Use Clash Meta Rules on iPhone: App Store Apps and Configuration Setup

Check App Compatibility and Config Format First

To use Clash Meta rules on an iPhone, start by checking which config formats the app accepts—not by searching for an app with the same name. Clash Meta later evolved under the name mihomo. mihomo is a proxy core, a subscription provides access to configs or proxy nodes, and rules determine which outbound connection handles each request. These are three separate things.

iOS apps typically use Apple's Network Extension to establish a VPN tunnel. Seeing the VPN indicator only means the tunnel is active; it doesn't confirm that the app runs mihomo or supports every rule in your config. A YAML file that works on desktop may not import as-is on an iPhone.

Client type	What to check before importing	How rules are handled
Apps that support Clash-style YAML, such as Stash	Check which protocols, fields, and rule-set formats the current version supports	Some config structures may be reusable, but check support for each mihomo-specific field
Apps with their own config formats, such as Shadowrocket	Choose the subscription format provided for that app	Proxy subscriptions and rule configs may need to be imported separately
Other iOS proxy apps	Check the developer documentation and App Store listing	Go by the formats the app says it supports, not its name

App Store Availability and Apple ID Country or Region

First, check the iOS option on the client download page, then verify the app's name, developer, and purchase details in the App Store. App availability depends on the country or region associated with your Apple Account's store. Changing your iPhone's language or region settings won't change the App Store country or region.

Check your current App Store country or region

Open Settings on your iPhone and tap your Apple Account name at the top.
Go to Media & Purchases → View Account, then authenticate if prompted.
Check Country/Region. Labels may vary slightly by iOS version; use the account page as the source of truth.
Return to the App Store, search for the exact app name, and verify the developer—not just the icon.

If you can't find the app, check whether it's unavailable in your store region, requires a newer iOS version, or has been removed or changed in the App Store. Don't keep changing your iPhone's region settings, and don't mistake an install button on a third-party website for an App Store listing.

Check purchase requirements before changing your account region

Follow Apple's requirements for account balance, subscriptions, Family Sharing, and a valid payment method. You may need to take care of these before changing your region.
Use an account you manage. Don't give your Apple Account password or two-factor authentication codes to someone offering to install apps for you.
App downloads are managed through Media & Purchases. You don't need to sign out of iCloud on your whole device just to install a proxy app.
Purchases are linked to the account used to buy the app. You may still need that account for updates, redownloads, or restoring purchases.

The app and proxy service are billed separately. Buying an app doesn't give you proxy nodes, and having a subscription doesn't mean you've bought a particular app. Once the download is complete, open the app and make sure you can reach its main screen before importing a config.

Import a Subscription URL

Open your provider's account page and choose a format for your client. A full YAML config for mihomo, a standalone proxy subscription, and a config for another app may each have a different download link. Matching filenames or HTTPS addresses don't guarantee that the contents use the same format.

Choose an export format: For an app that uses Clash-style configs, check which YAML formats it accepts. For Shadowrocket, use the option your provider explicitly recommends for that app.
Copy the full URL: Keep the path, query parameters, and token intact. A line break in a chat app or a missing character at the end can cause authentication to fail.
Add a remote config: In the app's config or subscription manager, choose Add, Download from URL, or the remote config option. Labels vary by app; don't paste the URL into a single proxy node's server field.
Download and select the config: Make sure the list shows a config name and update time. If the app requires you to select an active config, do that after importing.
Check the proxy groups: Open the policy or proxy screen, make sure the final outbound group isn't empty, and select a working node.

Check the Response When an Import Fails

For HTTP 401 or 403, check the token, account status, and access restrictions first. For 404, make sure you copied the full path. If the app reports a YAML parsing error, check whether the response is actually a login or error page. If a protocol or rule type isn't supported, use an export format for your client instead of deleting the offending line and connecting anyway.

Being able to open your provider's homepage in a browser doesn't mean the subscription URL will return a valid config. The subscription API may use a separate domain or redirect elsewhere. For troubleshooting, note the error text and when it occurred; don't post a full response containing credentials in a public forum.

Local YAML Files and Rule Dependencies

If you already have a config file, save it in the Files app on your iPhone, then select it through the client's file import option. Apps that support sharing may also let you import from the Share menu. Make sure you're importing the actual config file, not a web shortcut or a copy that a chat app converted into a text attachment.

Config files usually use the .yaml or .yml extension, but the extension doesn't determine compatibility. A full config may include proxy nodes, proxy groups, rules, and remote rule sets; a snippet containing only rules can't provide proxy nodes. The example below shows how common rules are ordered, not a complete config you can connect with.

