Clash FAQ
Subscription imports, proxy setup, and connection troubleshooting. First check whether requests reach the core, then investigate rules, nodes, and DNS. Change one setting at a time.
Select a question to expand the answer. Setting names may vary slightly between clients; answers also include the relevant configuration fields. For a first-time setup, start with the Getting Started guide. For the full list of options and override methods, see the Advanced Setup manual.
Basics
Learn how clients, cores, and proxy modes differ. Installing the app or passing a test does not mean all traffic is being routed through it.
How are Clash, mihomo, and GUI clients related?
Clash is the name of a rule-based proxy project, while mihomo is a core that builds on and extends its configuration system. GUI clients such as Clash Verge Rev and FlClash handle subscription imports, proxy group selection, and system settings. A client opening successfully does not mean the core loaded the configuration correctly. If a configuration field is unsupported, check the active core in the client's About or core settings, then look for parsing errors in the logs. Do not assume that mihomo fields in a tutorial work with every older Clash core.
Why do I need a subscription or configuration file after installing a client?
A client reads configuration and forwards connections; installing it does not provide proxy servers. A subscription typically includes server details, proxy groups, and routing rules, though some subscriptions only provide nodes and require the client to generate rules. Get a configuration compatible with your core from your service provider, then import and enable it on the configuration page. Do not use a website login URL as a subscription URL or post your subscription link publicly: its access token may let others retrieve the same configuration.
Which mode should I use: Rule, Global, or Direct?
For everyday use, choose Rule mode, which corresponds to mode: rule. Connections are routed according to the order of rules. Global mode sends connections handled by the core through the global proxy group, making it useful for brief comparisons, but it does not take over every system app. Direct mode connects core-handled traffic straight to its destination; it does not turn off the system proxy. After changing modes, start a fresh test connection and check its actual route on the Connections page. Existing connections may keep the policy they started with.
What's the difference between system proxy and TUN mode?
System proxy changes the operating system's HTTP proxy settings, and only works for apps that honor them. Some command-line tools, games, and apps with their own network stacks bypass these settings. TUN uses a virtual network interface and routes to capture more IP traffic. It corresponds to tun.enable and requires system approval or service permissions. Start by testing with the system proxy, then enable TUN if needed. Routing, exclusion rules, and other VPNs can affect what TUN captures, so an enabled toggle does not guarantee that all traffic reaches the core.
Why can I still not open a website after a node passes the latency test?
A latency test usually measures how long a node takes to reach a specific test address. It does not prove that a target website, every protocol, or your current routing rules will work. On the Proxy page, make sure the target proxy group has the tested node selected. Then open the site and check the matched rule and route on the Connections page. If the connection never reaches the client, check the system or app proxy settings. If it does, review DNS, TLS, and connection-timeout errors in the logs. Don't keep changing configurations based on one latency number: the target service may restrict that route.
Glossary: Cores, proxy groups, and network stack terms.
Installation & Setup
Check the configuration format, account status, and local permissions. Load the subscription first, then enable features that need additional authorization.
How do I fix a subscription import failure or format error?
On the configuration page, add a remote configuration and paste the complete subscription URL. Check for extra spaces and make sure a messaging app did not truncate it. YAML parsing errors or missing proxy details in the logs may mean the download returned a login page, an error page, or an incompatible subscription format instead of a valid configuration. Ask your provider whether to use the Clash or mihomo format, then import it again. A Base64-encoded list of node links is not a complete YAML configuration. Keep the error line number when troubleshooting, but hide the subscription URL and server credentials before sharing screenshots.
My subscription stopped working, or an update removed nodes. What should I check first?
First, check your provider's account page for your plan status, a changed subscription URL, or node updates. Then manually refresh the configuration in your client. HTTP 401 or 403 errors often indicate authorization or access restrictions; a 404 may mean the URL changed. Repeatedly clicking Update will not fix these issues. After a successful update, confirm that this is the configuration currently enabled and check whether the client filters nodes. Do not send subscriptions containing access tokens through untrusted conversion services. If you have a usable local backup, save a copy before overwriting it.
Where do I find the mixed port, and what address should apps use?
The mixed port is usually listed under Ports or Proxy settings in the client, and corresponds to mixed-port. Port 7890 is a common example, not a universal default. Save any changes and reload the core if needed. Local apps that support manual HTTP or SOCKS5 proxies can use 127.0.0.1 and the actual mixed port, with the protocol required by the app. If the port is already in use, close duplicate client instances or choose an unused port, then update the app's proxy settings to match.
TUN reports insufficient permissions or fails to create a virtual network interface. What should I do?
Turn off TUN first, then check in the client settings whether service mode is installed and running. Windows desktop clients typically need an auxiliary service installed and administrator approval. On macOS, approve the network permissions requested by the client. On Linux, make sure the service can create TUN devices and manage routes. Running the entire client as administrator all the time is not the only fix. Check the logs for permission or device errors, then follow the client's instructions to repair the service. Temporarily disable other VPNs to rule out virtual interface and route conflicts.
macOS says the app can't be opened. How can I identify the problem?
First, check that the installer matches your Mac: Apple Silicon usually needs ARM64, while Intel needs x64. Make sure the download and extraction completed successfully. If macOS cannot verify the developer, confirm the app's source, then open Privacy & Security in System Settings and look for an option to allow that app to open. Follow the prompts to authorize it. A damaged-app warning and a permissions warning are different errors; the same command will not fix both. Don't disable macOS security system-wide just to launch one client. If the problem persists, note your macOS version and the full warning, then check the project's installation instructions.
Related resources: Client downloads and platform installation guides, Port settings.
Tips & Usage
Validate startup, switching, and overrides separately. Check the effective configuration and newly established connections.
