Clash Meta for Android (CMFA) Complete Guide 2026: Mihomo Setup & VPN Import
About This Guide: Clash Meta for Android (CMFA) is the definitive Mihomo-core Clash client for Android, maintained by the meta-backbone team. It is the most feature-complete and widely compatible Clash implementation for Android, supporting all modern protocols including VLESS+Reality, Hysteria2, and TUIC. This guide covers everything from installation to advanced TUN mode configuration with VPN07.
What Is Clash Meta for Android (CMFA)?
Clash Meta for Android, commonly abbreviated as CMFA, is an Android application powered by the Mihomo core (formerly known as Clash.Meta). While the original Clash project was archived by its creator in November 2023, the Mihomo fork has continued active development and is now the primary reference implementation for Clash-compatible proxy configuration in 2026.
The reason CMFA has become the go-to Clash client for Android is its comprehensive compatibility with Clash YAML profiles from virtually every VPN provider — including VPN07. Any subscription URL that provides a Clash YAML configuration works immediately with CMFA. The Mihomo core also adds support for newer protocols not present in original Clash, making it future-proof for emerging proxy standards.
CMFA Core Features
- Mihomo core — latest protocol support
- Full TUN mode — system-wide traffic capture
- Clash YAML profile compatibility
- Web UI dashboard (built-in Metacubexd)
- Subscription URL with auto-update
- Per-app proxy bypass rules
Protocols Supported (Mihomo Core)
- VMess — Full transport options
- VLESS — Reality, WebSocket, gRPC
- Trojan — TCP+TLS, WebSocket+TLS
- Hysteria2 — QUIC-based, low latency
- TUIC — UDP over QUIC
- Shadowsocks + ShadowsocksR
- Wireguard — Built-in kernel VPN
Installing CMFA on Android
CMFA is available as an APK download from GitHub. Since it's not on Google Play in most regions, installation requires enabling "Unknown Sources".
Download from Official GitHub
Visit github.com/MetaCubeX/ClashMetaForAndroid/releases. Download the latest APK. For arm64 devices (most modern Android phones), download the arm64-v8a variant. Universal APK also available for compatibility.
Enable Unknown Sources Installation
On your Android device, go to Settings → Security (or Apps & Notifications → Special App Access) → Install Unknown Apps → enable for your browser or Files app. This allows installing the CMFA APK outside of Google Play.
Install and Grant Permissions
Tap the downloaded APK to install. After installation, launch CMFA. Grant the VPN permission when prompted (tap "Allow" in the VPN configuration dialog). Also grant notification permission for connection status updates.
Explore the Interface
CMFA's main screen shows Profile, Proxy, Rules, and Settings tabs. The key concept is the Profile — a YAML configuration file that defines all your proxy servers, rules, and routing logic. You'll add a VPN07 profile as your first step.
Import VPN07 Mihomo Profile via Subscription URL
The easiest way to set up CMFA with VPN07 is by importing a Clash/Mihomo YAML profile via subscription URL. VPN07 provides subscription URLs that generate complete Clash YAML configurations with all servers, proxy groups, and rules pre-configured.
Import VPN07 into CMFA — Complete Steps
- 1.Log in to your VPN07 account at vpn07.com → go to "My Subscription"
- 2.Copy the Clash (Mihomo) subscription URL — this generates a YAML profile with all VPN07 nodes
- 3.In CMFA, tap the Profile tab → tap the + button → select "URL"
- 4.Enter a name (e.g., "VPN07") → paste the subscription URL → tap "Confirm"
- 5.CMFA downloads and parses the YAML profile — you'll see all VPN07 servers listed
- 6.Tap the profile to activate it (it shows a checkmark when active)
- 7.Tap the home screen Connect button to start the proxy — you're now using VPN07!
Understanding Clash YAML Profile Structure
When you import a VPN07 Clash YAML profile, it contains several key sections. Understanding these helps you customize the configuration for your specific needs.
