Clash FAQs

Clash usually refers to the proxy core and its configuration ecosystem. mihomo is a core project that supports Clash configurations and continues to add features. Graphical clients handle configuration imports, proxy selection, system proxy settings, and core process management. Similar-looking interfaces do not mean the cores support the same features. When troubleshooting protocol or field compatibility, check the core name in the client's About page or startup logs, then consult the matching documentation. The advanced setup guidance here uses mihomo as its reference; older cores may not support every field.

The client provides proxy connections and traffic routing, but installing it does not provide a working proxy service. A subscription or local YAML configuration typically contains proxy servers, proxy groups, and rules. Whether connections work also depends on the service being active and reachable from your network. After importing, make sure the configuration is selected as the active one, then check that its proxy groups contain selectable proxies. Don't post subscription links in public forums: their access tokens may let others view your service configuration.

Use Rule for everyday traffic routing: connections are checked against rules from top to bottom, and the first match determines where they go. Global sends connections entering the core to the GLOBAL proxy group; you still need to select a proxy in that group. Direct connects those incoming connections directly. The mode switch does not automatically capture traffic from every app—system proxy settings or TUN determine whether traffic reaches the core. If access still fails in Global mode, check traffic capture and the proxy connection rather than switching modes repeatedly.

The system proxy points your operating system's proxy settings to the client's listening port. It usually works for browsers and apps that honor those settings, but apps with their own proxy settings or direct connections may bypass it. TUN creates a virtual network interface and uses routing to capture more IP traffic; it also requires appropriate DNS, routing, and permissions. Start by testing your configuration with the system proxy. Enable TUN only if you need to capture traffic from other apps. When troubleshooting, enable one traffic entry point at a time instead of changing several at once.

Not necessarily. A latency test usually measures how long a request to a specific test URL takes through the proxy; it doesn't confirm that every website, UDP, or the target service is reachable. Results depend on the test URL, timeout, connection reuse, and your current network. Make sure the test uses the same proxy policy as your actual traffic, then open the target site and check the matched rule and outbound policy in the connections panel. If only one service fails, check regional restrictions, server-side blocking, and whether the domain is being routed incorrectly.

Add the remote configuration in the client's configuration or subscription manager, paste the full link, then download or import it. Menu names vary between clients. After downloading, select that configuration as the active one and confirm the core reloads successfully. Then check the proxy names in its groups, the rules, and the update log. If the interface still shows old content, make sure you updated the configuration currently in use and that a local override hasn't replaced it. A changed timestamp in the subscription list alone doesn't prove that all configuration changes took effect.

First check that the link is complete and hasn't been reset by the provider, then verify your account's expiration date and data balance. If the log shows HTTP 401 or 403, check authorization or access restrictions first. A 404 may mean the link path changed; for a timeout, check whether your current network can reach the subscription URL. If the URL is only accessible through a proxy, change the configuration update proxy method if your client supports it. Don't keep submitting the link to unfamiliar subscription converters. If it has been exposed, reset its access token in your provider's account dashboard.

First confirm the download is a YAML configuration, not a login page, error page, or plain list of proxy links. If the log gives a line number, check indentation, colons, and quotation marks on that line and the one above it. YAML indentation uses spaces, not tabs. A configuration can still have semantic errors after it parses—for example, a rule may reference a missing proxy group, or an older core may not support a proxy type. Keep a copy of the original file, make one change at a time, and recheck it with the client's configuration validator or core test.

Check the logs first to distinguish insufficient permissions from a service that isn't running or a failed virtual interface creation. Prefer the client's built-in service installation or startup option, and grant permissions as prompted. If the client has no service mode, verify the program's source, then try running it as an administrator. You may need to restart the client after installing the service before enabling TUN. If the problem persists, check security software logs and virtual interfaces created by other VPNs. Don't disable the entire firewall as a troubleshooting shortcut, or repeatedly reinstall drivers.

mixed-port is the listening port for both HTTP and SOCKS proxy connections. 7890 is a common example, not a required fixed value. If you see address already in use, close other proxy instances or use system tools to find what's occupying the port, then choose an unused port in the client settings or local configuration. After reloading, confirm the client is listening and update the manual proxy address in your browser, terminal, and other apps. Remote subscriptions may overwrite your changes, so use the client's persistent override feature for long-term settings.

