Clash Setup Guide for Every Platform

01 / PREPARATION

Before You Start: Clients, Subscriptions, and Connection Methods

Know the Difference Between the UI, Core, and Service

In the Clash ecosystem, GUI clients manage configuration lists, proxy group selection, and system integration. The core parses configuration, matches rules, and establishes connections. mihomo is a widely used core, but client features and configuration options vary. Installing a client does not create usable nodes or provide a proxy service. Before you begin, get a subscription URL from your provider or a complete configuration with valid nodes, proxy groups, and rules. Check your account status and device limits, too.

For desktop and Android, start with Clash Plus from the downloads page. If you already have a stable workflow, compare Clash Verge Rev, FlClash, and other clients based on your platform needs. On Linux, choose Clash Verge Rev or FlClash for a GUI. Whether a configuration works across clients depends on its format, protocol support, and the core in use—not just similar product names. Archived clients are best kept for existing setups, not used as the default for new devices. See the Client Comparison Guide for details.

Check Your Architecture and Subscription Contents

Check your device's processor architecture before downloading. Desktop systems commonly use x64 or ARM64; macOS downloads are divided between Intel and Apple Silicon. Whether an installer runs depends on the operating system, architecture, and minimum system requirements—not on subscription validity. If an app will not launch, changing subscriptions repeatedly will not help. Do not confuse mobile app packages with desktop installers. Match your device details to the platform and system requirements on the downloads page.

A subscription URL often acts as an access credential. Keep the full query string when pasting it, but remove leading or trailing spaces and punctuation added by chat apps. First check whether your provider gave you a Clash YAML subscription, a single-node link, or a management page for browser sign-in. A complete YAML configuration usually includes nodes or a proxy provider, proxy groups, and rules. A string of encoded text may not be accepted by the import option you are using. If conversion is needed, prefer an adapter URL from your provider. See Subscription Formats and Conversion for details.

Start with a Minimal Setup You Can Roll Back

For your first setup, use one proxy client and one connection method. Start in rule mode with one manually selected proxy group and a node you've confirmed works. Verify that you can load a webpage, then add TUN, overrides, rule providers, or custom DNS one at a time. You do not have to enable both system proxy and TUN; combining them can make troubleshooting harder. Phones typically use the platform VPN service to create a tunnel, so their controls may not match desktop settings.

These snippets illustrate common fields. They contain no remote nodes and are not a substitute for your provider's subscription. A mixed port accepts both HTTP and SOCKS requests; listening only on the loopback address prevents access from other devices. The example port is not a universal default—check your current client settings. GUI clients may generate these fields automatically, and manual edits to generated files may be overwritten the next time you save.

mixed-port: 7890
allow-lan: false
bind-address: 127.0.0.1
mode: rule
log-level: info
ipv6: false

Before connecting, note your current system proxy, DNS, and VPN settings, and keep a copy of a configuration that starts successfully. Test three things separately: whether a node test succeeds, whether a request matches a proxy rule, and whether the target webpage loads. Each checks a different part of the connection. After basic connectivity works, test the apps you actually use. A single latency result in the dashboard does not prove that your whole network is working.

02 / WINDOWS

Windows: Installation, System Proxy, and Service Permissions

Choose an Installer and Launch the Client

Open the Windows downloads page. Clash Plus is the recommended starting point; you can also choose Clash Verge Rev, FlClash, or Clash Nyanpasu based on your existing setup. Clash for Windows is archived and no longer maintained. In Settings, go to System > About to check your system type, then select the matching download. Do not infer your architecture from the processor brand in your device name. If the installer will not run, check the system requirements and package type first.

Run the installer and launch the app as a standard user, then follow the prompts to choose an installation location. If you need a system service or virtual network adapter, install it from the client settings and review the permission prompt. You do not need to run the entire app as an administrator just to open its dashboard. If security software blocks the first launch, check what was blocked and where the file came from instead of disabling system-wide protection.

Import a Subscription and Activate Its Configuration

In the Configuration, Subscription, or similar section, add a remote configuration, enter the full URL, and download it. Once it appears in the list, select or activate it; a completed download does not mean the core has switched to it. Open the proxy page and check that proxy groups appear and contain nodes. If the only option is Direct, check the subscription contents and import type, then look for unsupported protocols or fields in the core logs. Do not change system routes right away.

