Clash FAQs and Troubleshooting

Clash generally refers to an ecosystem of rule-based proxy configurations and clients. mihomo is a actively maintained compatible core responsible for connections, DNS, rule matching, and traffic forwarding. Graphical clients such as Clash Plus and Clash Verge Rev handle subscription management, policy selection, and system settings. Different clients may use the same or similar configuration structures, but supported features depend on the core version.

Rule mode evaluates traffic from top to bottom according to the configured rules and is best for everyday use. Global mode sends most connections through the currently selected proxy policy and is useful for temporary testing. Direct mode connects to destinations without using proxy nodes. You can switch modes briefly while troubleshooting, but restore the mode that fits your actual needs after testing.

A configuration file is the YAML content loaded by the client. It can include ports, DNS, nodes, policy groups, and rules. A subscription URL is an address used to retrieve configuration or node data; after updating the subscription, the client saves the remote content as a local configuration. Local files generated from subscriptions may be overwritten during the next update, so lasting changes should use an override layer or a separate configuration.

Graphical clients differ in interface capabilities, bundled cores, and release schedules. Some provide overrides, service mode, and connection dashboards, while others retain only basic subscription and policy selection features. Protocol support also depends on the core version. Before switching clients, check the system architecture, subscription format, TUN support, and protocol types you need.

Fake-IP returns mapped addresses through the DNS module, then restores domain names from those mappings to apply rules, usually providing more complete domain matching. Redir-Host returns real DNS results and can be more straightforward for some LAN devices or specialized apps. If LAN domains, printers, games, or specific apps resolve incorrectly, first add the affected domains to the filter list before switching modes.

First confirm that the downloaded client supports your operating system and processor architecture. Import a valid subscription and run an update. Then select Rule mode, choose an available node in the main policy groups, enable the system proxy, and visit a test page in your browser. Configure TUN mode only when you need to handle apps that ignore system proxy settings; avoid changing several advanced options during initial setup.

Open the client’s configuration or subscription page, choose Add Subscription, paste the complete URL, and save it. Then click Update or Download. After importing, explicitly select the newly generated configuration rather than merely saving the URL to the list. If the client asks for a name, use a locally recognizable label; it does not change the subscription or affect node connections.

Use a browser to confirm that the URL still returns content, and check that it was not truncated or copied with extra spaces. Then review the client log for the HTTP status and parsing errors. If the URL returns a login page, a plain-text notice, an expiration message, or an unsupported format, the node list will be empty. Also confirm that the configuration updated successfully and is set as the active configuration.

Check four layers in order: URL validity, response format, client compatibility, and the local network. Copy the original URL again, disable browser extensions or old proxies that may rewrite requests, and try updating in the client. If the response contains YAML indentation errors, duplicate fields, or protocol parameters unsupported by the current core, the subscription provider must fix it, or you should use a compatible core.

Save the installer in a directory writable by the current user, and close any older client that is still running. Standard graphical features usually work with user permissions, but installing services, writing to system directories, or enabling a TUN driver may require administrator approval. If a security policy blocks the installation, check the exact file and policy name reported by the system instead of repeatedly launching installers.

First confirm that the installer matches Intel or Apple Silicon, then move the app to the Applications folder. If macOS blocks it, check the related notice under Privacy & Security. After enabling TUN or a network extension, macOS may request an administrator password and approval for the system extension. Once approved, quit and reopen the client so an older process does not continue running without authorization.

Rules are matched in the order listed in the configuration, and the policy group specified on the matching line is used. Domains can use DOMAIN, DOMAIN-SUFFIX, or DOMAIN-KEYWORD; IP addresses can use IP-CIDR; and GEOIP is commonly used for geographic database matches. Put specific rules before broader ones. MATCH is normally placed at the end to handle connections that matched nothing earlier.

select lets the user manually choose a node or child policy group. url-test periodically accesses a test URL and selects a suitable member based on the results. fallback chooses an available member in configuration order and can switch back when the earlier member recovers. Automated test results reflect connectivity to the test target only and cannot fully represent the experience across all websites and apps.

Not necessarily. Browsers and most desktop apps that follow system proxy settings need only the system proxy enabled. TUN mode handles apps that ignore system proxy settings, some command-line tools, and a broader range of system traffic. Both can work together in some clients, but when troubleshooting, test the system proxy alone first and enable TUN afterward to identify which layer is failing.

Enable Allow LAN in the client, confirm that the listen address is not limited to 127.0.0.1, and note the mixed-port or HTTP port. On the LAN device, set the proxy server to this computer’s private network address and the corresponding port. Also check that the system firewall allows inbound connections on that port and that both devices are on the same LAN with mutual access.

Save the file after editing, then reload the configuration or switch away and back to it in the client. First check that YAML indentation uses consistent spaces, fields are at the correct level, and list-item hyphens are intact. If the configuration came from a subscription, direct edits to the generated file may be overwritten during an update. When the client supports overrides or configuration merging, put lasting changes in the override layer.

A successful latency test only shows that the test URL is reachable through that node. Confirm that the current policy group has actually selected the node, then check which rule matched the destination domain in the connection panel. Next verify that DNS returns a result, the browser is not using a separate proxy or secure DNS, and the system clock is accurate. Testing in Global mode can help distinguish a rule problem from a node problem.

Disable the system proxy and TUN first, and confirm that the local network can reach common websites. Then update the subscription, restart the client, and check the logs for DNS, handshake, certificate, or protocol-parameter errors. When every node times out at once, prioritize the local network, subscription status, firewall, and client core. Only investigate individual node availability when just a few nodes time out.

Disable TUN first and confirm that system proxy mode still works. Then check whether the client has administrator permissions and whether the virtual adapter or system extension installed successfully. Next look for conflicts with other VPNs, virtual machine adapters, security software, and older proxy services. During recovery testing, enable only one traffic-capture tool at a time and review routing, DNS, and permission errors in the logs.

Some apps ignore operating-system proxy settings or support only specific proxy protocols. First confirm that standard apps such as browsers work normally to verify that the local port is functional. For apps that do not follow the system proxy, enter the local proxy address in the app itself, or enable TUN after confirming the required permissions and compatibility. Also check whether the app has retained an old proxy address.

Some UWP apps are restricted from loopback access and cannot connect by default to a local proxy port at 127.0.0.1. Use the client’s UWP Loopback tool to grant loopback access to the apps that need the proxy, then fully quit and restart those apps. Afterward, check the Clash connection panel to see whether the app generates connection records.

First determine whether every domain fails or only specific domains are affected. Check whether the current core supports the DNS switch, nameserver, fallback, and enhanced-mode settings in the configuration, then clear the system DNS cache and restart the client. If IP addresses work but domain names do not, focus on the DNS log, encrypted DNS reachability, and Fake-IP filter rules.

If the client exits unexpectedly, the system proxy may still point to a local port that is no longer listening. Reopen the client and disable the system proxy, or manually turn off the proxy server in the operating system’s network settings. If TUN was enabled, also confirm that the virtual adapter and related services have stopped. Reconnect to the network afterward and restart the browser or computer if necessary.

First make sure both devices use the same latest subscription and the same node, then compare their network environments, client cores, and protocol parameters. On the computer, focus on the system proxy, TUN, DNS, firewall, and system time. The phone may be using mobile data rather than Wi-Fi. Testing both devices on the same network reduces interference from differences in network egress.