Clash Frequently Asked Questions

Clash is a general term for rule-based proxy tools. The original Clash core has stopped development. Most mainstream clients today (Clash Plus, Clash Verge Rev, FlClash, etc.) bundle the community-maintained mihomo core, which handles protocol parsing, rule matching, and traffic forwarding; the client itself is just the graphical shell, and the config format and rule syntax are defined by the core, so configuration files are largely interchangeable between different clients.

An already installed copy will still run, but the original author has stopped releasing updates, so new protocols and rule syntax won't be supported and there's no fix channel for issues. It's recommended to migrate to an actively maintained client such as Clash Plus or Clash Verge Rev: their config syntax is largely compatible with the old version, so simply re-importing your subscription link into the new client completes the migration without manual editing. See the download page for installers on every platform.

Rule mode matches traffic against the rules in your config file one by one: traffic matching a proxy rule goes through a node, traffic matching a direct rule is sent out directly. It balances speed and reliability and is the recommended everyday mode. Global mode routes all traffic through the currently selected node, useful for quickly testing a node or handling sites not covered by rules. Direct mode sends all traffic out without any proxy, mainly used to check whether your local network itself is working.

Both the clients and the mihomo core are open source and free to download and use, most under licenses like GPL-3.0. But the client itself doesn't include any proxy nodes. The node service needed to actually connect is sold separately by subscription providers, and that cost has nothing to do with the client software — which provider to use is entirely up to you.

Not exactly. A subscription link is a URL; what the server returns when you visit it is the actual YAML-format Clash config file, containing the node list, proxy groups, and routing rules. The client re-fetches the subscription at a set interval to refresh the local config; if you already have a ready-made local YAML file, you can also import it directly into the client without going through a subscription at all.

Using Clash Verge Rev as an example: open the client's settings page and enable the "Launch at startup" switch. If you also use TUN mode, it's a good idea to also enable "Silent start" and install the system service to grant permissions, otherwise a User Account Control (UAC) prompt will appear every time you boot. Clash Plus also offers an auto-start option in its settings page; once enabled, the client launches automatically at login and restores your last proxy state.

First copy the full subscription URL from your provider's user panel. Open the client's config or subscription page, click "New / Import", paste in the link, and confirm — the client will download and parse the config automatically. Once imported, click the entry in the config list to activate it, then switch to the proxy page to pick a node and turn on the system proxy to start using it. See the Setup Guide for a step-by-step walkthrough with screenshots.

This is macOS Gatekeeper's default block for apps not distributed through the App Store — it doesn't mean the app is broken. Two ways to fix it:

• Open "System Settings → Privacy & Security", scroll to the bottom to find the blocked app, and click "Open Anyway";
• Or run xattr -dr com.apple.quarantine /Applications/AppName.app in Terminal to remove the quarantine attribute before launching.

Either method only needs to be done once — after that, double-clicking to open works normally.

The Android client uses the system's VpnService interface to create a virtual network adapter on the device to take over traffic. The first time you tap connect, the system shows a VPN connection request, which you must allow for it to work. This permission only sets up a local virtual tunnel inside the device — where the traffic actually goes is still determined by your config file, not handed off to some third-party VPN provider.

The mixed port is a local port the core listens on that accepts both HTTP and SOCKS5 connections, commonly defaulting to 7890. Once the client turns on the system proxy, it automatically writes 127.0.0.1:7890 into the system proxy settings; if you need to configure a proxy manually for a specific app, enter address 127.0.0.1 and port 7890 in its proxy settings — either HTTP or SOCKS5 will connect successfully.

On the proxy page, click the latency test icon at the top right of a proxy group. The client sends a request to the test URL defined in the config and shows a millisecond value next to each node — lower means a faster handshake, and a timeout means the node is currently unreachable. Keep in mind latency only reflects connection setup speed, not bandwidth; actual video and download performance should be judged by real use, so try a few low-latency nodes and compare.

