Clash FAQ

The client handles installation, configuration management, system proxy settings, and the user interface. The core parses configuration, matches rules, and establishes connections; mihomo is a commonly used core in the Clash ecosystem. A subscription provides configuration or proxy details, but you need to obtain a valid link separately. Installing a client does not give you a working proxy service. On first use, confirm that your subscription provider supports the current core, then import and activate the subscription on the configuration page. Finally, check that your proxy groups offer an outbound option. A client launching successfully does not mean the configuration is working.

Rule mode is usually best for everyday use: rules are evaluated in order to determine each connection's outbound route. Global mode sends connections that enter the core through the global proxy group, making it useful for briefly checking whether a problem is caused by routing rules. It does not automatically capture traffic from every app. Direct mode sends connections entering the core straight to their destinations. The mode setting is separate from the system proxy and TUN: the former determines how traffic exits, while the latter determine how it enters the core. When troubleshooting is done, switch back to Rule mode and check the matched rule and outbound route on the Connections page.

mixed-port lets one listening port accept both HTTP and SOCKS proxy requests. Port 7890 is a common default, but not every client uses it. You usually don't need to change it if only one client is running and there are no port conflicts. If you're setting up a browser or terminal to use the proxy manually, check the mixed port shown in the client; the address is usually 127.0.0.1. The external controller port is for managing the core, not for an app's proxy settings. After changing the port, update the app settings and terminal environment variables too, so they don't keep connecting to the old port.

For a new installation, consider Clash Plus, then compare Clash Verge Rev, FlClash, and Clash Nyanpasu based on their interfaces. First check your operating system and processor architecture, then confirm support for the TUN, service mode, and configuration fields you need. Before migrating, save your original subscription link, custom rules, and override files. Import the subscription into the new client rather than copying the old program directory. Don't enable the system proxy or TUN in both clients at once. Once the new client connects successfully, disable the old client's startup option and background service.

Get Clash Plus from the App Store. Its official website is clashplus.io. After installation, add a valid link on the configuration or subscription page, or import a config file using a method supported by the client. Then select and activate that config. On the first connection, follow the system prompt to allow a VPN configuration and complete any device verification. A VPN icon in the status bar only confirms that a tunnel was established; open the site you want to access to verify the rules and outbound route. If your organization manages the device and blocks VPN configuration, check its device management policy instead of repeatedly reinstalling the client.

Open the client's Configuration, Subscription, or Profiles page and create a new remote profile. Paste the complete subscription link into the URL field and save it. Don't paste it into a proxy address or external controller address field. Once the download succeeds, select the profile as the active configuration, then open the proxy page and choose an outbound option in the relevant proxy group. Finally, enable the system proxy or TUN as needed and visit your target site. Menu names vary between clients, but importing, activating, choosing an outbound route, and capturing traffic are four separate steps. Missing any one of them can prevent access.

Check the first parsing error in the log for the field name and line number. Then check YAML indentation, the space after each colon, and the hyphens before list items. Use spaces for indentation; don't use tabs. If the error mentions an unsupported proxy type or field, check whether the current core supports the subscription format rather than just changing indentation. When importing from a link, confirm that the response is actually a config: a login page, expiration notice, or regular web page can't be used as YAML. Keep a copy of the original file before editing. After fixing the issue, reload the config and confirm that the same error no longer appears in the log.

First confirm that the system proxy connects normally, then troubleshoot TUN separately. On Windows, look in the client settings for Service Mode or an option to install the service, then follow the prompts to authorize and start it. On macOS, grant the helper service or network extension permissions requested by the client. Linux usually requires administrator privileges or network capabilities configured according to the client's documentation. Don't disable system security as a default workaround. After granting permission, restart the client and check the log to confirm that it created a virtual interface. If it still fails, close other VPNs and virtual network tools, then investigate the specific driver or routing error.

Android clients typically use the system VPN interface to route app traffic through a local proxy core, so the first connection prompts you to establish a VPN. Allow it only after confirming the prompt comes from the client you just installed and are using. In most personal-use setups, two standard VPN services can't run at the same time in the same user profile. Stop any conflicting VPN, VPN-based filtering app, or firewall first. If only some apps bypass the proxy after connecting, check the per-app proxy include and exclude lists, and whether a work profile uses separate network policies.

This usually means another process is using the listening address and port. Fully quit other proxy clients first, and check that the current client isn't running twice; closing its main window may leave the core running in the background. On Windows, check listening ports in Resource Monitor's Network tab. On macOS and Linux, use the system's network tools to identify the process using the port. Confirm what the process does before stopping it, or change the current client's mixed port to an unused one in the config. Don't terminate unfamiliar system processes. Reload the config after changing the port, and confirm that the system proxy and any apps with manual proxy settings use the new port.