Manually select a proxy group for the service you want to access. A configuration may have separate groups for general proxy traffic, streaming, downloads, or other uses. Changing one group does not automatically change the others. After selecting a node, switch to rule mode and check a real request in the connection log to confirm the matched rule and final outbound. Latency tests can help identify failed connections, but they do not measure webpage throughput or app compatibility. See Node Latency, Multipliers, and Regions for tips on choosing a node.

Test the System Proxy Before Trying TUN

After enabling the system proxy, check Windows proxy settings to confirm that the local address and port match the client. If your environment uses an automatic configuration script, check its URL too; these are separate connection methods. Browsers often use system settings, but terminals, developer tools, and apps with their own networking stacks may not. If one app still connects directly, check its proxy options before switching all rules to global mode.

In PowerShell, you can make a request through an explicit proxy to rule out system settings as a factor. The command below only works if the client is listening on the same port. It tests the local HTTP proxy and the connection beyond it; it does not prove that all apps are using the proxy. If the explicit proxy works but the browser does not, check browser extensions, custom proxy settings, and cache. If the local port cannot be reached, check whether the core is running, the listening address, and port conflicts.

curl.exe --proxy http://127.0.0.1:7890 -I https://example.com
Get-NetTCPConnection -State Listen -LocalPort 7890

Enable TUN only if you need to capture traffic from apps that ignore the system proxy. The client may require a service installation, service mode, or administrator permission; follow its prompts. After enabling TUN, check for a virtual network adapter, a successful device creation message in the core logs, and installed routes. VPNs, virtual machines, container networks, and enterprise security software can all affect routing. For a clean test, temporarily disable other nonessential tunnels and repeat the same request.

Recovering from Sleep, Updates, and Unexpected Shutdowns

A lost connection after waking from sleep does not necessarily mean the subscription is invalid. First confirm that the underlying network is back, then refresh the node connection. After switching between Wi-Fi and Ethernet, routes for the old interface may need to be rebuilt. If no webpages load after you exit the client, check whether the system proxy still points to a local port that is no longer listening. Turn off the connection method before quitting normally. After an unexpected shutdown, restore proxy settings first, then troubleshoot the client. Do not try to download a new package while you are still offline.

If a port is in use, check the process ID in the listening-port results to identify the owner, then close the duplicate client or change your port. Update manual app proxy settings, the system proxy, and terminal variables to match; changing just one configuration file can leave some apps using the old port. Back up your subscription source, overrides, and proxy selections before updating the client, then recheck service status. See How to Fix a Local Port Conflict for more troubleshooting commands.

03 / MACOS

macOS: Processor Architecture, Network Services, and Background Components

Choose the Right Installer for Apple Silicon or Intel

Check the chip or processor in About This Mac, then visit the macOS downloads page. Clash Plus is recommended for new setups; Clash Verge Rev and FlClash are also options. ClashX Meta is archived and no longer maintained. Apple Silicon and Intel installers target different architectures. Avoid relying on translation as a workaround for choosing the right build, especially when the client installs background networking components. A working UI does not mean its supporting components are compatible.

For apps distributed as disk images, copy the app to Applications before launching it rather than running it from the mounted image. If macOS shows a security prompt the first time you open it, check the download source, make sure the file finished downloading, and confirm it meets system requirements. Then follow macOS's standard authorization steps. Do not make bulk removal of security attributes part of your routine installation process. Work-managed Macs may also have policies that restrict network tools, so check what is allowed first.

Import a Remote Configuration and Read the Menu Bar Status

Add the subscription URL in configuration management and explicitly activate the entry once it downloads. A menu bar icon usually means only that the app is running; it does not confirm that a subscription is loaded, a node is selected, or the system proxy is enabled. Check the proxy groups for available nodes, then watch a real request on the connections page. If the import succeeds but expected groups are missing, check whether the provider returned an error page, your plan has expired, and whether the import option expects a full configuration or a node list.

Put custom rules you need to keep in a client-supported override or merge option, not directly in the subscription cache. Remote updates often replace cached content, so temporary edits may disappear on the next refresh. Export a copy first, then confirm that rule order and proxy group names match exactly. Names in configuration are case-sensitive. Trailing spaces, full-width punctuation, or renamed groups with outdated references can prevent a rule from using the intended outbound.