In Rule mode, place the direct rule for the domain before general proxy rules and MATCH. For example, DOMAIN-SUFFIX,example.com,DIRECT matches example.com and its subdomains; DOMAIN,example.com,DIRECT matches only that domain. Reload the configuration, close existing connections, revisit the site, and check the matched rule in the connections panel. Rules use first-match logic, so a rule added after MATCH usually won't take effect. With a remote subscription, use a local override to keep your custom rules.

select lets you choose a member manually, which works well when you want to stick with a specific route. url-test automatically picks a suitable member based on test results, which depend on settings such as the test URL and tolerance. fallback selects the first available member in order, making it useful for switching to a backup when the primary route fails. Automatic groups don't know which websites restrict access, and a successful test doesn't guarantee the target service will work. Choose based on whether you need a fixed route, test-based selection, or ordered failover, then set the test interval. Frequent switching is no guarantee of stability.

With Fake-IP, the core returns a virtual address to the app and uses a stored domain mapping to handle the connection; it's not the real address of the remote proxy server. In mihomo, this is typically configured with dns.enable and dns.enhanced-mode. With TUN, also make sure DNS requests are actually captured by the core. LAN device discovery, some games, and apps that depend on real DNS results may need adjustments to fake-ip-filter. Add exceptions for confirmed incompatible domains first, then clear the app's or system's DNS cache. Excluding every domain is not a good way to mask the problem.

Connect the phone and computer to a LAN where they can reach each other. On the computer, enable allow-lan in the configuration and make sure bind-address allows listening on the LAN interface. On the phone, set the Wi-Fi network's manual HTTP proxy to the computer's LAN IP and the actual mixed-port; don't enter 127.0.0.1. Allow the corresponding inbound port only on trusted private networks, and restrict which network ranges can connect. A manual HTTP proxy doesn't capture all phone traffic. Don't expose the listener on public networks, and configure proxy authentication if needed.

Remote configuration updates usually download a fresh copy of the configuration, which can replace rules edited directly in that file. Use the client's override, merge, or scripting feature instead, and check its execution order and scope. Whether proxy selections persist also depends on the client and settings such as profile.store-selected. If proxy group or proxy names change, a previous selection may no longer have a matching entry. Back up local overrides before updating, then inspect the generated configuration and make sure custom rules still appear before general rules.

First check that the system proxy points to the listening port of a running client. Then check whether a browser extension, separate proxy setting, or system auto-configuration script is overriding it. Visit a site with a new connection while watching the client's connections panel. If there's no record at all, check how traffic is being captured; if there's a record using DIRECT, check the mode and rules. Terminal apps may not use the system proxy, so configure them according to their own documentation. Enterprise policies can also enforce a proxy—check device management restrictions instead of repeatedly toggling the setting.

Turn off the proxy first and confirm that your local network can access the internet. Then check the system clock, subscription expiration, and active configuration. Identify the error type in the logs: for DNS resolution failures, check DNS; for connection timeouts, check server reachability; for authentication or TLS errors, check credentials, system time, and protocol settings. Try another known-working route or switch networks to see whether the problem follows the route or network. A timeout on a test page alone doesn't mean every proxy is down. If real-world access also fails, contact the provider and share redacted error logs.

Check whether the system still has a manual proxy pointing to a local port. Once the client is closed, nothing is listening there, which can prevent the browser from connecting. Turn off the leftover manual proxy and test again. If you used TUN, reopen the client, disable TUN, and exit normally. Also check whether system DNS still points to a local service that has stopped. Don't reset all network settings right away. Work or school devices may need their existing proxy and DNS settings, so note the current configuration first and restore the settings required by your administrator.

Some UWP apps are restricted by network isolation and can't access a local loopback proxy directly. First confirm the affected app uses the system proxy. Then run CheckNetIsolation LoopbackExempt -s as an administrator to view the exemption list. If needed, use CheckNetIsolation LoopbackExempt -a -n=Microsoft.WindowsStore_8wekyb3d8bbwe to exempt Microsoft Store. For other apps, use their actual package family name rather than copying the Store app's name. Grant exemptions only to apps that need them. If you're using TUN, separately check routing, DNS, and rule matches.

Turn off TUN and test the same website with the system proxy to confirm the proxy service itself works. Then enable TUN on its own and check the logs for DNS requests, outbound connections, and routing errors. Also check whether another VPN is running. With Fake-IP, confirm system DNS queries reach the core and that the app isn't using a stale cache. For LAN domains, check the direct DNS resolution policy as well. Browser Secure DNS may use a separate resolution path, so temporarily test with it disabled for comparison. Change one setting at a time and keep the original configuration. Changing DNS, the network stack, and all rules at once makes the cause hard to find.