Clash FAQs

Clash originally referred to a proxy core and its configuration ecosystem. Clash Meta was the former name of a forked core project, now maintained as mihomo. Graphical clients handle subscription imports, proxy group selection, system proxy settings and logs; the core parses configuration, matches rules and establishes connections. Similar client names do not guarantee the same core or protocol support. Before troubleshooting, note the client name and version, along with the core version, from the About page. Then follow the settings for that specific project rather than relying on screenshots from another client.

The client provides the interface and network handling, while the configuration defines proxy servers, proxy groups, rules and DNS settings. Installing the client alone does not provide proxy servers to connect to. If you already have a configuration, import it by URL or from a local file on the configuration page. Enable it, then check that the proxy groups contain usable options. Subscriptions often contain access credentials, so get them only from trusted sources. Never post a full subscription URL on public forums, online conversion sites or in screenshots.

Use Rule mode for everyday browsing: rules are evaluated from top to bottom to send connections to DIRECT, a proxy group or REJECT. Global mode applies the global policy to connections that have already reached the core, making it useful for briefly checking whether rules affect the result. Direct mode sends intercepted connections straight to their destinations. The mode selector does not control traffic interception: switching to Global will not capture an app that does not use the system proxy, an explicit proxy or TUN. When testing is done, switch back to Rule mode and start a new connection.

The system proxy writes a proxy address into the operating system settings and mainly serves apps that follow those settings. TUN uses a virtual network interface and routing to capture eligible traffic, including traffic from apps that ignore the system proxy. You do not need both enabled for proxying to work. Start by testing a browser with the system proxy, then enable TUN if your apps require it; change one setting at a time. TUN coverage also depends on routing, exclusions and DNS settings, so an enabled switch does not mean all traffic is captured.

Proxy servers, proxy groups and common rules can often be reused, provided the target client’s core supports the same syntax and protocols. Network interface names, file paths, scripts, external control interfaces and TUN settings often need platform-specific changes. When migrating, import the original configuration and check the parse results before enabling traffic capture separately. Do not overwrite a new installation by copying the old device’s runtime directory. Subscription updates may also overwrite local edits, so keep ongoing changes in the client’s supported override or merge settings.

Start by reading the full error on the configuration page. For a timeout, check network access and whether the update depends on the current proxy. For HTTP 401 or 403, verify the subscription authorization and whether the URL is still valid. For certificate errors, correct the system clock, then check the certificate chain and network; do not disable certificate verification. For parse errors, confirm the response is Clash YAML, not a webpage, login prompt or node list in another format. When copying the URL again, remove leading and trailing spaces and keep all parameters intact. Avoid exposing the URL in public logs.

Use the client’s configuration checker first, and follow the reported line number to find indentation, field or reference issues. YAML uses spaces for indentation; avoid tabs. Node names referenced by proxy groups and proxy group names used in rules must match their definitions, including capitalization. If a proxy type or field is unsupported, check core compatibility instead of repeatedly reinstalling the client. Keep a copy of the original file, change one thing at a time, and run the check again. Importing only confirms that the file was read; you still need to enable the configuration and confirm the core starts successfully.

First make sure the core is running. Then check that the listening address and port in the system proxy settings match the client. 7890 is a common example of a mixed port, not a guaranteed port for every client. Check for browser proxy extensions, manual proxy settings and system bypass lists that may override the client. Next, open the Connections page and visit the destination in a new tab. Check whether a connection appears and which rule it matches. If there’s no connection entry, investigate how traffic is being intercepted. If it shows DIRECT, check the rules and policy rather than just switching nodes.

On Windows, turn off TUN and check whether the client offers an option to install or repair its service mode. Grant permission when prompted, then restart the client. Some clients can also complete the setup when run as administrator. On macOS and Linux, follow the project’s documentation to authorize the network extension, helper service or required capabilities; Windows steps do not apply. If the service fails to start, check the specific log error, then look for security software blocking it, virtual network adapter issues or conflicts with other VPNs. Re-enable TUN after fixing permissions, and avoid repeatedly reinstalling the service.

First confirm that the active configuration is the one you just imported, not another configuration with the same name. If it uses proxy-providers, check that the provider resource downloaded successfully and that the group’s use, filter or exclude-filter settings have not filtered out every entry. Defining proxies in a configuration does not automatically make them appear in every group. Incomplete subscription responses, an expired plan or unsupported protocols can also cause missing entries. Keep the original configuration and check for update errors. Temporarily disabling custom overrides can help distinguish a subscription issue from a local merge issue.