Check the System Proxy for the Active Network Service

macOS proxy settings are specific to each network service. Wi-Fi and Ethernet may have different settings, so check the service currently in use after switching interfaces—not just the Wi-Fi network you used before. Enable the client’s system proxy first, then check the proxy address and port in Network settings. If an automatic proxy configuration, browser extension, or another network tool is already in use, decide which component should manage the settings to prevent them from overwriting each other.

The commands below list network services and show the proxy settings for a service. The example uses the common name “Wi-Fi,” but your service may have been renamed; check the list before substituting its name. HTTPS traffic through a local HTTP proxy typically uses CONNECT, so check the secure web proxy setting as well. Seeing the web proxy enabled does not confirm that HTTPS apps use the same settings.

networksetup -listallnetworkservices
networksetup -getwebproxy "Wi-Fi"
networksetup -getsecurewebproxy "Wi-Fi"
curl --proxy http://127.0.0.1:7890 -I https://example.com

TUN Permissions and Development Environments

Test the system proxy path before enabling TUN, then install the helper component or authorize network access as prompted by the client. Implementations may use a privileged helper, a system extension, or another connection method, so the authorization flow can differ. Check the relevant approval status in System Settings, then enable the tunnel again. If logs show device creation or permission errors, fix the component status instead of switching nodes to mask a local permissions issue.

Terminal apps do not always use the system proxy configured by a GUI. For a temporary test, specify a proxy in the command. If you use environment variables, set them only for the sessions or tools that need them, and account for case sensitivity and differences in tool support. Docker, virtual machines, and remote development environments have their own network contexts; loopback inside them does not point to the host. If a container cannot reach a local proxy, first identify which machine it needs to reach, then decide whether a restricted LAN listener is necessary.

Waking from sleep, changes in network service order, and a corporate VPN can all disrupt connections. Compare a direct request with one through an explicit proxy to the same URL, then check routes and DNS. If a LAN printer, file share, or development domain stops working, check local name resolution and direct-connection rules rather than routing every private address through a remote server. Before uninstalling the client, turn off the system proxy and tunnel, then remove helper services using the client’s own controls. Deleting the app alone may leave components running.

04 / ANDROID

Android: App Installation, VPN Permissions, and Background Activity

Choose a Compatible Package and Keep a Migration Path

Open the Android downloads page. Options include Clash Plus, Clash Meta for Android, FlClash, and Surfboard; Clash Plus is recommended for first-time users. Compatibility depends on your device architecture and minimum Android version, not just the phone brand. Most newer devices use ARM64, but check the actual specs on older devices and custom Android builds. If the installer reports that the package is incompatible, check the architecture and system requirements before trying another client.

When you open a downloaded file in the system file manager, Android may ask you to allow app installs from that source. Grant permission only to the browser or file manager you are using, and restore the previous setting after installation. An update that will not install may also be caused by a different signing key, an app from another distribution channel, or a downgrade restriction. Export your configuration and overrides before uninstalling, and confirm that the subscription can be downloaded again. Uninstalling the app can also remove local proxy selections and runtime settings.

Tell Subscription Updates Apart from the Active Configuration

Add a URL subscription on the configuration page, download it, and switch to that configuration. After it succeeds, open the proxy page and confirm that the target group contains nodes, then select one to test. If you use a browser shortcut to import, return to the client and check the URL, configuration name, and active status. Several installed apps may handle the same type of link. If a shortcut opens another client, it will not update the instance currently running.

Configuration options differ between apps such as Clash Meta for Android, and Surfboard's supported syntax is not interchangeable with Clash YAML. If your provider offers multiple subscription types, choose the one for your client. After an import error, read the format or protocol message instead of adding the same URL repeatedly. A node-only list also needs the client to supply rules and proxy group logic; a list of nodes alone is not a complete routing policy.

Approve the VPN Connection and Check What It Captures

When you tap Connect or Start, Android usually shows a VPN connection prompt. Approve it, then check that the client reports the service is running and that Android shows a VPN connection. In a typical personal setup, only one VPN service can occupy this slot at a time. Ad blockers, firewalls, work network tools, and other proxy apps may compete for it. If the connection drops immediately after starting, check for another active VPN before changing remote node settings.

