The Problem: Remote YAML You Should Not Touch by Hand

Most Clash Meta users today live inside a workflow that feels simple on the surface: paste a subscription URL, let the client fetch nodes, pick a region in a selector, and forget about the rest. Underneath that calm UI, the client is still assembling a full YAML configuration that describes proxies, policy groups, DNS, and routing rules. When something needs to change—a corporate domain that must stay DIRECT, a personal Shadowsocks hop you host yourself, or a selector default that the provider template sets poorly—the tempting fix is to open the downloaded profile and edit it like a text document.

That temptation is where people lose afternoons. Airport profiles refresh on a schedule. One-click updates from the tray menu can overwrite local edits without ceremony. Even when you remember to back up a file, diffing a ten-thousand-line dump after every refresh is not a sustainable hobby. The right mental model is to treat the subscription as read-only input and move every personal tweak into a second layer that your client merges on top. In the Clash Meta (Mihomo) ecosystem, that layer is what people usually call an override, a merge file, or a patch profile, depending on which GUI you run.

This guide explains what that layer can do, how rule order interacts with appended lines, and how to add custom nodes without renaming half the tree every time your provider rotates UUIDs. It assumes you already understand selectors, rule providers, and the basics of split routing—topics we cover in depth in our split routing guide for China DIRECT and overseas proxy and in the subscription URLs and multi-source management walkthrough.

What an Override Actually Is

At the core, nothing magical happens inside Mihomo when you talk about overrides. The daemon still reads one unified configuration structure: listeners, proxies, proxy-groups, rules, optional rule-providers, and DNS blocks. The trick is where those keys come from. A mature client first expands proxy providers and injects remote node lists, then applies your local fragment. Depending on the merge strategy, later keys can replace earlier ones with the same name, or list-style sections such as rules can be concatenated with a defined precedence—prepend for high priority, append for catch-all tweaks.

That separation matters because it restores the workflow users wanted all along: keep the provider responsible for mass-market nodes and latency-tested groups, while you retain a small, version-controlled file that only describes your exceptions. Think of it as the difference between editing the vendor firmware image versus loading a sysctl drop-in. The subscription stays pristine; your override tracks in a backup folder you actually own.

Adding Custom Proxies and Providers Locally

Hand-authored proxies entries remain the most straightforward reason to use an override. You might run a tiny VM in another region, forward through a wireguard exit you control, or keep a backup SOCKS5 endpoint that never appears on the public provider list. Define those nodes in your local YAML exactly as the Meta documentation describes: type, server, port, cipher or plugin parameters, and a clear name field you will reference elsewhere.

For larger static lists, proxy-providers pointing at a local file path behave like miniature subscriptions without HTTP. The core watches mtime in many setups, so regenerating the file triggers a reload. This pattern shines when you generate node lists from an internal inventory system rather than a single remote URL. Keep provider names namespaced so they never collide with the airport bundle that arrives through proxy-providers with remote url keys.

After the proxies exist, wire them into proxy-groups. A common pattern is to clone the provider’s main selector and add your nodes as extra proxies entries, or to create a dedicated relay or url-test group that only contains infrastructure you operate. Document why each group exists; six months later you will thank yourself when a provider renames upstream groups and your override still reads like a checklist rather than archaeology.

Tweaking Policy Groups Without Rewriting the Profile

Selectors and URL-test groups are not sacred text. Overrides can adjust type, interval, tolerance, or the ordered list of child proxies when you need a more aggressive health check on flaky airline Wi-Fi. Some users only want to change the default outbound for a group: pairing profile.store-selected with a sensible initial value in the merged result often achieves the same outcome as hard edits, because the client remembers the last user choice across restarts.

When you must duplicate an entire group to experiment, give the duplicate a new name and point rules at the experimental group first. Roll back by deleting a handful of lines in your override instead of hunting through provider YAML for every PROXY reference. That workflow pairs naturally with staged testing: flip one domain rule to the new group, verify latency and DNS, then widen the blast radius.

Appending and Prepending Rules Safely

Routing is where small mistakes echo loudly. Clash evaluates rules from top to bottom until one matches; the position of your custom lines relative to the provider’s MATCH line decides whether you actually hit them in production traffic. Many merge implementations expose explicit prepend-rules and append-rules sections so you do not have to splice arrays by hand. Prepend is where you park high-priority exceptions—split intranet domains, LAN segments, or a brittle app that breaks when steered through the wrong ASN. Append is where you add long-tail domains after the provider’s defaults without reprinting their entire GEOIP section.

