FAQ · Live-answered questions · 21 entries
Clash FAQ
High-frequency questions organized into four categories — basics, setup, usage tips, and troubleshooting — covering subscription import and expiry, node timeouts, TUN permissions, system proxy issues, UWP loopback restrictions, and DNS leaks, each with a diagnostic path and fix.
CAT-01 · BASIC
Basics
5 entries · Core concepts: the core, proxy modes, and subscription links.
What is Clash? How is it different from a VPN?
Clash is a rule-based proxy client, not a VPN. It listens on local HTTP/SOCKS ports (or creates a virtual network adapter via TUN mode) and routes each connection according to the rules in its config file: traffic matching a proxy rule goes to a node, everything else connects directly.
The key difference from a VPN is granularity: a VPN takes over all traffic at the system level with no distinction between apps or destinations, while Clash routes traffic based on domain, IP, process, and other conditions. The client only handles connection routing — you still need to bring your own proxy nodes.
How does the mihomo core relate to Clash?
mihomo (formerly Clash Meta) is the community-maintained core fork that took over after the original Clash project stopped receiving updates. It stays compatible with the original config syntax while adding new protocols and features like TUN mode, VLESS, and Hysteria2.
Today's leading clients — Clash Verge Rev, FlClash, Clash Plus, and others — all run on the mihomo core. In everyday usage, "Clash" now generally refers to this core-plus-GUI ecosystem rather than any single piece of software.
Is the Clash client free to use?
Yes. The mihomo core and the leading GUI clients are all open source, and installers can be downloaded directly from this site's download page, free to use permanently.
Keep in mind: the client only handles connections — you'll need your own proxy node service, and whether that service is free or paid depends entirely on the provider, not the client.
What's the difference between Rule, Global, and Direct mode?
Rule mode routes traffic based on rule sets — domestic sites connect directly, overseas sites go through a proxy node — and is the best default for everyday use. Global mode sends all traffic through a single selected node, useful mainly for troubleshooting or when you need one unified exit IP. Direct mode disables proxying entirely, effectively pausing traffic splitting.
You can switch modes anytime from the client's home screen or the top of the Proxies tab — changes apply instantly, no restart needed.
What's a subscription link, and how is it different from adding a single node manually?
A subscription link is a URL that periodically returns a list of nodes; the client fetches it and auto-populates the node list, refreshing on a set interval — ideal when you have many nodes or a list that changes often. Adding a node manually means entering one server's full connection details at a time.
Under the hood, subscription content is typically a Base64-encoded node list or a YAML config, and support varies slightly between clients, so format conversion is sometimes needed — see this guide to subscription formats for details.
CAT-02 · INSTALL
Installation
5 entries · Platform-specific setup, subscription import, and first-time configuration.
Which client should I use on Windows?
Clash Plus (a mihomo-core GUI, actively maintained) is the top pick; Clash Verge Rev, FlClash, and Clash Nyanpasu are solid alternatives. Clash for Windows is no longer maintained — its download page is kept only as an archive, and new users shouldn't install it. See the migration guide for moving off it.
For Windows 10 and later, grab the x86_64 installer and follow the setup wizard; see the download page's Windows tab for full system requirements.
macOS says the app "can't be opened" or "is damaged" — what now?
This is Gatekeeper blocking an app that hasn't been notarized — it doesn't mean the file is actually damaged. To fix it: go to System Settings → Privacy & Security, and under Security click "Open Anyway." If it's still blocked, run sudo xattr -rd com.apple.quarantine /Applications/AppName.app in Terminal to clear the quarantine flag.
On Apple Silicon, make sure you downloaded the arm64 build. Full steps for network extension and keychain permissions are in this macOS permissions guide.
Which client should I use on iOS?
Search for Clash Plus on the App Store to install it, or visit its official site at clashplus.io and follow the link to the store listing. Once installed, import your subscription link and you're set — it supports rule-based routing and a home screen widget.
Since iOS apps are distributed exclusively through the App Store, there's no standalone installer like on desktop — just follow the store listing, linked from the download page's iOS tab.
How do I import a subscription link into the client?
The steps are basically the same across clients: open the Profiles page, choose to create or import a new profile, paste in the subscription URL, confirm the download, then select that profile in the list to activate it. In Clash Verge Rev this is labeled "Subscriptions," in Clash Plus it's the plus icon in the top-right of the Profiles page, and in FlClash it's just the Profiles page.
After importing, it's worth turning on auto-update — the default 24-hour interval works fine, though you can shorten it if the node list changes often. See the full walkthrough in the setup guide.
The node list is empty after importing a subscription — why?
Work through this checklist in order: ① Open the subscription URL directly in a browser to confirm it returns content — if the link has expired, ask the provider for a new one. ② Switch the client to Direct mode before updating, to avoid a deadlock where a dead node blocks the subscription update itself. ③ Make sure the config format matches what your client expects — some clients only accept YAML-formatted subscriptions. ④ Confirm the profile is actually "selected" in the profile list after importing — downloading a profile without selecting it won't load any nodes.
CAT-03 · USAGE
Usage Tips
5 entries · Rule tweaks, LAN sharing, managing multiple subscriptions, and checking connections.
