Clash FAQs and Troubleshooting

mihomo is the core responsible for parsing configurations, establishing proxy connections, matching rules, and handling DNS. Graphical clients such as Clash Verge Rev and Clash Plus provide subscription management, policy selection, log viewing, and system proxy controls while calling the core in the background. Similar interfaces do not mean that clients use identical cores. When checking feature compatibility, review the client documentation, core type, and configuration syntax together.

Rule mode matches configuration rules from top to bottom and sends different requests to the assigned proxy group, DIRECT, or REJECT. It is best for everyday use. Global mode usually sends all traffic to the GLOBAL policy group, which is useful for temporarily testing a node. Direct mode bypasses proxy forwarding and can help determine whether a problem originates in the client. Switching modes does not rewrite rules in the subscription.

A configuration file is the YAML content loaded by the client, typically containing proxies, policy groups, rules, DNS, and port settings. A subscription link is the address used to retrieve a remote configuration, which the client downloads and saves locally as needed. Remote subscription updates may overwrite local edits, so use overrides, merged configurations, or a separately maintained local file for long-term custom rules.

The system proxy works well for browsers and apps that read the operating system's proxy settings, and it is straightforward to enable or disable. TUN mode uses a virtual network interface to capture a broader range of traffic, making it suitable for apps that ignore system proxy settings, command-line tools, and some games. When getting started, verify the system proxy first, then enable TUN if needed. If both are enabled, watch for conflicts involving routes, DNS, and other network tools.

Start by choosing a maintained client that supports your operating system and current architecture. Windows commonly requires x64 support, macOS requires a choice between Apple Silicon and Intel, and Android packages may be split by ARM architecture. Most users should choose a client with a graphical interface, subscription management, and system proxy controls. Running the mihomo core directly is better suited to servers and routers.

First, confirm on the service provider's website that the link is still valid and was not copied with extra spaces. Then open it in a browser to check whether it returns content. A login page, error page, or blank response usually points to the subscription URL or account status. If content is returned but the client cannot parse it, check that the format is YAML recognized by Clash or mihomo. You can also disable the proxy and fetch the subscription again so old rules do not route the request through an unavailable exit.

TUN mode creates a virtual network interface and modifies system routes, so it usually requires administrator privileges. On Windows, follow the client's instructions to install service mode or complete the initial setup as an administrator. On macOS, approve the network extension or enter system credentials. On Linux, check CAP_NET_ADMIN, device permissions, and the service configuration. After granting permission, fully quit and restart the client, then confirm that the virtual interface was created successfully.

Some UWP apps are restricted from loopback access by default, so they may be unable to connect to a local listening port even when the system proxy is enabled. Use the client's UWP loopback tool to select the target app, grant loopback exemption, and save. If the client has no such option, use Windows CheckNetIsolation. Restart the target app afterward and confirm that Clash's mixed port matches the system proxy port.

On the configuration or subscription page, select the relevant item and run an update. Wait for the download to finish before switching to or reloading the configuration. Nodes, policy groups, and remote rules usually update with the subscription, while client-level settings are generally stored separately. Editing the YAML generated from a subscription directly can lead to changes being overwritten at the next update. Put DNS, rule, and policy changes that must persist into a client-supported override, script, or merged configuration.

Not necessarily. Latency tests depend on the selected test URL, timeout period, and current network conditions. A blocked test URL, failed DNS resolution, or a node that blocks probing can also cause a timeout. Switch to the node, open a stable HTTPS page, and review the connection log. If real requests succeed while the test still times out, change the test URL. If real connections also fail, check the node details, device time, and network restrictions.

Rules are matched from top to bottom in configuration order, and matching usually stops at the first hit. Broad DOMAIN-SUFFIX, GEOIP, or GEOSITE rules placed too early can override more specific rules later in the list. During troubleshooting, check the target domain, resolved address, matched rule, and final policy in the connection details before changing rule order. After adding a custom rule, confirm that the modified configuration was loaded rather than an older version.

Keep the domain resolution path consistent with the traffic-routing policy. After enabling the client's DNS, make sure the roles of nameserver, proxy-server-nameserver, fallback, and nameserver-policy are clear, and avoid having another DNS tool on the system handle the same requests. In TUN mode, also check DNS hijacking and virtual network adapter settings. When resolution fails, compare system results with the client logs, clear the system DNS cache, and reload the configuration.

First confirm that the client is running, the configuration is loaded, and the system proxy points to the address and port currently used by the client. Then check whether the browser uses its own proxy settings, extensions, or security software that overrides the system settings. Test the local port to confirm that it is listening, then look for browser requests in the Clash logs. If no requests appear, focus on the browser and system proxy. If requests appear but fail, check the rules, node, and DNS.

Switch to other nodes in the same subscription first to determine whether one node or all nodes are affected. Then update the subscription, check whether the node server address resolves, verify the device date and time zone, and temporarily disable other proxy or VPN tools. If every node times out, test with a different basic network. If only a particular protocol fails, check whether the client core supports that protocol and its parameters. Finally, use DNS, connect timeout, and handshake messages in the logs to identify the failing stage.

Disable TUN first and confirm that the underlying network and system proxy mode work normally, then enable it again to narrow down the cause. Check whether the virtual network adapter was created, whether another VPN or security tool changed the default route, whether DNS points to a usable resolver, and whether the local network range was captured incorrectly. On Windows, also check the service mode status; on macOS, approve the network extension again if necessary. After changing the configuration, quit related network tools and restart the client.

If startup reports address already in use, the mixed port or controller port is usually occupied by another process. Close the conflicting program or choose another port. DNS timeout, no such host, or resolver errors during a request indicate that you should check the DNS configuration and current network. When connection records show a rule name and policy group, you can determine whether traffic took the wrong branch. For connect timeout or handshake failed, continue by checking node reachability, protocol parameters, and the device time.