Clash FAQ
Troubleshooting

Clash is a widely used name in the rule-based proxy ecosystem. Clash Meta was the former name of a related core fork, later known as mihomo. Clients provide a graphical interface for managing subscriptions, selecting policies, and configuring system networking. A client exposing an option does not mean the core has enabled the corresponding feature; configuration support depends on the core version and supported fields. If a configuration fails to load, check the active core in the client’s About or Core section, then consult its documentation. Don’t judge compatibility by the installer’s name alone.

A client reads configuration and forwards connections; it is not itself a proxy service. To use remote proxies, you’ll typically need to import a subscription from a provider or enter valid server details yourself. Direct rules don’t require remote nodes. A subscription may include nodes, policy groups, rules, and DNS settings, or provide only a node list. Check its format and validity period before importing. Subscription URLs often contain access credentials, so don’t post them in public comments, screenshots, or online conversion tools. If you need help, share only the error message with sensitive details removed.

For everyday use, Rule mode is usually the right choice: connections match policies in the order listed under rules. Global mode sends ordinary connections that reach the core to the global policy, but you still need to select a working node; it does not automatically route traffic from every app through the core. Direct mode is useful for temporarily comparing network behavior, but configured DNS, TUN routes, and an app’s own proxy can still affect the test. Note the original mode, change one setting at a time, and reconnect. Switching to Global mode is not a general fix for subscription, permission, or system proxy problems.

A system proxy writes the local proxy address to the operating system settings. Browsers and apps that honor those settings can use it, but some programs ignore them. TUN uses a virtual network adapter and routes to capture matching IP traffic, which can cover more apps but depends on permissions, routing, and DNS configuration. When setting things up, first use the system proxy to verify your subscription and nodes, then enable TUN if needed. Whether both can run together depends on the client. More enabled options don’t necessarily mean broader coverage and can make troubleshooting harder.

First check whether the error occurs during download or parsing. For download failures, verify the full URL, access permissions, and current network. For parse failures, check that the response is a YAML configuration—not a login page, error page, or Base64 node list. If you see an unknown field or unsupported protocol, check what your mihomo core and client support. Don’t overwrite a working configuration repeatedly: save a copy, then test the new one separately. If the format is incompatible, ask the subscription provider for a compatible version. Never send a credential-bearing subscription to a public converter.

Turn off TUN first, then check whether the client offers a service mode, helper service, or permission setup option. On Windows, follow the client’s instructions to install its service or run with elevated permissions. On macOS, you may need to approve a helper component. Linux permission requirements vary by installation method and distribution. After granting access, restart the relevant service, enable TUN, and check the logs to confirm that the virtual adapter and routes were created. Don’t leave system security features disabled just to clear an error. If the problem persists, quit other VPN or virtual adapter tools and use the system proxy temporarily.

Android clients commonly use VpnService to create a local VPN interface and route selected apps’ connections through the proxy core, so Android asks for permission on first launch. This does not make a subscription valid automatically; you still need to import a configuration and select a working policy. If another VPN is connected, disconnect it first—typically, two VPNs of this kind can’t run at the same time in the same user profile. If you’re stuck in a permission loop, check settings such as work profiles, always-on VPN, and blocking connections without a VPN. Make sure the current client is the one in effect, then try connecting again.

Starting at login, launching the core, and restoring the system proxy are separate settings. Enable launch at login in the client, then check whether it also loads the last configuration, restores the policy, and enables the required network mode. TUN may also depend on a background service starting first, so adding a startup shortcut alone may not be enough. After setup, fully restart the device and check the configuration name, running status, and proxy toggle. On shared devices, configure this per user so other accounts don’t inherit an unsuitable proxy. If networking breaks after you exit, turn off the system proxy first, then check whether a core is still running in the background.

If you edit a configuration file generated from a subscription, the remote content will usually replace your changes on the next update. To keep custom rules, use a client-supported override, merge, or script feature. Clients handle appending and replacing differently, so check the documentation before setting one up. After editing, inspect the effective configuration: make sure custom rules appear before MATCH and reference policy groups that exist. Test with a single domain rule before adding more. If an update makes the configuration fail to load, disable the override to restore connectivity, then use the logs to find conflicting fields.

Rules are checked from top to bottom. The first matching rule determines the policy, and later rules don’t take part in that decision. Open the connection log and check the destination domain, matched rule, and final policy group, then verify which node that group currently selects. If the connection shows only an IP address, the domain rule may lack the information needed to match; check DNS and sniffing settings. After changing a rule, close the app’s existing connections and retry—current connections may keep using the old route. Don’t just check whether the domain appears in a rule file; make sure that file is actually loaded.

Connect both devices to the same trusted local network. In the computer’s client, allow LAN connections and make sure the listening address isn’t limited to loopback. Then enter the computer’s LAN IP address and mixed port in the phone or TV’s network proxy settings; use the port shown in the current configuration. Allow connections through the computer’s firewall only from the LAN ranges that need access. A manual HTTP proxy usually covers only apps that honor that setting, not all traffic on the device. Turn sharing off when you’re done, and don’t expose the mixed port or external controller port to the public internet.

In Fake-IP mode, the core returns a synthetic address for a DNS query, then uses an internal mapping to associate later connections with the domain. It’s neither a remote node address nor the website’s real server address. Some LAN discovery, device control, or real-IP-dependent apps may need special handling. In those cases, configure fake-ip-filter for the relevant domains and check the active core’s filter mode. Don’t add every domain to the filter list, as that changes how DNS works overall. After making changes, reconnect the app and check the DNS logs and access to local devices.

A 401 or 403 often points to access credentials, permissions, or server-side access rules. Sign in to your provider’s account page to check the subscription status and whether its URL was reset; these status codes alone don’t prove the account has expired. For timeouts, check your local network, DNS resolution, and whether the update request depends on a proxy that’s no longer working. Keep the old configuration for now instead of deleting all your nodes. If the client lets you choose how to update, test both a direct connection and an existing working proxy. Note when the error occurred and send that information to your provider, hiding the subscription URL.

Pause the proxy and visit a site that normally works without it to confirm your basic connection is up. Then check your system clock and make sure the subscription is still valid. Client connectivity tests depend on the test URL and method, so all nodes timing out doesn’t necessarily mean they’re all offline. Try accessing a real website through one node and check the logs: DNS resolution failures point to DNS; connection refusals or handshake failures call for checking the server, port, protocol, and credentials. If only certain sites fail, check the matched rules and destination site. Don’t immediately reinstall the client or clear your entire configuration.

First confirm that the core is listening on the mixed port, then check that the proxy address and port in your operating system match the client settings. 7890 is a common value, not a required port. If the logs show address already in use, identify the process using the port and check whether it’s another proxy instance. Close the duplicate instance or switch to an available port. Update any manual proxy settings, browser extensions, and environment variables to match. If the core is running normally, check whether the browser uses its own proxy or is managed by an organization policy. Don’t terminate unknown system processes or enter the external controller port as the proxy port.

A loopback exemption may be needed when an app runs in a network-isolated AppContainer and needs to connect to a local loopback proxy. Not every Store app has this restriction. First confirm that the app uses the system proxy and that the problem isn’t with its subscription node or service. In an administrator terminal, run CheckNetIsolation LoopbackExempt -s to view existing exemptions, then use the client’s tool to grant access only to the apps that need it. TUN offers another traffic-routing method, but still requires correct routes and DNS. Don’t exempt every app in bulk; revoke any exemption you no longer need after troubleshooting.