On the configuration page, open the subscription’s edit or update settings and look for the auto-update interval and update proxy options. Labels and units vary by client, so follow the interface. Set the interval according to the provider’s requirements to avoid triggering rate limits with overly frequent requests. If a direct update fails but an existing proxy still works, try updating through that proxy. If you need to update the subscription before you can connect, relying on a broken proxy for the update creates a loop. After confirming that a manual update works, check that auto-updates run as expected.

Rules are checked in order, and matching one usually stops evaluation. Put specific domain rules before broader ones, and leave MATCH as the fallback at the end. For example, DOMAIN-SUFFIX,github.com,Proxy requires a proxy group named Proxy in the configuration. Use the client’s rule override feature to add or prepend rules so subscription updates do not overwrite them. Save and reload the configuration, then check the matched rule with a new connection. Existing long-lived connections generally do not switch to a new route immediately when rules change.

Open the Connections page and filter by destination domain, process name or destination address. Check the matched rule, policy chain and final selected proxy. A proxy group name is only the selection point, not necessarily the final exit; follow nested groups through the policy chain. Before testing, close the app’s existing connections and make a new request to avoid interference from connection reuse. The exit address shown in a browser only reflects that request; it does not prove that other apps, UDP traffic or all domains follow the same route.

Enable LAN access in the client and make sure it listens beyond the local loopback address. On other devices, enter the LAN address of the computer running the client and the actual listening port. allow-lan: false disables LAN access; check the current configuration for the default value. When changing firewall rules, allow access only on trusted private networks and for necessary addresses. Configure authentication if the core supports it, and never expose the proxy port to the public internet. Turn off sharing when it is no longer needed, and check that the external control interface has not been exposed as well.

Keep the client and core versions, operating system version, time of the issue, steps taken and full error type. Start with the info log level; raise it briefly only to reproduce the issue, then restore it to avoid generating excessive logs. Before sharing, redact subscription URLs, authorization parameters, passwords, control interface keys, and any domains or addresses you do not want made public. Do not upload the entire configuration directory. Share only a small set of relevant logs and redacted configuration snippets, and note whether the system proxy and TUN were enabled.

A node test is a single request from the core to a specified test URL. A timeout may mean the test URL is unreachable, DNS resolution failed or the server connection failed; it does not by itself mean all connections are down. First check whether the websites that open are using the proxy rather than DIRECT or cached content. Then try the same node with different destinations and check whether the error occurs during DNS resolution, the handshake or data transfer. If all destinations fail, check the server status, subscription validity and local network. You can change the test URL according to the client’s documentation; do not delete a configuration based on a single test.

Turn off TUN first and confirm that your regular network connection is back. Then test with just one traffic-capture tool enabled. Other VPNs, virtual machine adapters and security software can also modify the default route or DNS, causing traffic to bypass the proxy, loop back or fail to resolve. Check logs for network adapter creation, route setup and DNS listener errors, then verify service permissions, port conflicts and automatic routing settings in order. Do not delete all system routes. If you need to use a corporate VPN at the same time, configure excluded subnets according to its network requirements; do not assume two automatic routing setups will work together without changes.

Start by defining the expected DNS behavior: which resolver path should handle each domain, and should DNS connections go direct or through the proxy? A DNS test site shows the resolver’s exit location; a different region alone does not prove a leak. Browser Secure DNS, encrypted system DNS, IPv6 and TUN DNS hijacking settings can all cause DNS requests to bypass the client. Record these settings one at a time, clear the relevant caches and run the test again. Use client logs to confirm the request path. Avoid changing fake-ip, nameserver and system DNS settings at random all at once, or it will be hard to identify what actually changed.

Some Windows apps restricted by app-container isolation cannot access a local loopback proxy directly, even if a browser connects successfully. First confirm that the affected app uses the system proxy, then check whether the client offers a UWP loopback exemption option. To handle it manually, open a terminal as administrator and run CheckNetIsolation LoopbackExempt -s to view existing exemptions. Add one using the app’s actual package family name; do not copy another app’s name. Grant exemptions only to trusted apps that need them, and follow your device management policies. A loopback exemption will not fix node or rule errors.

If the internet stops working after you quit, check whether the system proxy still points to a local port that is no longer listening. Turn off any leftover manual proxy setting and try again. If you enabled TUN, check whether its helper service or virtual interface is still running. If a port is in use, first check whether two client instances are running and close the extra instance normally. Do not terminate an unfamiliar system process. If you need to change mixed-port, update the system proxy and any apps where you entered the port manually. Once everything works, use the client’s normal exit process to avoid leaving settings behind by repeatedly force-quitting it.