oixClash installation and configuration

For Merlin firmware with the KoolCenter software center (Merlin mods and modified stock firmware). Use the build linked by the download center. oixClash takes over LAN devices with the configuration oixCloud delivers, so LAN devices need the correct gateway and DNS but no separate client installation. The plugin cannot import other subscriptions. The plugin page is in Chinese, so its labels below are given in Chinese with a translation.

1. Choose the package

Open 软件中心 (Software Center) in the router admin page, check the platform it reports, then click the matching package below to download it directly. You do not need to open GitHub:

↔ Swipe left or right to see all columns

Platform	Package	Common models
hnd	Download	Most models, such as RT-AX86U, RT-AX88U, GT-AX6000 and GT-AX11000
mtk	Download	TUF-AX4200Q, TX-AX6000, RT-AX57 Go and similar
qca	Download	RT-AX89X
ipq32	Download	ZenWiFi BD4
ipq64	Download	Model code TUF_6500

These links follow the latest stable release. You can also download the SHA256 checksums to verify file integrity. If a direct link is unavailable, use the matching platform file from the latest GitHub release.

From 0.0.15, the hnd package carries both an armv7 and an arm64 core. Models with a 64-bit system, such as RT-AX86U and GT-AX6000, use the arm64 core automatically; it can use the CPU's AES instructions for encryption and is much faster than the armv7 core. 32-bit models such as RT-AX58U and TUF-AX5400 keep the armv7 core. Offline installation and in-plugin updates choose automatically and keep only the chosen core on JFFS; click 自检 (Self-check) to see which core is in use.

Package size varies by release and platform. Reserve JFFS space for the actual downloaded archive and extracted files. Models with 512 MB of RAM or more can use the defaults; smaller models, including 256 MB routers, can use memory optimization, available from 0.0.3. In normal mode, extracting the core into RAM consumes memory in addition to the running proxy, GeoIP data and dashboard. The amount depends on the build and architecture.

2. Install offline

1. Open 软件中心 → 离线安装 (Software Center → Offline Install) and upload the downloaded package.
2. Keep the file name. Remove any (1) a browser adds to repeated downloads, or the software center refuses the package.
3. When the installation finishes, return to the software center and open oixClash.

If the platform does not match, the software center says so and stops; install the package for your platform instead.

3. Sign in to oixCloud

English reference with Chinese control names · Chinese-only plugin UI · Click to enlarge

For the first sign-in under oixCloud 账号, choose email and password to create the dedicated oixClash token. You can use that Access Token afterward. See first sign-in for obtaining an oixCloud password after Google registration and restricting client password sign-in.

Sign-in methods:

• 登录令牌 (sign-in token): paste the access token copied from the oixCloud website or app, not a subscription URL.
• 邮箱和密码 (email and password): the password is only used for this sign-in and is not stored on the router.

After signing in, the page shows the account, plan, expiry date and traffic. A token from another oixCloud client is swapped for oixClash's own token, so its node filter is kept separately; tokens created on the website cannot be swapped and are used as they are.

4. Turn on the proxy

English reference with Chinese control names · Chinese-only plugin UI · Click to enlarge

1. Under 运行 (Run), turn on the switch and click 保存并应用 (Save and Apply).
2. Wait for the log to report a successful start. The first run also downloads GeoIP data and takes a moment.
3. 运行状态 (Status) shows the core as running with its version. This confirms startup; verify a LAN connection in the next section.

oixClash captures main-LAN DNS and eligible TCP according to device and port settings. From 0.0.14, 运行 → 仅代理常用端口 (Run → Common ports only) is enabled by default: common web/mail destination ports are captured and other ports go direct. An existing disabled setting is preserved.

For a game, call or other service using uncommon ports, disable 仅代理常用端口 if needed and save. UDP also requires UDP 转发 (UDP forwarding); verify after the status reports it active. Without UDP forwarding, keep 屏蔽 QUIC (Block QUIC) on for browser TCP fallback.

Port filtering cannot identify every BT/P2P transfer; downloads on common ports can still use the proxy. Device bypass, DNS capture and QUIC blocking retain their own settings, so the UDP switch alone does not establish capture. QUIC blocking does not affect private networks such as the LAN or a VPN.

Small-memory routers

From oixClash 0.0.3, 内存优化 (Memory Optimization) turns on automatically at first installation when detected total memory is below 384 MB. Upgrades preserve an existing choice. You can also change it under 运行 → 内存优化.

1. Enable 内存优化 and click 保存并应用. Applying settings stops the proxy before checking the configuration, so LAN traffic temporarily goes direct. If validation fails, inspect the recovery result: current versions attempt to restore the previous settings and running state. Do not assume the new settings were applied.
2. After startup, check the text below this option. 内核在 JFFS 上运行 means the core file runs from flash. JFFS 空间不足，内核仍解压到内存 means it is still extracted to RAM; free space used by unneeded plugins, then save and verify again.
3. Click 自检 (Self-check), check free JFFS space and available memory, then verify a LAN connection as described below.

↔ Swipe left or right to see all columns

Change	What to consider
Store the core and dashboard on JFFS when space permits	Reduces memory used by files but needs more flash space. The proxy process still uses RAM.
Use a smaller GeoIP database	Covers only CN and a few other regions. Check matching if custom GEOIP rules reference other regions.
Cap the core's memory	Reclaims memory early near the cap to limit peaks, which costs CPU time at that point. It does not guarantee every configuration will run on a 256 MB router.

