Clash FAQ

Clash is an open-source rule-based proxy core that ships with zero built-in nodes. It reads a YAML config file and routes traffic based on the node list and rules inside it. A subscription link is essentially a URL pointing to a remote config file, which the client fetches periodically to build its node list. So the workflow is: install the client first, then get a subscription link from your provider and import it — both steps are required.

The original core's repo has been archived, but the community fork mihomo (formerly Clash Meta) is fully compatible with the original config syntax and keeps adding protocol support. Mainstream clients like Clash Verge Rev and FlClash now ship with the mihomo core built in — just install one from our downloads page, and your existing subscriptions and configs should work without changes.

A traditional VPN usually routes 100% of a device's traffic through one tunnel. Clash is a rule-based proxy that can route traffic to three separate outcomes — direct, proxy, or block — based on domain, IP region, and other criteria. For example: local sites go direct, international sites go through the proxy. Clash also supports proxy groups with automatic latency-based switching, giving it far more flexibility than a single-tunnel setup.

Rule mode matches traffic against the rules in your config file from top to bottom, and it's the recommended mode for everyday use. Global mode sends all traffic through whichever proxy node is currently selected — handy for quickly debugging rules or forcing everything through the proxy temporarily. Direct mode sends everything without a proxy, useful for confirming your local network itself is working. Stick with Rule mode unless you have a specific reason not to.

Switch to Clash Plus or Clash Verge Rev — both ship with the mihomo core, get regular updates, and support system proxy, TUN mode, and subscription management. Your existing subscription link can be imported as-is. Clash for Windows is archived only and no longer receives core or security updates, so it's not recommended for new installs. Grab the right build from the Windows section of our downloads page.

Copy the full subscription link from your provider's dashboard, open the client's Profiles page, paste it into the new-profile field, and confirm — the client will download the remote config and build the node list. After importing, pick a proxy group and node on the Proxies page, then turn on the system proxy. Most clients let you set an auto-update interval — turning that on keeps your node list current. For the full step-by-step walkthrough, see the setup guide.

This is macOS Gatekeeper's default block for apps outside the App Store. After the first blocked attempt, go to System Settings → Privacy & Security, scroll down to find the blocked app entry, click "Open Anyway," and enter your password. If you see "file is damaged" instead, the download likely has a quarantine flag attached — run xattr -cr followed by the app path in Terminal and try again.

The Android Clash client uses the system's VpnService to set up a local virtual tunnel that intercepts traffic. The first time you tap Connect, Android shows a VPN connection request — you must approve it, or no traffic will be forwarded at all. This permission only creates the local tunnel; where the traffic actually goes is still decided by your config's rules. If the connection keeps getting killed by the system, add the client to your battery optimization allowlist.

Desktop clients usually have Auto Launch and Silent Start toggles under Settings → General. Auto Launch starts the app with your system; Silent Start keeps it minimized to the tray instead of popping up the main window. Turning both on gives the smoothest experience. On Windows, if auto-start fails, check whether the entry is disabled under Task Manager → Startup Apps. On macOS, check General → Login Items.

TUN mode intercepts all traffic at the network layer through a virtual network adapter, regardless of whether an app respects the system proxy setting. Turn it on when you run into apps that ignore the system proxy — some games, command-line tools, or third-party software. It requires elevated permissions: on Windows the service installs with admin rights, and on macOS you'll need to authorize a system extension or run with elevated privileges. Once TUN is on, turn off the system proxy to avoid double-handling traffic.

The system proxy just registers an HTTP/SOCKS proxy entry with the OS — whether apps actually use it is up to them. TUN mode forces traffic through at the network layer, covering far more but requiring higher permissions. For everyday browser use, the system proxy is lightweight, stable, and enough. Switch on TUN when dealing with command-line tools, games, or software that ignores the system proxy. If both are on at once, TUN takes priority.

The terminal doesn't read the system proxy setting by default — you need to export environment variables manually, e.g. export https_proxy=http://127.0.0.1:7890 http_proxy=http://127.0.0.1:7890, using whatever port your client's mixed port is actually set to. Verify it works with curl -x http://127.0.0.1:7890 https://www.gstatic.com/generate_204 -I — a 204 response confirms the proxy path is working. To make this stick across every terminal session, add the export lines to your shell config file.

The speed-test button on the Proxies page sends an HTTP request to a test URL (commonly Google's gstatic generate_204) and measures how long it takes. The number shown is the total round-trip time from your device, through the node, to that test URL — in milliseconds, lower is better. A single node timing out doesn't necessarily mean it's broken; that endpoint might just be blocking the test URL, so try a different test URL. If every node times out, check your subscription and local network first.

UWP apps are sandboxed from the network loopback by default, so they can't reach a local proxy on 127.0.0.1. You need to grant a loopback exemption: some clients include a built-in UWP loopback tool that does this with one click. You can also use Microsoft's own CheckNetIsolation command, or the EnableLoopback tool, to check off the target app manually. Restart the app after exempting it, and it should route through the local proxy normally.

Check these four things in order: 1) Is the system proxy toggle actually on, and does the port match your client's mixed port? 2) Is a working node selected on the Proxies page — run a manual speed test to confirm. 3) Does your browser have a proxy extension installed that's overriding the system setting — try disabling it temporarily. 4) Switch to Global mode as a test — if that works but Rule mode doesn't, it's almost certainly a rule config issue, so check your rule order and fallback rule first.

If every single node times out, suspect the subscription or your local setup before blaming the nodes: first confirm in your provider's dashboard that the subscription hasn't expired and you haven't run out of data, and manually refresh it. Next check that your system clock is accurate, since some protocols are sensitive to time drift. Then make sure a firewall or security software isn't blocking the client from reaching the network. Finally, try a different test URL. If it's only a couple of nodes timing out, just switch to a different one.

First confirm the system proxy was actually registered: on Windows, check Settings → Network & Internet → Proxy to see if the manual proxy points to 127.0.0.1 and your client's port. On macOS, check the proxy settings for your current network service. If other software (a booster app, security tool) keeps overwriting your proxy settings, quit that app and toggle the proxy again. It's normal for terminal programs to ignore the system proxy — set environment variables manually, or switch to TUN mode instead.

Three common causes: 1) The link was copied incompletely or has extra whitespace — copy it again in full. 2) The subscription URL itself needs a proxy to reach, so connect to any working node first, or enable use proxy for update in the subscription settings. 3) Your provider changed the subscription domain — go back to your dashboard for the new link. If you get a format error, make sure you actually have a Clash-format subscription, not one meant for a different client.