1. What Clash Verge Rev is, and how it relates to Clash, CFW, ClashX and mihomo

Clash Verge Rev is an open-source (GPL-3.0) desktop client built with Rust and Tauri 2. Its README describes it as a Clash Meta GUI and as the continuation of the original Clash Verge. It is only a local client: it starts a proxy core, manages profiles and changes system settings. It does not include proxy servers, and it is not a VPN service.

At the time of verification, the latest stable release is v2.5.8, published on October 9, 2026 on GitHub. Recent stable releases came out on September 22 (v2.5.5), September 26 (v2.5.6) and October 2 (v2.5.7). The project documentation states that the app is distributed only through GitHub Releases; download portals with similar names are not official channels.

The original Clash Verge by zzzgydi is archived on GitHub (last push November 3, 2023) and should not be used for new installations. Clash for Windows (CFW) was discontinued in November 2023, ClashX is a separate macOS family, and mihomo (formerly Clash.Meta) is the open-source core maintained by MetaCubeX. Verge Rev ships mihomo as verge-mihomo and offers an Alpha build of the same core under Settings → Clash Core; the closed-source Clash Premium core used by CFW is not an option.

The README and release notes contain third-party promotional links. They are not part of the software, and this guide does not recommend any proxy or subscription provider.

2. Four layers: inbound, outbound mode, DNS and the privacy boundary

The Verge documentation separates the inbound path (how traffic reaches the local core: System Proxy or TUN) from the outbound mode (where the core sends it: Rule, Global or Direct). DNS is a third, independent layer. Checking one switch tells you nothing about the other layers.

  • To the destination site: fully proxied requests normally show the node’s exit IP instead of your home or office public IP.
  • To the proxy operator: the node receives your connection and can see your original public IP. No client can hide it from the node itself.
  • To your local network or ISP: the proxy server address, timing and traffic volume remain visible; contents depend on the protocol and encryption.
  • To a DNS provider: DoH and DoT encrypt transport, but the resolver still sees the queried names and the IP that connects to it. Encryption is not anonymity.
  • To accounts and browsers: cookies, sign-ins, language, time zone, fingerprints and OS location services can still reveal identity or location.
Application
   │
   │  1. System Proxy: the app voluntarily uses 127.0.0.1:7897
   │  2. TUN: a virtual interface captures TCP/UDP at the routing level
   ▼
mihomo core (verge-mihomo)
   │
   │  3. Rule / Global / Direct: picks the outbound
   │  4. DNS: fake-ip or redir-host, which resolvers, which path
   ▼
DIRECT / proxy node / REJECT
   │
   ▼
Destination

3. Installation per operating system

  • Windows: v2.5.8 ships x64 and ARM64 setup.exe installers, plus fixed_webview2 variants that bundle WebView2 for systems where it is missing or cannot be installed. Most PCs need x64; an “app can’t run on your PC” error usually means the wrong architecture. Windows 7 is no longer supported.
  • Windows package managers: the docs list winget install ClashVergeRev.ClashVergeRev and a community-maintained Scoop package (extras/clash-verge-rev) that the project does not support.
  • SmartScreen: if Windows warns about an installer, confirm that it came from the GitHub release page and that its SHA-256 matches the digest GitHub shows for the asset. Do not disable SmartScreen or Defender globally.
  • macOS: separate DMGs for Apple silicon (aarch64) and Intel (x64). The install page states macOS 12 or later. If Gatekeeper blocks the first launch, verify the source and use System Settings → Privacy & Security to allow that one app rather than disabling Gatekeeper or stripping quarantine attributes from unknown files.
  • Linux: v2.5.8 ships .deb and .rpm packages for x86_64, ARM64 and ARMv7. Install with sudo apt install ./file.deb or sudo dnf install ./file.rpm. Arch users can use the AUR package clash-verge-rev-bin. No AppImage is attached to v2.5.8.
  • Linux requires a graphical session because the UI is a WebView. Headless servers should run the mihomo binary directly instead.
  • The .sig files next to each asset are signatures for the in-app updater. For a manual check, compare the file’s SHA-256 with the digest on the release page.
# Windows (PowerShell)
Get-FileHash .\Clash.Verge_2.5.8_x64-setup.exe -Algorithm SHA256

# macOS
shasum -a 256 Clash.Verge_2.5.8_aarch64.dmg

# Linux
sha256sum Clash.Verge_2.5.8_amd64.deb
sudo apt install ./Clash.Verge_2.5.8_amd64.deb

4. Service mode, Sidecar and what TUN needs

TUN creates a virtual network interface and changes routes, which requires elevated privileges. Service mode installs a separate privileged process (clash-verge-service) that launches the core, so TUN works while the GUI runs as a normal user. The service keeps running in the background after the GUI exits. Without the service, the app runs the core as an unprivileged Sidecar, and TUN is unavailable.

