Mihomo — High-Performance Rule-Based Network Proxy Kernel

Introduction

Mihomo is the continuation of the Clash.Meta project, a high-performance network proxy kernel written in Go. It acts as a local proxy gateway that routes traffic through encrypted tunnels based on configurable rules, supporting a wide array of modern proxy protocols.

What Mihomo Does

• Proxies traffic through Shadowsocks, VMess, VLESS, Trojan, Hysteria2, TUIC, and WireGuard
• Routes connections using domain, IP-CIDR, GeoIP, process name, and script-based rules
• Operates in TUN mode for system-wide transparent proxying without per-app configuration
• Manages multiple proxy groups with fallback, load-balancing, and URL-test strategies
• Supports rule providers and proxy providers for remote subscription updates

Architecture Overview

Mihomo runs as a single binary that opens local listeners (HTTP, SOCKS5, mixed, TUN) and matches each outbound connection against a rule chain. The rule engine evaluates conditions top-to-bottom and directs traffic to the appropriate proxy group or direct connection. DNS resolution is handled internally with support for DoH, DoT, and DoQ to prevent DNS leaks.

Self-Hosting & Configuration

• Single static binary for Linux, macOS, Windows, Android, and router firmware
• Configuration is a single YAML file specifying listeners, proxies, rules, and DNS
• Enable TUN mode for transparent proxying at the network-interface level
• Use proxy-providers to subscribe to remote server lists that auto-update
• Deploy on OpenWrt routers for gateway-level traffic routing

Key Features

• Sub-rule and logical rule combinations (AND, OR, NOT) for complex routing
• Built-in MITM and script engine for advanced traffic manipulation
• Supports QUIC-based protocols (Hysteria2, TUIC) for high-throughput on lossy networks
• Sniffing engine detects real destination from TLS SNI and HTTP Host headers
• Compatible with the Clash Premium API, enabling use with existing dashboard UIs

Comparison with Similar Tools

• sing-box — similar multi-protocol proxy; Mihomo has a larger existing Clash ecosystem and dashboard support
• Xray-core — V2Ray fork focused on XTLS; Mihomo adds rule-based routing and proxy group management
• WireGuard — excellent point-to-point VPN but lacks per-connection rule routing
• gost — Go tunnel with chaining; Mihomo provides a full traffic management engine

FAQ

Q: Is Mihomo the same as Clash? A: Mihomo is the continuation of Clash.Meta. The original Clash project was archived; Mihomo carries forward its feature set with active development.

Q: Which dashboards work with it? A: Yacd, Metacubexd, and Razord all connect via the RESTful API on the external controller port.

Q: Does it work on routers? A: Yes. Mihomo has builds for OpenWrt and is integrated into firmware projects like OpenClash and ShellCrash.

Q: How does TUN mode differ from system proxy? A: TUN mode creates a virtual network interface that captures all traffic at the OS level, while system proxy only affects applications that respect the HTTP/SOCKS proxy environment variable.

Sources

• https://github.com/MetaCubeX/mihomo
• https://wiki.metacubex.one/