Monitor traffic with an external dashboard

What the control interface is

When the core starts it opens an HTTP interface on the local machine. In the config it is external-controller, commonly 127.0.0.1:9090 by default. Your client's own connections, rules and logs pages are reading that interface — the UI is a skin over it. Being a public interface, other programs can read it too.

external-controller: 127.0.0.1:9090
secret: "put a long random string here"
external-ui: ui

secret is the access token a dashboard asks for. Leaving it empty means anything that can reach that address and port can switch your nodes, change the mode and read the domains you have visited. external-ui is optional: drop a dashboard's static files into that folder and the core serves them on port 9090, so you do not depend on a site you do not control.

Three kinds of dashboard

• Built into the client. Clash Verge Rev, Mihomo Party and similar desktop apps already have connections, rules and logs on screen. For everyday use that is plenty and there is nothing to set up.
• Standalone open-source web dashboards — metacubexd, yacd and zashboard are the names you will run into most. More columns, better sorting, bulk disconnects; generally finer-grained than the built-in view.
• Remote management. When the core runs on a router or the box that stays on at home and you want to drive it from a laptop browser, an external dashboard stops being a nicety and becomes the only option.

Getting connected

1. Check which address and port external-controller actually names in the config. If you changed it, reload the config — restarting only the window does not count.
2. Open the dashboard and fill in the host (127.0.0.1 for the local machine), the port, and the secret.
3. If it will not connect, separate the two failure modes: a wrong secret normally gives you an explicit unauthorized message, while a blocked port just spins or times out.
4. A dashboard served over https talking to a plain http interface on your machine gets blocked as mixed content. Either run the dashboard locally or allow that exception for the site in your browser.

What a dashboard is genuinely better at

• Following one domain. Search for it in the connection list and you see which rule matched, which node it left through, how long it has been open and how many bytes went each way. When a rule you wrote is not taking effect, this is where you find the earlier rule that swallowed it.
• Finding the bandwidth hog. Sort by upload or download and whatever is saturating the line floats to the top immediately. Eight times out of ten it is some application updating in the background.
• Killing a wedged connection. If one has been idle for ages while still holding a node, close it and the program will reconnect and pass through the rules again. Same trick after editing rules — old connections do not migrate, they stay pinned to the old exit.

Do not bind it to 0.0.0.0

Change external-controller from 127.0.0.1 to 0.0.0.0 and every device on the network can reach that interface — an interface that can rewrite your config, switch your nodes, and list the domains you visited. On a dorm, office or cafe network that is leaving the remote control on the table.

If you really do need remote access: set a long secret, only expose it on a network you trust, or tunnel it over SSH instead of opening the port. When you use someone else's hosted dashboard page, the requests go straight from your browser to your own interface and the data never touches their server — but the script running on that page is still theirs. If that bothers you, host the files yourself or use external-ui.