CLASH FAQ

Clash FAQ and Troubleshooting Steps

Start with the relationship between the client and core, then work through subscription imports, TUN permissions, the system proxy, UWP loopback, node timeouts, and YAML configuration errors. When troubleshooting, change one setting at a time and observe the logs and connectivity results.

BASIC

Core concepts

Distinguish the client, core, subscription, and policy group before choosing Rule mode, the system proxy, or TUN. Understanding these boundaries reduces interference from repeatedly changing settings.

How are Clash, its clients, and the mihomo core related?
mihomo is the core that reads configuration, matches rules, and forwards traffic. GUI clients such as Clash Verge Rev and FlClash handle subscription management, toggles, settings, and logs. Desktop and mobile clients usually include a usable core, so most users do not need to launch a separate command-line program.
Which mode should I use: Rule, Global, or Direct?
Use Rule mode for everyday traffic so each connection follows the configured proxy or direct rule. Global mode sends most manageable traffic through the current policy group and is useful for temporarily testing a node. Direct mode bypasses the proxy and is useful for troubleshooting or restoring local connectivity.
What is the difference between policy groups, nodes, and subscriptions?
A subscription is an updateable remote configuration that may contain nodes, policy groups, and rules. A node describes a specific connection endpoint, while a policy group selects one option from several nodes or actions. Switching policy groups does not change the subscription URL, while updating a subscription may reset the group structure defined by its provider.
Can Clash for Windows still be used after development stopped?
Existing installations may continue to run, but an unmaintained client will no longer receive compatibility fixes or bug fixes. Export or save your subscription URL first, then migrate to a maintained client. Do not overwrite the original directory immediately; complete import, node selection, and connectivity checks in parallel before removing the old client.
What is the difference between a system proxy and TUN mode?
A system proxy relies on applications reading the operating system's proxy settings; browsers and most desktop apps support this. TUN mode uses a virtual network interface to capture more traffic at the IP layer, including some programs that ignore system proxy settings. It requires higher privileges and is more susceptible to firewalls, virtual adapters, and security software.

SETUP

Installation and setup

The post-installation workflow is to import a valid configuration, choose a mode, enable one traffic-capture method, and verify the result. Handle permission and system restrictions separately after basic connectivity works.

What should I do after installing a Clash client for the first time?
Import a valid subscription from the configuration page and update it first. Then return to the proxy page, choose Rule mode, and select the policy group you need. Turn on the system proxy and visit a familiar website to verify the connection. Configure TUN mode only when you need to capture games, command-line tools, or other special apps, rather than changing multiple network settings at once.
What should I do if a subscription URL fails to import or reports an invalid format?
Open the subscription URL in a browser first and confirm that it is still accessible and does not redirect to a login page, verification page, or ordinary webpage. Check that no spaces, line breaks, or trailing punctuation were copied. If the response exists but the client still reports an error, the format may be incompatible with the current core. Ask the configuration provider for a Clash or mihomo-compatible URL.
How do I fix insufficient permissions or startup failures in TUN mode?
On desktop systems, launch the client with administrator privileges and confirm that the virtual network adapter driver or service is installed correctly. On macOS, approve the network extension in System Settings. If it still fails, close other VPNs, virtual adapters, and similar proxy tools and try again. Then check the logs for errors involving permission, service, or interface.
What should I do if the system proxy is enabled but my browser still connects directly?
Confirm that the client core is running and that the system proxy points to the local machine on the correct port. Disable any browser proxy extension or fixed proxy setting, then fully quit and reopen the browser. Enterprise policies, other network tools, and leftover PAC settings may override the system proxy, so disable them one by one and test again.
Do Windows Store apps need UWP loopback configured to access the internet?
Some UWP apps are restricted from loopback access and cannot connect to a proxy port on the local machine. Use the client's UWP loopback tool to enable a loopback exemption for apps that actually need the proxy, save the changes, and restart the app. Do not select every item at once; configuring only what you need makes later network troubleshooting easier.

USAGE

Usage tips

Subscription updates, rule overrides, and policy-group selection solve different problems. Before making changes, confirm the configuration source and current mode. Afterward, use the logs to verify what actually matched.

How often should I update my subscription?
The right frequency depends on how often the configuration provider makes changes. If nodes stop working, policy groups disappear, or rules remain unchanged for too long, try a manual update first. Avoid setting automatic updates too frequently; an hourly interval supported by the client is usually sufficient. After updating, verify that it succeeded and that the current policy group still points to the intended option.
How do I add custom Clash rules?
Prefer the client's override, merge, or scripting features, and keep custom rules in a separate configuration instead of editing a subscription file that will be replaced on the next update. Rules are matched from top to bottom, so specific domain rules should come before broad rules. After editing, validate the configuration, reload it, and check the matching results in the logs.
Why didn't the automatic policy-group selection choose the node I expected?
Automatic selection usually follows the test URL, interval, and tolerance configured in the policy group; it does not necessarily choose the fastest node for every situation. Results are also affected by your local network and the target site. Select a stable node manually first. For a lasting change, adjust the policy group's test parameters or preserve the setting with a configuration override.
Do I also need to enable the system proxy when TUN mode is on?
In most cases, a working TUN mode can capture the main traffic without relying on the system proxy. Whether both should be enabled depends on the client implementation and your use case. When troubleshooting, enable only one capture method at a time: verify the system proxy first, then test TUN separately. This makes it easier to tell whether the problem comes from an app's proxy settings or the virtual adapter.
Should I use the debug, info, or warning log level?
info is usually enough for everyday use, while warning is suitable when you only want to see problems. debug records more detail about rule matching and connection handling, making it useful for short troubleshooting sessions involving rules, DNS, or connectivity, but logs grow quickly. Switch to debug before reproducing an issue, note the key timestamps, then return to info when finished.

TROUBLESHOOTING

Troubleshooting

First determine whether the issue involves the basic network, configuration, nodes, or traffic capture. Restore the smallest working setup, then add the system proxy, TUN, and custom rules step by step. This is usually faster than changing several settings at once.

Where should I start when every node times out?
First confirm that direct internet access works on the local machine, then update the subscription and check that the system clock is accurate. Disable TUN and the system proxy, and run node tests only inside the client. If every node times out, check the firewall, DNS, configuration validity period, and network environment. If only some nodes time out, the issue is usually with those routes, so try another node.
What should I do if the computer loses internet access after closing the client?
A common cause is that the system proxy was not restored when the client exited. Open the operating system's network settings, disable the manual proxy and any unused automatic proxy script, then reconnect to the network. If TUN was enabled, confirm that its virtual adapter and related services have stopped. Restart the system if necessary to clear leftover routes and DNS state.
How do I fix a port-in-use error at startup?
Exit other proxy clients first, then check whether an old Clash or mihomo process is still running in the background. If the port remains occupied, change mixed-port, port, or socks-port in the configuration, and update the port used by the system proxy accordingly. Do not let two programs listen on the same local address and port.
How can I locate a YAML parsing error in my configuration file?
Use the line number in the error message to inspect the surrounding content. Pay particular attention to indentation, spaces after colons, list hyphens, and matching quotation marks. YAML generally uses spaces for indentation and should not contain tabs. Temporarily remove the latest rule or override section, confirm that the base configuration loads, then restore changes in sections to isolate the problem.
What should I do if an Android client disconnects after going into the background?
Allow the client to run in the background in the system app settings, and set its battery policy to Unrestricted or allow background activity. Confirm that VPN permission is still active and that the VPN indicator remains in the status bar. Some systems aggressively stop background services, so also allow the client in the autostart or background-protection list and avoid running another VPN app at the same time.