Clash proxy setup (Clash Verge Rev, Clash Meta for Android, ClashX Meta)

Published: 26 August 2026 · 8 min read

TL;DR: Add a type: socks5 node for gw.roamproxy.com:41080 with your dashboard username and password as separate YAML keys, put it in a select group, and use MATCH,PROXY while you verify. Use a maintained client (Clash Verge Rev / Clash Meta for Android / ClashX Meta) — the original Clash for Windows and Clash for Android are discontinued. Turn on System Proxy or TUN on desktop. If your network cannot reach the gateway directly, add dialer-proxy: Upstream to the Roam node. Verify on ip.sb and two or three real sites.

What you need before you start

Every Clash client in this tutorial reads the same four values. Get them from your Roam dashboard and keep that tab open.

Field	Value
Server	`gw.roamproxy.com`
Port	`41080`
Username	generated in the dashboard
Password	generated in the dashboard

Read this first if your network is restricted. Roam is an exit-IP layer: it changes the address the destination site sees. It is not a tunnel out of a network that blocks outbound connections. If your machine cannot reach gw.roamproxy.com:41080 directly, a plain Roam node fails in a way that looks like a broken product. On such a network you need the dialer-proxy chain from Step 5, which is one line of YAML in Clash — easier than in most other clients.

Step 1 — Pick a maintained Clash client

"Clash" today means a family of clients built on the Mihomo core (formerly Clash Meta). The original Clash core, Clash for Windows and Clash for Android were all discontinued in late 2023 — copies still circulate, but they receive no fixes and some are repackaged with unwanted extras. Use one of these instead:

Platform	Client	Where
Windows / macOS / Linux	Clash Verge Rev	GitHub releases of `clash-verge-rev/clash-verge-rev`
Android	Clash Meta for Android (CMFA)	GitHub releases of `MetaCubeX/ClashMetaForAndroid`
macOS (menu bar)	ClashX Meta	GitHub releases of `MetaCubeX/ClashX.Meta`

Everything below applies to all three, because they share the same configuration format.

Step 2 — Write the configuration

Clash is configured with a YAML file rather than a form. This is the complete, minimal file for Roam — replace the two credential values and keep everything else:

mixed-port: 7890
mode: rule

proxies:
  - name: Roam
    type: socks5
    server: gw.roamproxy.com
    port: 41080
    username: username
    password: password
    udp: true

proxy-groups:
  - name: PROXY
    type: select
    proxies:
      - Roam

rules:
  - MATCH,PROXY

Three things worth knowing about this file:

type: socks5 is the whole point. Clash also supports type: http, and Roam accepts both, but an HTTP proxy node only carries HTTP and HTTPS — DNS and every other protocol leak out over your normal connection. The symptom is an IP-check page that shows the new address while other apps time out. Use socks5.
The credentials are separate YAML keys, so a password containing @, # or : needs no escaping here. Just paste it. (If it contains a # or starts with a special character, wrap it in double quotes to be safe: password: "p#ss".)
MATCH,PROXY as the only rule sends everything through Roam. That is what you want while verifying. Add your own bypass rules above it later.

Step 3 — Import it and switch on

Clash Verge Rev (desktop)

Save the file as roam.yaml.
Open Profiles → New → type Local, choose the file, and click the profile card to make it active.
Go to Proxies, open the PROXY group and make sure Roam is selected.
In Settings, turn on System Proxy. Browsers and most desktop apps now route through Clash's mixed-port.

Some applications ignore the system proxy — command-line tools, some games and Electron apps. For those, turn on TUN Mode instead of (or as well as) System Proxy; it captures every connection at the network layer. TUN needs the service that Clash Verge installs on first use, so accept that prompt.

Clash Meta for Android

Copy the YAML to your phone, or host it somewhere you can reach and use its URL.
Open CMFA → Profiles → + → File (or URL), import it, then tap the profile to select it.
Tap the big Click to Start button. Android asks for VPN permission the first time — allow it.
Open Proxy, the PROXY group, and confirm Roam is selected.

Step 4 — Verify (properly)

Open https://ip.sb and confirm a Roam exit IP in the region you expect. In Clash Verge Rev the Connections page shows live connections and which proxy each one used — if ip.sb appears there with Roam in the chain column, the request really went through the gateway.

