Clash FAQ

Clash is an open-source rule-based proxy core and client ecosystem: the client reads the nodes and rules in a configuration file and decides, per connection, whether to route through a proxy or connect directly based on domain, IP, process, and similar criteria. A traditional VPN usually pushes all device traffic through a single tunnel, while Clash's core strength is traffic splitting — local sites go direct, services outside your region go through a node, and the two don't interfere with each other.

In daily use, you just import a subscription in the client, pick a node, and turn on the system proxy — the rules are already written by whoever maintains the config. No client yet? Head to Get the Client and pick one for your platform.

They form one evolutionary line: the original Clash core has stopped receiving updates; the community built a more capable Clash Meta core on top of it, which was later renamed mihomo, supporting more protocols and finer-grained rule types.

Mainstream clients today (Clash Plus, Clash Verge Rev, FlClash, and others) all bundle the mihomo core, and its config syntax remains backward compatible, so most older tutorials still apply. See the glossary and the beginner-to-advanced handbook for the full lineage.

A profile is mainly made up of three sections: proxies is the node list, recording each node's address, port, and encryption parameters; proxy-groups defines grouping strategies such as manual selection, automatic latency testing, and failover; rules is the rule list, matched top to bottom, deciding which proxy group handles each connection.

A subscription link from a provider is essentially a remote profile that refreshes on a schedule. For a section-by-section breakdown, read Profile Structure Explained & Managing Multiple Configs.

For everyday use, stick with Rule mode: traffic is automatically split according to the rules in your config, with local traffic going direct and traffic outside your region going through a proxy — the best balance of speed and compatibility. Global mode sends all traffic through the current node; use it only temporarily when you need every app to go through the proxy or when debugging rules. Direct mode effectively disables the proxy, sending all traffic straight out.

Picking the wrong mode is the most common source of beginner problems — check the current mode first whenever you can't get online.

Clash-style clients need to modify system proxy settings and create a virtual network adapter, and these behaviors easily trigger heuristic false positives. Fix: after confirming the installer came from this site's download page or an official release channel, restore the file from your antivirus quarantine and add the install directory to the allowlist (trusted zone); in Windows Defender the path is "Virus & threat protection → Exclusions → Add a folder."

Don't download installers from unverified cloud-drive links — a flag in that scenario deserves real scrutiny. See the full process in Windows Installation Walkthrough.

First, copy the Clash subscription link from your provider's user dashboard (make sure it's the Clash format, not a generic share link). Open the client's "Config" or "Subscriptions" page, paste the link, and click import or download; the client will fetch the remote config and show the node count. Once imported, go back to the main screen, pick a node, and turn on the system proxy.

If you get a format error, check whether the link is complete and whether it includes a format parameter like flag=clash at the end, or use the dedicated Clash link your provider offers. See the step-by-step version with screenshots in the setup guide.

This is macOS Gatekeeper's default block on apps not distributed through the App Store. Fix: in Finder, right-click the app icon → choose "Open", then click "Open" again in the dialog that appears — after that it will launch normally; or go to "System Settings → Privacy & Security," scroll to the bottom, find the blocked-app notice, and click "Open Anyway."

If it says "the app is damaged," you'll usually need to run xattr -cr /Applications/AppName.app in Terminal to clear the quarantine attribute, then reopen it.

Launch on startup: just toggle the "Launch at Login" switch in the client's settings; on Windows, some clients also offer a "Silently launch as administrator" option, which pairs well with TUN mode for stability.

Automatic subscription updates: set an update interval for each profile on the config or subscription management page — 720–1440 minutes (half a day to a day) is recommended; too short an interval means frequent requests to the subscription server, and some providers will rate-limit you. After setting it up, check the "Last updated" timestamp on the config page to confirm the automatic update is actually running. See the update interval guide for more.

The first time you tap connect, the system will show a VPN connection request — you must tap "Allow". On Android, Clash takes over traffic through VpnService, and this step is mandatory; without granting it, the app simply won't work.

It's also worth setting the client to "unrestricted" in your battery optimization settings and allowing background activity and autostart (the exact menu varies by manufacturer skin), otherwise the system tends to kill the client after the screen turns off, breaking the connection. Enabling notification permission is also recommended so you can check connection status. Find the Android client in the download page's Android section.

On the client's "Proxies" or "Nodes" page, click the speed test button (often a lightning bolt or a latency test icon); the client pings a test URL through each node and shows the round-trip time in milliseconds: lower is better, and a "Timeout" label means that node is currently unusable.