If your client only offers a single merged rules list, duplicate the mental model manually: place your lines immediately above the final MATCH when you want them to participate in normal competition, or at the very top when you need to short-circuit everything below. Combine that discipline with logging: our guide to reading Clash logs and rule hits shows how to confirm which line won for a stubborn connection.

When rules grow beyond a dozen lines, consider moving bulk lists into rule-providers with behavior: classical or domain-based strategies. Your override then references a concise RULE-SET entry instead of an unreadable paragraph of DOMAIN-SUFFIX noise. The maintenance win is similar to proxy providers: refresh the provider file independently from the subscription.

DNS, Sniffing, and Miscellaneous Keys

Overrides are not limited to outbound selection. Users who fight fake-ip mismatches sometimes need a dns stanza that pins nameservers for specific domains, or a hosts entry that keeps an internal Git remote on a split horizon. Meta-class cores also expose tuning knobs for sniffing and TLS parsing; placing those keys in the local layer prevents the next subscription refresh from reverting your resolver strategy to the provider default.

Be conservative. DNS overrides interact with TUN stacks, IPv6 toggles, and operating-system caching in ways that look like random breakage until you isolate variables. Change one block at a time, restart the core, and verify with simple tools—lookups from the same shell you use for curl tests, not only from a browser that might still cache stale answers.

How Different Clients Surface Overrides

The exact menu label varies. Clash Verge Rev on Windows and desktop Linux exposes merge-style panels where a standalone YAML fragment ships alongside the imported profile; the application handles ordering so you rarely touch raw merge semantics unless you want to. macOS-oriented tools may call the same concept a patch or a custom suffix file. Android wrappers sometimes offer a smaller text area for snippets—enough for a few append-rules but not a novel—while still honoring the same merge idea.

Regardless of platform, prefer the official UI path when it exists. Hand-editing cached profiles under AppData or ~/Library works until an update migrates storage layout and your symlink breaks silently. If you need a headless Linux service, systemd units paired with a directory of include fragments achieve a similar outcome: the service reads a generated file that your automation assembles from remote plus local layers. For Windows GUI users who have not picked a client yet, our Clash Verge Rev Windows setup guide walks through installation paths that align with Meta-first workflows.

Failure Modes Worth Avoiding

First, stale references: if your override points a rule at PROXY_OFFICE but the subscription renamed that group during a template upgrade, the core may refuse to start or fall back to unintended behavior. Run the config validation your client exposes before applying changes live. Second, double merges: stacking multiple community snippets without understanding order can duplicate listeners or bind twice on the same port. Third, secret leakage: overrides are still YAML on disk; protect file permissions on shared machines and avoid pasting API tokens into screenshots when asking for help.

Finally, remember that overrides do not absolve you from reading release notes. Mihomo evolves; a key that worked in last year’s example may be deprecated today. Treat your local file like software: short comments that cite why a line exists beat clever hacks that nobody can delete safely later.

A Practical Workflow You Can Repeat

Start from a known-good subscription import with zero local edits. Capture a baseline log line for a test domain. Add one override block—say, a prepend rule that sends a single hostname to DIRECT—and reload. Confirm via logs that the new line matches before you expand scope. Only then introduce custom proxies or additional groups. That incremental rhythm prevents the classic failure mode where three untested changes fail together and you cannot tell which layer caused the regression.

When you share configs with friends or colleagues, export the override separately from the subscription URL. They can reuse your logic without inheriting your private nodes, and you avoid accidentally leaking internal infrastructure names embedded in group titles.

Trust, Transparency, and Where to Download

Clash Meta is open source; reading upstream documentation and changelogs remains the authoritative path when GUI labels lag behind core features. End users still benefit from downloading maintained clients from a curated download page rather than random mirrors, because verified distribution channels matter when your network stack handles sensitive traffic.

Closing Thoughts

Overrides exist because real networks refuse to fit a single vendor template. Subscriptions excel at delivering bulk nodes; they are poor at encoding your apartment’s IoT VLAN, your employer’s split-tunnel requirements, or the experimental relay you host for family overseas. Clash Meta gives you the vocabulary to describe those cases—proxies, groups, rules, DNS—and local merge layers give you a safe place to write them down without fighting the next subscription refresh.

Used with discipline, an override file is smaller than a README and clearer than a forgotten forum post. It travels with you across client upgrades, documents intent for your future self, and keeps the remote YAML exactly what the provider intended: a rotating list of nodes, not a scratchpad for everyone’s edge cases. Compared with brittle hand edits inside generated profiles, the override pattern is how you keep both automation and ownership.

If you want installers and pointers that stay current with Meta-class cores, start from our downloads hub and pick the build that matches your platform. → Download Clash for free and experience the difference between disposable profile hacks and a setup you can maintain for years.