Clash FAQ and Troubleshooting

Rule mode matches traffic against the rules in the configuration file, allowing different websites to use a proxy or connect directly. It is the best choice for everyday use. Global mode sends all manageable connections to one proxy group and is useful for temporarily testing a node. Direct mode bypasses the proxy and is useful for troubleshooting or pausing proxy use. Switching modes does not change subscription content.

Enable the system proxy for browsers and most apps that follow the operating system's proxy settings. Games, command-line tools, some Microsoft Store apps, and software that ignores system proxy settings generally require TUN mode. For first-time setup, start with the system proxy. Once regular web access works, enable TUN only if specific apps need it, so troubleshooting stays focused.

Clash usually refers to the configuration format, proxy rule system, and related client ecosystem. Clash Meta is a kernel fork that supports and extends this ecosystem and is now primarily maintained under the name mihomo. Graphical clients such as Clash Verge Rev and FlClash can use the mihomo kernel, while each client handles its own interface, update process, and platform support.

A subscription link is the entry point for retrieving a remote configuration. After the client updates the subscription, it receives a configuration file. The file contains nodes, proxy groups, rules, DNS settings, and more; a node is simply one component used to establish a proxy connection. Subscription updates overwrite subscription-managed content, so local changes should go in the client's override or merge configuration.

Open the subscription link in a browser first and confirm that it is still valid and returns configuration content rather than a login page, notice page, or blank response. Then check that copying did not add spaces, line breaks, or Chinese punctuation. If the response is not in Clash configuration format, select Clash or mihomo format on the subscription provider's side, delete the failed entry, and import it again.

Exit the client, then relaunch it with administrator privileges and enable TUN again. If the client offers a service mode or helper service, install it from the Settings page first and restart the client. If it still fails, check whether security software is blocking network adapter creation, and use Device Manager to verify that no broken virtual network adapters remain.

The traditional system proxy may not directly handle some UWP apps. Open UWP loopback management from the client's Tools menu, select the Store apps that need network access, save the changes, and restart those apps. TUN mode usually does not require separate loopback settings; after switching modes, avoid keeping duplicate loopback rules enabled.

Open Privacy & Security in System Settings and allow the relevant client to load its network extension. If macOS asks you to install a helper, follow the entry in the client's Settings page and enter the system administrator password. Fully quit and reopen the client after authorization. If an old version keeps triggering the prompt, uninstall the old helper before installing the current version.

Update when nodes or rules change, or use the client's scheduled update feature. Updates usually replace the nodes, proxy groups, and rules generated by that subscription, so editing the subscription cache directly is not recommended. Put ports, DNS changes, or rules that must persist in local overrides, scripts, or a merged configuration.

Not necessarily. Latency tests depend on the selected test URL, timeout value, and current network conditions. A blocked test URL or DNS resolution problem can also produce a timeout. Try another test URL, then visit the target website in a browser. If every node times out at once, check the local network, subscription validity, system clock, and DNS first.

A mixed port accepts both HTTP and SOCKS connections and is usually the most convenient option when configuring a single app manually. HTTP and SOCKS ports are better for programs that require a specific protocol. The port must not be in use by another process. After changing it, update the proxy address in the app as well; the address is usually 127.0.0.1.

First confirm that the problem occurs only in Fake-IP mode. For LAN domains, printers, router administration addresses, and software that depends on real DNS results, add the relevant domains to the Fake-IP filter list. If the issue affects a wider range of traffic, switch temporarily to redir-host for testing. After changing the DNS mode, clear the system DNS cache and restart the affected apps.

Check that the client is running and that the system proxy switch is actually enabled. Then verify that the operating system's proxy address and the client's port match. A browser's standalone proxy extension, enterprise policy, or manual proxy setting may override the system settings, so disable those temporarily. Finally, use the connection log to confirm whether requests reach the client before deciding whether the issue is interception or a rule matching Direct.

Turn off the proxy first to confirm that the underlying network works, then update the subscription and check the system date and time zone. If only one node fails, try another node from the same subscription. If all nodes fail, check whether the subscription has expired, whether the network restricts the relevant protocol, and whether the firewall is blocking the client. Switching to mobile data or another broadband connection can help distinguish local configuration issues from upstream network problems.

Use the log to determine whether the failure is DNS resolution or node connectivity. Temporarily disable the client's built-in DNS and restore automatic DNS from the system to determine whether the issue comes from the Clash DNS configuration. With a custom configuration, check that nameserver, fallback, enhanced-mode, and the listening port are valid. Clear the DNS cache after making changes, then test again.

Turn off the system proxy and TUN inside the client, then quit normally. If the client has already crashed, disable the manual proxy in the operating system's network settings and remove any proxy address still pointing to 127.0.0.1. Then disable and re-enable the current network connection, restarting the system if necessary. Do not delete an active physical network adapter or reset all network settings indiscriminately.