Yes. Set an update interval (e.g. every 24 hours) in the subscription entry's edit screen, and the client will re-fetch the config periodically, syncing any node or rule changes made by the provider. Note that if the provider changes their panel domain, the old link stops working entirely — automatic updates can't recover from that, and you'll need to manually replace it with the new subscription link.

System proxy only affects apps that respect system proxy settings — browsers and most desktop software fall into this category, and it's enough for everyday browsing without extra permissions. TUN mode takes over all traffic at the network layer via a virtual adapter, covering command-line tools, game clients, and other apps that ignore system proxy settings, but it requires administrator privileges. Use system proxy by default, and only enable TUN when you truly need full traffic capture — there's no need to run both at once. See the Advanced Handbook for how TUN and Fake-IP work under the hood.

Add a direct-connect rule near the top of the rules section in your config, for example:

DOMAIN-SUFFIX,example.com,DIRECT

This sends that domain and its subdomains straight out without a proxy; for process-based routing, use a PROCESS-NAME rule. Clients that support overrides or a rule editor can also add this through the GUI. Reload the config after making changes — rules are matched top to bottom, so higher entries take priority.

Some subscriptions are delivered in a format meant for other clients that the Clash core can't parse directly, in which case a subscription conversion service is needed to turn the link into Clash-readable YAML format. Most providers now offer a native Clash format, and mainstream clients also have built-in automatic conversion for some common formats, so it's best to try importing directly first and only consider conversion if parsing fails.

A four-step approach works well:

1. Confirm the client is running and either the system proxy or TUN is turned on;
2. Test the current node's latency, and if it times out, try two or three other nodes to rule out a single bad node;
3. Switch to direct mode and try loading any site to confirm your local network itself is fine;
4. Check the log page for connection refused or DNS-related errors.

In practice, most cases turn out to be a dead node or an expired subscription, and updating the subscription fixes it.

First paste the subscription link directly into a browser: a 404 or inaccessible page means the link has expired and you need to grab a fresh one from the provider's panel; if the browser opens it fine but the client throws a parse error, it's likely a format incompatibility — try subscription conversion; if it's an update timeout, the subscription domain may be blocked on your current network, so try turning on the proxy with a node that still works, then retry the update.

There are three common causes:

• The browser has a proxy extension like SwitchyOmega overriding the system settings — switch the extension to its "system proxy" profile;
• Firefox uses its own independent proxy configuration by default, which needs to be changed to "use system proxy settings" in its network settings;
• Some security software or network repair tools quietly reset the system proxy, so check the "Proxy" page in Windows Settings to confirm 127.0.0.1:7890 is still set.

Windows sandboxing blocks UWP apps from accessing the local loopback address by default, so they can't reach the proxy port on 127.0.0.1. Clients like Clash Verge Rev provide a "UWP loopback exemption (Loopback)" tool in their settings — check the apps that need network access and save to allow them through; you can also use Microsoft's official EnableLoopback utility to perform the same exemption manually.

TUN requires administrator privileges to create a virtual network adapter: on Windows, run the client as administrator, or install the system service in settings before enabling it; the first time it's enabled, wait for the virtual adapter driver to finish installing. If it starts but there's no network, first make sure other VPNs or game accelerators have fully quit (virtual adapters can conflict with each other), then check whether DNS hijacking is enabled in settings, and if needed, point the system DNS at the address provided by the core.

The first step is always to manually update the subscription: providers change server addresses from time to time, which makes locally cached old nodes fail all at once, and updating usually restores service immediately. If everything still times out after updating, check whether your system clock is accurate (some encryption protocols are sensitive to time drift and will fail the handshake if it's off by even a few minutes), then try a different network (like a phone hotspot) to compare and determine whether it's a node-side issue or a local network restriction. For a full troubleshooting workflow on speed issues, see the log page and the related sections in the Advanced Handbook.