# VPN07 Clash YAML profile structure overview
mixed-port: 7890 # HTTP + SOCKS5 mixed port
allow-lan: true # Allow connections from LAN devices
mode: rule # rule / global / direct
log-level: info
dns:
enable: true
enhanced-mode: fake-ip
nameserver:
- 8.8.8.8
- 1.1.1.1
proxies:
- name: VPN07-US
type: vless
server: us-relay.vpn07.com
port: 443
uuid: xxx
network: tcp
tls: true
reality-opts:
public-key: xxx
short-id: xxx
proxy-groups:
- name: VPN07-Auto
type: url-test
proxies: [VPN07-US, VPN07-JP, VPN07-SG, VPN07-HK]
url: http://www.gstatic.com/generate_204
interval: 300
rules:
- GEOIP,CN,DIRECT
- MATCH,VPN07-Auto
Key Profile Sections Explained
- proxies: Individual VPN07 server configurations (one entry per node)
- proxy-groups: Logical groupings of servers with selection strategy (url-test, fallback, select, load-balance)
- rules: Traffic routing decisions — which connections go via proxy vs direct
- dns: DNS configuration including enhanced-mode (fake-ip or redir-host) for DNS leak prevention
Proxy Groups: Smart Node Selection in CMFA
Proxy groups are the core of Clash's routing intelligence. VPN07's Mihomo profile includes several pre-configured proxy groups optimized for different use cases.
Automatic Speed Test Group
CMFA tests all nodes in the group every 300 seconds and switches to the fastest one automatically. With VPN07's 1000Mbps nodes in 70+ countries, the auto group always has high-quality options to choose from.
type: url-test, url: http://www.gstatic.com/generate_204, interval: 300Manual Selection Group
Tap the group in CMFA's Proxy tab to manually choose which VPN07 server to use. Great for accessing content locked to a specific region — switch to US for American Netflix, Japan for anime, UK for BBC iPlayer, etc.
Fallback Group (Resilience)
Continuously tests nodes and uses the first healthy one. If the primary VPN07 node goes down for maintenance, CMFA automatically switches to the next available node — zero manual intervention required.
Load Balance Group
Distributes connections across multiple VPN07 nodes simultaneously. With consistent hashing, the same destination always routes to the same node (important for session-based services). Round-robin distributes evenly for maximum throughput.
TUN Mode: System-Wide Traffic Capture
TUN mode is CMFA's most powerful feature — it creates a virtual network interface that captures ALL network traffic at the system level, including traffic from apps that don't respect proxy settings (games, UDP traffic, apps with direct socket connections).
Enabling TUN Mode in CMFA
- 1. In CMFA, go to Settings → Override
- 2. Enable "Enable TUN"
- 3. Set TUN stack to "mixed" (recommended for best compatibility) or "system"
- 4. Enable "DNS Hijacking" to prevent DNS leaks in TUN mode
- 5. Restart CMFA to apply TUN mode changes
⚠️ TUN mode requires root access on some older Android versions, but works without root on Android 10+ with Network Extension permissions.
TUN Mode Advantages
- • Routes UDP traffic (games, VoIP, QUIC)
- • Captures traffic from all apps equally
- • Prevents DNS leaks comprehensively
- • Works with apps that ignore system proxy
- • Required for Hysteria2/TUIC protocols
TUN Mode Considerations
- • Higher battery usage than proxy-only mode
- • May conflict with other VPN apps
- • Use per-app bypass for banking apps
- • "System" stack: lower overhead
- • "Mixed" stack: better compatibility
CMFA Troubleshooting: Common Issues & Fixes
Most CMFA issues fall into a few common categories. Here are the solutions that resolve the vast majority of connection and configuration problems.
