Clash FAQ

Clash usually refers to the proxy core and its configuration ecosystem; mihomo is a core project that continues that ecosystem. Graphical clients handle tasks such as importing subscriptions, selecting policies, and managing the system proxy, while the core handles the actual connections. That means two clients with similar interfaces may support different configuration fields, and two clients using the same core may offer different settings. Before following a guide, check the client’s name, then confirm the core in its About page or logs. This helps avoid applying limitations from older Clash versions to mihomo.

A client is a tool for configuring and using proxy connections; installing it does not provide working nodes. You’ll need a subscription link you’re authorized to use, or a configuration file containing proxy nodes, policy groups, and rules. Subscriptions are usually provided by a service provider or generated by a service you run yourself. This site’s download links do not include a subscription service. Before importing, make sure the subscription format is supported by your client and keep credentials in the link private. Don’t post the full subscription URL in public forums or import remote configurations from unknown sources.

Rule mode applies the configuration’s rules in order to route each connection directly, through a proxy, or block it. Global mode applies a global policy to connections that reach the core, but you still need to select a working node. Direct mode sends connections that reach the core straight to their destinations. These modes control how the core handles connections; they don’t determine whether an app sends its traffic to the core in the first place. Switching to Global mode therefore doesn’t replace system proxy or TUN settings, and it doesn’t guarantee that all app traffic is proxied.

The Clash ecosystem includes multiple independently maintained cores and graphical clients. A page calling itself an official site doesn’t necessarily represent the entire ecosystem. Check the project name, maintenance information, and release channel for the specific client. This site brings together download links and Chinese configuration guides; it does not treat separate projects as one team. When looking for a Clash for Windows alternative, check maintenance status, platform support, and configuration compatibility before comparing interfaces. Installers and setting names in older guides may have changed.

Whether a configuration can be shared depends on the core and the fields it supports, not just the operating system. Basic rules and common proxy fields may be compatible, but desktop system proxy, TUN, file path, and script settings can’t be copied directly to mobile. Mobile clients typically route traffic through the system VPN interface, with different permission settings from desktop clients. When importing across devices, start with a configuration the provider says is compatible, then check the import log. If a field isn’t supported, consult the client’s documentation rather than deleting an entire configuration section at random.

In the client’s configuration or subscription page, add a remote configuration, paste the full URL, save it, and run an update. Once it appears in the list, set it as the active configuration; a successful download alone isn’t enough. Open the proxy page and check that the expected policy groups appear. Then select a working node and enable the system proxy or mobile VPN. Finally, visit a site you need to access and check the connection log to see which policy was applied. A message saying the subscription is saved only confirms that the URL was saved—not that the configuration was loaded or traffic is being routed through it.

First check whether the update failed because of a network timeout, an HTTP status error, or a configuration parsing error. Make sure the URL is complete, the subscription hasn’t expired, and the provider hasn’t changed the endpoint. A 401 or 403 may indicate an authorization issue or access restriction; a 404 may mean the URL has changed. If your current proxy isn’t working, try a working node or, if the client supports it, update directly. Downloading an HTML login or verification page can also cause parsing errors. Don’t keep reinstalling the client; first confirm that the subscription endpoint is returning a valid configuration.

Use the line number in the log to check the surrounding lines, especially indentation, spaces after colons, and hyphens before list items. YAML indentation must use spaces; tabs or non-ASCII punctuation introduced during copying can break the structure. If the file came from a subscription, download the original configuration again. Don’t append undocumented parameters to the subscription URL. If the syntax is valid but the error persists, the current core may not support one or more fields. Keep a backup before editing and change one thing at a time so you can distinguish formatting errors from compatibility issues.

Stop TUN first, then check whether the client’s required service components, administrator authorization, or system network extensions are installed and allowed to run. Windows clients often require their service mode to be installed and running. On macOS, you may need to allow a network extension in System Settings; follow the client’s prompts. On mobile, allow the client to create a VPN connection. Permanently running the entire client with elevated privileges shouldn’t be your only solution. After granting permission, restart the core. If it still fails, check whether another VPN is using the network interface and keep the specific error from the logs.

mixed-port is a local listening port that accepts both HTTP and SOCKS proxy connections. The active configuration determines its value; don’t assume it’s always 7890. If startup reports that the address is already in use, check whether another client or core process is running. Close the duplicate process or choose an unused port. After changing it, update proxy addresses in browsers, terminals, and any apps configured manually, then restart the core. If you edit the configuration without reloading it, the old port may remain active.

