Clash FAQ

Clash usually refers to the proxy core and its configuration ecosystem. mihomo is a core project that builds on and extends those configuration capabilities; it was previously known as Clash Meta. Graphical clients handle subscription management, mode switching, and system integration, while their underlying features depend on the core and its version. Before troubleshooting, note the client name and core version from the About or core information screen, then consult the relevant documentation. Button locations vary by client, so don’t assume a feature is supported based on its UI label alone.

A client provides proxy connections and rule processing, but it doesn’t include working proxy servers. A subscription retrieves configuration provided by a service, while a config file defines proxies, proxy groups, rules, DNS, and other settings. Check the subscription source and supported format before importing it. Don’t post subscription URLs in public chats or screenshots; their access tokens may be tied directly to your account. If you run your own service, enter connection details for the protocol you use.

Use Rule mode for everyday browsing so each connection follows the configured rules for direct or proxied access. Global mode applies the global policy to connections handled by the core; it’s useful for briefly checking whether rules affect access, but it doesn’t capture all device traffic. Direct mode sends connections handled by the core straight to their destinations; it doesn’t exit the client. After switching modes, test with a new connection. Existing connections may keep their previous policy, so close them from the Connections screen if needed.

Start by filtering for your operating system, processor architecture, and required traffic-capture method, then compare subscription management and rule-editing features. Windows users can start with Clash Plus or consider clients such as Clash Verge Rev and FlClash. Clash for Windows is no longer maintained, so don’t treat UI steps in old tutorials as current guidance. When migrating, keep your subscriptions and custom rules, but don’t copy the entire old client data directory. After importing, check ports, proxy groups, and DNS settings one by one.

A system proxy registers HTTP and other proxy endpoints with the operating system; only apps that honor this setting will use them. TUN uses a virtual network interface and routes to capture more connections, including traffic from apps that ignore the system proxy, but it requires extra permissions and may conflict with other VPNs. Both modes depend on your rules and configuration, and enabling TUN doesn’t guarantee that every connection will use the proxy. Verify the basics with the system proxy first, then enable TUN only if you need broader app coverage. Avoid changing multiple network layers at once.

Open the client’s Config or Subscription screen, choose URL import, and paste the full subscription URL. Once it downloads, select that config. For a local file, use the file import option to select the YAML, then check the load logs. A link that contains only a Base64 list of nodes may not be a usable Clash config; ask the service provider for a compatible format. Don’t submit URLs containing account credentials to an unfamiliar conversion service. After importing, make sure the proxy groups offer a selectable proxy before enabling the system proxy.

Check your processor architecture in your system’s About settings. Most Intel and AMD desktop computers use x64, while Apple Silicon Macs need the corresponding ARM build. For Windows on ARM, confirm that the client offers native support. On Android, choose based on your device’s architecture when possible; if you’re unsure, check the universal build and system requirements. The package format must also match your Linux distribution—for example, deb and rpm packages aren’t interchangeable. Don’t guess based only on the device’s brand or appearance.

Turn off TUN first, then check whether the client offers an Install Service, Service Mode, or Repair Service option. Follow the prompts to grant system permissions, then restart the client. Windows often needs an administrator-level service to manage the virtual interface; macOS requires approval for the relevant network permissions; Linux depends on the client’s privilege escalation method. Don’t use running every app with elevated privileges as a long-term workaround. If the service is installed but TUN still fails, check the first error in the logs and see whether another VPN, virtual network adapter, or security policy is blocking interface creation.

mixed-port is a single port that accepts both HTTP and SOCKS proxy connections. 7890 is a common example, but not every client uses it. Use the listening port shown in the settings or active config, then point your browser, terminal, or system proxy to that same port. For local connections, the address is usually 127.0.0.1. Reapply the system proxy after changing the port. If the logs say the address is already in use, identify the process using it rather than terminating system processes at random.

Enable it only when other devices on the same local network need to use your proxy. In addition to allowing LAN connections, check the listening address, host firewall, and network reachability between devices. On the other devices, enter the host’s local IP and the actual port. Don’t use 127.0.0.1—that points to the device itself. Configure access authentication and source restrictions if supported. Never expose proxy ports or external control interfaces to the public internet, and don’t leave them open on public Wi-Fi.