Using Android's VPN connection does not require a separate toggle named TUN. Many mobile clients route traffic to the core through the platform VPN API, with the app managing the network stack, DNS, and per-app routing. If the UI offers a system or userspace stack, start with the default and compare alternatives only if you encounter a specific compatibility issue. Desktop fields such as auto-route may not be used by mobile clients. Copying them wholesale may cause them to be ignored or conflict with generated settings.

With “Proxy only selected apps,” newly installed apps may not be added automatically. In exclusion mode, excluded apps bypass the tunnel. First check whether you are using an allowlist or a blocklist, then confirm that the target app is on the right side. If a browser works but other apps do not, test app routing, Private DNS, in-app proxy settings, and UDP requirements separately. Do not assume every difference means the subscription has failed.

Manage Battery Restrictions and Network Changes

If the connection drops after the screen locks, first check whether battery settings restrict background activity, whether required auto-start is allowed, and whether the foreground service notification remains visible. Settings vary widely by manufacturer, and locking an app in the recent apps screen is not the same as granting full background access. Adjust the current client's battery settings first, then check the logs after locking and waking the screen. If the client keeps reconnecting without exiting, check mobile network changes, node reachability, and tunnel recovery.

Switching from Wi-Fi to mobile data changes your public egress and underlying connection, so existing long-lived connections may need to be re-established. Wait for the network to stabilize, reconnect, and test the same destination. If a public Wi-Fi network uses a captive portal, sign in before enabling the proxy. If Always-on VPN or Block connections without VPN is enabled, stopping the client may block network access altogether. Note these system settings before troubleshooting so you do not mistake an expected block for a client crash.

05 / IOS

iOS: App Store Installation, Subscription Compatibility, and Tunnels

Install Clash Plus from the App Store

On iPhone or iPad, open the iOS downloads page to find Clash Plus in the App Store, or go straight to the Clash Plus App Store page. The app’s website is clashplus.io. Review the device and system requirements listed in the store before installing, then open the app. iOS manages network access through platform APIs; desktop installation services, menu bar apps, and system proxy menus do not apply in the same way.

Before using the app for the first time, make sure the device can access the internet and complete any captive portal sign-in on the current Wi-Fi network. Subscription downloads usually happen before the tunnel is established, so an offline connection can look like an import timeout. Work-managed devices may also have restrictions on network extensions, profiles, or access. If iOS does not allow a VPN configuration to be added, check the device management policy instead of changing node protocols in the subscription.

Import the Full URL and Check Configuration Compatibility

Add a remote URL in the app’s configuration or subscription manager, preserving all parameters, then fetch it. If the page offers a quick import option, return to the app and check that the new entry appears and is set as the active configuration. A subscription may offer formats for different clients; use the one your provider explicitly marks as compatible. A YAML file opening in a text editor does not mean every field is supported on mobile. A valid file format and supported features are not the same thing.

If fetching fails, first distinguish a network request error from a parsing error. For a timeout, check your connection, the subscription domain, and your provider's service status. For a parsing error, check whether the response is a sign-in page, error message, or unsupported configuration. If the URL contains access credentials, do not paste it into an unfamiliar online tool. Before converting a subscription, read your provider's instructions and confirm that proxy groups, rules, and protocol settings are preserved across formats.

After activating the configuration, open the proxy selection page and check whether the target group has usable nodes. Select one manually, start the connection, and open a specific webpage to test it. Automatic test groups may need to run a health check before results appear. If the group is empty or tests fail, check its members and test conditions first. Do not rule out the entire service because one test URL failed, or assume every business group is configured correctly just because one node connects.

Approve the Tunnel and Verify the Actual Route

The first time you connect, follow the system prompt to allow the app to add a VPN configuration and complete any required authentication. Return to the app to check its connection status, and check the active VPN in system settings if needed. A VPN icon in the status bar only means the tunnel is active; it does not mean every request goes through a remote proxy. In rule mode, some destinations may still use a Direct policy. Check the app's connection log to see the actual outbound route.

If you have another VPN or network filtering app installed, first confirm which configuration is active. With on-demand connections, a network change may trigger an automatic reconnect; disconnecting manually and seeing it reconnect later does not necessarily mean the button failed. Temporarily turn off the current app's on-demand rules, then test the connection on a stable network. Restore automatic behavior after confirming the basic connection works. Do not change nodes, rules, and on-demand conditions all at once, or it will be hard to identify what affected the result.

