Clash FAQ

Clash Meta was the former name of a Clash-derived core project, later renamed mihomo. The core handles protocol connections, rule matching, and DNS; GUI clients provide the interface for importing subscriptions, selecting proxy groups, and toggling the system proxy. Even clients using mihomo may differ in menu layout and how configuration overrides work. When troubleshooting, note both the client name and core version; the word “Clash” in a window title alone does not indicate which features are supported. Before switching clients, export your configuration, note any custom settings, and check the new client’s core documentation.

A client runs a configuration; installing it does not provide a working remote proxy service. You’ll usually need to import a subscription link you’re authorized to use or load a local configuration containing proxies, groups, and rules. Subscription expiry, data limits, and server status are managed by the service provider and cannot be reset by reinstalling the client. Before using the client, verify where the configuration came from and that its proxy groups loaded correctly. If Direct is the only option, check the configuration and import logs instead of repeatedly toggling the system proxy. Subscription URLs may contain credentials, so don’t share them publicly.

A subscription link retrieves remote content; a profile is usually a saved configuration entry in the client; YAML is a common configuration file format. A subscription may return a complete Clash configuration or only a list of proxies. The latter requires a compatible import option or conversion with a trusted tool. After importing, check that proxy groups, rules, and DNS settings are present. Remote updates usually replace subscription-generated content, so keep custom rules in the client’s override or merge configuration rather than editing files that updates may overwrite.

Rule mode routes connections according to the configuration’s rules and is suited to everyday traffic routing. Global mode sends connections handled by the core through the selected global policy. It’s useful for quick comparisons, but does not take over every app on the device. Direct mode sends core-handled connections straight to their destinations and can help isolate proxy egress issues. All three modes require traffic to reach the core; switching modes may do nothing if an app bypasses the system proxy. After changing modes, start a new connection and check the connection log. Existing long-lived connections may keep using their original route.

Choose your operating system first, then check the processor architecture and package format. On Windows, find the system type in Settings; on macOS, check About This Mac to distinguish Apple silicon from Intel; on Linux, run uname -m and choose a package for your distribution. For Android, check the device and client’s architecture requirements. Desktop installers and core archives are not mobile apps. If installation fails, note your OS version and the full error message, then check for an architecture mismatch, an outdated OS, or a conflict with an existing installation. Avoid repeatedly trying modified packages from unknown sources.

Paste the full subscription URL on the Configuration or Profiles page and import it. Then make sure the entry is selected as the active configuration. Some clients separate downloading a configuration from activating it, so seeing an entry in the list doesn’t mean the core has loaded it. Check that the expected proxy groups appear and that the logs show no YAML parsing errors or unsupported fields. For local files, keep a backup and verify that remote rule sets and proxy providers can be fetched. Finally, select an available proxy, start a new connection, and check the matched rule and policy.

TUN mode creates a virtual network interface and changes routes, so it usually needs more privileges than the system proxy. On Windows, check that the client’s service mode is installed and running, then grant permissions when prompted. On macOS, check authorization for the system network extension or helper service. On Linux, follow the client’s documentation for the TUN device and required permissions. Android and iOS typically require approval for a VPN configuration. Don’t leave security protections disabled just to troubleshoot. If the issue persists, quit other VPN or traffic-routing tools and check the specific interface, route, or permission error. Remove subscription URLs and credentials before sharing logs.

iOS clients typically route traffic through a system network extension, so the first connection prompts you to add a VPN configuration. Make sure the authorization prompt comes from the client you just installed, approve it through the system flow, then return to the app to import a configuration and connect. A VPN icon only confirms that the tunnel is active; it doesn’t prove the selected remote proxy is working. Check the client’s connection logs as well. If your device is managed by an organization, its policies may restrict access; contact your device administrator. For Clash Plus, use the download page to open the App Store. Product information is available at clashplus.io.

A manual selection group lets you pin a specific proxy. An automatic test group typically selects one based on probes to a configured test URL, while a fallback group follows its configured order and availability. Test results reflect access to that test target at that moment; they don’t represent every website or your download speed. To troubleshoot a specific site, pin the same proxy in a manual group to avoid interference from automatic switching. Check whether the group nests other groups, too: the final proxy may be in a different layer from the one shown on the current screen. Verify the result with a new connection.

Rules are usually matched from top to bottom, and the first match determines the route. Put custom rules before any broader rules that could match first, and make sure the target policy name matches an existing proxy group. If your client supports overrides or merges, use that feature and confirm where the rules are inserted. Direct edits to a remote configuration may be lost on subscription updates. Save and reload the configuration, then check the matched rule in the connection log. Domain rules require the core to identify the domain, and connection reuse or existing long-lived connections can affect results. Close old connections and retry before testing.

Fake-IP assigns virtual addresses to domains, then the core uses the mapping to identify and route traffic. Redir-host typically returns the resolved address to the app. Choose based on how the client handles DNS and the apps you use, not just the mode name. If a local network service or app has issues, identify the affected domain first, then consider excluding only that domain with fake-ip-filter rather than allowing a broad range. Switching modes may require clearing system and app DNS caches and reconnecting. If an app uses encrypted DNS on its own, check whether its queries bypass the current configuration.

Allow LAN lets other devices on the same trusted network use the proxy port on your device. Enabling it isn’t enough: check the bind address, listening port, and firewall rules. Other devices should use the client device’s LAN address, not their own loopback address. Expose the proxy only to the networks and devices that need it, keep it off on public networks, and configure authentication if the client supports it. Never forward the proxy port or control interface to the public internet through your router. If connections fail, check network isolation, the firewall, the listening port, and credentials in that order; the toggle alone doesn’t confirm the proxy is reachable.

Check the specific error in the update log first. HTTP 401 or 403 usually points to authorization or service status; 404 may mean the URL is invalid or its path changed; for 429, wait before trying again. For timeouts, DNS failures, or TLS errors, check the network, system clock, and certificate environment. If the download succeeds but parsing fails, the response may be a login page, an error page, or an unsupported subscription format. Keep your current working configuration, check whether the client fetches updates directly or through a proxy, and try another retrieval route. Never paste a full URL containing credentials into a public testing site.

Start by checking the individual proxy; reinstalling is rarely the first step. Select the failing proxy and check the logs to see whether the issue is DNS resolution, a refused connection, a handshake failure, or a probe timeout. Then check whether the subscription expired or the server settings changed. A test timeout doesn’t necessarily mean all real-world requests will fail, especially if the test target is unreachable. Try again on another trusted network to distinguish a network-path issue from a server problem. If only UDP-dependent protocols fail, check whether the network supports that traffic. Don’t disable certificate verification just to clear an error.

The system proxy affects only apps that follow the corresponding OS settings. Command-line tools, some browser settings, and apps with their own network stacks may use separate proxy configurations. Check that the system proxy address and port match the current client, then look for other software that may be changing the settings. Open a new page and check the client’s connection log: no entry points to a traffic-ingress issue; a Direct match points to mode or rule settings; a proxy match followed by failure points to the outbound proxy. If you need to route more apps, consider TUN mode, but first check permissions and routing, and avoid running multiple traffic-capture tools at once.

Some UWP apps are subject to AppContainer loopback restrictions and may be unable to connect to the client’s local proxy port. First confirm that a standard desktop app can use the same proxy, and check whether the affected app is actually restricted; not every app installed from the Store is UWP. Use the client’s loopback exemption tool, if available, or follow Microsoft’s CheckNetIsolation guidance to exempt the target package. This usually requires administrator privileges. Fully quit and relaunch the app, then check the connection log. Exempt only apps that need it, and remove the exemption when it’s no longer needed.