Clash Meta (Mihomo) YAML Config Guide & Template for macOS

Published on 2026-03-01 · Last updated 2026-11-11

Why You Need a Dedicated Mihomo YAML Template on macOS

Many proxy templates found online were authored years ago for legacy Clash or Clash Premium. If you attempt to use those outdated templates with modern high-speed protocols—such as VLESS, Hysteria 2, TUIC v5, or REALITY—they fail to load or lack optimizations for macOS network interception.

ClashFX runs natively on the mihomo (Clash Meta) core. This production-ready template incorporates:

• Unified Mixed Port: Serves both HTTP and SOCKS5 proxy traffic on port 7890.
• macOS-Optimized Fake-IP DNS: Resolves local application DNS queries instantly, preventing DNS leaks and connection stalls.
• Dynamic Rule-Providers: Modular rule collections that update automatically in the background.
• Smart Failover & Auto-Testing: Latency-tested proxy groups to route around congested nodes.

Production-Ready Clash Meta YAML Template

Copy the complete configuration below. You can paste it directly into a new .yaml file inside ~/.config/clashfx/:

# ==============================================================================
# Clash Meta (Mihomo) Standard Configuration Template for macOS
# Client: ClashFX 1.1.11 | Location: ~/.config/clashfx/config.yaml
# ==============================================================================

# --- General Port & Controller Settings ---
mixed-port: 7890
allow-lan: false
bind-address: "*"
mode: rule
log-level: info
ipv6: false
external-controller: 127.0.0.1:9090
secret: ""

# --- macOS TUN & DNS Engine ---
dns:
  enable: true
  listen: 0.0.0.0:1053
  ipv6: false
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  fake-ip-filter:
    - "*.lan"
    - "*.local"
    - "localhost.ptlogin2.qq.com"
    - "+.msftconnecttest.com"
    - "+.msftncsi.com"
  default-nameserver:
    - 223.5.5.5
    - 119.29.29.29
  nameserver:
    - 223.5.5.5
    - 119.29.29.29
  fallback:
    - 1.1.1.1
    - 8.8.8.8
    - https://cloudflare-dns.com/dns-query
    - https://dns.google/dns-query
  fallback-filter:
    geoip: true
    geoip-code: CN
    ipcidr:
      - 240.0.0.0/4

# --- Proxy Node Definitions ---
# Replace these placeholder nodes with your actual credentials or subscription
proxies:
  - name: "Sample-Shadowsocks-US"
    type: ss
    server: us.example.com
    port: 8388
    cipher: aes-256-gcm
    password: "YourPasswordHere"
    udp: true

  - name: "Sample-VLESS-Reality-JP"
    type: vless
    server: jp.example.com
    port: 443
    uuid: "a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d"
    network: tcp
    tls: true
    udp: true
    flow: xtls-rprx-vision
    servername: gateway.icloud.com
    reality-opts:
      public-key: "YourPublicKeyHere"
      short-id: "abcd1234ef56"
    client-fingerprint: chrome

  - name: "Sample-Hysteria2-SG"
    type: hysteria2
    server: sg.example.com
    port: 443
    password: "YourHysteriaPassword"
    sni: sg.example.com
    skip-cert-verify: false

# --- Proxy Routing Groups ---
proxy-groups:
  # Primary outbound selector
  - name: "PROXIES"
    type: select
    proxies:
      - "AUTO-LOWEST-LATENCY"
      - "Sample-VLESS-Reality-JP"
      - "Sample-Hysteria2-SG"
      - "Sample-Shadowsocks-US"
      - "DIRECT"

  # Auto-select node with the lowest ping
  - name: "AUTO-LOWEST-LATENCY"
    type: url-test
    url: http://cp.cloudflare.com/generate_204
    interval: 300
    tolerance: 50
    proxies:
      - "Sample-VLESS-Reality-JP"
      - "Sample-Hysteria2-SG"
      - "Sample-Shadowsocks-US"

  # Streaming media policy group
  - name: "STREAMING"
    type: select
    proxies:
      - "PROXIES"
      - "Sample-VLESS-Reality-JP"
      - "Sample-Hysteria2-SG"
      - "Sample-Shadowsocks-US"