Checking ip.sb alone is not enough. Open two or three sites or apps you actually use. If ip.sb shows the new IP but other things stall, the config is wrong — almost always the http-vs-socks5 issue from Step 2, or an app that is not honouring the system proxy (Step 3) — and you should go to connected but not working.

Optional: verify the credentials outside Clash

Testing outside the client tells you whether a problem is with your credentials or with Clash. Note the form: -x takes the proxy address and -U passes the credentials separately.

curl -v -x socks5h://gw.roamproxy.com:41080 -U 'username:password' https://ip.sb

If curl returns a Roam IP but Clash does not, the credentials are fine and the problem is in the config or the client. If curl fails too, re-copy the username and password from the dashboard.

Step 5 — Chaining behind an upstream hop

Skip this step if Step 4 already works. You need it when your network cannot reach the gateway directly. Clash's Mihomo core has a first-class way to send one proxy through another: dialer-proxy. The path becomes: your machine → your upstream node → Roam gateway → destination. The destination still sees the Roam exit IP.

Add your existing upstream node to proxies (whatever type it is), then add one line to the Roam node:

proxies:
  - name: Upstream
    type: …your existing node…
    server: …
    port: …

  - name: Roam
    type: socks5
    server: gw.roamproxy.com
    port: 41080
    username: username
    password: password
    udp: true
    dialer-proxy: Upstream

Keep Roam selected in the PROXY group — traffic goes to Roam, and Roam's connection to the gateway is dialled through Upstream. If the chain fails, test the hops separately: select Upstream alone in the group and confirm you have working internet, then switch back to Roam. A chain that fails at hop one looks identical to one that fails at hop two. Shadowrocket calls the same feature Chain Proxy; Surge calls it underlying-proxy; the Shadowrocket guide covers the iOS side.

Rules for everyday use

Once the setup is verified, replace MATCH,PROXY with rules that keep bulk traffic off the metered proxy. Residential traffic is billed per gigabyte, so video, OS updates and app-store downloads should go DIRECT. A minimal rule set:

rules:
  - DOMAIN-SUFFIX,youtube.com,DIRECT
  - DOMAIN-SUFFIX,googlevideo.com,DIRECT
  - DOMAIN-SUFFIX,apple.com,DIRECT
  - DOMAIN-SUFFIX,windowsupdate.com,DIRECT
  - GEOIP,LAN,DIRECT
  - MATCH,PROXY

Or flip the client to Global mode when you want everything through Roam regardless of rules, and back to Rule afterwards.

Plans and what a session costs

Rotating residential traffic is billed at $2/GB with no monthly minimum. If you need one address that stays the same across sessions — anything with a login that reacts badly to a changing IP — a static residential IP is $4/IP/month. New accounts receive 300MB of trial traffic on their first top-up (from $2), which is more than enough to complete this tutorial and confirm the exit IP behaves the way your target site expects.

FAQ

Clash shows the node as green, but nothing loads.

A green latency test only proves Clash could reach the gateway; it does not prove your apps are going through it. On desktop, check that System Proxy (or TUN Mode) is actually switched on in Settings, and that the PROXY group has Roam selected rather than DIRECT. On Android, confirm the profile is selected and the service is running. If the latency test itself fails, re-copy the username and password from the dashboard, and if your network is restricted, go to Step 5.

Which config keys does Roam actually need?

Only name, type: socks5, server, port, username and password. udp: true is optional and harmless. Do not set tls or skip-cert-verify on this node — the gateway speaks plain SOCKS5 on port 41080, and enabling TLS on the node makes the handshake fail.

Can I still use Clash for Windows or Clash for Android?

They still run, but both were discontinued in 2023, receive no security fixes, and the original core they bundle lacks dialer-proxy. Clash Verge Rev and Clash Meta for Android accept the same YAML shown here and are actively maintained, so there is no reason to stay on the old clients.

My dashboard shows traffic being used, but pages will not load.

Billed traffic means authentication succeeded and the gateway is carrying data — your credentials are fine. The failure is in what is being carried: the node type or DNS. Make sure the node is type: socks5, not http, and that Clash's own DNS settings are not forcing lookups outside the tunnel. If it is already socks5 and pages still fail, see connected but not working.

Roam is the exit-IP layer for this setup: rotating residential at $2/GB, static residential at $4/IP/month, no monthly minimum. Create an account and get 300MB of trial traffic on your first top-up — enough to finish this tutorial and confirm the exit IP behaves the way your target site expects.