After disabling memory optimization, a core already stored on JFFS stays there. The next plugin update restores the compressed archive for extraction to RAM at run time.

5. Verify with a LAN device

1. Let the test device use the gateway and DNS the router hands out, and turn off the browser's secure DNS before testing.
2. Visit a site that should go direct and one that needs the proxy.
3. Click 打开控制面板 (Open Dashboard) and check the destination, matched rule and outbound in the connection list.

Traffic of the router itself and of guest networks does not pass through oixClash. Devices that use IPv6 bypass the proxy; the status warns about it. To avoid this bypass, set the connection type on the router's IPv6 page to disabled and verify from a LAN device. The website's IPv4 Only controls remote-node egress and does not fix IPv6 bypass on the router.

6. Nodes, filters and updates

• Switch nodes: click 打开控制面板 and pick a node in a proxy group; the choice survives restarts.
• Node filter: 订阅管理 (Subscription Management) in the account row opens the website editor. After saving, click 更新节点 (Update Nodes) in the plugin to fetch them now, or wait for the daily update. The filter applies to every oixClash signed in to the same account; see Subscriptions and filters.
• Update the plugin: while it is turned on, the plugin checks for a new version daily, or click 检查更新 (Check for Updates) next to the version. When 更新到 x.y.z (Update to x.y.z) appears, click it; the plugin downloads and verifies the package before installing, and the proxy pauses briefly.

If the in-plugin updater cannot verify a package, or an older self-check reports missing sha256sum, download the matching package from this page and update through 软件中心 → 离线安装 (Software Center → Offline Install). Do not install a package with a checksum mismatch; download it again and verify SHA256.

7. Edit account custom rules

From oixClash 0.0.2, 自定义规则 (Custom Rules) edits the same account rules as the website. These rules precede the defaults. Saving affects other clients that use this account rule list. Saving an empty editor deletes the entire account list, so keep a copy of anything you need first.

English reference with Chinese control names · Chinese-only plugin UI · Click to enlarge

1. Sign in and click 读取面板规则 (Read Panel Rules). Wait until the status confirms that the rules are ready to edit.
2. Enter one standard Surge-format rule per line, without rules: or a leading dash. Lines starting with # or // are comments. Use DIRECT, REJECT, or a policy group that exists in the configuration.
3. Click 保存到面板并更新 (Save to Panel and Update), then read the log. A running plugin updates and checks the configuration; a stopped plugin fetches and checks it when next enabled.
4. Make a new connection from a LAN device and verify the matched rule and outbound in the dashboard.

DOMAIN-SUFFIX,example.com,DIRECT
DOMAIN,ads.example.com,REJECT

The router editor handles up to 8192 UTF-8 bytes. Some characters use multiple bytes. Edit longer lists on the website and then click 更新节点 (Update Nodes); do not truncate the list to fit the editor.

↔ Swipe left or right to see all columns

Message or situation	What to do
Another page changed the rules	Keep a separate copy of your draft, read the latest rules, then merge your changes instead of overwriting the newer content.
Saved to the panel, but not applied on the router	The website list has changed. Fix the rule or network problem, then click 更新节点 and verify a connection.
Reading fails, or this version has no editor	Edit account rules on the website, then click 更新节点. Reading and saving within the plugin also require support from the website.

Reading again replaces unsaved edits, so review the confirmation first. Account rules and node filters have different sharing scopes; see Subscriptions and filters.

Troubleshooting

↔ Swipe left or right to see all columns

Symptom	Next step
Offline install reports a platform mismatch or a bad file name	Download the package for the platform the software center reports and remove (1) from the file name
运行状态 shows 登录已失效 (sign-in expired)	Click 退出登录 (Sign out), then sign in again
Status shows 账号没有可用的套餐 (no active plan)	Renew, then click 保存并应用
Status shows 路由器时间尚未同步 (router time not synchronized), or the log says the time is wrong	Check the time zone and NTP server under Administration → System; the plugin starts by itself once the time syncs
Not enough memory; the core cannot start	Enable memory optimization, close unneeded plugins, then click 保存并应用. After a memory failure, the watchdog retries every 30 minutes.
Memory optimization is on, but the core is still extracted to RAM	Check JFFS space and the plugin log, free flash space, then save again. Enabling the option alone does not confirm a successful move.
The in-plugin updater cannot verify a package	Download the package for your platform and install it offline; do not skip integrity verification.
UDP forwarding does not take effect	Click 自检 (Self-check) and look at the TPROXY and policy routing items; firmware without support only loses UDP, TCP stays proxied
Conflict with fancyss or MerlinClash	Turn off the other proxy plugin; only one can run
The router runs but a device still misbehaves	Check the device's gateway, DNS and IPv6, then the dashboard's connection list
The same node is slower through the router than on a phone or computer	• Check the core architecture: Click 自检 (Self-check) and check the core—64-bit hnd models should show 使用 arm64 内核 (using the arm64 core); if it still shows armv7, update to 0.0.15 or reinstall offline. 32-bit models are limited by the CPU. • Check port filtering: Speed tests on uncommon ports go direct, so turn off 仅代理常用端口 (Common ports only) temporarily before comparing

Before contacting support, click 自检 and send its result together with the plugin log from 查看日志 (View Log), with account details hidden.