Panel setup

This page is for those who run a Remnawave panel. Users do not need to do anything here.

Response rule for the client

The app introduces itself as ClodClash/<version> (Android). Without a rule of its own the panel returns its default answer instead of a mihomo config, and the subscription will not be added.

In Subscription response rules add a rule: regular expression ^clodclash (case does not matter), response format MIHOMO. The same rule serves the desktop version too.

To show each server's Server description under its name, add ^ClodClash/ to responseModifications.additionalExtendedClientsRegex in the same rule — as a prefix, otherwise the rule breaks with the next app update.

{
  "name": "Mihomo Clients",
  "description": "Response with generated YAML config (Mihomo Template)",
  "enabled": true,
  "operator": "AND",
  "conditions": [
    {
      "headerName": "user-agent",
      "operator": "REGEX",
      "value": "^(?:FlClash|FlClashX|Flowvy|[Cc]lash-[Vv]erge|[Kk]oala-[Cc]lash|[Cc]lash-?[Mm]eta|[Mm]urge|[Cc]lashX [Mm]eta|[Mm]ihomo|[Cc]lash-nyanpasu|clash.meta|prizrak-box|[Cc]lod[Cc]lash)",
      "caseSensitive": false
    }
  ],
  "responseType": "MIHOMO",
  "responseModifications": {
    "additionalExtendedClientsRegex": [
      "^ClodClash/"
    ]
  }
}

The MIHOMO template and the keys the client overrides are in the panel setup guide. Response headers are on the Subscription headers and clod-* headers pages.

Secure channel

When a subscription is added, the app first tries the secure channel of remnawave-subscription-middleware; if the provider has no channel, the subscription is loaded with a plain HTTPS request. The user can turn the channel off in the subscription properties and on again.

Without the middleware, your server answers the channel request (the /c1/… path on the subscription domain), and that answer decides whether the subscription is added:

To check what the subscription domain returns for an unknown path:

curl -sS -o /dev/null -w '%{http_code}\n' https://sub.example.com/c1/test

404 — the subscription is added right away. Another code or 000 (the connection was closed with no answer) — after three channel attempts, that is a few seconds longer (with the VPN on and your server unreachable directly — up to half a minute); to have it added right away, make unknown paths answer 404.

The subscription is not added when the channel address redirects to http:// or through a chain of 10 or more redirects. Answer /c1/… without a redirect or with a redirect to https:// only.

With the middleware and the channel turned off, the subscription is added the plain way, without the channel. With the channel turned on, the subscription is added through it, and after the middleware is reinstalled (a new key) it picks up the new key by itself on the next update — with any middleware version.

A subscription with the channel sends a node quality report after a scheduled refresh (and between refreshes if they are less frequent than every 6 hours or turned off, at most once every 6 hours): latency and “16–20” results per node, traffic, the kind of network and the external address the measurements were made from. The middleware receives and shows the reports (Clod Clash → “Статистика” tab) when receiving is turned on there. The client collects measurements only after the middleware has confirmed receiving in the subscription answer over the channel (current middleware versions do); once an answer comes without that confirmation, it stops collecting and deletes what it has collected. Android learns the measurement address from Yandex outside the tunnel by itself; on the PC this needs DIRECT rules in the template — see the panel setup guide.

An external address and a device identifier linked to a subscription can be personal data under the GDPR and Russian law 152-FZ, and their controller is the provider, not the authors of the client. If you turn on receiving reports or the “16–20” check, describe it in your own privacy policy (purpose, legal basis, retention, recipients) and inform your users. What exactly the client sends is in the client's privacy policy.

Network stack

The tunnel stack comes from the template — details in Clod Core.