Subscription setup · Traffic routing · Connection troubleshooting
Clash FAQ
Separate configuration, traffic routing, and connectivity issues before changing settings. The checks below are grouped into four categories; menu names may vary by client.
Getting Started
Understand the roles of the client, core, and configuration first, so you don't mistake a traffic-routing issue for a node problem.
What are a Clash client, the mihomo core, and a subscription?
The client provides the interface, manages configuration, and routes system traffic; the core establishes connections, evaluates rules, and handles DNS. mihomo is a core project that continues the development of Clash Meta. A subscription is a link provided by a configuration service and may include nodes, proxy groups, and rules. Installing a client does not provide usable nodes. Before importing a subscription, check its source, validity period, and supported configuration format.
How do Rule, Global, and Direct modes differ?
For everyday use, start with Rule mode, which matches connections against the rule list from top to bottom. Global mode generally sends connections reaching the core through the global proxy group, where you still need to select a node. Direct mode sends connections handled by the core directly to their destinations. These modes determine how the core handles traffic; they do not connect every app to the proxy. Check separately whether the system proxy or TUN is enabled.
Can I use the same subscription in different clients?
The URL suffix alone doesn't tell you. A client may accept Clash YAML, specific node-link formats, or configuration formats used by other cores; support depends on the client version. Choose Clash or mihomo format on your configuration provider's site, then check the client's import instructions. If you see field errors, verify the format and core compatibility. Don't submit a subscription URL containing access credentials to an unfamiliar online converter.
Can I still use Clash for Windows now that it's discontinued?
An existing installation may still work, but an unmaintained app won't receive updates for system changes, protocol changes, or bug fixes. For a new installation, choose a client that is still maintained. Before migrating, back up your configuration, import the subscription, and check proxy groups, DNS, and port settings. Interface preferences and service settings from the old client may not transfer. Once the new client works, turn off the old client's system proxy and startup options.
Is it safe to share a subscription URL or logs for troubleshooting?
A full subscription URL often contains access credentials, so treat it as sensitive information. Before sharing screenshots or logs, redact subscription URLs, tokens, server addresses, and any access history you don't need to disclose. Keep only the error type, time, and relevant settings. If a link has been exposed, reset the URL or credentials with your configuration provider, then update the subscription in your client. Deleting a chat message does not invalidate a leaked link.
Setup
Follow this order: import a configuration, choose a proxy, then route traffic. Test the system proxy and TUN separately.
What's the right order for importing a subscription after installing the client?
First, make sure the installer matches your operating system and processor architecture. Open the client's configuration or subscription page, add the remote subscription URL, and update it. Once downloaded, select the configuration, open the proxy page, choose an available node for the proxy group, and then enable the system proxy. Test the connection in a browser before considering TUN for apps that need it. A successful subscription download doesn't mean the configuration is active or a node has been selected.
TUN reports insufficient permissions. How do I fix it?
Start by checking the client log for the specific permission error. A Windows client may require service mode or administrator privileges; macOS may require approval for a helper component; Linux may need appropriate network-management permissions. The exact setup varies by client. After granting permission, restart the relevant service and check that the virtual interface and routes were created. Don't leave system protections disabled as a workaround for missing permissions.
Why isn't my browser using the proxy even though the system proxy is on?
First, confirm the configuration is loaded, the core is running, and the system proxy address matches the port the client is listening on. Then check whether the browser has its own proxy settings, a proxy extension, or a bypass list; some browsers may need to be restarted. Temporarily quit other proxy tools to prevent them from overriding the settings. Make a new request and check the client's Connections page. If no connection appears, troubleshoot traffic routing before switching nodes repeatedly.
A Windows UWP app can't connect. Do I need loopback exemption?
First confirm that the app runs in an app container subject to loopback restrictions and is trying to connect through a local proxy port. If the client provides a loopback exemption tool, follow its instructions, grant exemptions only to the apps that need them, and restart the app to test. Not every Store app is subject to the same restrictions. You can also consider routing traffic through TUN, but disable any duplicate routing method first so permission and routing issues don't get mixed up.
How can a phone or other device use my computer's LAN proxy?
Connect both devices to the same trusted LAN. On the computer, enable LAN access in the client and check the listening address and HTTP or mixed port. On the other device, enter the computer's LAN address and the corresponding port—not a loopback address. Allow the connection through the firewall only on trusted networks, and set proxy authentication if needed. Don't expose the proxy port to the public internet. Guest network isolation, computer sleep, and changing IP addresses can also interrupt connections.
