  - DOMAIN-SUFFIX,google.com,Proxy
  - DOMAIN-KEYWORD,youtube,Proxy
  - GEOIP,CN,DIRECT
  - MATCH,Proxy

Local Encryption

As a local proxy client, ClashX performs all rule matching and routing decisions locally on your Mac. Your raw traffic data is not uploaded to any third-party servers (except the proxy servers you configure).

DNS Leak Protection

To prevent DNS pollution and privacy leaks, it is recommended to enable DNS encryption (DoH or DoT) in your configuration file. ClashX supports taking over system DNS requests to ensure your domain resolution process is also encrypted.