A few domestic sites are still routing through the proxy in Rule mode — how do I fix that?
This means the current rule set doesn't cover that domain. Add a line like DOMAIN-SUFFIX,example.com,DIRECT (swap in the real domain) to the top of the rules: section in your config — rules are matched top to bottom, so placing it first gives it priority.
Most clients offer an Override feature that lets you add custom rules without touching the original subscription file, so your additions survive future subscription updates. Full rule syntax is on the Config Fields page.
How do I share my computer's proxy with a phone or tablet?
Two steps: ① Enable "Allow LAN" in the client's settings. ② Note your computer's local IP address and port (the default mixed port is 7890, shared by HTTP and SOCKS).
On your phone, go into the Wi-Fi network's advanced settings and set the proxy to "Computer IP:7890." If it doesn't connect, check whether your computer's firewall is blocking that port. Full walkthrough in this site's technical note on mixed ports and LAN sharing.
When should I switch to Global mode?
Three common cases: ① A site still won't load in Rule mode, and switching to Global helps confirm whether a missing rule is the cause. ② Certain apps ignore the system proxy and need to be forced through the proxy (TUN mode handles this more reliably). ③ You temporarily need one unified exit IP.
Note that in Global mode, domestic traffic also routes through your node, which adds latency and eats into bandwidth — switch back to Rule mode once you're done testing.
Can I manage multiple subscription links together?
Yes, in two ways: ① At the client level, most GUIs let you keep multiple profiles side by side and switch between them as needed. ② At the core level, you can declare several subscription sources under proxy-providers in your mihomo config — the core pulls in nodes from all of them, and you can organize them into policy groups, effectively merging them logically.
If you'd rather not edit config files, a subscription conversion service can merge multiple links into a single URL to import instead.
How can I check which node a specific connection is actually using?
Open the client's Connections panel — every active connection shows the rule chain it matched, in the form "GEOSITE rule → policy group → node name," so you can check each one.
Clash Verge Rev and Clash Plus both include this panel built in. If you're comfortable with the command line, you can also query the core's external controller API at :9090/connections for the same data.
CAT-04 · TROUBLESHOOT
Troubleshooting
6 entries · Diagnostic paths for subscription failures, node timeouts, permissions, and proxy issues.
Subscription update failed — how do I troubleshoot it?
Work through the chain step by step: ① Open the subscription URL directly in a browser to confirm it returns valid content. ② Switch the client to Direct mode before updating, to rule out a deadlock caused by a dead node blocking the update. ③ Check that your system clock is accurate — TLS certificate validation depends on correct time. ④ If the link is being interfered with, enable the proxy and retry using "Update via proxy."
If none of this works, the subscription itself is most likely dead — contact your provider for a new link.
Every node shows "timeout" during latency testing — what should I do?
First separate a "test timeout" from a genuinely dead node: switch to Global mode, pick any node, and try loading an overseas site. If that works, it just means the test URL (gstatic by default) is being blocked — swap in a reachable test URL in settings and retest.
If nodes are truly unreachable: check whether the system proxy and TUN mode are both enabled and conflicting; check the client's log page for core errors; and note that an expired subscription can also knock out an entire batch of nodes, so try updating the subscription first.
System proxy is on, but the browser still connects directly — why?
Check these four things: ① Confirm the system proxy setting was actually applied — on Windows, Settings → Network → Proxy should show 127.0.0.1:7890. ② Check whether the browser has a standalone proxy extension installed (like SwitchyOmega) — extensions override the system proxy, so disable it and retest. ③ Make sure the browser's network settings are set to "Use system proxy." ④ If the client's port has been changed, use whatever value is currently shown on the client's Ports page.
TUN mode says permission denied or fails to create the virtual adapter — what now?
TUN mode requires system-level permissions. On Windows: run the client as administrator, or install its service mode (Clash Verge Rev offers a one-click installer in settings). On macOS: the first time you enable it, you'll get a permission prompt — approve it and enter your password. On Linux: grant the core binary the cap_net_admin capability, or run it as root.
If it still fails with correct permissions, check for conflicts with other virtual adapters (WSL, VMware, other VPN clients) and disable them one at a time to retest.
Windows Store (UWP) apps can't connect through the proxy — why?
UWP apps are blocked by default from accessing the loopback address 127.0.0.1, which means the system proxy doesn't work for them. Two fixes: ① Use the client's built-in UWP loopback exemption tool (found in Clash Verge Rev's settings page) — check the target app and save. ② Run CheckNetIsolation LoopbackExempt -a -p=AppPackageSID from an administrator command prompt to add the exemption manually.
See this note on UWP loopback restrictions for how to find the package SID and the full steps.
I suspect a DNS leak — how do I check for one and fix it?
To check: enable the proxy and visit a DNS leak test site — if your local ISP's DNS server shows up in the results, you have a leak.
To fix it: enable core-level DNS handling in the dns: section of your config (enable: true, listen: 0.0.0.0:53), paired with enhanced-mode: fake-ip so domain resolution also gets routed by your rules; in TUN mode, DNS is handled by the core by default, which minimizes leak risk. Field-level details are in the DNS section of the Config Fields page.
NEXT HOP
More Resources
Didn't find your answer here? Keep exploring through these links.