# Config snippet: PROXY must be defined in proxy-groups
rules:
  - DOMAIN-SUFFIX,example.com,DIRECT
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - MATCH,PROXY

DOMAIN-SUFFIX matches domain suffixes. The example domain illustrates the syntax; replace it with a domain you specifically want to route directly.
192.168.0.0/16 is a private IP range. It doesn't cover every local network address or mean that the proxy app is handling LAN traffic.
no-resolve prevents this IP rule from triggering a DNS lookup just for the rule. It doesn't disable DNS globally.
Put MATCH last as the catch-all rule. Once an earlier rule matches, later rules usually aren't considered for that connection.

Three Checks When Migrating a mihomo Config

First, make sure policy names match. If a rule refers to PROXY, there must be a policy group with that name and at least one available member. Second, a remote rule set must not only download successfully; its format and behavior type must also be supported by the app. Third, GEOSITE and GEOIP depend on the relevant data and implementation—support for one doesn't imply support for both.

Don't copy desktop control ports, listen addresses, or TUN routing parameters into iOS instructions. The app and iOS work together to create the iPhone's tunnel, and the client determines the specific DNS, UDP, and routing behavior. Before editing a remote subscription, use the app's override or local-copy feature if available, so an update doesn't overwrite your changes.

First Connection and VPN Configuration Approval

Importing a config only loads its data. The first time you tap Connect, iOS will usually ask whether the app can add a VPN configuration. Make sure the request is from the client you just installed, then tap Allow and enter your device passcode or authenticate as prompted. This authorizes a system network tunnel; it doesn't buy a proxy service.

Make sure the config is selected and at least one proxy group has a working outbound node.
Choose rule-based routing. The app may call it Rule, Config, or something else; follow the client's documentation.
Tap Connect, approve the VPN configuration prompt, and wait for the app to show a connected status.
Open Settings → General → VPN & Device Management → VPN and check the connection status for the relevant configuration.

If you already use another VPN, DNS tool, or network filtering app, disconnect any service that may be using a similar tunnel before testing on its own. Whether different Network Extension types can work together depends on how they're implemented; don't assume every network tool can run at the same time. Don't disable system security features to fix a regular proxy connection.

Check Rules, DNS, and Actual Traffic Routing

After connecting, check in this order: node reachability → matched rule → a real request. A successful latency test only means the test destination was reachable at that moment; it doesn't guarantee access to videos, games, or every website. Node latency, page load time, and bandwidth are different metrics—don't mistake a millisecond reading for download speed.

Run a Repeatable Test

Check the test result: Note the selected node, test destination, and whether the request timed out. Don't keep switching policies before the test finishes.
Open a site that should use the proxy: Check the client's connection log for the destination domain, matched rule, and final node. Not every app provides detailed logs, so use the information available in its interface.
Compare your exit IP: Use the same IP lookup page and record the result with the proxy disconnected and connected. The lookup domain must match a proxy policy; otherwise, identical results may be expected.
Check direct connections: Visit a service explicitly configured for direct access and make sure it still works. This helps catch local traffic issues that a proxy exit test won't reveal.

If the connection log shows a destination domain but name resolution fails, check DNS settings and whether the resolver is reachable. If the config uses fake-IP, confirm that the client supports it. Don't treat a virtual mapping address as the website's actual server address, or rewrite your entire DNS setup just to remove synthetic addresses from the logs.

Keep the Wi-Fi or cellular connection consistent during testing to avoid adding variables. iCloud Private Relay, existing browser connections, and cached content can also affect comparisons. Try closing the old page and making a fresh request, then check the proxy log. One successful page load doesn't replace a record showing which rule matched.

Common Problems and Routine Updates

Why did the import succeed but no proxy nodes appear?

First check whether you imported a proxy subscription, a full config, or a standalone rules file. If the config loads nodes through a remote proxy group, also check whether that group downloaded and whether its name matches the reference. A successful config parse doesn't mean every external resource has finished downloading.

VPN says connected, but webpages won't load. What should I check first?

Check the proxy group members, node test results, DNS errors, and the final matched rule—in that order. You can briefly switch to a known working node for comparison, but don't change DNS, rules, and routing mode at the same time. Change one variable at a time and keep the original config so you can restore it.

Why does a subscription that works on desktop fail on iPhone?

Desktop mihomo and iOS clients may differ in protocol support, rule parsing, and support for extended fields. Check the field named in the error and the client's compatibility notes, then choose a format your provider offers for that app. Renaming a file to YAML or pasting the URL again won't fix differences in parsing support.

Why did my custom rules disappear after updating the subscription?

Updating a remote config may replace local content. Put your changes in an override, merge, or separate local config supported by the app, and keep a backup. After updating, check the active config, proxy group selection, and remote rule-set status—not just whether the update time changed.

For routine maintenance, follow a consistent order: update the client from the App Store, refresh the subscription as needed, then check that nodes, rules, and DNS still work. When switching apps, check the config format again. Don't assume the old app's menu paths, listen ports, or TUN settings are defaults in the new one.