Clash FAQ

Clash is a rule-based proxy client that routes traffic by domain, IP region, process, and other conditions to different exits. Unlike a traditional VPN that pushes all traffic through a single tunnel, Clash can send some traffic direct, some through a proxy, and block the rest outright — usually giving better performance and flexibility. Most mainstream clients today run on the Mihomo core.

Rule mode matches traffic against the rules in your config file one by one, routing each match accordingly — this is the default for everyday use. Global mode sends all traffic through the current proxy node, useful when rules are temporarily broken or you need everything proxied. Direct mode bypasses the proxy entirely, handy for troubleshooting or temporarily disabling the proxy. Stick with Rule mode most of the time; see the mode comparison article in our technical notes for a full breakdown of all three.

A subscription link is a URL pointing to config content that includes nodes and rules, provided by your service provider through their user panel. The client fetches and periodically refreshes this config, so node changes don't require manual edits. Treat your subscription link like a login credential — never post it publicly in forums or chat groups.

Mihomo (formerly Clash Meta) is the command-line core that handles actual proxying, traffic splitting, and DNS resolution. GUI clients like Clash Plus, Clash Verge Rev, and FlClash wrap around the core, handling subscription management, system proxy toggles, and node selection through a visual interface. Most users only need the GUI client — downloading the core separately is typically for server or router setups; see the core section on the download page.

The original Clash for Windows repository has been archived and no longer receives updates, so newer config fields and protocols may not be recognized. On Windows, we recommend switching to Clash Plus or Clash Verge Rev — both run on the Mihomo core and support current subscription formats. Migrating just means re-importing your subscription link into the new client; the subscription itself doesn't need any changes. Grab an installer from the Windows section of the download page.

When you first run an open-source client installer, SmartScreen may show a "Windows protected your PC" warning. This is a generic notice for apps without a paid code-signing certificate, not a sign of an actual problem. Click "More info," then "Run anyway" to continue installing. Before doing this, make sure the installer came from our download page or the project's official release channel.

This happens because Gatekeeper flags apps distributed outside the App Store with a quarantine attribute. Go to System Settings → Privacy & Security, scroll to the bottom, and choose "Open Anyway." If that option isn't there, run xattr -cr /Applications/YourClient.app in Terminal to clear the quarantine flag, then reopen the app. Also double-check you downloaded the right build — Apple Silicon and Intel installers aren't interchangeable, and running the wrong one causes launch failures too.

General steps: copy the subscription URL from your provider, open the "Subscriptions" or "Profiles" tab in your client, choose "New" or "Import," paste the URL, and confirm. Once the client downloads the config, enable it from the list. You'll know it worked when node groups show up on the proxy page. See the setup guide for step-by-step instructions on each platform.

iOS clients are distributed through the App Store — Clash Plus (clashplus.io) is the top pick. Our download page's iOS section links directly to the store listing. After installing, it's the same three steps: import your subscription, pick a node, and connect. The first time you connect, iOS will prompt you to add a VPN configuration — just allow it.

Nearly every phone made after 2016 runs on arm64, so grab the arm64 build first — it's smaller. If you're not sure about your device's architecture, or you're installing on an emulator or older hardware, use the universal build instead; it bundles libraries for multiple architectures for maximum compatibility. If Android warns about "unknown sources," you'll need to grant install permission to your browser or file manager in Settings.

System proxy just tells the OS about an HTTP/SOCKS proxy entry point — apps and browsers that respect this setting will route through it, but anything that ignores system proxy settings (some games, CLI tools) won't be affected. TUN mode creates a virtual network adapter and intercepts all traffic at the network layer, giving full coverage. Use system proxy for everyday browsing, and switch on TUN when you run into an app that won't respect the system proxy.

Most clients let you set an update interval per subscription: open the edit page for your subscription entry, find "Auto Update" or "Update Interval," and enter a number of hours — 12 or 24 are common choices. Still get in the habit of updating manually too, especially right after a node-change notice from your provider. If auto-update keeps failing, check the subscription update entry in the troubleshooting section.

On the proxy page, look for the latency test button — usually a lightning bolt or refresh-arrow icon. The client pings a test endpoint and shows a millisecond value. This only measures handshake latency, not bandwidth, so a node with stable, low-variance latency is often more reliable than just picking the lowest number. For url-test groups, the client auto-selects the lowest-latency node for you.

Most CLI tools respect proxy environment variables. Assuming the default mixed port of 7890, run export https_proxy=http://127.0.0.1:7890 http_proxy=http://127.0.0.1:7890 in your terminal, and tools like curl and git in that session will use the proxy. On Windows PowerShell, use $env:https_proxy instead. Double-check the actual port in your client's settings page — it may differ from the default.

Add a higher-priority direct rule in your client's rule or override settings — for example, DOMAIN-SUFFIX,example.com,DIRECT — to bypass the proxy for that domain. Most clients offer a "Rule Override" or "Custom Rules" interface for this. Don't edit the raw subscription file directly, since manual edits get wiped out on the next update; overrides persist across updates instead.

Check three things in order. First, open the subscription URL directly in a browser — a 404 or expiration notice means the link is dead, so reset it in your provider's panel and grab a new one. Second, your current network might be blocking the subscription domain — connect through any working node first, then switch the update method to "update via proxy" and try again. Third, some providers check the request's user agent — set your client's subscription UA to clash or whatever value your provider requires.

Check the client logs first to see if traffic is actually coming through. If you see request logs, the proxy chain is working and the issue is likely the node — switch to one with normal latency and retry. Next, make sure your browser doesn't have another proxy extension overriding the setting. Then confirm the system proxy port matches what the client is listening on — usually 7890 by default. If there's no traffic in the logs at all, the system proxy toggle probably didn't take effect — turn it off and back on, or switch to TUN mode.

TUN needs to create a virtual network adapter. On Windows, run the client as administrator, or install/reinstall the system service from Settings and try again. On macOS, the first time you enable TUN, you'll get a network extension authorization prompt — allow it in System Settings → Privacy & Security. On Linux, the process needs CAP_NET_ADMIN or must run as root. If you're still offline after enabling it, try switching the TUN stack between system and gvisor.

Windows blocks UWP apps from accessing the local loopback address by default, so they can't reach the proxy on 127.0.0.1. Look for "UWP Loopback Exemption" or a "Loopback" tool in your client's settings, check the box for the affected app, and save. If your client doesn't have this built in, switch to TUN mode instead — it intercepts traffic at the network layer and isn't affected by the loopback restriction.

Across-the-board timeouts usually aren't about any single node. First, confirm your device has normal direct internet access by loading a site that doesn't go through the proxy. Second, your subscription might be fully expired — update it. Third, the test endpoint itself may be blocked on your current network — switch to a standard one like http://www.gstatic.com/generate_204 in settings. Fourth, check whether your firewall or security software is blocking the client process, and add an allow rule if needed.

Work through three layers. First, compare 2–3 nodes in different regions — if only one is slow, just switch nodes. If most nodes slow down together during peak hours, that's usually line congestion, so try nodes with a different protocol or transport. If it's still slow, check your local setup — disable unnecessary rule sets, try a different DNS, and make sure you're not accidentally stacking multiple proxies. See the network speed troubleshooting article in our technical notes for the full layer-by-layer breakdown.