Are launch at startup and auto-connect the same setting?
No. Launch at startup starts the client process; whether it also enables the system proxy, TUN, or the last-used configuration depends on the client's separate startup options. Enable startup in the client's settings, then check the system proxy, service mode, and configuration restore options individually. On Windows, check Startup apps in Task Manager; on macOS, check Login Items in System Settings. After restarting, confirm the core is running before checking proxy status. If a stale system proxy address remains while the client is not running, your browser may temporarily lose internet access.
How can I confirm a connection is using the new node after switching?
Switch the target proxy group on the Proxy page, then reopen your test page or close the app's existing connections on the Connections page so it creates new ones. Existing TCP connections and some reused sessions may continue through the old route, so refreshing a page once may not be enough for a valid comparison. Check the connection details for the matched rule, proxy chain, and destination domain to confirm the expected group handled the traffic. If the configuration uses an automatic url-test or fallback group, manual selection may be limited by the group type. First identify the group that actually routes the site's traffic instead of switching an unrelated group.
How can I bypass the proxy for one website without affecting others?
Keep Rule mode enabled and add a rule for the target domain in the client's rule or local override, such as DOMAIN-SUFFIX,example.com,DIRECT. Place it before broad rules that might match first and before MATCH. Replace `example.com` with the actual domain. A website may also request other domains for sign-in, images, and APIs, so check each connection on the Connections page. Use a persistent override where possible. Editing only the subscription-generated file may not last: the next update could overwrite your changes.
How can a phone or another computer use this device's proxy?
On a trusted local network, enable Allow LAN connections, corresponding to allow-lan: true, then check the listen address and make sure your firewall allows access from devices on the same network. On the other device, enter this computer's local IP address and actual mixed port. Do not use 127.0.0.1: on each device, that address points back to itself. Configure authentication and restrict allowed source addresses where possible, and turn off sharing when you no longer need it. Do not forward the proxy port to the public internet from your router. Whether a phone app uses a Wi-Fi proxy depends on how the app is built.
Will a subscription update overwrite my rule changes? How can I keep local settings?
Changes made directly to the YAML file for a remote subscription are often replaced at the next update. Put settings you want to keep, such as rules, dns, or tun, in the client's override, merge, or script feature, and check how that feature applies changes. Clients may append or replace rule lists, and may place them differently relative to MATCH. After an update, check the effective configuration and connection logs rather than only the editor contents. Save a local backup before making changes. To troubleshoot, temporarily disable overrides to distinguish subscription issues from local changes.
Setup guides: Launch at startup, Proxy groups and node selection.
Troubleshooting
Check your basic network, app proxy settings, matched rules, and proxy route in that order. Handle timeouts, authentication failures, and DNS errors separately.
Clash can't connect to the internet. How should I troubleshoot it?
Turn off the system proxy and TUN, then check that your basic network can reach sites that normally connect directly. If not, check Wi-Fi, the gateway, or a stale system proxy. Once the network works, enable only one client and confirm the configuration loaded, the core is running, and a proxy group has an available node. Then check whether the request appears on the Connections page. If it does not, investigate the app's proxy settings and routing. If it does, check the matched rule and DNS or connection errors. Change one setting at a time and retest so you can tell what fixed the problem.
Nodes keep timing out. How can I tell whether the problem is the subscription, network, or node?
First, confirm the subscription updated successfully and your account is active. Then test different nodes from the same subscription. If only a few nodes time out, check for node maintenance or restrictions on their exit routes. If all fail, check the system clock, server DNS resolution, and whether the current network blocks the connection. You can compare results on another trusted network, but a timeout does not automatically mean the port is wrong. Authentication failures, certificate errors, and connection timeouts have different causes; note the exact error keywords in the logs. If only the latency test fails while browsing works, check whether the test address is reachable through that route.
Why does my browser or command-line tool connect directly even though the system proxy is on?
Check that the system proxy points to the current client's listening port. Then check whether a browser extension, enterprise policy, or separate proxy setting overrides it. Command-line tools do not always read system proxy settings. For an explicit test, run curl -I --proxy http://127.0.0.1:7890 https://example.com, replacing the port with the actual value. If this request appears on the Connections page but regular requests do not, the issue is probably how the app connects to the proxy. Configure proxy environment variables as documented for the app, or consider TUN. Switching nodes repeatedly will not fix a request that never reaches the core.
Windows UWP apps can't use the local proxy. How can I fix this?
Some Windows apps running in the AppContainer sandbox are restricted from accessing loopback addresses on the local machine. Check this if a browser works but those apps do not. First confirm the app is actually trying to connect to the local proxy. Then use the client's UWP loopback tool to enable a loopback exemption only for the apps that need it. If no such tool is available, find the package family name and configure the exemption using Windows CheckNetIsolation commands. Administrator approval may be required. Not every Store app has the same restriction, and an exemption will not fix node or DNS problems. Avoid enabling it for every app.
TUN causes DNS issues or cuts off all internet access. Which settings should I check?
Turn off TUN to restore connectivity, then check service permissions and logs. Make sure another VPN is not changing routes at the same time. Review tun.enable, tun.auto-route, tun.auto-detect-interface, and dns.enable to confirm interface detection and DNS interception match your platform. With dns.enhanced-mode: fake-ip, the core must correctly associate domain mappings with subsequent connections. For apps with compatibility issues, adjust fake-ip-filter as needed. Reload the configuration after changes and clear the affected apps' DNS caches. Avoid mixing copied DNS sections from multiple sources. Once connectivity is restored, enable TUN features one at a time.
For a full settings reference, see the Advanced Setup manual. Don't overwrite a working configuration with one from an unfamiliar source.