  • Install it from Settings with Install Service and approve the system prompt. The home page should then show service mode before you enable Tun Mode.
  • Since recent releases, the Windows service checks the ownership and permissions of the core files and their parent directories. If ordinary users could replace the core, the check fails and the app falls back to Sidecar. The fix is to reinstall to the default C:\Program Files\Clash Verge directory with default permissions, not to loosen permissions.
  • As an alternative on Windows, the docs allow running the app as administrator without the service; that also enables TUN but must be repeated at every start.
  • Firewalls: the core binaries verge-mihomo and verge-mihomo-alpha may need to be allowed for TUN. mihomo notes that the system and mixed stacks do not work when the firewall blocks the core.
  • macOS: the service is a launchd daemon. The docs also describe install-service and uninstall-service helpers inside the app bundle for manual repair.
  • Linux: the service is installed from the same settings switch; the docs list sudo /bin/install-service and sudo /bin/uninstall-service for manual repair.

5. First run: import a profile you already own

  • Open Profiles and paste the HTTPS subscription URL you already have, or import a local YAML file. You can also drag a file into the window, or use a clash://install-config?url=<URL-encoded link> URL scheme. Local files are copied into the profiles directory.
  • Subscription URLs usually contain an account token. Keep them out of screenshots, issue reports and chat logs.
  • Leave Allows Invalid Certificates (Danger) off. Enabling it removes TLS verification for the download and makes tampering much easier.
  • Select the profile card, open Proxies, choose Rule mode and select a real node in the main group.
  • Turn on System Proxy, then verify in a browser: the request should appear under Connections with the expected rule and chain.
  • Enable Tun Mode only when you need apps that ignore system proxy settings. Auto Launch and Silent Start only control how the app starts; they do not prove that the profile, node or DNS are healthy.
  • Default ports in v2.5.8: mixed 7897, SOCKS 7898, HTTP 7899, external controller 127.0.0.1:9097. Always use the values shown under Port Config.

6. System Proxy vs TUN, and Rule / Global / Direct

System Proxy writes the OS proxy settings; applications that honor them send requests to the local mixed port. It is voluntary, and it does not carry UDP such as game traffic. TUN redirects traffic at the routing layer, so applications need no configuration and both TCP and UDP reach the core. Enabling both does not create double encryption; for diagnosis, prefer one clear capture method.

  • Browsers only: System Proxy plus Rule mode is usually enough and is easier to troubleshoot.
  • Terminals, IDE components, games, UDP apps, WSL or Docker: TUN through service mode, followed by DNS, IPv6 and UDP checks.
  • Proxy Guard re-applies the system proxy if another program changes it; Proxy Bypass Settings lists hosts that skip the proxy. Keep localhost, 127.0.0.1, private ranges and *.local there and do not add public destinations you want proxied.
  • Use PAC Mode is available for PAC-based setups; a PAC file is just another routing decision and should be reviewed like a rule set.
  • Rule matches traffic against the profile’s rules. Global sends everything that reaches the core through the node you pick in GLOBAL. Direct sends everything out of the local network.
  • Global cannot capture applications that never reached the core, and it is only meaningful if GLOBAL points to a real node rather than DIRECT.
  • Tun Mode settings include Tun Stack, Auto Route, Strict Route, Auto Detect Interface, DNS Hijack, Route Exclude Address and MTU. Change one field at a time and retest.

7. Profiles, Extend Config (Merge) and Extend Script

Remote profiles are overwritten on update, so long-term changes belong in extensions. The current order is: original profile → app settings → global extend config → global extend script → profile extend config → profile extend script → app settings reapplied. Right-click a profile card to edit its Extend Config or Extend Script.

Since v2.5.5, the dns fields and top-level hosts written in an extend config replace the existing values as a whole (including nameserver-policy) instead of merging entry by entry. Lists such as rules are also replaced; nested objects such as tun or sniffer are merged per field. Settings owned by the app, such as mixed-port, allow-lan, mode, ipv6, secret, external-controller, tun.enable and fields saved in the Tun Mode dialog, are discarded at the end of the chain if an extension sets them.