Selection tips: favor nodes with low, stable latency; for bandwidth-heavy use like video streaming, pay attention to throughput and confirm by actually connecting and test-playing. You can also just use an "Auto-select" proxy group and let the client periodically pick the fastest node for you.

System proxy simply "broadcasts" a proxy address to apps, and whether an app respects it is up to that app — browsers do, but many command-line tools, games, and some client software ignore it. TUN mode creates a virtual network adapter and takes over all traffic at the network layer, so every app gets routed regardless of whether it supports proxy settings.

Turn on TUN when you notice an app isn't going through the proxy, or when you need terminal commands to be routed uniformly. Note that TUN requires administrator or service-mode permissions, and you should close any other VPN-style virtual adapter software first to avoid conflicts. See the full setup steps in the TUN mode tutorial.

Stay in Rule mode; routing is controlled by the rules section in the config: DOMAIN-SUFFIX matches by domain suffix, GEOIP matches by the destination IP's region, and PROCESS-NAME matches by process name (requires TUN or enhanced mode).

To route one site through a specific line, add DOMAIN-SUFFIX,example.com,proxy-group-name near the top of the rule list — rules are matched top to bottom, and the first match wins. Most clients also offer a graphical rule editor or rule override feature, so you don't have to hand-edit YAML. See the rule routing chapter of the advanced handbook for the full syntax breakdown.

Turn on "Allow LAN" in the client's settings, and note this machine's LAN IP and mixed port (commonly 7890). On other devices' Wi-Fi proxy settings, enter this machine's IP as the server and 7890 as the port to borrow its routing exit.

Notes: only enable this on a trusted home or office network; make sure the firewall allows the port; and sharing stops working once this machine goes to sleep.

GEOIP and GEOSITE rules rely on a local geo database, and an outdated database can cause incorrect routing decisions — for example, a newly added domestic CDN range might get misclassified as foreign.

Mainstream clients offer a "GeoIP data update" button in settings; clicking it every month or two is enough, and some clients update it automatically alongside the core. If you notice a site that should obviously go direct is instead going through the proxy, update the geo data first before digging into the rules themselves.

Work through four checks in order: first, test node latency — if everything times out, the nodes in your subscription have failed, so update the subscription or contact your provider; second, check the proxy mode — accidentally being in Direct mode means the proxy isn't actually in use; third, switch to a different node and try again to rule out a single bad node; fourth, open the client logs and see whether the matched rule is DIRECT, which would mean the rule engine classified the target as a direct connection.

Working through these usually pins down the problem within five minutes. See the full nine-point checklist in the troubleshooting checklist article.

Errors fall into three buckets: a 404 or 403 response usually means the subscription link has expired or been reset, so copy a new one from your provider's dashboard; a timeout or connection failure means the subscription server is being blocked on the network, so manually pick a working node first and let the update request go through the proxy (most clients have a toggle for this); a parse-failure message means the content you fetched isn't valid YAML, often due to a wrong format parameter in the link or the provider temporarily returning an error page.

Match the error to the right fix and you're done — see the dedicated subscription-failure article for a breakdown of all five causes.

First confirm the proxy was actually written into your system settings: on Windows, check "Settings → Network & Internet → Proxy" — it should show an address like 127.0.0.1:7890; if it's empty, the client failed to write the setting, so try restarting the client as administrator.

Next check whether your browser has a proxy management extension installed (such as SwitchyOmega); its own settings can override the system proxy, so switch it to "follow system settings." Finally, make sure no other proxy software is modifying system settings at the same time — two clients overwriting each other is a common conflict.

For isolation reasons, Windows blocks UWP apps from accessing the local loopback address by default, so Store apps can't reach the proxy port on 127.0.0.1.

There are two fixes: use the client's built-in UWP loopback exemption tool (some clients expose this in settings) and check the target app to lift the restriction; or simply enable TUN mode, which takes over traffic at the network layer and bypasses the loopback restriction entirely. Restart the affected app after making the change to verify.

This means something on your machine is already using the default port — usually another proxy client that didn't fully quit, or two Clash instances running at once. Quit all proxy-related programs before launching; if the conflict persists, on Windows run netstat -ano | findstr 7890 to find the process holding the port and end it.

You can also just change the mixed port to something free like 7891 in the client's settings — just remember to update anywhere referencing the old port, such as LAN sharing setups.