How to Use a Static Proxy in Clash Verge Rev

A static proxy is an upstream proxy endpoint whose public exit IP is intended to stay stable. Clash Verge Rev does not supply that proxy; it runs the Mihomo core and routes your applications through credentials supplied by your proxy provider or network administrator. Use only a proxy you are authorized to access and follow the rules that apply to your network.

What you need before you start

Ask your provider or administrator for these values:

• Protocol: HTTP, HTTPS, or SOCKS5
• Server hostname or IP address
• Port
• Username and password, if authentication is required
• Whether TLS is required
• Whether UDP is supported, if you plan to use SOCKS5 for UDP traffic

Do not paste real credentials into screenshots, support forums, public repositories, or online YAML converters. A Clash profile stores the credentials locally as plain text.

Understand the two proxy endpoints

There are two different endpoints in this setup:

1. The static proxy is the remote upstream server, such as proxy.example.com:8080.
2. mixed-port: 7890 is the local listener opened by Mihomo on your computer. Applications connect to 127.0.0.1:7890, and Mihomo forwards selected traffic to the upstream static proxy.

Mihomo documents server and port as required outbound-proxy fields. Its mixed port accepts both HTTP(S) proxy and SOCKS5 client connections.

Create an HTTP or HTTPS static-proxy profile

Create a UTF-8 file named static-proxy.yaml and paste the following configuration. Replace only the sample host, port, username, and password with values from your provider.

mixed-port: 7890
allow-lan: false
mode: rule
log-level: info

proxies:
  - name: Static-HTTP
    type: http
    server: proxy.example.com
    port: 8080
    username: 'your_username'
    password: 'your_password'
    tls: false

proxy-groups:
  - name: PROXY
    type: select
    proxies:
      - Static-HTTP
      - DIRECT

rules:
  - MATCH,PROXY

Set tls: true only when the provider explicitly describes the endpoint as HTTPS or HTTP over TLS. Keep certificate verification enabled; do not add skip-cert-verify: true as a routine fix. If the proxy does not require authentication, remove the username and password lines.

Use SOCKS5 instead

If your endpoint is SOCKS5, keep the rest of the profile and replace the item under proxies with this one:

  - name: Static-SOCKS5
    type: socks5
    server: proxy.example.com
    port: 1080
    username: 'your_username'
    password: 'your_password'
    udp: false

Also replace Static-HTTP with Static-SOCKS5 inside the PROXY group. Change udp to true only when both your provider and the SOCKS5 server support UDP relay. An HTTP upstream is normally for TCP-based HTTP/HTTPS traffic and should not be treated as a universal UDP tunnel.

Import and activate the profile in Clash Verge Rev

The exact labels can vary slightly by release, but the workflow is stable:

1. Open the Profiles or Subscriptions page.
2. Choose New, select Local, and select static-proxy.yaml. You can also create an empty local profile, open its file, and paste the YAML.
3. Save the profile, then select it or use the profile card's Use action so it becomes active.
4. Open Proxies, expand the PROXY group, and select Static-HTTP or Static-SOCKS5.
5. Open Settings and enable System Proxy. Most browsers and desktop applications that follow the operating-system proxy will now use Mihomo.

For an application that ignores the system proxy, either configure that application to use 127.0.0.1:7890 or enable TUN Mode if you understand its wider routing impact and have the required system permissions. Start with System Proxy because it is easier to diagnose.

Verify that the static proxy is working

Use this sequence so you can identify where a failure occurs:

1. Confirm the local profile is marked active.
2. Confirm the intended node is selected in the PROXY group.
3. Run the node delay or availability test in Clash Verge Rev.
4. Enable System Proxy and open your provider's IP-check page or another reputable IP-check service.
5. Compare the reported exit IP with the static IP assigned by your provider.
6. Open Connections in Clash Verge Rev to confirm the test request matched the PROXY group.

A successful delay test proves that the upstream is reachable; it does not by itself prove that every application is using the system proxy.

Common problems and fixes

The profile imports, but no node appears

Check YAML indentation and confirm that the node name in proxy-groups exactly matches the name under proxies. YAML uses spaces, not tabs. After editing a local profile, save it and activate or reload it again.

Authentication fails

Re-copy the username and password from the provider. Keep them quoted when they contain :, #, spaces, or other YAML-sensitive characters. Confirm that the provider has not restricted the account to a different source IP.

The browser works, but another application does not

The application may ignore the operating-system proxy. Point its HTTP or SOCKS proxy setting to 127.0.0.1:7890, or test TUN Mode. Do not put the remote proxy address into the application's local proxy field when you intend Clash Verge Rev to manage routing.

The exit IP does not change

Confirm the local profile is active, the static node is selected, and System Proxy or TUN Mode is enabled. Also check that the application is not using its own VPN, proxy extension, or secure-DNS path that bypasses the operating-system proxy.

UDP traffic fails

HTTP upstream proxies do not provide general UDP forwarding. For SOCKS5, UDP works only when the upstream supports it and the profile has udp: true. Test TCP browsing first before adding UDP or TUN complexity.

HTTPS connections show certificate errors

Do not disable certificate verification first. Check the system clock, hostname, port, and provider instructions. For an HTTPS proxy, confirm that tls: true is correct and ask the provider whether a specific SNI value is required.

Security checklist

• Keep allow-lan: false unless you intentionally want other devices to reach the local listener.
• Store the YAML where only your user account can read it.
• Redact usernames, passwords, subscription URLs, and static IPs before sharing logs or screenshots.
• Use TLS when the provider supports it, and leave certificate verification enabled.
• Remove old profiles when credentials are rotated or access is revoked.
• Remember that a stable exit IP improves allowlisting and session consistency; it does not make traffic anonymous by itself.

Sources

• Clash Verge Rev project and feature overview
• Mihomo proxy common fields
• Mihomo HTTP proxy configuration
• Mihomo SOCKS5 proxy configuration
• Mihomo local proxy ports and mixed port
• Clash Verge Rev local-profile workflow