  • Replace Proxy with a group name that exists in your profile, spelled exactly.
  • Rules are matched from top to bottom; the first match wins, and MATCH belongs at the end.
  • PROCESS-NAME uses the executable name of the platform, for example git.exe on Windows.
  • Scripts run in an embedded JavaScript engine (boa_engine) without network or file I/O, but they can still rewrite every rule, DNS server and outbound. Only run scripts you understand.
  • Check the result under Settings → Runtime Config, which shows the configuration the core actually loads.
# Extend Config (YAML): merge a small, reviewable change
dns:
  use-system-hosts: false

// Extend Script (JavaScript): prepend two rules safely
function main(config, profileName) {
  const extra = [
    "DOMAIN-SUFFIX,example.com,DIRECT",
    "PROCESS-NAME,git,Proxy"
  ];
  config.rules = extra.concat(config.rules || []);
  return config;
}

8. DNS: fake-ip vs redir-host, nameserver, fallback and DoH

In mihomo, enhanced-mode accepts fake-ip or redir-host, and redir-host is the default. fake-ip returns addresses from a reserved range such as 198.18.0.1/16 and keeps a domain mapping inside the core, so routing can use the domain name without leaking a real lookup to the application. redir-host returns real addresses. Neither mode is encryption.

nameserver is the default resolver list. default-nameserver must be plain IPs and only resolves the hostnames of DNS servers. proxy-server-nameserver resolves proxy-node hostnames and avoids a chicken-and-egg problem. fallback plus fallback-filter selects alternative answers when results look polluted; the geosite filter is deprecated in favour of nameserver-policy. respect-rules makes DNS connections follow routing rules and requires proxy-server-nameserver.

Verge’s DNS Overwrite switch writes a DNS section from the app before extensions run. If a profile already contains a carefully built DNS policy, compare both before turning it on.

  • dns.ipv6: false only suppresses AAAA answers; it does not disable IPv6 on the operating system.
  • mihomo documents that on Windows and macOS dns-hijack cannot capture DNS requests sent to LAN addresses, so do not point the system resolver at your router while relying on TUN.
  • On macOS, Verge sets the system DNS to a placeholder public resolver while TUN is on and restores it afterwards; v2.5.8 fixed a case where 114.114.114.114 remained after TUN was turned off.
  • Intranet names that fail under fake-ip need a nameserver-policy entry for the internal resolver or a targeted fake-ip-filter entry, not a disabled DNS module.
  • A nameserver can carry #GroupName to choose its outbound, for example https://1.1.1.1/dns-query#Proxy, where Proxy is a real group.
# Reference runtime fragment for current mihomo (check under Runtime Config).
# Set tun.* in the Tun Mode dialog; Verge owns those fields.
dns:
  enable: true
  ipv6: false
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  fake-ip-filter:
    - "+.lan"
    - "+.local"
  default-nameserver:
    - 1.1.1.1
  proxy-server-nameserver:
    - https://1.1.1.1/dns-query
  respect-rules: true
  nameserver:
    - https://1.1.1.1/dns-query
    - https://8.8.8.8/dns-query

tun:
  enable: true
  stack: mips          # current mihomo default; system, gvisor, mixed also exist
  auto-route: true
  auto-detect-interface: true
  strict-route: true   # Windows: blocks multi-homed DNS leaks; may break VirtualBox
  dns-hijack:
    - any:53
    - tcp://any:53

9. IPv6, WebRTC, QUIC, browser DoH and how to check for leaks

  • IPv6: Verge’s IPv6 switch controls whether the core accepts IPv6 traffic. If the physical network has public IPv6 and the tunnel does not carry it, IPv6 sites may still see the original address. Either route IPv6 deliberately or restrict it, then retest both families.
  • WebRTC: STUN can expose additional addresses outside a normal application proxy (RFC 8828). Chromium-based browsers can restrict this with a non-proxied UDP policy, which may affect calls.
  • QUIC/HTTP3 uses UDP. With System Proxy only, browsers usually fall back to TCP; with TUN, the node must actually support UDP. Verify rather than assume.
  • Browser DoH: a browser’s own secure DNS bypasses the core’s resolver and fake-ip. Consider disabling it only after TUN and DNS hijacking are verified.
  • A .local mDNS candidate in a WebRTC test is not a public-IP leak; focus on public IPv4/IPv6 addresses.
  • Check method: (1) open two independent IP-check pages and note the IPv4 and IPv6 results; (2) run a standard and an extended DNS test and look for your ISP, router or another unexpected resolver; (3) run a WebRTC test; (4) confirm the same requests in Connections with the expected rule and chain.
  • Retest after sleep, network changes, profile updates, node changes and app restarts. If apps go direct when Verge is stopped, the setup is not fail-closed; TUN is not a kill switch.

