Clash FAQ

Clash commonly refers to the proxy core and its configuration ecosystem. mihomo is a core that continues the development of Clash.Meta, handling connections, rule matching, and DNS. Clients such as Clash Plus and Clash Verge Rev provide a graphical interface for managing configurations, system proxy settings, and core processes. Whether a configuration works depends on the core and version bundled with the client, not simply whether its name includes Clash.

A client runs a configuration; installing it does not automatically provide a remote proxy service. A subscription typically supplies server details, proxy groups, and routing rules. You can also maintain your own YAML configuration. Before importing one, check that its source is trustworthy, the service is active, and the format is supported. Subscription URLs may contain access credentials, so redact the full link in screenshots and support logs. Never share it publicly like an ordinary web address.

Rule mode is the usual choice: connections are routed according to the configuration's rules, in order. Global mode sends connections that reach the core through the global proxy group, making it useful for briefly checking whether rules are affecting access. Direct mode connects those traffic flows straight to their destinations. These modes only control traffic that has already reached the core. Global mode does not take over the whole device or replace the system proxy or TUN.

For a fresh install, start with Clash Plus on the downloads page, then compare Clash Verge Rev, FlClash, and Clash Nyanpasu based on your interface preferences. Clash for Windows is no longer maintained. Before switching, back up your configuration and custom rules, then import them into the new client. Interface settings may not transfer directly: check the mixed port, service mode, TUN, and DNS overrides individually. Do not let two clients manage the system proxy at the same time.

A node speed test usually measures how long the core takes to reach a test endpoint. It does not measure download bandwidth, video throughput, or gaming performance. Results depend on the endpoint, timeout, server load, and the network hosting the destination. Compare nodes using the same endpoint and network, then test them in the apps you actually use. A node marked as timed out may simply be unable to reach the test endpoint. Check the logs before removing it based on a single result.

On your provider's site, choose a subscription URL explicitly labeled for Clash or mihomo. In the client's configuration or subscription page, use an option such as Import from URL, paste the link, and save it. Then set that configuration as active. Account sign-in pages, order pages, and QR code image URLs are usually not subscription links. If you only have a Base64 node list or SIP008 data, first check whether your client supports it; changing the file extension to YAML is not enough.

First check that the client core is running, then address permissions for your platform. On Windows, you may need to install and start the service mode provided by the client. macOS may require installing and authorizing a helper. On Linux, use a supported privilege escalation method or service configuration. On Android, approve the system VPN connection request. Once set up, enable TUN again and check the logs. Do not rely on repeated elevation to mask a failed service installation, and do not run another VPN app at the same time.

No. 7890 is just a common setting. A mixed port accepts both HTTP and SOCKS5 proxy connections on the same listening port; the actual value depends on your client. When entering proxy details manually in a browser extension or another app, use 127.0.0.1 as the local address and match the client's port. If the port is already in use, close the old client or identify the process using it. After changing the port, update it in every app where you entered it manually.

The system proxy provides proxy settings to apps; it does not force every program to use them. Test with a browser that respects the system proxy, then check whether the request appears on the client's connections page. Command-line tools, games, and apps with their own networking stack may need a proxy configured separately, process environment variables, or TUN. If the connection appears in the client but is still routed as DIRECT, check which rule matched instead of repeatedly toggling the system proxy.

Connect the devices to the same trusted LAN. In the computer's client, enable Allow LAN and make sure it listens on an address beyond loopback. On each device, set the manual HTTP proxy to the computer's LAN IP and mixed port. Do not enter 127.0.0.1 or mistake the router's gateway address for the computer's. Allow the port through the computer's firewall only on the required private network. A standard HTTP proxy does not route every app or UDP traffic on the device.

A subscription update downloads the remote configuration again, so edits made directly to a generated file may be overwritten. Use the client's override, merge, extension configuration, or scripting features to keep your own rules separate from the remote subscription. Merge order varies by client. After adding rules, check the effective configuration and verify matches on the connections page. When switching clients, set up overrides again rather than assuming they will transfer with the subscription URL.

Stay in Rule mode and add a domain match for the site to your custom rules. Place it before any broad rules that might match first and before the final MATCH rule. For example, DOMAIN-SUFFIX,example.com,DIRECT matches that domain and its subdomains. A site may also use separate domains for sign-in, images, or APIs; use the connection logs to add any required domains. Do not bypass an entire large, shared service domain just to make one site connect directly.

Fake-IP returns a mapped address to the app first, then the core associates the connection with its domain for rule matching and further resolution. It is not the remote server's real IP address. Apps that depend on real DNS results, LAN discovery, or special authentication flows may not work with it. Identify the affected domains first, then add exceptions using the fake-ip-filter behavior supported by your core. Restart the affected apps after making changes and clear the DNS cache if needed; only then decide whether to switch DNS modes.

First define what you expect: which resolver should handle each domain. Then check the client's DNS settings, DNS handling in TUN, and whether the browser's Secure DNS uses a separate path. Resolver names or locations shown by DNS test sites are clues, not proof on their own. Compare actual requests against the core logs and system DNS settings, and capture traffic if necessary. Local DNS resolution when rules allow a direct connection may be expected.

Wait for the network to reconnect, then try a new request. After switching networks, existing TCP connections, DNS cache entries, and TUN routes may briefly stop working. Try closing old connections, running the speed test again, and re-enabling the current traffic routing method; restart the client only as a last step. If you share the proxy over a LAN, check whether the computer's IP has changed. If the issue returns after every sleep, note the OS version, core logs, and wake time to help distinguish a network driver issue from a client recovery issue.

Check the status in the update log first. A 401 or 403 often points to authorization, a revoked link, or access restrictions; a 404 may mean the address changed. For a timeout, check your network and DNS resolution for the subscription domain. A status code alone does not prove the service has expired, so verify your account on the provider's site. If the subscription download depends on a node that is unavailable, verify the source and try updating via Direct, or switch to a working configuration first. Do not submit your full subscription URL to an unknown conversion service.

Temporarily disable the client's traffic routing and confirm your regular network can reach sites that normally connect directly. Then check that the core is running, the subscription is valid, and the system clock is correct. Test a single node and use the logs to distinguish DNS resolution failures, refused connections, handshake failures, and test endpoint timeouts. Do not change DNS, ports, and mode all at once; change one setting and retest. Keep a backup of the original configuration until you find the cause so a reinstall does not erase useful clues.

Some apps running in AppContainer are restricted by network isolation and cannot connect directly to a local loopback proxy. First confirm that a regular browser works with the same proxy. Then check whether the client offers a UWP loopback exemption and enable it only for apps that need it. This usually requires administrator privileges and may need to be checked again after reinstalling an app. Not every Store app is a UWP app. If you use TUN, test its routing separately instead of assuming every failure is a loopback issue.

First, open your system network proxy settings and disable any leftover manual proxy or auto-configuration script; the local listening port may have stopped when the client closed. If you were using TUN, reopen the client, disable TUN normally, and wait for routes to recover. Then check whether DNS is still manually configured on the network adapter. Do not remove managed settings on a work or school device without authorization. Test a direct connection once access is restored and reconnect to the network if needed. Avoid a full network reset at the outset, as it can affect other software.

Back up your current configuration and check the startup logs first. For parsing errors, check YAML indentation, duplicate keys, proxy group references, and fields the core does not support. If the client exits as soon as it opens, also check for port conflicts, missing or incomplete core files, system permissions, and runtime dependencies. Try a configuration that worked previously for comparison, but do not delete the entire data directory. When asking for help, include the client name, system architecture, and a redacted error excerpt. Do not include node passwords or subscription credentials.