CLASH SETUP REFERENCE · FAQ
Clash FAQ & Troubleshooting.
Find the right checks for your issue, from subscriptions and configuration to connection testing. Change one setting at a time, keep the original configuration, and use connection logs to verify the result.
Basics
Understand the difference between clients, cores, subscriptions, and traffic-capture methods before changing settings. Select a question to expand its answer.
What are Clash, mihomo, and GUI clients?
Clash began as a proxy and rule-based traffic-routing core. mihomo is a core project that evolved from Clash.Meta, while GUI clients provide interfaces for managing subscriptions, switching modes, and routing traffic through the system. Similar client names do not guarantee they use the same core or support the same configuration fields. Before troubleshooting, note the client name and the core name and version from the About or core information page, then consult the relevant documentation. If an older configuration contains unsupported fields, check core compatibility before reinstalling the client.
Why do you need a subscription after installing a Clash client?
A client reads configuration and establishes connections, but it is not a proxy service by itself. Subscriptions are usually provided by a service provider and may contain nodes, proxy groups, and rules—or just node information that the client needs to convert. Before importing one, make sure the service is active and the format is supported, and keep the link private: its access token or other parameters may let anyone use your subscription. Enabling the system proxy will not provide an exit node if you have only local rules and no working nodes. Never post a subscription link in public comments, screenshots, or on an unfamiliar conversion site.
When should you use Rule, Global, or Direct mode?
Rule mode routes connections according to the match order in your configuration and is usually the best choice for everyday use. Global mode sends connections that reach the core through the global proxy group, making it useful for brief comparison tests. Direct mode sends those connections straight to their destinations. Global mode does not take over the entire device: apps that use neither the system proxy nor TUN may bypass the core. For a Global mode test, select a working node in the global proxy group. When you're done, switch back to Rule mode and adjust rules based on the connection logs.
How do the system proxy and TUN differ? Should you enable both?
The system proxy provides a local proxy endpoint for apps that follow the system proxy settings, making it a good first step for testing browser traffic. TUN uses a virtual network interface to capture traffic covered by its routes and is often used by apps that ignore the system proxy. For your initial setup, verify the system proxy first, then enable TUN if needed so you change only one variable at a time. Some clients let you enable both, but the result depends on routing and bypass settings—enabling more options does not necessarily capture more traffic. If you lose connectivity, get connection loops, or encounter app conflicts, quit other proxy tools and retest with just one traffic-capture method enabled.
Setup
Check each step in order: import the subscription, activate the configuration, then enable traffic capture. A successful download does not guarantee a working connection.
Where do you import a Clash subscription, and what should you check afterward?
In the client’s Configuration, Subscription, or Profiles page, add a new remote profile, paste the full link from your service provider, and save it. Once the download completes, set it as the active configuration. Button names vary between clients, but adding a subscription is not the same as activating it: seeing an entry in the list does not mean the core has loaded it. Next, check that proxy groups appear, nodes are selectable, and the logs show no parsing errors. Then enable the system proxy and test a connection. If YAML parsing fails, first make sure the response is not a login page or error page, and that the subscription format does not require conversion.
Clash subscription update failed or shows as expired? Troubleshoot in this order
First, make sure the device is online and its clock is correct. Then check your service provider account for the subscription’s expiration date, remaining traffic, and any changes to the link. Next, review the update log: 401 or 403 errors often point to authorization or access restrictions, a 404 may mean the URL has changed, and a timeout calls for checking the network route to the subscription domain. If the client offers an option to update through a proxy, test it with a working node; if none are available, switch to a network that can reach the subscription URL. Keep the old configuration while retrying, and don’t delete all your nodes first. Redact the subscription URL and its parameters before asking for help publicly.
TUN says permission denied or fails to create a virtual network interface. What should you do?
Turn TUN off first, then confirm that the client supports virtual network interface capture on your operating system. Follow the client’s instructions to install its service mode or authorize its helper component. Windows often requires administrator privileges to install the service; macOS may require approval for a helper tool or network extension; Android requires VPN permission. Another VPN, an old service, or security software may also block interface creation. Check the first specific error in the logs rather than repeatedly granting permissions. If needed, quit other VPNs and restart the service. Once permissions are fixed, test with the default TUN settings. If it still fails, check the virtual network interface driver and system compatibility.
Browser traffic still bypasses Clash after you enable the system proxy. What should you check?
First, confirm the client core is running and that the system proxy’s local address and port match the active configuration. A common mixed port is 7890, but use the value in your actual settings. Disable browser proxy extensions, other proxy clients, and automatic proxy scripts, then reopen the browser and visit a site while watching the client’s connection log. If there’s no log entry, the request may not have reached that proxy endpoint. If it appears but uses a direct connection, check the matched rule and proxy group. Some browsers and apps have their own proxy settings, so the system proxy switch alone cannot tell you how every app is routing traffic.