Profile parsing failed / YAML syntax error
Fix: The subscription URL may have returned a non-YAML response (e.g., HTML error page or base64-encoded v2ray links). Ensure you copy the Clash-specific subscription URL from VPN07, not the v2ray URL. Check in CMFA's profile detail view for the error line number. Common issues: missing required fields, incorrect indentation, or UTF-8 encoding problems.
Connected but traffic not routing correctly
Fix: Check the Mode setting in CMFA's top bar. If set to "Direct", no traffic goes through the proxy. Set it to "Rule" for smart routing or "Global" to route everything through VPN07. In Rule mode, verify that your YAML's [rules] section has correct GEOIP and MATCH entries at the bottom as fallback rules.
Subscription URL update failed
Fix: VPN07 subscription URLs are accessible worldwide, but if you're behind heavy filtering, enable a node first then update the subscription through the proxy. In CMFA's Profile tab, long-press the profile and tap "Update using proxy" to route the update request through the currently active VPN07 connection.
High battery drain with TUN mode enabled
Fix: Disable Android's battery optimization for CMFA (Settings → Battery → App battery usage → CMFA → "Unrestricted"). On Samsung/Xiaomi devices, also disable "Adaptive battery" for CMFA. If battery drain is extreme, switch from "mixed" TUN stack to "system" stack which has less overhead.
Certain apps not going through CMFA proxy
Fix: In normal mode, apps using UDP or apps that bypass system proxy won't be captured. Enable TUN mode to capture all traffic. Alternatively, check if the app's domain/IP is covered by your Clash rules — add explicit rules for the app's server domains if needed.
Speed test shows slow results despite 1000Mbps VPN07 nodes
Fix: The bottleneck is often your device's cellular or WiFi connection, not VPN07. Run the speed test on a 5GHz WiFi network first. Also try switching between different VPN07 node regions — sometimes a nearby node (e.g., Hong Kong for Asia users) significantly outperforms a geographically distant one (US) due to routing path length.
CMFA Advanced: Per-App Bypass & DNS Configuration
Two advanced CMFA features significantly improve the user experience for power users: per-app bypass rules and custom DNS configuration.
Per-App Bypass Rules
In CMFA Settings → Override → Per-app Proxy → set specific apps to "Bypass" mode so they always connect directly without going through VPN07. Recommended bypass apps:
- • Banking and payment apps
- • Local food delivery/ride-hailing
- • Government and official apps
- • Apps that detect VPN usage
DNS Configuration Best Practices
In your Clash YAML's dns section, use these settings for optimal performance with VPN07:
dns:
enable: true
enhanced-mode: fake-ip
fake-ip-range: 198.18.0.0/15
nameserver:
- 8.8.8.8
- https://1.1.1.1/dns-query
fallback:
- 8.8.4.4VPN07: The Best Mihomo-Compatible VPN for CMFA Android
VPN07 — #1 Choice for CMFA Android
- Clash YAML subscription URL compatible with CMFA Mihomo core
- VLESS+Reality, VMess, Trojan, Hysteria2, TUIC — full Mihomo protocol support
- 1000Mbps bandwidth — url-test always selects fastest available VPN07 node
- 30-day money-back guarantee — zero risk to start
VPN07 — Best VPN for CMFA Android
1000Mbps · 70+ Countries · Trusted Since 2015
VPN07 provides Clash-compatible Mihomo subscription URLs with VLESS+Reality, VMess, Trojan, Hysteria2, and TUIC protocols across 70+ countries. With 1000Mbps peak bandwidth and 10 years of service stability, VPN07 is the trusted infrastructure behind millions of CMFA Android setups worldwide.
Related Articles
v2rayNG Android Complete Guide 2026: VMess, VLESS & Trojan
The most popular Android proxy client — v2rayNG with xray-core. A lightweight alternative to CMFA for users who prefer the v2ray interface.
Read More →Hiddify vs NekoBox 2026: Android Proxy Clients Compared
Explore two modern Android proxy alternatives based on sing-box core — newcomers with cutting-edge protocol support and clean interfaces.
Read More →