DNS, LAN Services, and Wi-Fi Proxy Settings

The HTTP proxy in Wi-Fi settings and the VPN tunnel created by an app are separate connection methods. The Wi-Fi proxy affects traffic on that network that uses the setting; the VPN tunnel is managed jointly by the app and the operating system. Remove any obsolete manual Wi-Fi proxy first to avoid sending traffic to an old local or LAN address. A loopback address on your phone points to the phone itself, not a proxy on your computer. To connect across devices, use the computer's actual LAN address and an explicitly enabled listening port.

LAN discovery, screen casting, and control of local devices depend on both routing and name resolution. If public webpages work but local devices are unreachable, check whether local addresses are being proxied by mistake, whether local domain names are using an unsuitable DNS path, and whether the app has permission to access the local network. Before changing system privacy or network options, note the original settings and test one change at a time. Do not permanently disable all protections to fix one compatibility issue.

iOS manages background processes and tunnel resources. Whether scheduled subscription updates run as expected depends on the app and system scheduling. If you have not opened the app in a while, update the configuration manually and check the result before testing the connection. After switching Wi-Fi networks or returning from mobile data to Wi-Fi, verify the underlying network and subscription status before rebuilding the tunnel. Keep a known-working configuration, but do not treat an expired subscription as a permanent offline backup; nodes and access permissions can change.

06 / LINUX

Linux: GUI Clients and systemd Service Deployment

Use a GUI Client on Desktop Linux

If you have a desktop environment, open the Linux downloads page and choose the recommended Clash Verge Rev or FlClash package for your distribution. Run uname -m to check your architecture, then confirm the package type on the downloads page. If a package is unavailable or dependencies are missing, check the distribution version and supported package formats instead of renaming a binary for another platform. Once the GUI launches, set up your subscription and network connection.

In the desktop client, add and activate a remote configuration, select a node manually, then enable the system proxy supported by your desktop environment. GNOME, KDE, and terminal tools do not all use system proxy settings in the same way, and a GUI toggle will not cover every program. Test the local port with an explicit proxy request, then configure developer tools as needed. TUN also requires device permissions and routing capabilities; follow the client's service installation steps. Do not start a second standalone core that competes for the same port.

Run mihomo as a Standalone Server Core

Without a desktop environment, download and extract the mihomo core that matches your processor architecture. The commands below assume the current directory contains the extracted binary named mihomo and a complete configuration named config.yaml. The configuration must already include valid nodes or a provider; the snippets on this page are not a complete service configuration. Configuration files may contain subscription credentials, so restrict directory and file permissions and keep them out of public web directories.

sudo install -m 0755 ./mihomo /usr/local/bin/mihomo
sudo install -d -m 0700 /etc/mihomo
sudo install -m 0600 ./config.yaml /etc/mihomo/config.yaml
sudo /usr/local/bin/mihomo -t -d /etc/mihomo -f /etc/mihomo/config.yaml

Test the configuration first. Resolve syntax errors, invalid proxy group references, and missing resource files before starting a persistent service. If the configuration depends on external rules, geodata, or providers, confirm that the service user can access the required directories and fetch resources when needed. A failed first connection may be caused by missing local resources, not a bad node. If downloading resources requires a proxy, prepare them in advance or set up a clear bootstrap route to avoid a startup dependency loop.

Manage Startup and Logs with systemd

Create /etc/systemd/system/mihomo.service. The example below is for a local deployment that needs TUN management privileges and runs as root when no user is specified. If you only need a local proxy, consider using a dedicated unprivileged user. Creating a virtual network adapter, changing routes, or binding restricted resources requires additional capabilities. Do not copy a set of hardening options without understanding the required permissions, or the service may appear to start but fail to create a network device.

[Unit]
Description=mihomo local proxy service
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
ExecStart=/usr/local/bin/mihomo -d /etc/mihomo -f /etc/mihomo/config.yaml
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now mihomo
sudo systemctl status mihomo --no-pager
sudo journalctl -u mihomo -n 80 --no-pager

After the service starts, use ss -lntp to check the actual listening ports, then test outbound access through the local proxy. If you enable the control interface, bind it to the loopback address and set credentials; use a restricted tunnel for remote administration. Exposing the control interface and exposing a proxy port pose different risks, and neither should be opened directly to the public internet. A server's loopback address is not directly accessible from a remote computer, so make sure the browser dashboard connects to the right host.