10. Terminals, Git, SSH, browsers, IDEs, Docker and WSL

Command-line tools usually ignore system proxy settings. Choose PowerShell, Bash or CMD under Copy Env Type, then use the tray menu’s copy action to get matching environment variables. The copied host is 127.0.0.1 unless you set the CLASH_VERGE_REV_IP environment variable.

  • Git’s http.proxy does not affect git@ SSH remotes; use TUN or a ProxyCommand.
  • Chrome and Edge follow the system proxy; also check extensions, secure DNS, WebRTC and QUIC. Firefox can use a manual SOCKS v5 proxy with DNS through the proxy.
  • IDEs: the editor, extensions, language servers, package managers and the integrated terminal may each have their own proxy setting.
  • Windows Store (UWP) apps cannot reach localhost by default; use Settings → Open UWP tool for the specific apps that need it.
  • Docker containers and WSL have their own network stacks; 127.0.0.1 inside them is not the host. Prefer TUN, or enable Allow LAN only on a trusted network and only as long as needed.
  • Some macOS apps ignore system proxy settings; configure their in-app proxy or use TUN.
# Bash / zsh (current shell only; use your actual port)
export http_proxy=http://127.0.0.1:7897
export https_proxy=http://127.0.0.1:7897
export all_proxy=socks5://127.0.0.1:7897

# curl with remote name resolution through the proxy
curl --proxy socks5h://127.0.0.1:7897 https://example.com/

# Git over HTTP(S) only; set and remove
git config --global http.proxy http://127.0.0.1:7897
git config --global --unset http.proxy

# SSH via SOCKS for one host (~/.ssh/config, macOS/Linux)
Host example.com
    ProxyCommand nc -X 5 -x 127.0.0.1:7897 %h %p

# PowerShell (current session)
$env:HTTPS_PROXY = "http://127.0.0.1:7897"
Remove-Item Env:HTTPS_PROXY

11. Logs, Connections, Web UI and a troubleshooting checklist

  • Connections shows the process, destination, network type, matching rule and chain. A chain ending in DIRECT did not use a node. No entry at all means the app never reached the core.
  • Logs show profile loading, DNS and TUN errors. Raise Log Level to Debug only while diagnosing, and remove domains, IPs and subscription URLs before sharing. Export Diagnostic Info collects details for bug reports; review it first.
  • Auto Close Connections drops old connections when you switch nodes, so a stale TCP session does not keep using the previous exit.
  • Web UI opens an external dashboard against the External Controller. It needs the controller address and Core Secret.
  • No network unless Verge runs (Windows): the system proxy may have stayed on after a crash. Turn off the manual proxy under Settings → Network & Internet → Proxy.
  • Network breaks after enabling TUN: check service mode, firewall rules for verge-mihomo, extra virtual adapters or other VPNs, and the TUN stack. Restore a known-good profile before changing many settings.
  • Empty Proxies page: the controller port may be taken by another program; change the External Controller port and restart.
  • Some sites fail after enabling the proxy: check for another program on port 7897 and for unexpected entries in the system hosts file.
  • UI does not open on Windows: WebView2 is missing or disabled; reinstall it or use the fixed_webview2 installer. On Linux with NVIDIA and Wayland, the docs list WEBKIT_DISABLE_DMABUF_RENDERER=1 as a workaround.

12. Security notes and maintenance

  • Only import profiles from sources you trust. A profile decides which traffic goes DIRECT, which DNS servers are used and which nodes see your traffic.
  • Extend Scripts are code. Read any script before enabling it, and keep a copy of what you changed.
  • Change the Core Secret. The v2.5.8 template fills an empty secret with the placeholder set-your-secret, and the default CORS list allows several hosted dashboards to call the controller from a browser.
  • Keep the External Controller on 127.0.0.1. Never expose an unauthenticated controller on 0.0.0.0 or a public interface.
  • Keep Allow LAN off unless another device really needs the proxy, especially on public Wi-Fi.
  • Backup Setting supports local and WebDAV backups. Backups can contain subscription URLs and node credentials, so store them only where that is acceptable.
  • Use the stable channel, update promptly, and check release notes for fixes. AutoBuild builds are for testing, and the Alpha core is a test build.
  • The project’s privacy policy says the app collects no user data and lists the network connections it makes, such as update checks.
  • Follow local law and the terms of the services you use. A proxy client changes network paths; it does not change your obligations.