Every time the Clash core (including Clash Meta / mihomo) handles a network connection, it first decides which "mode" applies — Rule, Global, or Direct. These aren't just interface toggles; each mode follows a completely different logic for handling connections. Understanding how traffic actually flows in each mode is the foundation for troubleshooting proxy issues and optimizing speed.
How traffic flow differs across the three modes
Every time Clash establishes a new connection (one DNS lookup, one TCP handshake), it makes a routing decision to determine the final outbound path. Here's the logic behind each mode:
- Rule Mode: The core matches connections against the
rulesfield top to bottom. Once a rule matches, the connection is routed according to that rule's outbound (a proxy group, DIRECT, or REJECT), and matching stops there. Rules typically combine domain suffixes, GeoIP data, process names, and rule sets (rule-providers); a catch-allMATCHrule at the end usually defines the default outbound for anything that doesn't match earlier rules. - Global Mode: Ignores everything in the
rulesfield. Every connection skips rule matching entirely and is routed through whichever proxy node or proxy group is currently selected. DNS resolution also follows the proxy-side policy, with no distinction between domestic and international sites. - Direct Mode: Also skips rule matching, but in the opposite direction — every connection bypasses all proxy nodes and goes straight out through the local network, effectively disabling the proxy temporarily.
| Mode | Reads rules? | Typical outbound | Best for |
|---|---|---|---|
| Rule Mode | Yes | Routes to proxy or direct per rule | Default mode for daily use |
| Global Mode | No | Everything through current proxy | Testing nodes, temporary full proxying |
| Direct Mode | No | Everything direct, no proxy | Checking whether the proxy is causing an issue |
Why Rule Mode is the default choice
The core value of Rule mode is selective routing: traffic to domestic sites, LAN addresses, and system updates goes straight out through the local network, while only traffic that actually needs a proxy gets routed through a node. This gives two concrete benefits: latency for local resources isn't affected by the proxy chain, and the proxy node's bandwidth is reserved for traffic that actually needs it instead of getting clogged with unrelated requests.
Common matching methods used in rule files include:
DOMAIN-SUFFIX: matches by domain suffix, e.g.DOMAIN-SUFFIX,github.com,PROXY.GEOIP: matches by IP region, often used to route mainland China IPs directly, e.g.GEOIP,CN,DIRECT.RULE-SET/rule-providers: references externally maintained rule sets, making bulk updates possible without manually editing the config.
Most subscription-provided configs already ship with a built-in rule template covering common scenarios like domestic services, ad filtering, and streaming routing. For everyday use, there's usually no need to tweak anything — just stick with the default Rule mode.
Rules are matched top to bottom, so earlier rules take priority. If a site isn't routing the way you expect, check whether an earlier rule is catching it first before jumping to change proxy nodes.
When Global Mode makes sense — and its cost
The most common use for Global mode is ruling out rule configuration as the cause of a problem. For example, if a site isn't working properly and you're not sure whether it's a missing rule or a bad node, switching to Global mode and seeing the issue disappear points to a rule-matching problem rather than a node problem. If the issue persists in Global mode, the problem lies with the proxy node or the connection itself.
Another use case is covering gaps in an unfamiliar rule set — say you just switched to a new subscription and haven't verified its rules yet. Running Global mode temporarily keeps things working while you check whether additional rules are needed.
The trade-off: in Global mode, domestic sites and LAN services also get forced through the proxy, which adds unnecessary latency and can trigger login failures or extra CAPTCHA prompts on services with strict location checks. Global mode is best used for short-term troubleshooting and testing, not as a long-term daily setting.
Direct Mode and local network troubleshooting
Direct mode effectively disables the proxy, sending all traffic out through the original local network path. Its main value is diagnostic: if you suspect the proxy node or client itself is causing a network issue, switch to Direct mode — if the problem persists, it's unrelated to the proxy and likely a local network, DNS, or ISP issue; if the problem disappears, that confirms the proxy side is at fault.
Direct mode is also sometimes used temporarily for scenarios that require strict network conditions — like verification flows that check your real local IP, or debugging services on a local network — before switching back to Rule mode. It's not meant for long-term use, since that defeats the purpose of running a proxy client at all.
Switching and verifying modes day to day
Most mainstream clients (Clash Verge Rev, Clash Plus, FlClash, etc.) provide a mode switcher right on the main screen or overview page, usually labeled "Rule / Global / Direct." Switching takes effect instantly — no restart or config reload needed.
It's worth distinguishing mode switching from TUN mode: TUN mode determines how traffic is captured in the first place (system-level network interface takeover, covering apps and protocols that aren't proxy-aware), while Rule/Global/Direct determines how that captured traffic gets routed. These are two independent settings that can coexist — with TUN mode enabled, you can still switch between Rule, Global, and Direct mode, and the routing logic behaves exactly the same.
To confirm a mode switch actually took effect, check the client's connection log or traffic panel: in Rule mode, different connections show different outbound policies; in Global mode, every connection shows the current proxy group; in Direct mode, there's no proxy traffic logged at all.
Quick answers to common questions
- A site is slow under Rule mode — should I switch to Global? First check which rule the site is matching and whether that node is healthy. Only switch to Global temporarily to test; it's not meant as a long-term fix.
- Can Global mode and Direct mode be used interchangeably? No — they route traffic in opposite directions. Global mode still goes through a proxy node, while Direct mode bypasses the proxy entirely.
- Do I need to re-import my config when switching modes? No. Mode is a runtime toggle and doesn't affect the rules defined in your config file.
In short, Rule mode covers the vast majority of everyday scenarios, while Global and Direct are best treated as short-term troubleshooting tools. Knowing how traffic flows differently in each mode makes it much faster to pinpoint whether an issue is coming from your rule config, a proxy node, or your local network.