Windows Setup

Choose the Client, System Architecture, and Core

To use Clash on Windows, you’ll usually install a desktop client that launches the proxy core. Clash and Clash Meta (now called mihomo) are separate project lines. A client opening successfully doesn’t guarantee that its core supports every protocol in your subscription. Before installing, check your system architecture, whether the client is actively maintained, and the format of your subscription. This can save you from having to try multiple packages later.

Check These Three Things Before Installing

1. System architecture: In Windows, go to Settings → System → About and check System type. Most Intel and AMD PCs use x64 installers. For ARM devices, choose an ARM64 version explicitly offered by the client. Don’t rely on installer file size to identify the right build.
2. Maintenance status: Choose a client that’s still updated and supports your version of Windows. Clash for Windows is no longer maintained. Menu locations, driver solutions, and troubleshooting steps in older guides may not apply to current clients.
3. Configuration type: Check with your subscription provider that the link returns a Clash or mihomo configuration, not just a list of node share links. Some newer protocols and fields require mihomo; older cores may fail while loading the configuration.

Choose a package for your platform on our Clash client downloads page. Before installing, close any other proxy clients to prevent them from both changing system proxy settings, competing for ports, or creating duplicate virtual adapters. If you need to keep your existing settings, export a backup using the client’s configuration manager first. It may contain subscription credentials, so store it in a secure local folder.

Installing Clash and Handling SmartScreen Warnings

When you run the installer, Windows SmartScreen may show a “Windows protected your PC” warning. These warnings can be related to file reputation, signatures, and other factors. They don’t prove a file is unsafe, but they shouldn’t be dismissed automatically either. First, confirm the file came from the selected project’s official release channel, and that its name, architecture, and download destination match. Then check the file’s digital signature in its properties, if one is available.

What to Do When an Installer Is Blocked

1. Close installers from unclear sources. Recheck the download page and the file itself; don’t continue with an attachment from a chat or a random copy from a file-hosting site.
2. Only if the source is trusted and your device policy allows it, consider selecting More info → Run anyway in SmartScreen. If that option isn’t available, don’t bypass your organization’s policy by disabling system protections.
3. If security software quarantines the file, go to Windows Security → Virus & threat protection → Protection history and review the detection details. Then decide whether to report it to the software publisher. Don’t add your entire Downloads folder to the exclusions list.
4. After installation, launch the client normally. You generally don’t need to run the entire interface as an administrator for standard system proxy use. Configure any service mode or permissions required for TUN separately later.

For a portable package, extract all files to a fixed folder that your account can write to. Don’t run the client from inside the archive. If it can’t save settings or update the core, check folder permissions, Controlled folder access logs, and whether another process is using the files before trying to elevate permissions.

Importing a Subscription: Activate the Configuration After Updating

Open the client’s Configuration or Profiles page, choose the option to import from a URL, paste the full address from your subscription provider, and download it. A subscription URL containing a token is a credential. Don’t share it in public logs, screenshots, or online converters. If it has been exposed, reset it in your provider’s dashboard rather than just deleting the local entry.

1. Check the download: A new entry should appear in the configuration list. If the server returns a login page, an expired-session message, or an error page, renaming it with a YAML extension won’t make it load correctly.
2. Activate the configuration: Select the imported entry and wait for the core to reload. A successful subscription update only means the file was downloaded; it doesn’t mean the client is now using it.
3. Check the logs: Start with YAML parsing errors, unknown proxy types, or missing proxy groups. The reported line may only be where the parser detected the problem, so also check indentation and fields on the preceding line.
4. Choose an exit node: Switch to Rule mode and select a node in a policy group that your active rules actually use. Changing a backup group that isn’t referenced by the current rules won’t affect traffic.

If the first subscription download fails, turn off the system proxy and retry the provider’s URL over your current network. The client may not have a working node yet, so don’t assume the request is already going through the proxy. Configure a dedicated proxy for subscription updates only if your provider allows it and the client supports it. Avoid unknown conversion services.

System Proxy and Ports: Get Browser Access Working First

For the first test, enable only the system proxy and leave TUN off. The system proxy affects apps that follow Windows proxy settings; it doesn’t handle every program. Games, command-line tools, and apps with their own network stack may ignore it. Get this path working first to distinguish node issues from virtual adapter problems.

Check the Listening Port and Windows Settings

Check the HTTP or mixed port in the client settings. If the mixed port is 7890, turn on the system proxy, then go to Settings → Network & internet → Proxy and check the address and port under Use a proxy server. The local address is usually 127.0.0.1. PAC mode may use an automatic configuration script, so the manual proxy toggle alone won’t tell you whether the proxy is working.

Run the command below in PowerShell to check whether the example port is listening. If there’s no output, first check for a core startup failure, a port mismatch, or a configuration loading error.

Get-NetTCPConnection -LocalPort 7890 -State Listen |
  Select-Object LocalAddress, LocalPort, OwningProcess

If the port is already in use, use the process ID in the output to identify the program, then close the conflicting client or change the port in your current client. Don’t terminate an unfamiliar system process. After changing the port, re-enable the system proxy and update any proxy address entered manually in other apps.

curl.exe --proxy http://127.0.0.1:7890 --head --connect-timeout 10 https://example.com/

This command explicitly uses a local HTTP proxy. It works with an HTTP or mixed port, not a SOCKS-only port. An HTTP response confirms that this request made it through the proxy chain, but it doesn’t prove that every site is reachable. Open the target page and check the client’s Connections or logs page for the domain, matched rule, policy group, and actual exit node. A successful latency test only checks its test address and isn’t a substitute for this step.

