Clash FAQ: Answers Organized by Symptom

Clash is a general term for a family of open-source proxy clients: it intercepts local network requests at the application layer and routes each connection to a direct connection or a specific proxy node, based on rules in a configuration file.

The key difference from a VPN is the layer at which it operates: a VPN builds a system-level tunnel and routes all traffic through the same exit point, with no distinction between apps. Clash routes connection by connection, so you can send a specific domain through one route while everything else connects directly. Also, a Clash client doesn't ship with any proxy nodes — those need to come from a subscription.

The original Clash core stopped receiving updates in 2023. The community fork Clash Meta continued development on top of it, adding more proxy protocols and features, and was renamed mihomo starting in 2024 — it's now the de facto standard core for the ecosystem.

Most actively maintained clients today — Clash Verge Rev, FlClash, Clash Meta for Android, and others — are built on mihomo, with config syntax that's largely compatible with the original Clash. When people say "Clash" in everyday conversation, they usually mean this whole ecosystem rather than one specific app.

Rule mode routes traffic connection by connection based on your config: traffic matching a proxy rule goes through a node, traffic matching a direct rule bypasses the proxy — this is the recommended everyday setting. Global mode sends nearly all traffic through your selected node, which is useful as a quick reference check when rules seem broken. Direct mode bypasses the proxy entirely, effectively pausing it.

If you're unsure, stick with Rule mode by default, and only switch to Global temporarily to test whether something is actually connecting, then switch back. Leaving Global mode on long-term means even local sites take the long way around, which actually slows things down.

The client is just the tool — the nodes need to be supplied separately. Proxy nodes come from a subscription link provided by your service; importing it into your client automatically pulls the node list and routing rules, and keeps them updated.

Without a subscription, you can also add a single node manually, or import a local YAML config file. See our getting-started guide for how to obtain and import a subscription, and see Config Profile Basics for how config files and multi-profile management work.

A proxy group is a selector that bundles a set of nodes together. Common types: manual selection (select), automatic latency testing (url-test), automatic failover (fallback), and load balancing (load-balance). Entries in your config like "Auto", "Hong Kong", or "Streaming" are all proxy groups, and outer groups can nest and reference inner ones.

Day to day, you only need to pick a route from the top-level proxy group. If you'd rather not choose manually, use an auto-test group instead — the client will test latency periodically and switch to whichever node is currently fastest.

We recommend Clash Plus; if you prefer the open-source community route, Clash Verge Rev is a solid pick — both are listed on our download page with system requirements.

After installing, do three things: import and update your subscription link on the profile page; set mode to Rule on the main screen; and turn on the system proxy toggle. Then open a browser and visit a site outside China to confirm it's working — if not, check the System proxy not working section.

This is usually caused by Gatekeeper blocking an app that hasn't been notarized by Apple — the file itself isn't actually damaged. First, try right-clicking the app in Applications and choosing Open; this resolves it for many versions.

If it's still blocked, run sudo xattr -rd com.apple.quarantine /Applications/YourApp.app in Terminal, swapping in the actual app path, then open it normally. Only do this for installers downloaded from our download page or an official source.

Install Clash Plus from the App Store — official site is clashplus.io. After installing, paste your subscription link into the app to import it, allow the VPN configuration prompt when asked, then flip the switch to connect.

All proxy apps on iOS work through a VPN profile, so seeing the VPN icon in your status bar is normal and expected. Just turn off the switch in the app when you don't need it.

TUN mode creates a virtual network adapter that captures traffic system-wide, including apps that ignore the system proxy setting — certain games, command-line tools, and UWP apps. Creating a virtual adapter is a system-level operation, so Windows needs service mode installed or admin rights, while macOS and Linux need root helper authorization.

If you're just browsing, the system proxy is enough — you don't need TUN mode. Turn it on when you need to proxy CLI tools, games, or Store apps. The two can run together without conflict; keeping the system proxy on while TUN is enabled won't cause issues.

Check these in order. First, the link itself: make sure it was copied in full, has no leading or trailing spaces, and starts with http or https. Second, verify it's live: paste it into a browser address bar — if it downloads a YAML file, the link works.

Third, check for a loopback issue: if the client is actively proxying while it tries to update, the request can loop back on itself and fail — switch to Direct mode or pause the proxy before updating. Fourth, check your plan: log into your provider's dashboard to confirm the subscription hasn't expired and you still have data left. If it still fails after all four checks, try importing the same link into a different client to see whether the problem is the link or the client.