Enable automatic updates in the subscription details and check the units used by the interval field. Some clients use minutes—for example, 1,440 minutes is one day—while interval in a provider config is usually measured in seconds. Don’t copy the same number without converting units. Follow the service provider’s recommended frequency; updating too often may trigger rate limits. Try updating through the proxy only if the subscription URL can’t be reached directly and an enabled proxy is available. After changing the interval, refresh manually and check the logs for success. Keep a backup config you can restore.

Use the client’s override, merge, or rule extension feature instead of editing a source file that a remote subscription may overwrite. Clash rules are usually matched from top to bottom, so put specific domain rules before broader ones and place MATCH near the end. Make sure the target policy exists and that its capitalization and spelling match exactly. After saving, check the config validation results, then use a new connection to confirm which rule matched. Merge order varies by client, so verify the final active config.

Open the client’s Connections screen, filter by the target domain or app, and check the matched rule, proxy group, and final outbound route. Then close the existing connection and reopen the site to avoid misleading results from a reused connection. The client’s home-screen switch or the IP shown by your browser can’t explain every request, since a webpage may connect to multiple domains. If the request doesn’t appear in the connection list, first check whether the app uses the current proxy endpoint; then look into TUN, a browser-specific proxy, or the app’s own network settings.

Start with a subscription or client-recommended setting that you’ve verified works. fake-ip assigns virtual addresses to domain names, helping the core preserve domain information when it captures connections. redir-host usually returns the actual resolved address. Some games, LAN services, or apps that depend on real addresses may need individual compatibility settings; you don’t have to switch modes across the board whenever something goes wrong. Check fake-ip-filter and related DNS rules first. After switching, clear the affected apps’ DNS caches and reconnect so old results don’t skew your test.

Check your system’s battery usage first to distinguish the client’s background activity from traffic generated by other apps through the proxy. Reduce unnecessary speed tests and subscription refreshes, and turn off verbose logging when it isn’t needed. If Android disconnects frequently, adjust battery optimization or background restrictions as needed, bearing in mind that fewer restrictions may increase battery use. On iOS, background operation depends mainly on the system’s network extension policies. Change one setting at a time and observe actual usage. Don’t run multiple always-on tools just to keep the client alive. Continuous traffic capture also requires the network service to remain active.

Check the update log for the specific error. For a timeout, check whether the subscription domain is reachable and compare direct updates with updates through the proxy. For a certificate error, correct the system date first and check whether a login page or network device is intercepting the request; don’t disable certificate verification. A 401 or 403 usually points to credentials, permissions, or a restriction imposed by the service provider, so check your account page. If the response is HTML instead of YAML, you may have received a login or error page. Keep the old config, copy the subscription URL again, and retry. Hide account credentials before sharing logs.

A speed test timeout only means the expected result wasn’t received from the test URL within the time limit; it doesn’t prove the subscription is invalid. First use a proxy to open the target site, then check whether the test URL is reachable, the system clock is correct, and the network requires you to sign in through a web page. Compare with another network or a different proxy in the same subscription. If all proxies fail, check whether the config loaded and review the core logs. If only a few fail, contact the service provider. Don’t keep lowering the timeout threshold, or working connections may be marked as failures.

Check the listening port, system settings, and app settings in that order. Make sure the core is running and the port matches the system proxy. Then confirm that the OS proxy address points to the local machine, and disable any browser proxy extension that might override it. If the connection appears in the client, check the matched rule and selected proxy; if it doesn’t, keep tracing the connection path. Turn off other VPNs and test with a new connection. If access still fails after you quit the client, check for a system proxy pointing to a stopped service and restore your previous network settings.

Some Windows apps isolated in an AppContainer can’t access a proxy at 127.0.0.1 because local loopback access is restricted. First confirm that this applies to the app, then use the client’s UWP loopback tool to add an exception for that app and grant permission when prompted. Users familiar with Windows administration can also inspect the settings with CheckNetIsolation. Don’t enable loopback access for every app by default. If the app still can’t connect, check whether it reads the system proxy and whether a security policy prevents changes.

Turn off TUN and confirm that your basic network connection is back, then test the same config using the system proxy. If only TUN fails, check the logs for routing, DNS interception, or virtual interface errors, and disable other VPNs for comparison. Don’t overwrite your subscription with a complete DNS config found online. Check whether the upstream DNS server is reachable and whether DNS requests are looping. Save the original settings before making changes, and adjust one parameter at a time. If the problem continues after closing the client, check for leftover proxy or route settings, then repair the service or restart the network connection as described in the client documentation.