Not necessarily. A latency test usually sends a request to a test URL through a selected outbound route. The result depends on the test site, DNS, the handshake, and the remote server's response; it isn't the same as the connection's physical latency. Select the outbound route manually, try accessing your actual destination, and check the connection log. If the site works but the test times out, check whether the test URL is blocked or increase the test timeout. If access fails too, check your subscription status and local network. Don't delete multiple configs based on one timeout or compare results from different test URLs directly.

A latency test measures how long it takes to establish a connection and receive a test response. A download speed test measures sustained transfer capacity and uses real data. Low latency doesn't guarantee faster large downloads, and high throughput doesn't mean interactive requests will get a faster response. For a fair comparison, use the same network, test destination, and time window. Pause background downloads and avoid running tests in multiple clients at once. Limit testing especially on mobile data or metered subscriptions. When choosing an outbound route for everyday use, first confirm that your target service is stable, then consider latency and real-world performance instead of relying on a single speed test.

Keep Rule mode enabled, open the client's Connections page, and make a new request to the target site. Filter connections by domain or process, then check the rule type, rule content, and outbound chain. Check the log too if needed. Rules are generally matched from top to bottom, and the first match determines the outbound route, so add new rules before the fallback MATCH rule. Reload the config after editing, close existing connections, and test again; established connections may keep using their original route. If a page uses multiple domains, check its static assets, sign-in, and API requests individually—not just the main domain in the address bar.

Use the client's override, config merge, or rule extension feature to keep local changes separate from the remote subscription. Direct edits to a downloaded subscription file may be replaced the next time it updates. Before adding a rule, confirm that the referenced proxy group exists in the current config and check where the new rule will be inserted. After updating the subscription, review the final active config and verify the match on the Connections page. Merge order and syntax vary between clients. Recheck your setup when migrating rather than assuming the same override file works unchanged everywhere.

Leave LAN access off if you only use the proxy on the local device. If you need to share it with devices on the same local network, enable Allow LAN, confirm the listening address includes the right network interface, and allow only the required port through the firewall on trusted networks. On other devices, enter the LAN address of the computer running the client and its actual mixed port; 127.0.0.1 refers to the device itself, not another computer. Set up proxy authentication and avoid exposing the listener on public networks. The external controller interface is for management, not proxy sharing—don't open it for this purpose. Turn off LAN access and its firewall rules when you're done sharing.

Check that you copied the entire subscription link, including trailing parameters, with no line breaks or extra spaces. A 401 or 403 generally means access was denied, but check your subscription provider's guidance for the specific cause; the link may need to be reset, your account may have an issue, or access may be restricted. Check your device's date and time, then see whether the provider has issued a new subscription URL. If the update fails with a network error, check whether the client fetches subscriptions directly or through the proxy, then retry using a working route. Never post the full subscription link in a public forum; it may contain credentials. If the link has been exposed, reset it with the provider and import the new one.

First check the client's Connections page to see whether requests are reaching the core. If the browser shows no requests, check proxy extensions, browser-specific proxy settings, system bypass lists, and whether another client has overridden the system proxy. Terminal tools often don't use the system proxy automatically. Follow the tool's documentation to set http_proxy and https_proxy or pass a one-off proxy option, and make sure the port matches the client. If requests reach the core, check the matched rule and outbound route instead of toggling the system proxy again. Consider TUN for apps that don't follow system proxy settings. Environment variables affect only processes that read them; open a new terminal to inherit updated values.

Some Windows apps running in an AppContainer sandbox are restricted from accessing local loopback addresses. This can make the browser work while a specific app can't connect. First confirm the affected app runs in this kind of environment, and verify that the proxy and rules are working. If the client offers UWP loopback access, grant administrator permission and select only the apps that need access to the local proxy, then restart them. Not all Microsoft Store apps have this restriction, and you don't need to grant access to every app. If it still fails, check the app's proxy support, DNS, and firewall policy rather than assuming every connection error is caused by loopback restrictions.

Turn off the system proxy and TUN first, then confirm your local network can reach sites that normally connect directly. Reopen the client and check that the config is active, the subscription is valid, a proxy group has a working outbound selected, and the log's first connection error. If all outbounds fail, check shared dependencies first: device time, DNS, the local firewall, other VPN conflicts, and network restrictions. If only specific outbounds fail, check their remote status. Change one thing at a time and record the result. Temporarily switching from Rule to Global mode can help isolate a routing issue, but it won't restore a remote service that's down.

Reopen the client, explicitly turn off the system proxy and TUN, then exit normally; force-quitting may leave system proxy settings or broken routes behind. Check whether the system network settings still point to a local proxy address. If the problem occurs only with TUN enabled, review DNS settings, domain resolution logs, and route conflicts with other VPNs. Don't change several DNS fields at once. With fake-ip, some apps may keep stale results; after restoring the config, restart the app and flush its cache using the system's normal method. If the issue persists, restart the network connection and use the logs to identify any leftover interface. Avoid deleting system routes unless you know what they're for.