Why Developers Need a Dedicated Clash Setup
GitHub clone failures, broken SSH pushes, and stalled Homebrew updates can interrupt an entire development day. The problem is often not the repository, package manager, or terminal itself. It is usually the gap between a desktop proxy client and command-line tools that do not automatically inherit the same routing settings.
Clash can provide a consistent network path for source-code hosting, package registries, release downloads, container images, and other development services. However, simply switching the client to Global Mode is rarely the best solution. Global routing may send local repositories, private company domains, and internal registries through an unnecessary proxy. It can also make troubleshooting more difficult because every command follows the same path.
This guide explains how to build a practical developer-oriented configuration with Clash Verge Rev, Clash Verge, or another Mihomo-based client. The examples focus on Git, SSH, Homebrew, and terminal traffic, but the same principles apply to npm, pip, cargo, Docker, and similar tools.
Technical Goal
Route public development services through a reliable Clash proxy while keeping private networks, local mirrors, and internal repositories on DIRECT whenever appropriate.
1Choose the Right Routing Strategy
Before editing Git or shell settings, decide how traffic should be divided. Clash normally offers Rule, Global, and Direct modes. For development work, Rule mode is usually the safest starting point because it allows public code-hosting and package domains to use a proxy while preserving direct access to local services.
Rule Mode for Daily Development
Rule mode lets Mihomo inspect the destination domain or IP address and select a policy group. A typical developer profile may use one proxy group called Developer, another group for general browsing, and DIRECT for local resources. The exact group names depend on your subscription, so replace Developer below with a policy that exists in your profile.
The final MATCH rule should not automatically be copied into every profile. If your normal browsing policy is already well designed, place the developer rules above the existing final rule and keep that final rule unchanged. Clash evaluates rules from top to bottom, so a broad rule placed too early can override all later exceptions.
Domain Rules Are Better Than IP Guessing
GitHub, GitLab, Homebrew, and container registries use CDNs and changing address ranges. Hard-coding a few public IP addresses may work temporarily and then fail without warning. Prefer DOMAIN-SUFFIX, DOMAIN, or DOMAIN-KEYWORD rules for recognizable services. Use IP rules mainly for private networks or a documented corporate range.
Pro Tip
Keep private Git hosting, internal package registries, and office subnets above broad public-service rules. A company repository should not be sent to a third-party proxy unless your organization explicitly requires it.
2Prepare Clash Ports and DNS
Command-line applications need a local endpoint that they can understand. Mihomo commonly exposes an HTTP proxy port and a SOCKS5 port. You can find the active values in the client dashboard or in the profile configuration. The following example assumes HTTP on 7890 and SOCKS5 on 7891; use your actual ports if they are different.
A mixed-port can accept both HTTP and SOCKS-style connections in clients that support it, but separate ports are also common. Do not expose the controller API or proxy port to your entire local network unless you understand the security implications. For a personal workstation, allow-lan: false is a reasonable default.
Use Fake-IP Carefully
When TUN mode and Fake-IP DNS are enabled, applications that use normal domain resolution can often be routed automatically. This is convenient for browsers and many GUI tools. SSH is different: the traditional command ssh [email protected] opens a TCP connection directly and does not automatically understand an HTTP proxy. Git can also call SSH without involving the browser or system proxy settings.
For reliable results, test DNS and connectivity separately. First confirm that the hostname resolves. Then confirm that the relevant port is reachable through the intended route. Finally test the application itself. Separating these layers prevents you from mistaking a DNS failure for an authentication failure.
If the direct request fails but the proxy request succeeds, Clash is working and the terminal application simply needs explicit proxy configuration. If both requests fail, inspect the selected node, DNS mode, rule order, and client logs before changing Git credentials.
3Configure Git and SSH in Practice
There are two practical ways to route Git operations: use HTTPS with a Git proxy, or keep SSH and add a SOCKS-aware ProxyCommand. HTTPS is usually easier to maintain. SSH is often preferred by developers because it supports familiar keys, avoids repeated token prompts, and works well with signed or automated workflows.
Option A: Git over HTTPS
Set a proxy for Git globally if most public repositories should use Clash. The HTTP proxy URL is appropriate for HTTPS repository URLs. Git supports both an HTTP proxy and a SOCKS5 proxy; use the one that matches your client and operating system.
The socks5h scheme is useful because hostname resolution is performed through the SOCKS proxy rather than locally. This can avoid misleading DNS results in restricted networks. Do not configure both HTTP and SOCKS proxies at the same time without a reason; the last value saved for a key is the one Git uses.
