Kovalink in Clash, alongside a company VPN

When the same computer also needs the company VPN (OpenVPN and the like), load the Kovalink subscription in Clash: the company intranet goes through the company VPN, everything else through Kovalink.

1. What you need

  • A client built on the mihomo (Clash Meta) kernel. On Windows / macOS use Clash Verge Rev (GitHub releases page); on Android use Clash Meta for Android (releases page) or FlClash (releases page).
  • The original Clash, Clash for Windows, and Clash Premium do not support VLESS + REALITY and will not work.
  • Subscription link: open Kovalink on iPhone / iPad / Mac, go to Settings → Account → Windows / Android, and tap "Generate link". Copy the link, or let the PC / phone scan the QR code straight from the app.
  • No Apple device with Kovalink? The link follows your account — sign in once on any iPhone / iPad / Mac and generate it there.

2. Windows / macOS (Clash Verge Rev)

  1. Open "Profiles", paste the subscription link into the "Profile URL" field at the top, and click "Import"; if the client says it cannot recognize the link, append ?format=clash to it and import again.
  2. Click the new profile card (or right-click → "Select") to make it the active configuration.
  3. Open "Proxies", set the mode to "Rule", and pick a node in the Kovalink group (the first one by default).
  4. In "Settings" → "System Setting", turn on "System Proxy"; do not turn on "Tun Mode".
  5. Connect the company VPN as usual — either one can connect first; disconnect the Kovalink app on this computer first, and never run both at once.

3. Android (Clash Meta for Android / FlClash)

Android runs only one VPN app at a time, so Clash cannot be on together with the company VPN — the steps below are for when you do not need the company VPN.

  • Clash Meta for Android: "Profiles" → New Profile → "Import from URL" → fill in the profile name and the profile URL → "Save" → tap the profile to enable it → "Tap to start" on the main screen → pick a node under "Proxies".
  • FlClash: "Profiles" → "Add profile" → "Import from URL" → paste the link → "Submit" → tap the profile card → "Start" on the "Dashboard".

4. How it coexists with a company VPN

In the Clash configuration, the following addresses always connect directly and never go through Kovalink:

  • The private ranges 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10, and the IPv6 range fc00::/7;
  • Loopback and link-local addresses;
  • Domains ending in .local, .lan, .internal, .corp, .home.arpa, and localhost.

Company intranet domains (for example git.company.com): Clash first resolves the name with the DNS your computer is currently using; if the answer is one of the private ranges above, the connection goes direct and is handed to the company VPN. The trade-off: the DNS server your computer is currently using can see the names of the sites you visit — while the company VPN is connected, that may be the company DNS. If the company VPN sets DNS only for the company domains, Clash cannot resolve the intranet addresses and those domains will not open; the same happens when the intranet uses public addresses. See below for the fix.

Everything else goes through the Kovalink node group (the first node by default).

Ground rules and limits:

  • Use Clash in "System Proxy" mode and do not turn on "Tun Mode". This leaves the company VPN's routes untouched. In System Proxy mode, the browser and most programs that follow the system proxy go through Kovalink; programs that ignore the system proxy use the normal network (and the company VPN) as before.
  • If the company VPN captures all traffic (full-tunnel mode), Kovalink's own connections also pass through the company network — whether they can connect depends on that network.
  • If a company intranet domain does not open: in Clash Verge Rev, open "Settings" and click the settings icon next to "System Proxy" to open "System Proxy Setting". Turn off "Always use Default Bypass", and in the "Proxy Bypass Settings" box that appears keep the existing entries and add *.example.com at the end (replace it with your company domain; separate entries with ; on Windows and , on macOS), then click "Save". Those addresses then skip Clash and go straight to the system and the company VPN (company DNS, company VPN routes).

5. Rules and troubleshooting

  • One link = one device. Switching to a new PC or phone? "Reset link" in the app first — the old link stops working immediately — then import the new link on the new device.
  • The link is your credential. Do not share it.
  • Subscriptions refresh automatically once a day; new nodes appear on their own, no re-import needed.
  • A total of 0 B or a full bar on the profile card does not mean your data has run out.
  • The Clash configuration carries only the main route (REALITY) for each node; the backup routes (XHTTP, the ones marked Fallback) currently exist only in v2rayN / v2rayNG.
  • Import fails: make sure the client runs the mihomo (Clash Meta) kernel, append ?format=clash to the link, and try again.
  • Intranet does not open: make sure "System Proxy" is on instead of "Tun Mode", and add the company domain to "Proxy Bypass Settings" (see section 4).
  • Still stuck: email kova@kovaview.com with a screenshot of the Clash log.

Using v2rayN / v2rayNG? Read the Windows & Android guide.

On iPhone, iPad, or Mac? Read the Kovalink guide; for the Mac app, head to the download page.