There are three common causes: the subscription has expired or run out of data, which you can check in your provider's dashboard; your network is interfering with the subscription domain, so the update request never reaches the server; or the config file was manually edited and broke, so validation failed after an update and it got rolled back.

Fix it in this order: check your plan status in the provider's dashboard; turn off the system proxy and try a manual update while directly connected; if that still doesn't work, delete the profile and re-import the subscription link. Note that manual edits get overwritten on the next update — back up important changes first, or maintain them with your client's override feature, as described in Custom rules.

Rules are matched top to bottom, and matching stops at the first hit — earlier rules take priority. If nothing matches, traffic falls through to the final MATCH catch-all rule. If a site isn't routing as expected, it's usually because a broader rule higher up is catching it first — for example, a mainland China GeoIP rule or an earlier direct-connect rule.

To find the culprit, open the connections panel in your client, locate the connection for that site, and check which rule it actually matched — then reorder rules or add a more specific rule above it. Rule syntax is covered in our quick reference.

Add a more specific rule near the top of the rules section in your config file. For example, to force example.com and its subdomains to always connect directly: DOMAIN-SUFFIX,example.com,DIRECT. To route through a specific proxy group instead, replace DIRECT with that group's name. Save and reload the config to apply it.

Note: subscription updates will overwrite manual edits every time. For something that needs to stick long-term, use your client's built-in rule override or merge feature (like Clash Verge Rev's global extended config), or maintain your own local copy of the config separately.

No, don't share it freely. Your subscription link is effectively an account credential: anyone with it can burn through your data allowance, and some providers can even trace account info from it. Don't post it in group chats, forums, or screenshots. If you suspect it's leaked, reset the link from your provider's dashboard — the old link stops working immediately.

Online subscription converters process your full subscription content, including every node and credential, which is essentially handing your keys to a third party. If you need to convert formats, prefer a local tool or a self-hosted subconverter instance over an unknown online service.

Work through these four steps in order. First, switch to Global mode and test again — if Global works but Rule mode doesn't, the problem is your routing rules, not the nodes. Second, manually update your subscription — the node list may be outdated, so retest after updating.

Third, switch networks — test on cellular data instead of Wi-Fi to tell whether it's local broadband or ISP interference versus every node actually being down. Fourth, check your provider's status page or announcements. If all four steps still show timeouts, the issue is likely on the subscription side — contact your provider.

If the connection is established but pages won't load, the problem is usually DNS: your system or browser is getting a poisoned DNS result, so it simply can't reach the right server.

Fix it by confirming DNS takeover is enabled in your client; if your browser has Secure DNS enabled and pointed at an unreachable server, turn it off and try again; then flush your system DNS cache — on Windows, run ipconfig /flushdns. If it's still not working, check your client logs and search the DNS section of our troubleshooting guide for the error message.

UWP apps are blocked by default from accessing the local loopback address 127.0.0.1, and the system proxy points to 127.0.0.1:7890 — so Store, Weather, and similar apps fail to connect directly. This is a system restriction, not a client bug.

Fix it one of two ways: use your client's built-in UWP loopback exemption tool to check the target app (this calls the system's CheckNetIsolation LoopbackExempt under the hood), or just enable TUN mode so the virtual adapter handles the traffic and bypasses the loopback restriction entirely. If it still doesn't work after exempting, restart the app once.

Three common culprits. First, a browser extension with its own proxy settings is overriding the system proxy — disable the extension and test again. Second, another proxy or accelerator app is grabbing the system proxy setting — quit it, then toggle the client's system proxy switch off and on again.

Third, the system proxy settings themselves may be wrong: check the network proxy page in Windows Settings and confirm the address is 127.0.0.1 with the port matching your client's mixed port (default 7890), and make sure your target site isn't listed in the exceptions. If all three check out and it's still going direct, restart the client and try again.

Narrow it down in three steps. First, run the client's built-in latency test — if latency is high or unstable, switch nodes and retest. Second, use the same node to test speed in a browser speed test and in the actual app you're using — if only one app is slow, check whether it's routing through the right proxy group.

Finally, retest at a different time of day — if it's slow during evening peak hours but fine late at night, the line is congested, so try a higher-tier node or use it at off-peak times. Also keep in mind the latency shown in your client is just handshake time to the node, not actual bandwidth — judge speed by actual load times instead.