TUN and Safe Rollback During Maintenance

Linux TUN requires access to the kernel device and network management permissions. Running in a container also requires device mapping and the right capabilities; an ordinary container process usually cannot change host routes. Merge the snippet below into a tested mihomo configuration, and use it only if the current core supports the relevant fields. auto-detect-interface can help identify the outbound interface, but you still need to check the results on systems with multiple network adapters or policy routing.

tun:
  enable: true
  stack: mixed
  auto-route: true
  auto-detect-interface: true
  dns-hijack:
    - any:53

Before enabling automatic routes on a remote server, keep a second management session open and have a console rollback option ready. Confirm that management traffic will not be captured by mistake. After verifying the network, configure startup behavior and test configuration changes before restarting. The command-line core does not automatically provide all the scheduled subscription update features found in GUI clients. Update scripts should download to a temporary file, test the configuration, and replace the active file only after success. See Linux Desktop and systemd Deployment for more on deployment and service maintenance.

07 / DIAGNOSTICS

Configuration FAQ: Ports, Rules, DNS, and Recovery

Troubleshoot One Step at a Time—Don't Change Everything at Once

Follow the same troubleshooting order: underlying network, configuration loading, local listener, connection method, rule matching, then remote connection. First confirm that the device can open a regular webpage with the proxy off. Then check that the core starts without errors and use an explicit proxy request to test the listening port. This separates local issues from remote ones. Only test the next step after the previous one passes under the same conditions; changing DNS, nodes, and mode at once makes results impossible to reproduce.

Keep logs at the info level and note the time, destination, and error type for failed requests. Increase verbosity only for short debugging sessions, then restore it to avoid recording unnecessary traffic. Connection refused often means nothing is listening on the target port. A timeout may involve the network, firewall, or remote service. Configuration parsing errors happen before outbound connections. Error messages can narrow down the cause, but they do not prove who is responsible. Compare requests under the same conditions to confirm.

Rule Order and Persistent Overrides

Rules are generally matched from top to bottom; the first match determines the policy. Put specific domain rules before broad rules and fallback rules at the end. The example below assumes your configuration has a proxy group named PROXY; replace it to match your actual group name. Copying a rule that references a nonexistent group can cause a load error or make the rule ineffective. After updating rules, verify them in the connection log rather than relying on a successful save in the editor.

rules:
  - DOMAIN-SUFFIX,github.com,PROXY
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - MATCH,PROXY

Updating a proxy provider is not the same as replacing a complete subscription. The former may update only node resources; the latter may replace rules and proxy groups as well. Preserve custom content using an override feature explicitly supported by the client, and check whether merging happens before or after configuration generation. If a group name changes, a saved selection may no longer match the new group. If some apps stop working after an update, check the active configuration and each relevant group again.

How DNS and TUN Work Together

TUN captures IP packets, while domain-based rules need reliable domain information. DNS hijacking, the core's DNS, Fake-IP, and other mapping methods all affect how domains are associated with connections. Enabling a virtual network adapter alone does not ensure that every app's DNS requests go to the core. App-level encrypted DNS, system Private DNS, and cached results can change the resolution path. Compare the resolution and connection logs for the same domain, and clear the app's cache before testing again if its documentation recommends it.

Before checking for a DNS leak, define which resolver should handle which domains. Local DNS for direct-connection domains may be intentional; seeing your local ISP on a test page does not necessarily mean the entire configuration is wrong. Conversely, a proxy destination that bypasses its intended resolution path can cause privacy or compatibility issues. Do not force every scenario to use a single public DNS address: enterprise domains, LAN names, and remote services may need different paths. See TUN, Routing, and DNS Interception for background.

Common Checks and Recovery Steps

After fixing the issue, keep the smallest working configuration and record your changes and test results. Restore automatic updates, on-demand connections, and extra rules one at a time. To revisit the connection setup, return to the Quick Start Guide. Before switching clients, see the Client Comparison Guide. The goal is to make configuration ownership and connection boundaries clear—not to have multiple clients manage the same system network settings.