Clash FAQ

The client provides an interface for importing configurations, switching modes and viewing logs. The core handles connections, evaluates rules and selects an outbound route. A subscription is provided by a service and usually contains proxies or a complete configuration. Installing a client does not give you access to a working proxy service, and importing a subscription does not mean your system traffic is being routed through it. To get started, confirm that the subscription is valid and its configuration is selected, then enable the system proxy and check the connection log. Distinguishing these three layers helps prevent an expired service from being mistaken for an installation problem.

Rule mode is usually best for everyday use: the configuration’s rules determine whether each connection goes direct, through a proxy or is rejected. Global mode typically sends connections handled by the core to the global proxy group, where you still need to select an outbound route; it does not automatically capture traffic from every app. Direct mode generally sends connections handled by the core straight to their destinations and can help with comparisons during troubleshooting. Existing long-lived connections may keep using their previous route after you switch modes. Test with a new connection and check the connection log to see which policy was actually used.

The system proxy changes the operating system’s proxy settings and mainly affects apps that follow them. Some command-line tools, games and apps that manage their own networking may not use the system proxy. TUN mode routes more traffic through a virtual network interface, but depends on permissions, drivers, DNS and routing settings; support varies by client and core. Start with the system proxy to verify the basics, then enable TUN if your apps require it. Neither mode is a higher level of network acceleration, and neither can fix an expired subscription or unavailable proxy.

The client and proxy service are separate. Some clients are free and open source, but subscription providers manage proxy server bandwidth, accounts and service periods. That does not mean the service is free or will remain available indefinitely. Before importing a subscription, check its source, supported configuration format and terms of use. Don’t use an unfamiliar subscription as your primary configuration or share its URL publicly: it may contain access credentials that others could use if exposed. Reset the credentials with the provider if necessary.

Clients with similar cores can often share some YAML configurations, but interface settings, core versions, extension fields and file paths may not be compatible. Before migrating, back up your configuration and check protocol support, rule-set format, DNS fields and local file references. Then validate the configuration in the new client. Startup behavior, system proxy settings and service permissions usually need to be set up again. After importing, verify that rules match as expected and connections use the correct outbound route. A file loading successfully does not mean every feature has migrated.

Check your processor architecture in system information, then choose the matching client installer. x64 or AMD64 is used by most Intel and AMD desktop processors; ARM64 is for compatible ARM devices. Don’t rely on the operating system name alone. On macOS, distinguish Apple Silicon from Intel. On Android, check your device and app compatibility. If the installer reports an architecture mismatch, verify your selection rather than repeatedly changing the file extension. Export or back up your current configuration before upgrading an existing client.

Check the import result and logs first. Make sure the response is a configuration supported by the client, not a login page, web page or error message. Some URLs return only a list of proxies, which requires the client to support that import format; a complete configuration usually also includes proxy groups and rules. Next, confirm that the imported configuration is selected and loaded. If the logs show a parsing error, ask the subscription provider for a compatible format. Don’t save web page content as YAML. When troubleshooting, share only redacted error details, never the full subscription URL.

Turn off TUN first and confirm that the system proxy works. Then follow your client’s instructions to install or repair its service component. Windows commonly requires a service or administrator privileges; macOS may require approval for network permissions; Linux may need service permissions and virtual network interface support. After granting access, restart the client and check the first error message. If it still fails, look for conflicts with other VPN or virtual network software. Don’t leave security protections disabled to bypass an error, and avoid changing multiple routing settings at once.

Import a supported subscription or configuration in the client, select the configuration and proxy policy, then allow the VPN configuration when prompted by iOS. Return to the client and start the connection. Check the system connection status and client logs, then test with a new web request. iOS handles network traffic differently from desktop system proxies, so don’t copy desktop port settings. If you can’t enable the connection, check the configuration parsing result and system permissions. If it is enabled but you still can’t connect, check the subscription’s validity, selected outbound route and DNS settings.

Starting at login only means the client launches; it doesn’t necessarily enable the system proxy or TUN. Check startup settings, the connect-on-launch option, selected configuration and service status separately, and confirm that all required permissions are granted. On multi-user systems, check which account owns the startup item. Start the client manually and verify the connection first, then sign out and back in while checking the logs. Don’t rely on the tray icon alone. If a laptop’s routes aren’t ready after waking from sleep, wait for the network connection to come back, then reconnect the client.

