Clash FAQ
Subscriptions, Configuration & Connection Troubleshooting

Clash client is a general term for graphical tools in this category. mihomo is the core that handles proxy protocols, rule matching, and DNS. Apps such as Clash Verge Rev and FlClash provide configuration import and system integration, while Clash for Windows is a specific product that is no longer maintained. When choosing a client, check both its maintenance status and core compatibility; similar names don’t mean identical features. Before migrating, export your configuration and note any local overrides and system proxy ports.

Installing a client does not provide a working proxy by itself. Subscription links are usually available from the dashboard of a service you already use; you can also use a configuration for a service you host yourself. Before importing, make sure the format is compatible with Clash YAML or your client’s import method. An account login page is not a subscription URL. Subscription links may contain access credentials, so don’t post them publicly, include them in screenshots, or submit them to unfamiliar converter sites. If a link is exposed, reset it with the provider.

For everyday use, start with Rule mode, where rules are checked in order and connections are sent to the matching policy. Global mode sends connections that reach the core through the selected global policy, but it does not automatically capture traffic from every app; whether traffic reaches the core still depends on the system proxy or TUN. Direct mode sends connections that reach the core straight to their destinations. For troubleshooting, you can temporarily switch to Global and select a proxy you know works. Switch back to Rule mode afterward instead of leaving the temporary setting in place.

Not by default. The system proxy changes your operating system’s proxy settings and works with browsers and apps that honor them. TUN captures traffic through a virtual network interface and routing, which can help with apps that ignore the system proxy but requires additional permissions. For your first connection, use the system proxy to verify the subscription and proxy groups, then enable TUN if your apps need it. If using both causes problems, disable one capture method and pause other VPNs to narrow down the cause.

A subscription link retrieves remote content, the configuration file is the YAML the core actually reads, and proxy groups organize proxies or other actions into selectable targets. A complete configuration usually includes DNS, rules, and listening ports—not just a list of nodes. Proxy group names must match those referenced by rules. For example, if a rule ends with PROXY, the configuration must include a proxy or proxy group with that name. If you only have a single protocol link, import it using a method supported by your client rather than treating it as a complete YAML configuration.

First, make sure you copied the full subscription URL. Then check the provider’s account page to confirm the service is active and the link hasn’t been reset. A 401 or 403 often relates to authorization or access restrictions; a 404 may mean the URL has changed, but check the provider’s documentation for the exact meaning. Don’t keep retrying the import. Check the client logs for the response status, then make sure subscription updates aren’t trying to use a proxy that isn’t available yet. When reporting the issue, share only the status code and time with sensitive details removed—never the full URL.

First, check that the downloaded content is actually YAML. A login page, web error message, or Base64-encoded node list is not a complete configuration. If the logs show yaml: unmarshal errors, use the reported line numbers to check field types, indentation, and list structure. YAML indentation must use spaces, not tabs. Revert to the unmodified subscription configuration to confirm it loads, then restore overrides one at a time. Remove server credentials and subscription URLs before sharing error snippets.

Follow your client’s instructions to install or enable its service mode, then confirm the service is running. Depending on the product, this may be called service mode, Service Mode, or an auxiliary service. On Windows, installing the service usually requires elevation; macOS may require permission for a helper tool; on Linux, configure permissions according to your distribution and client documentation. Don’t grant broader permissions to every executable. If it still fails, check the specific error for creating a virtual network adapter or adding a route, then look for conflicts with security software or other VPNs.

Check that the system proxy points to 127.0.0.1 and that its port matches the configured mixed-port or HTTP listening port. Then check whether the browser uses its own proxy settings, a proxy extension, or an organization policy that overrides the system proxy. Open the client’s connections page and visit a new page to see whether the connection appears. If there’s no entry, investigate how traffic is being captured. If there is an entry but the browser still connects directly, check the matching rule and proxy group. Repeatedly toggling the system proxy won’t help identify the cause.

On the computer, enable LAN access with allow-lan and make sure bind-address isn’t limited to the loopback address. Connect the phone and computer to the same trusted network. In the phone’s Wi-Fi settings, set a manual proxy using the computer’s local IP address and HTTP or mixed-port. Allow access through the firewall only on the necessary private networks, and configure authentication if available. A phone’s Wi-Fi proxy may not cover every app. Restore the original settings when finished, and don’t expose the listening port to the public internet.