Usage Tips
Keep custom rules, check which policy actually matched, and verify startup settings separately from connection status.
Why did my manually added rules disappear after a subscription update?
A remote subscription update may regenerate the entire configuration, overwriting direct edits to the downloaded file. To keep custom rules, use the client's supported override, merge, or extension feature, and confirm it still applies after subscription updates. Check proxy group names and rule order; put specific matches before catch-all rules. After saving, verify the active configuration rather than relying only on what the editor shows.
Why can't I connect after startup even though auto-start is enabled?
Starting the client, loading a configuration, enabling the system proxy, and starting a background service are separate settings; check each one. Confirm the client is running after you sign in, then check that the right configuration is selected, the proxy group is valid, and the subscription is up to date. If you use TUN, confirm its service is running. If the network isn't ready at startup, try updating after you connect. Starting multiple proxy clients at once is not a good workaround.
Why do terminal commands connect directly when my browser uses the proxy?
Many command-line tools don't automatically use the desktop system proxy. You can use a terminal proxy command provided by the client, but first check the local address, port, and proxy protocols the tool supports. Set environment variables only in the terminal sessions that need them. Some tools have their own proxy settings, which can override environment variables. Make a request and check the connection log; when you're done troubleshooting, remove temporary settings so the terminal doesn't keep pointing to a dead port after the client exits.
Why are downloads still slow when the node test passes?
A connectivity test only shows that the test destination responds; it doesn't measure sustained transfer speed. Compare direct and proxied connections to the same destination on the same network, then try another node. Check the Connections page to confirm the download matched the expected rule and proxy group. Also consider your Wi-Fi, other downloads, and rate limits at the destination. Change one thing at a time and note the test time and results; changing DNS, protocols, and routing together makes the cause harder to identify.
How can I check which rule matched a website?
Open the client's Connections page, then make the target app start a new connection. Check the destination domain or address, matched rule, and final outbound policy. Existing connections may keep using the old route after a configuration change, so close them in the app and retry if needed. If the log shows an address but no domain, consider the DNS mode and how the app resolves names. Raising the log level temporarily can help; restore it afterward and delete logs containing browsing history.
Troubleshooting
Keep the error message, test your basic connection first, then check the subscription, core, and app in order. Change one setting at a time.
A subscription update fails with an expired message, 401, or 403. What should I check first?
Check with your configuration provider to see whether the subscription expired, the URL was reset, or device or access limits apply. A 401 or 403 usually points to authorization or access policy, but the status code alone doesn't identify the cause. Copy the full URL again, check for spaces or line breaks, and verify your system clock. If the response is a login page instead of a configuration, get the correct subscription URL. Never post the full URL when asking for help.
All nodes time out. How can I tell whether the problem is with the nodes or my setup?
Turn off the proxy and verify that your basic internet connection works. Then confirm the subscription contains nodes and the selected proxy group isn't set to a reject policy. Run only one proxy client, check the core log for DNS, authentication, or handshake errors, and verify the system clock. Try another node or a different available network for comparison. If tests fail only for one test destination, check that destination too; don't assume every node is down.
GeoIP or GeoSite updates are failing. What should I do?
Check the logs to distinguish a failed download from a directory permission issue or an incompatible data format. Confirm which geodata mode the configuration uses, then update it through the corresponding client option. Resources in different formats can't be made interchangeable by renaming the files. If the download source is unreachable, use a download method supported by the client documentation. After updating, reload the configuration or restart the core as instructed, then verify rule matches in the logs rather than relying on file timestamps.
My computer loses internet access after I quit Clash. How do I restore it?
Check your system network settings for a manual proxy still pointing to a local port. Turn it off and test again. If you were using TUN, reopen the client, disable TUN and the system proxy normally, then quit; check whether any related background service is still running. Also clear proxy settings in browser extensions, terminal environment variables, and other tools. If you're still offline, use the logs to check DNS and routing rather than resetting all network settings immediately.
The configuration reports a port conflict or DNS resolution failure. How should I troubleshoot it?
For a port conflict, identify the process using the port. A common cause is an old core or another proxy tool still running. Once you confirm what it does, stop it or change the client's listening port and update the system proxy to match. For DNS failures, first check that your basic connection and upstream DNS server are reachable, then review the configuration syntax, DNS rules, and TUN DNS settings. Don't kill system processes at random or change DNS settings in several places at once; make one change and test again.