Don’t put long-term custom rules directly in a source file that gets overwritten by subscription updates. Use the client’s override, merge or extension features, and check where they insert rules. Rules that need to take priority generally belong before catch-all rules, but clients can merge configurations in different orders. After an update, check the effective configuration and create a new connection to the target domain to confirm the expected rule matches. Back up your configuration before making changes so you can restore it if parsing fails.

Enable the system proxy, make a new browser request and watch the client’s connection log. It should show the destination, matched rule and policy used. If there’s no entry, first check whether traffic is reaching the client. A trusted IP lookup service can help identify the outbound IP, but it reflects only that request and cannot prove that every app uses the proxy. Test destinations configured for direct and proxied access separately. Don’t assume routing is correct just because the client says it’s running or a page loads.

A latency test usually measures how long one request takes to reach a test server. It does not measure available bandwidth or fully reflect packet loss, congestion or the experience of accessing a particular site. The network path beyond the proxy can vary between services. For a fair comparison, use the same device, network, destination and time period, and watch for stable transfer speeds. If only one site is slow, check its matched rule and outbound route rather than repeatedly switching proxies based on latency alone. Tests may also use up subscription traffic.

Enable LAN access only when you need devices on the same trusted network to use the proxy. On each connecting device, enter the LAN address of the computer running the client and its actual listening port, not the device’s own loopback address. Check the listening address, inbound firewall rules and whether the client supports access authentication. Don’t expose the proxy port to the public internet, and avoid opening it on public Wi-Fi. Turn off LAN access when you’re done. If a connection fails, first confirm the devices can reach each other, then check that the proxy protocol and port match.

At minimum, hide the full subscription URL, access tokens, passwords, proxy server addresses, account details, private domains and local file paths. Logs can reveal service identifiers or details about your network even when no password is visible. When reporting an issue, include the client name, core details, operating system, steps to reproduce and relevant error lines; you don’t need to upload the entire configuration. If a configuration is needed to reproduce the issue, create a minimal, redacted sample and review the attachment first. If credentials have been exposed, deleting the screenshot isn’t enough: reset them with the provider.

First, confirm that your local network and system clock are working. Then check whether the subscription has expired, its traffic allowance is used up or its URL has been reset. Review the update log to distinguish a timeout from an authentication or configuration parsing error. If the download succeeds but parsing fails, ask the provider about the returned format. If the subscription domain must be reached through a proxy but your current configuration isn’t working, use direct access temporarily if the client supports it, or connect through a route you’ve verified. Don’t retry repeatedly or submit a private subscription URL to an untrusted conversion site.

Turn off the proxy to confirm that your basic network connection works, check the system clock, then verify the subscription status and selected configuration. If only one proxy fails, compare it with other routes in the same configuration. If they all fail, check the local network, subscription account, core protocol support and security software before blaming the proxies. Use logs to distinguish DNS resolution failures, connection timeouts and authentication errors. You can test on another trusted network, but don’t change the port, DNS and protocol settings all at once.

First, check that the address and port in system proxy settings match the client’s actual listening endpoint. Confirm that the core is running and the port isn’t already in use. Browser extensions, custom proxy settings or other proxy software may override the system settings; temporarily disable them and test with a new connection. If the client’s connection log still shows no request, the problem is likely at the traffic entry point. If requests appear, check the rules and outbound route. Command-line tools may not follow the system proxy and may need a separately configured, supported proxy method. That alone doesn’t mean the client is broken.

First, confirm that a regular browser can connect through the system proxy. Then check whether the affected app is a packaged app subject to loopback restrictions. Some apps can’t access a local loopback proxy directly. If your client provides a loopback exemption tool, grant access only to the apps that need it and follow the prompts for administrator privileges. An exemption won’t fix every Store app issue or resolve proxy or DNS failures. If you use TUN, check the virtual network interface and routing separately. Restart the affected app after applying the exemption; don’t exempt every app at once.

A connected status only shows that some components are running. Check whether new requests appear in the connection log, then verify the selected policy, whether a rule is rejecting traffic, DNS errors and whether the outbound route works. If your internet stops working after you quit the client, check whether the system still points to a local proxy that is no longer listening, and clear any leftover proxy settings. If you used TUN, confirm that the virtual network interface and routes have been restored. Keep a record of the original settings and revert changes one at a time; don’t reset every network setting at once. On a work- or school-managed device, contact your network administrator first.