Clash FAQs
and Troubleshooting

Clash is a general name for rule-based traffic routing tools and their configuration format. Clash Meta extended the original capabilities with additional protocols, rules, and DNS features; the core project was later renamed mihomo. Many newer clients that still use Clash in their names actually run the mihomo core, so interface names may differ while subscription imports, proxy groups, and rule matching generally remain compatible.

For everyday use, choose Rules mode. Connections are matched from top to bottom against the rules in the configuration, then sent to DIRECT, REJECT, or a selected proxy group. Global mode sends most connections to one proxy group and is useful for temporarily testing rule issues. Direct mode bypasses the proxy and is suitable for pausing traffic routing. Switching modes does not rewrite the subscription file, but it changes how current connections are handled.

A system proxy only handles applications that follow the operating system's proxy settings, such as most browsers and desktop apps. TUN mode creates a virtual network interface that can handle apps that ignore system proxy settings, some command-line programs, and games. Start with the system proxy for a simpler setup; enable TUN only when an app is not covered, then grant the network extension or administrator permissions requested by the system.

A subscription link provides configuration from a server, which the client can fetch again at set intervals. It is useful when proxy groups and connection details need to stay synchronized. A local config.yaml is stored on the device, making rules, DNS, and port changes more direct, but it does not automatically follow subscription updates. For long-term customization, keep the original subscription and use the client's override feature to prevent updates from replacing manual changes.

Copy the complete subscription link into a browser and confirm that it returns YAML or starts a configuration download—not a login page, error page, or blank response. Then check for spaces around the link, truncation by messaging apps, and an incorrect device clock. If import still fails, download the file locally and import it; if it cannot be parsed either, check the YAML indentation or request a new link from the subscription provider.

Temporarily disable the system proxy and TUN, then run the subscription update again to rule out old rules sending the subscription domain to an unavailable proxy group. Check whether the subscription address has changed, whether the current network can access it directly, and whether the client can write to the configuration directory. After a successful update, select the configuration again and verify that the interface shows the newly updated file.

On Windows, allow the client to install or start its service with administrator privileges. On macOS, approve the network extension in System Settings and allow the VPN configuration to be added. On Linux, the core usually needs permission to create a TUN interface and modify routes. After granting permission, fully quit and restart the client. If an old service remains, disable TUN, remove the old service, and reinstall it from the client.

Mobile operating systems usually allow only one app to occupy the VPN tunnel. Disconnect VPNs created by other proxies, corporate VPNs, ad blockers, or private DNS apps, then reconnect in the Clash-compatible client. On Android, also check whether Always-on VPN is assigned to another app. On iOS, confirm the active configuration in the system VPN list. Disconnect the existing connection before switching clients.

Clash evaluates rules from top to bottom and stops at the first match. Make sure the custom rule appears before broader rule sets and MATCH, then verify that types such as DOMAIN, DOMAIN-SUFFIX, and IP-CIDR match the target. Reload the configuration after editing. Connection details or logs can show the rule that actually matched, helping determine whether the issue is rule order, DNS resolution, or an unhandled process.

First confirm that the system proxy points to the client's current mixed-port or HTTP port, and check that no other program is using the port. Some apps use their own proxy settings, ignore the system proxy, or open UDP connections directly, which the system proxy cannot cover. Enter the proxy address manually in the app or switch to TUN mode. Restart the affected app afterward so it does not reuse old connections.

UWP apps are subject to local loopback restrictions by default and may be unable to access a proxy port running on 127.0.0.1. Use the client's UWP loopback tool to enable loopback exemptions for the Store apps that need network access, then save and restart them. Do not select every system component at once. If the client has no such option, enable TUN mode so traffic is handled through the virtual interface.

Fake-IP first returns a reserved address, then the core restores the domain and applies rules. For LAN devices, printers, casting devices, or apps that require real DNS results, add the relevant domains to fake-ip-filter and keep a DIRECT rule for private addresses. After changing DNS settings, clear the system DNS cache and restart the affected app. If the issue is widespread, temporarily switch to redir-host for comparison testing.

Switch to a different network first to rule out the current Wi-Fi, mobile network, or firewall. Then check the client clock, the subscription's update time, and system components required by the node protocol. A timeout on one node usually indicates a node-side issue; simultaneous timeouts on every node are more likely related to DNS, core startup, port conflicts, or an expired subscription. Log entries such as timeout, refused, and DNS error can help identify the connection stage involved.

Do not delete the local configuration that still works, or you may lose your fallback. Open the subscription address directly in a browser and check whether the link has expired, the account is active, and the response is still a Clash configuration. If the server returns a login page, message, or empty file, the client cannot parse it as a proxy list. Add the new link as a separate configuration, verify that it works, and then remove the old one.

The system proxy or TUN routes usually did not revert correctly. Restart the client, disable the system proxy and TUN, then quit normally from its menu. If the client will not start, turn off the manual proxy in the operating system's network settings and remove any leftover proxy address. Disconnect and reconnect the network afterward. If access is still unavailable, restart the device to reinitialize the virtual interface, routing table, and DNS settings.

Switch to Direct mode first to confirm that the underlying network works, then return to Rules mode and try another proxy group. Check the logs for DNS resolution failures, refused connections, or timeouts, and confirm that the active configuration, system proxy port, and running core match. If only the browser is affected, disable its separate proxy or Secure DNS and try again. If every app is affected, check the subscription, DNS, TUN routes, and local firewall first.