For everyday use, start with Rule mode so the configuration chooses a route based on each destination. If a particular site isn’t working, switch temporarily to Global mode for comparison and make sure the global policy has a working node selected. If Global works but Rule doesn’t, check which rule matched the connection, then adjust that policy or the rule order. Restore your original mode when you’re done to avoid routing other connections through the same exit. A Global mode test can help narrow down the cause, but it doesn’t prove the rules are at fault. Also compare the nodes actually used in each mode.

Add an exact-domain or domain-suffix rule for the target and place it before any broader rule that might match first, including the MATCH fallback. Use DOMAIN-SUFFIX to match a domain and its subdomains; consider DOMAIN for a single hostname. Before editing a subscription configuration, look for an override or custom rules feature in the client so an update won’t overwrite your changes. Save and reload, then create a new connection and check its match in the log; existing connections may keep their original route. If the site uses multiple domains, check how requests to each one are handled.

The system proxy mainly affects apps that read the system proxy settings. Some command-line tools only use their own options or proxy environment variables. Check which proxy methods your tool supports, then set HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY to the current listening address and port. The tool’s documentation determines the exact variable names and precedence. You may need to reopen existing terminal sessions, and a tool’s own settings may override the environment. Check actual connection logs while troubleshooting. When finished, remove temporary environment variables so the terminal won’t point to an inactive local port after you stop the client.

Fake-IP returns a virtual address for a domain, then the core maps the connection back to the original domain. This can help route traffic by domain, but it relies on app DNS queries going through the core’s managed DNS. Start with the client’s default configuration and check compatibility with your network rather than changing a single setting in isolation. LAN devices, some games, and apps that rely on real resolved addresses may need exceptions. If a particular domain has problems, check the logs and configure an exception using the fake-ip-filter syntax supported by your core. Then clear relevant caches and reconnect.

Existing TCP connections usually don’t move automatically to a new exit when the selected policy changes, and apps may reuse connection pools. As a result, traffic may appear to keep using the old node for a while. Close the relevant connections in the app or disconnect them from the client’s Connections page, then make a new request. After updating rules or DNS settings, you may also need to restart the app, clear the DNS cache, or reload the core. Don’t judge a change by a page that was already open; check the policy log for a new connection. Avoid clearing every connection at once if that would interrupt ongoing tasks.

First make sure the core is running and the active configuration is valid. Then check that the system proxy points to a local port that’s listening. Check whether browser extensions, browser-specific proxy settings, or other proxy software are overriding the system settings. Next, make a new request and check the Connections page: if there’s no entry, troubleshoot how traffic reaches the core; if there is, inspect the matched policy and any errors. Try another browser temporarily to distinguish browser settings from network issues. Don’t change DNS, rules, and nodes all at once. Verify traffic entry, policy, and exit one step at a time to isolate the problem.

Try another node with the same destination to see whether the problem is limited to one node. A test timeout may be caused by an unreachable node, a problem with the test URL, protocol incompatibility, or network restrictions. One failed test doesn’t mean the entire subscription is invalid. Check that the subscription is up to date, verify your device’s clock, and review the logs for the node. If only the test fails but browsing works, check the test URL. If browsing also fails, switch to a working node and report the time, network type, and a summary of the error with sensitive details removed to your provider.

Some UWP apps restricted by app-container isolation can’t access a loopback proxy address on the local machine. If a browser works but a particular UWP app doesn’t, confirm that it’s affected by this restriction, then use the client’s loopback exemption tool to grant access only to the app that needs it. If no such tool is available, follow Windows CheckNetIsolation documentation to check the package’s exemption status. This may require administrator privileges and doesn’t apply to every Store app. Restart the app after granting access. If it doesn’t read the system proxy settings, you’ll also need to check how its traffic is routed.

First find out what handles the app’s DNS queries, then compare the core’s DNS configuration with the system DNS and the browser’s Secure DNS settings. A browser’s built-in encrypted DNS may use a separate resolution path and bypass the core’s DNS policy. The resolver location shown by a leak test is a clue, not proof of a leak based on location alone. Check DNS logs and the traffic path to confirm that queries are sent as intended. After changing TUN or DNS settings, make a new query and clear the cache if needed. Also check whether IPv6 queries and DNS requests from LAN devices are covered by the configuration.

If the internet stops working after you close the client, check whether the system still has a manual proxy pointing to a local port, then check DNS and VPN connection status. Use the client’s normal controls to turn off the system proxy and TUN. If only printers, routers, or LAN services fail with TUN enabled, check route exclusions and direct rules for private subnets rather than disabling the entire firewall. Automatic routing differs between clients, so note the original settings before changing them. Once the network is working again, re-enable features one at a time. If the problem persists, keep the routing details and logs instead of blindly resetting all network settings.