For an internal repository that must bypass Clash, add a per-host exception. Git configuration supports more specific URL sections:
In many environments, it is cleaner to use environment variables temporarily instead of storing a global proxy. This is useful when switching between office and home networks:
Option B: Git over SSH with SOCKS5
SSH does not natively accept an HTTP proxy URL. On macOS and Linux, OpenSSH can call a small helper such as nc or ncat to create a SOCKS5 connection. Add a host entry to ~/.ssh/config:
Some versions of netcat use different flags. If nc -X 5 -x is rejected, install a compatible netcat package or use Ncat from the Nmap project:
On Windows, the OpenSSH client included with modern Windows installations can use Ncat if it is installed and available in PATH. Clash Verge Rev users should first confirm that the local SOCKS port is enabled, then test the connection with verbose output:
A successful authentication message proves that the key was accepted, but it does not necessarily mean every repository operation will work. Test both fetch and push against a non-critical branch. If authentication succeeds but the connection closes during transfer, inspect node stability, MTU behavior, and whether the selected proxy supports long-lived TCP sessions.
Common Pitfall
Do not paste a GitHub personal access token into a proxy URL or commit it into a repository. Proxy settings and credentials are separate concerns; keep keys and tokens in the operating system credential store whenever possible.
4Route Homebrew and Other Terminal Tools
Homebrew downloads formula metadata, bottles, source archives, and sometimes Git repositories. The command line may not use the same proxy setting as your browser, so configure it explicitly when updates stall or return TLS and timeout errors.
For a temporary Homebrew session on macOS or Linux, export standard proxy variables before running the command:
Use uppercase variables for broad compatibility, but remember that some tools only inspect lowercase names. If a command ignores the proxy, define both forms in a temporary shell:
Do not blindly place these exports in your permanent shell profile. A proxy that is useful on one network may break access to a local mirror or corporate endpoint on another. A small shell function or an environment manager can make switching predictable. The NO_PROXY list should include local addresses, private domains, and internal registries that must remain direct.
Containers and Language Package Managers
Docker requires separate configuration for the daemon and for containers. Setting HTTPS_PROXY in your terminal does not automatically configure the Docker daemon, and a container may have its own DNS and network namespace. Configure only the layer that needs the proxy, and avoid putting proxy credentials into image layers.
Many language tools follow standard environment variables. For example, npm, pip, and Rust can use explicit settings or environment variables. Keep the configuration scoped to the project or session if different repositories require different routes.
When downloads are slow, compare the package manager’s output with a direct curl request. A stalled package operation may be caused by a blocked registry, an unavailable mirror, certificate inspection, or a proxy node that cannot handle large files. Changing several settings at once makes the real cause harder to identify.
5Debug Failures and Maintain the Setup
A dependable developer proxy setup should be observable. In your Clash client, temporarily set the log level to info and watch which rule matches the failed request. Check whether the request reaches the expected domain, whether it uses the intended policy group, and whether the connection is closed by the remote server or the local client.
Use this troubleshooting order:
- Confirm Clash is running: Open the client dashboard and verify that the selected profile is active.
- Confirm the port: Test
curl -xagainst a known HTTPS site using the actual local port. - Check the rule match: Make sure the domain is not caught by a broad
DIRECTrule before the developer rule. - Check DNS behavior: Try
socks5hwhen local DNS results appear incorrect or inconsistent. - Test authentication separately: For SSH, use
ssh -T -v; for HTTPS, verify the credential helper and repository URL. - Test a small transfer: Clone a small repository or download a small package before retrying a large image or monorepo.
Common symptoms provide useful clues. A Git error saying “Could not resolve host” points toward DNS or proxy environment variables. “Connection timed out” usually indicates a routing, port, or node problem. “Permission denied (publickey)” is an SSH identity or server authorization issue, not proof that Clash is broken. A Homebrew checksum error may indicate an incomplete download, a stale cache, or a damaged mirror rather than a simple connectivity failure.
Review your configuration after changing subscriptions. Providers can rename policy groups, alter ports, or replace rule providers. Keep a short record of your local ports, SSH host entries, Git proxy commands, and required NO_PROXY domains. When a new profile is imported, compare those values before starting work.
Security Checklist
Bind local proxy ports to localhost, protect the Clash controller, avoid sharing configuration files that contain subscription URLs, and remove debug logs that may contain private repository names or access tokens.
With Rule mode, explicit Git settings, a SOCKS-aware SSH configuration, and carefully scoped terminal variables, Clash becomes a predictable part of the development toolchain rather than a hidden source of failures. Start with one repository and one package manager, verify each layer, and expand the rules only after the basic path is stable.