A successful test only shows that the configured test address was reachable at that moment; it doesn’t guarantee access to every site, protocol, or app. Check that the policy group actually used by the connection has selected that node, then inspect the destination domain, matching rule, and connection error on the connections page. If browsers work but games or calls don’t, check UDP support and how traffic is being captured. Don’t rule out a node issue based only on a test result. Compare the same destination and policy step by step to find out whether the difference is due to rules, protocols, or the remote service.

Direct edits to a subscription-generated configuration may be overwritten the next time it updates. Keep persistent rules in an override, extended configuration, or script supported by your client; see the product documentation for the right place. Back up the current file before restoring anything, then check the order of rules in the final active configuration: specific rules must come before MATCH. Proxy group names in overrides must also match the names in the subscription, or the configuration may fail to load because a policy can’t be found.

After enabling launch at startup in the client, make sure system startup permissions aren’t blocking it. Launching the app at startup, setting the system proxy after launch, and running a service at startup are separate settings—check each one. For the first test, restart the computer, confirm the configuration loads, and check that the service and network are ready. If a subscription update fails because it starts too early, try updating manually after the network is connected. Before uninstalling or switching clients, turn off the system proxy so the operating system doesn’t keep pointing to a port with nothing listening on it.

Use Rule mode and add an exact-domain rule or a DOMAIN-SUFFIX rule to a local override, with DIRECT as the target. Rules are matched in order, so place the rule before broader rules and MATCH. After editing, check that the rule appears in the final configuration, then use a new connection to verify it matched; existing long-lived connections may continue using the previous policy. Don’t leave the entire client in Direct mode just for one website, and don’t use a broader domain suffix than necessary.

First, confirm external-controller is enabled and that the address, port, and secret entered in the panel match the core configuration. If you only use the controller locally, bind it to 127.0.0.1; don’t expose it to the public internet for convenience. If the panel is served over HTTPS but the controller uses HTTP, the browser may block requests as mixed content. Adjust the setup according to the panel’s deployment documentation. Hide the controller secret in screenshots, and configure a trusted network and access controls for remote use.

Turn off the proxy first to verify the underlying network, then confirm the subscription is valid and the node configuration loaded successfully. Select a node, connect to an actual destination, and check the logs. timeout means the request didn’t finish within the allotted time, but it doesn’t by itself prove the server is at fault. Check the system clock, server hostname resolution, firewall, and interference from other VPNs. If multiple nodes fail, start with components they share on your device. If only a few fail, contact the provider with the error details and time, with sensitive information removed.

Some Windows app containers are restricted from connecting to loopback addresses, which can prevent them from reaching a local proxy port. If your client includes a UWP loopback tool, enable loopback exemption only for the affected apps, then restart them. Don’t enable it for every app at once. You can also test TUN capture if your setup supports it, but still check the app’s own proxy settings and the system configuration. Loopback exemption won’t fix every Microsoft Store issue; check logs for account, system service, and DNS errors as well.

Record the failing domain and full error first. Then check whether the configured DNS upstream is reachable and whether resolving the upstream hostname creates a dependency loop. A DNS timeout doesn’t mean Fake-IP itself is broken. If you confirm that an app is incompatible with virtual IP addresses, add it to fake-ip-filter as needed or compare results in redir-host mode. After making a change, clear the relevant DNS cache and establish a new connection. Don’t replace all DNS settings at once; even if access returns, you won’t know which change fixed it.

If the existing database is still present and the core can read it, a failed update may not immediately affect existing GEOIP matches. If the database is missing or corrupted, rules that reference it may fail to load or match. Check the database path and download error in the logs, then verify write permissions, available disk space, and the download connection before retrying through the client’s database update feature. Country.mmdb is a common GeoIP data file, but the expected format depends on your configuration. GeoIP and geosite serve different purposes and aren’t interchangeable.

address already in use usually means another process is using the listening port. Check for multiple client instances or leftover core processes. Stop duplicate instances, or change mixed-port and update the system proxy port to match—don’t change just one. If you lose internet after quitting the client, turn off any manual proxy settings left in the system. If you used TUN, stop the service as instructed by the client and check that routes were restored. Once basic connectivity is back, start a single client and test again.