Docs Config General Config

General Config

These are the fields written at the very top level of config.yaml, alongside proxies/rules, that control how the core itself runs: which addresses it listens on, which mode it runs in, how verbose its logging is, and how the API is exposed.

Allow LAN

allow-lanOptional

Whether to let other devices access the internet through this machine's proxy ports. Required if you want phones or tablets to connect to Clash running on a computer.

bind-addressOptional

The bind address — only devices connecting through this address are allowed. "*" binds all IPs; you can also specify a single IPv4/IPv6 address to bind just one interface.

lan-allowed-ips / lan-disallowed-ipsOptional

Whitelist and blacklist of IPs allowed to access via LAN; only takes effect when allow-lan: true. The blacklist takes priority over the whitelist.

config.yaml YAML
allow-lan: true
bind-address: "*"
lan-allowed-ips:
  - 0.0.0.0/0
  - ::/0
lan-disallowed-ips:
  - 192.168.0.3/32
Authentication
authenticationOptional

Sets up username/password authentication for http(s)/socks/mixed proxies, formatted as an array of "user:pass" strings.

skip-auth-prefixesOptional

Sets IP ranges that are allowed to skip authentication, e.g. 127.0.0.1/8, ::1/128.

Run Mode & Logging

modeDefault: rule

rule: rule-based matching (most common); global: global proxy mode, all traffic goes through the node selected in the GLOBAL proxy group; direct: global direct mode, ignores all proxies.

log-levelDefault: info

How verbose the logs are, from least to most: silent → error → warning → info → debug (outputs nearly everything — only needed for troubleshooting).

ipv6Default: true

Whether the core accepts IPv6 traffic.

find-process-modeDefault: strict

Whether to match the process that initiated the connection (used together with the PROCESS-NAME rule): always forces matching for every process; strict lets the core decide whether matching is needed; off disables matching entirely — recommended when running on a router.

TCP Keep Alive

On mobile devices, tuning these settings can help reduce battery drain:

FieldDescription
keep-alive-intervalInterval between TCP Keep Alive packets, in seconds
keep-alive-idleMaximum idle time for TCP Keep Alive
disable-keep-aliveDisable TCP Keep Alive; forced to true on Android

External Control (API)

The dashboard talks to the core via the RESTful API configured here.

external-controllerOptional

The address the API listens on. Defaults to 127.0.0.1:9090, which only allows local access; change it to 0.0.0.0:9090 to listen on all interfaces (e.g. so your phone can reach a dashboard hosted on a router).

secretOptional

The API's access secret. Strongly recommended when exposing the API on 0.0.0.0 — otherwise anyone can connect to your dashboard and change your config.

external-controller-corsOptional

CORS header config for the API: an allow-origins array plus allow-private-network.

external-ui / external-ui-urlOptional

Mounts a set of static dashboard web assets (like metacubexd) at API address/ui; external-ui-url sets the address used to automatically download/update those dashboard assets.

config.yaml YAML
external-controller: 127.0.0.1:9090
secret: ""
external-ui: ui
external-ui-url: "https://github.com/MetaCubeX/metacubexd/archive/refs/heads/gh-pages.zip"

There are also advanced options like external-controller-tls (HTTPS API), external-controller-unix (Unix socket), and external-controller-pipe (Windows named pipe). Accessing the API over a Unix socket / named pipe does not check secret, so make sure to secure it yourself.

Other Common Fields

FieldDescription
unified-delayWhen enabled, unified delay calculates RTT to remove latency differences caused by different protocols' handshake overhead, making speed test numbers directly comparable
tcp-concurrentEnables TCP concurrent connections: connects to every IP resolved by DNS at the same time and uses whichever succeeds first, which can help with connection failures on certain networks
interface-nameSpecifies the network interface mihomo uses for outbound traffic
routing-markSets a default routing mark for outbound connections on Linux
profile.store-selectedRemembers the manually selected node for each proxy group, so you don't have to reselect after a restart
profile.store-fake-ipStores the fake-ip mapping table, so a domain reuses its existing mapped address on reconnection
global-client-fingerprintDeprecated — set client-fingerprint directly inside each proxy instead

GEO Data Source

geodata-modeDefault: false

The GEOIP data file format: true uses the .dat format, false uses the .mmdb format.

geodata-loaderDefault: memconservative

standard is the standard loader; memconservative is a loader optimized for low-memory devices (recommended for routers and similar setups).

geo-auto-update / geo-update-intervalOptional

Whether to automatically update the GEO database, and how often (in hours).

geox-urlOptional

Sets custom download URLs for the four geoip/geosite/mmdb/asn data files — useful for switching to a domestic mirror on poor network connections.