Docs Config General Config

General Config

These are the fields written at the very top level of config.yaml, alongside proxies/rules, that control how the core itself runs: which addresses it listens on, which mode it runs in, how verbose its logging is, and how the API is exposed. Use the sidebar to jump straight to the guide, outbound proxies, routing rules, and other sections.

Allow LAN

allow-lanOptional

Whether to let other devices access the internet through this machine's proxy ports. Required if you want phones or tablets to connect to Clash running on a computer.

bind-addressOptional

The bind address — only devices connecting through this address are allowed. "*" binds all IPs; you can also specify a single IPv4/IPv6 address to bind just one interface.

lan-allowed-ips / lan-disallowed-ipsOptional

Whitelist and blacklist of IPs allowed to access via LAN; only takes effect when allow-lan: true. The blacklist takes priority over the whitelist.

config.yaml YAML

allow-lan: true
bind-address: "*"
lan-allowed-ips:
  - 0.0.0.0/0
  - ::/0
lan-disallowed-ips:
  - 192.168.0.3/32

Authentication

authenticationOptional

Sets up username/password authentication for http(s)/socks/mixed proxies, formatted as an array of "user:pass" strings.

skip-auth-prefixesOptional

Sets IP ranges that are allowed to skip authentication, e.g. 127.0.0.1/8, ::1/128.

Run Mode & Logging

modeDefault: rule

rule: rule-based matching (most common); global: global proxy mode, all traffic goes through the node selected in the GLOBAL proxy group; direct: global direct mode, ignores all proxies.

log-levelDefault: info

How verbose the logs are, from least to most: silent → error → warning → info → debug (outputs nearly everything — only needed for troubleshooting).

ipv6Default: true

Whether the core accepts IPv6 traffic.

find-process-modeDefault: strict

Whether to match the process that initiated the connection (used together with the PROCESS-NAME rule): always forces matching for every process; strict lets the core decide whether matching is needed; off disables matching entirely — recommended when running on a router.

TCP Keep Alive

On mobile devices, tuning these settings can help reduce battery drain:

Field	Description
`keep-alive-interval`	Interval between TCP Keep Alive packets, in seconds
`keep-alive-idle`	Maximum idle time for TCP Keep Alive
`disable-keep-alive`	Disable TCP Keep Alive; forced to true on Android

External Control (API)

The dashboard talks to the core via the RESTful API configured here.

external-controllerOptional

The address the API listens on. Defaults to 127.0.0.1:9090, which only allows local access; change it to 0.0.0.0:9090 to listen on all interfaces (e.g. so your phone can reach a dashboard hosted on a router).

secretOptional

The API's access secret. Strongly recommended when exposing the API on 0.0.0.0 — otherwise anyone can connect to your dashboard and change your config.

external-controller-corsOptional

CORS header config for the API: an allow-origins array plus allow-private-network.

external-ui / external-ui-urlOptional

Mounts a set of static dashboard web assets (like metacubexd) at API address/ui; external-ui-url sets the address used to automatically download/update those dashboard assets.

config.yaml YAML

external-controller: 127.0.0.1:9090
secret: ""
external-ui: ui
external-ui-url: "https://github.com/MetaCubeX/metacubexd/archive/refs/heads/gh-pages.zip"

There are also advanced options like external-controller-tls (HTTPS API), external-controller-unix (Unix socket), and external-controller-pipe (Windows named pipe). Accessing the API over a Unix socket / named pipe does not check secret, so make sure to secure it yourself.

Other Common Fields

Field	Description
`unified-delay`	When enabled, unified delay calculates RTT to remove latency differences caused by different protocols' handshake overhead, making speed test numbers directly comparable
`tcp-concurrent`	Enables TCP concurrent connections: connects to every IP resolved by DNS at the same time and uses whichever succeeds first, which can help with connection failures on certain networks
`interface-name`	Specifies the network interface mihomo uses for outbound traffic
`routing-mark`	Sets a default routing mark for outbound connections on Linux
`profile.store-selected`	Remembers the manually selected node for each proxy group, so you don't have to reselect after a restart
`profile.store-fake-ip`	Stores the fake-ip mapping table, so a domain reuses its existing mapped address on reconnection
`global-client-fingerprint`	Deprecated — set `client-fingerprint` directly inside each `proxy` instead

GEO Data Source

geodata-modeDefault: false

The GEOIP data file format: true uses the .dat format, false uses the .mmdb format.

geodata-loaderDefault: memconservative

standard is the standard loader; memconservative is a loader optimized for low-memory devices (recommended for routers and similar setups).

geo-auto-update / geo-update-intervalOptional

Whether to automatically update the GEO database, and how often (in hours).

geox-urlOptional

Sets custom download URLs for the four geoip/geosite/mmdb/asn data files — useful for switching to a domestic mirror on poor network connections.