Tips & usage
Speed tests, rules, and automatic updates all have limits. Check actual requests and logs to confirm what’s working.
Node latency test shows a result, but websites still won’t load. Why?
A latency test only confirms that a request to a specific probe address completed at that time. It doesn’t prove that a particular website, every port, or every protocol is reachable. Select one node, open a site you know works, then try the site that’s failing. Compare the domain, matched rule, proxy group, and error in the connection log. If only one site fails, check for destination restrictions, DNS issues, and rules. If every site fails, check the traffic-capture method and node authentication. Latency is not download speed, and running repeated batch tests before comparing results can congest connections or trigger server-side rate limits.
Where should you add custom rules, and why do they disappear after a subscription update?
Remote subscriptions typically replace the downloaded configuration file when they update, so direct edits may be overwritten. Use the client’s override, configuration merge, or extension script feature to manage local rules separately from subscription content. Rules are generally matched in order: put specific domain rules before broader rules and the final catch-all, and make sure every referenced proxy group exists. Reload the configuration and confirm the match in the connection log. Don’t rely on the editor’s save confirmation alone: an incorrect merge order, field type, or proxy group name can prevent rules from taking effect or stop the configuration from loading.
How do you schedule subscription updates? Is more frequent always better?
Enable scheduled updates in the client’s subscription settings and use the interval recommended by your service provider. If your configuration uses proxy-providers, note that updating the full subscription in the client and refreshing node providers in the core are separate tasks. Short intervals can increase network requests and mobile battery use, and may trigger access restrictions from the subscription service. After changing the schedule, check the last update time and logs to make sure it ran successfully. Scheduled updates may be delayed when a device is asleep or a phone restricts background activity. If nodes change, update manually once rather than constantly shortening the interval for the sake of real-time updates.
Connection drops when your phone locks, or battery drain increases. What can you adjust?
First, check whether the system is stopping the app in the background or whether the connection fails to recover when the network switches from Wi-Fi to mobile data. On Android, allow the background activity the client needs and check for VPN conflicts. On iOS, test the client’s supported on-demand connection settings. If battery use increases, reduce frequent latency tests and overly frequent subscription or rule-set updates, then compare usage over the same period on the same network. Don’t disable every battery restriction or enable every keep-alive option at once. Keep only the settings you need and use the system battery statistics to see whether the client, another app, or fluctuating signal strength is responsible.
Troubleshooting
Start by narrowing down the scope: one website, one app, one device, or the entire network. A clearer scope makes the cause easier to find.
All Clash nodes time out. How can you tell whether the problem is the nodes or your device?
Turn off the proxy and confirm the underlying network works. Then check whether the subscription has expired, the node list has just changed, and the device clock is correct. Select one node and review the connection log to distinguish DNS resolution failures, authentication failures, refused connections, and timeouts—each points to a different fix. Next, test the same node on another network, or a known working node on the same network, changing only one condition at a time. If only this device fails, check its firewall, other VPNs, and local ports. If multiple devices and networks fail, ask your service provider to check the node status instead of repeatedly switching clients.
Microsoft Store and other UWP apps can’t connect. How do you check loopback restrictions?
First, make sure a regular browser can access the internet through the system proxy, then check whether the issue affects only a specific UWP app. Network isolation can prevent some UWP apps from connecting to a local proxy endpoint. If the client includes a UWP loopback exemption tool, follow its instructions and grant administrator permission to exempt only the apps that need it. Then fully close and reopen those apps. Don’t change settings for unrelated apps or assume every Microsoft Store connectivity issue is a loopback problem. If the issue persists, check the system clock, account status, and connection logs. If your client supports it, test TUN capture as a comparison.
Some websites or local network devices can’t be reached with fake-ip enabled. What should you do?
First, check whether the issue affects only local network domains, printers, or apps that depend on real DNS addresses. fake-ip returns a virtual address that maps to a domain; it should not be treated like an ordinary public IP address. What matters is whether the same core continues to handle the connection correctly. Check that DNS requests are reaching the client, TUN routes are complete, and other encrypted DNS services aren’t bypassing the configuration. For domains that are genuinely incompatible, add them to fake-ip-filter using the syntax supported by your core, or configure an appropriate DNS resolution policy. After making changes, clear the system and app DNS caches and restart affected apps before retesting, so old cached results don’t make the new configuration appear ineffective.
The whole device loses internet access after you quit Clash. How can you restore it?
Check your system network settings for a manual proxy that still points to the local device. When the client quits, its local listener stops, and any remaining proxy setting can prevent apps that follow it from connecting. Turn off proxy settings you no longer use and check whether the TUN interface or helper service is still running. If you changed DNS manually, restore the network’s original settings or set DNS to automatic, then reconnect. Don’t reset all network settings right away; that could remove workplace network settings or static addresses. Once connectivity is restored, restart the client and test again by turning off traffic capture before quitting. This can help identify an unexpected shutdown or a conflict between proxy tools as the cause.