  # AI & Developer services (OpenAI, Claude, GitHub)
  - name: "AI-SERVICES"
    type: select
    proxies:
      - "PROXIES"
      - "Sample-VLESS-Reality-JP"
      - "Sample-Shadowsocks-US"

# --- Remote Rule Providers ---
rule-providers:
  reject:
    type: http
    behavior: domain
    url: "https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/reject.txt"
    path: ./ruleset/reject.yaml
    interval: 86400

  media:
    type: http
    behavior: domain
    url: "https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/media.txt"
    path: ./ruleset/media.yaml
    interval: 86400

  ai:
    type: http
    behavior: classical
    url: "https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/gfw.txt"
    path: ./ruleset/gfw.yaml
    interval: 86400

  direct:
    type: http
    behavior: domain
    url: "https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/direct.txt"
    path: ./ruleset/direct.yaml
    interval: 86400

  cncidr:
    type: http
    behavior: ipcidr
    url: "https://raw.githubusercontent.com/Loyalsoldier/clash-rules/release/cncidr.txt"
    path: ./ruleset/cncidr.yaml
    interval: 86400

# --- Traffic Routing Rules ---
rules:
  # 1. Custom High-Priority Direct Bypass
  - DOMAIN-SUFFIX,local,DIRECT
  - DOMAIN-SUFFIX,internal,DIRECT

  # 2. Ad & Telemetry Blocking
  - RULE-SET,reject,REJECT

  # 3. AI & Specialized Services
  - DOMAIN-SUFFIX,openai.com,AI-SERVICES
  - DOMAIN-SUFFIX,chatgpt.com,AI-SERVICES
  - DOMAIN-SUFFIX,anthropic.com,AI-SERVICES
  - DOMAIN-SUFFIX,claude.ai,AI-SERVICES

  # 4. Global Media Streaming
  - RULE-SET,media,STREAMING

  # 5. International GFW Sites
  - RULE-SET,ai,PROXIES

  # 6. Domestic Sites & Direct IP Routing
  - RULE-SET,direct,DIRECT
  - RULE-SET,cncidr,DIRECT
  - GEOIP,CN,DIRECT,no-resolve

  # 7. Local Subnets
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve

  # 8. Catch-All Fallback
  - MATCH,PROXIES

Breakdown of Key Architectural Sections

1. Unified mixed-port: 7890

Rather than running separate ports for HTTP (e.g. 7890) and SOCKS5 (e.g. 7891), mixed-port binds a single dual-stack socket capable of auto-detecting HTTP CONNECT or SOCKS5 handshakes. This simplifies configuration in third-party macOS developer tools.

2. Fake-IP DNS Engine

When Enhanced Mode (TUN) runs on macOS, the system forwards DNS queries to the internal resolver listening on port 1053. ClashFX immediately hands back a virtual IP address from the 198.18.0.1/16 subnet. This architecture eliminates DNS lookup latency and bypasses local ISP query hijacking entirely.

3. Decoupled Rule-Providers

By pointing rule-providers to high-reputation open-source repositories (such as Loyalsoldier’s ruleset), your ad-blocking, media routing, and domestic bypass databases remain perpetually up to date without requiring manual text editing.

How to Install and Edit This Template in ClashFX

Step 1: Open the Configuration Folder

Click the ClashFX icon in the macOS menu bar and choose Config → Open Config Folder. This opens ~/.config/clashfx in Finder.

Step 2: Create or Replace the Configuration File

Create a new file named custom-meta.yaml and paste the template content into it. Insert your personal proxy nodes into the proxies: section.

Step 3: Switch to Your New Profile

In the ClashFX menu bar, hover over Config and click custom-meta.yaml. ClashFX validates the YAML structure and activates the configuration.

Step 4: Live Customization with the Built-in Editor

To make quick adjustments to ports, upstream DNS servers, or rule priorities, click Config → Edit Current Config. Make your modifications and press Cmd + S. ClashFX hot-reloads the changes dynamically in memory.

Next Steps

• Learn more about the underlying engine in our Clash Meta (Mihomo) Guide.
• Fine-tune your rules with the Custom Rule Providers Guide.
• Activate full system-wide interception via the Enhanced Mode (TUN) Setup Guide.