Firewall Rules: A Local Proxy Isn’t a LAN Service

Windows Firewall controls traffic based on the app, network profile, and rule direction. If local apps connect only to 127.0.0.1, you usually don’t need to expose the proxy port to your local network. A Windows permission prompt doesn’t mean you should allow access on both private and public networks, and you don’t need to turn off the firewall entirely.

If you need to share the proxy over your local network, first confirm the client supports it and enable Allow LAN. Then check that the listening address covers your LAN interface. In Windows Security → Firewall & network protection → Advanced settings, create only the inbound rule needed for the proxy port, and restrict it to trusted device addresses or your local subnet. HTTP proxies typically use TCP. A proxy node using UDP doesn’t mean you should open every local UDP port.

The interface and core may be separate executables. The interface being able to update online doesn’t mean organizational outbound rules aren’t blocking the core. Use the logs to identify the process being blocked, then check its file path and firewall rules. A client update may change the path, making an older rule ineffective.

UWP Loopback: Browser Works, but Some Apps Don’t

Some apps running in an AppContainer are subject to network isolation and may be unable to connect directly to a local loopback proxy. You might be able to browse the web while a particular app still reports that it’s offline. Not every Microsoft Store app is affected, and packaged desktop apps don’t necessarily have the same restriction. First check whether the app is actually trying to use the system proxy.

Exempt Only the Apps That Need It

1. If your client has a UWP Loopback or Loopback tool, open it and select only the apps that need to access the local proxy. Save your changes, then restart those apps.
2. If there’s no graphical tool, run CheckNetIsolation.exe LoopbackExempt -s in a terminal to view existing exemptions.
3. To add an exemption, open a terminal as an administrator and pass the exact package family name you found to the -n= parameter. Don’t substitute the app’s display name, installation folder, or full package name.

Get-AppxPackage |
  Select-Object Name, PackageFamilyName

CheckNetIsolation.exe LoopbackExempt -s

To add an exemption, run CheckNetIsolation.exe LoopbackExempt -a -n= followed by the actual package family name. To remove it, change -a to -d and use the same name. There’s no package name to copy here because identifiers vary by app and distribution channel. After making the change, restart the app and check the client’s connection log. If no requests appear, check the app’s own proxy support and network policies.

TUN Mode: Service Permissions, Virtual Adapters, and DNS

Consider TUN only when you need to handle programs that ignore the system proxy. TUN uses a virtual network interface and routing to pass traffic to the core; whether a connection is captured still depends on routes, exclusions, and configuration. mihomo TUN stack options, DNS interception, and client service installation steps vary by version. Follow the documentation for your current client.

Enable One Setting at a Time

1. First, confirm the system proxy works. Note the current node, working port, and a test page that loads successfully.
2. Use Service mode or the service installation option in the client’s Settings to grant the required permissions. Installing a service requires administrator access. If it fails, check the error instead of repeatedly clicking the install button.
3. To make it easier to see what TUN is capturing, turn off the system proxy first, then enable TUN. Check the logs to confirm the virtual interface and routes were created successfully.
4. Check whether the subscription, override settings, or client-managed configuration changed your DNS settings. Turning on TUN doesn’t guarantee that DNS interception or name resolution is working.

In PowerShell, run Get-NetAdapter -IncludeHidden to inspect virtual interfaces, then use route print to view the routing table. The interface name may not include “Clash,” and you may not see a single traditional default route; some automatic routing setups use more specific routes. Compare the system before and after startup and check the core logs rather than relying on a network adapter icon alone.

If a driver fails to load, first stop other VPNs, accelerators, or virtual adapter tools. Then repair the service or driver using a method supported by the client. Don’t download individual DLLs from unknown sites and overwrite files in the installation folder, or disable protections such as Memory integrity to run an old driver. If the driver setup is incompatible, update to a supported client version.

If your LAN printer, NAS, or company network becomes unreachable after enabling TUN, check route exclusions and direct rules for private IP ranges. DIRECT in a rule and a system route exclusion are different settings. If DNS resolution has already failed, adding a direct rule alone may not help. For a company VPN, confirm the approved network setup with your organization to avoid having two programs manage routes and DNS at the same time.

Verify the Setup and Restore Your Network When Done

After configuring the client, check each item below. Change one setting at a time and note when you test and any errors in the logs. This usually makes the cause easier to pinpoint than changing nodes, reinstalling drivers, and editing DNS all at once.

• Configuration: The imported subscription is active, the core logs show no parsing errors, and the policy group is set to a working exit node.
• Browser: The target page loads, the client shows the corresponding connection, and the matched rule is what you expect.
• Apps with special requirements: Distinguish between system proxy settings, UWP loopback restrictions, and an app’s own proxy settings. Don’t assume every failure is caused by the firewall.
• TUN: Enable it only when needed. Confirm the virtual interface, routes, and DNS are working, and test access to local network resources.
• Restore on exit: Turn off TUN and the system proxy before closing the client. Check that your normal network access still works.

If no websites load after the client exits unexpectedly, go to Windows Settings → Network & internet → Proxy and check for a local proxy that is no longer listening or a leftover automatic configuration script. If your device is managed by an organization, don’t override its existing policies. If the problem started after using TUN, restart the client and turn TUN off normally so it can clean up the routes. Restart Windows if access still doesn’t return; don’t delete every network adapter or reset the entire network stack.

For more on rules, subscription updates, and startup settings, read the user guide. For Windows-specific settings, see the Windows section of the Platform Guide. Keep a verified working baseline, then add features one at a time so you have a clear reference point when troubleshooting.