Clash FAQ

The client reads configuration, matches rules and forwards traffic. Installing it does not automatically provide working proxy routes. A subscription link is an address used to retrieve configuration, which typically includes nodes, proxy groups and rules, though some subscriptions contain nodes only. Check with your configuration provider that the subscription supports Clash or mihomo, then import it into the client. A successful import only means the configuration was read; you still need to check that the service is active, a proxy group has an exit selected, and system traffic is routed through the client. This site provides client downloads and configuration guides, but does not provide subscriptions or nodes.

Start with your operating system, then check configuration compatibility. Clash Plus is a good place to start. On Android, also check the package architecture and system requirements; on iOS, install through the App Store. For desktop, choose a client based on your needs for rule editing, service mode and TUN settings. Similar interfaces do not guarantee the same core features. For subscriptions using specific protocols or rule fields, check which core the client uses and what it supports. Back up existing configurations before migrating, then verify each feature rather than assuming compatibility based on the client’s name.

Rule mode selects an outbound route based on the configuration’s rules and is suitable for everyday use. Global mode typically sends connections that reach the core through the global proxy group, while Direct mode connects them straight to their destinations. Global mode does not automatically capture all traffic on your phone or computer; that depends on the system proxy, TUN or a mobile VPN connection. To troubleshoot, you can briefly switch to Global and select a working node to see whether a rule is causing the issue. Switch back to Rule mode afterward so temporary test settings aren’t left in place.

No. VpnService is an Android system API that lets a client create a local virtual network tunnel and process traffic routed through it according to the configuration. The VPN permission prompt shown on first launch authorizes traffic handling; it does not mean Android provides a remote connection. You still need a valid configuration and a working outbound route. Under the same user or work profile, a standard VPN tunnel generally can’t be used by two apps at once. If the connection drops as soon as it starts, check for another VPN, accelerator or filtering app that uses a local VPN.

Hide subscription links, node passwords, access tokens and control API keys. A subscription URL may look like an ordinary web address but still contain credentials in its path or query parameters. Before sharing logs, check for full request URLs, account details and private network addresses; redact configuration details and QR codes in screenshots. To get help, you usually only need to share your OS version, client name, core details, when the error occurred and a sanitized excerpt of the error. If a link has been exposed, reset its credentials with your configuration provider. Deleting the post won’t invalidate a link that others may have copied.

Open the client’s configuration or subscription page, choose Import from URL, paste the complete link and save it. Once it has downloaded and parsed, select the configuration and set it as the active one; appearing in the list does not mean it is enabled. Next, open the proxy or proxy group page, check that nodes are listed, and select an outbound node for any manual selection group. Start the connection, grant any permissions requested by the system, then visit a test page. If the subscription contains nodes only, you’ll also need to add proxy groups and rules using a method supported by the client. A node list alone is not a complete configuration.

First check that the link is complete, has no extra spaces or line breaks, and isn’t a web page’s share URL. A 401 usually points to an authentication issue; a 403 may indicate an access restriction, but check with the provider for the specific cause. Sign in to the service dashboard to confirm the subscription hasn’t expired, check your traffic status and see whether the URL has been reset. Copy the current link into the existing configuration entry. If the response is a login page, verification page or error page, the client can’t parse it as YAML configuration. Don’t keep submitting the link to unfamiliar online converters; if conversion is necessary, find out who will receive the link first.

It depends on the platform. Android clients typically use VpnService to capture traffic; desktop administrator steps don’t necessarily apply, and root access may not be required. On Windows, TUN often depends on a client service or elevated permissions. On macOS, you may need to install and authorize a helper component. Disconnect first, install the service as described by the client, then reconnect and check the startup log. If it still fails, look for conflicts with virtual network adapters, other VPNs or security software. Don’t disable all system protections just to clear an error; identify the specific permissions, driver or routing issue first.

When a client using a Network Extension connects for the first time, iOS asks permission to add a VPN configuration and may require device authentication. Make sure the prompt was triggered by the client you just installed, then follow the system prompts to authorize it. An app-created VPN configuration is not the same as a separately downloaded device management profile. Installing an unknown management profile is not a standard connection step. If you can’t connect after authorizing, check the subscription, proxy groups and logs in the client. On managed devices, an organization’s policies may restrict these permissions; check with your device administrator.

A system proxy provides a proxy address to apps, but not every app is required to use it. First make sure the client core is running and the system proxy points to the correct local listening port. Then check whether the browser or app has its own proxy settings. Some programs use their own network stack or connect directly; they may need an in-app proxy setting, or TUN if you understand the routing implications. Turn off the system proxy properly before quitting the client. If the client stops while the system proxy still points to it, apps that follow the proxy may lose internet access. On work devices, check for managed proxy settings too.

A latency test only shows how a node reaches a specific test address. It doesn’t prove that every website, protocol or download will work. First check which proxy group handled the request, then see which node that group currently selects. The node you tested may not be the one actually in use. Next, check the target domain’s DNS result, connection logs and rule match. An unreachable test address can also give misleading results, so test the actual service as well. Don’t focus only on the lowest latency: connection stability, reachability and remaining service traffic matter too.

To stick with a specific outbound node, use a select manual proxy group. To choose a lower-latency route based on test results, use url-test. To prefer the first available route in a list and switch when it fails, use fallback. These groups rely on a test URL and check interval, so switching isn’t instant. Make sure the subscription defines the relevant proxy group before selecting it in the client; renaming a group alone won’t change its behavior. Keep a copy before editing configuration, then check whether your changes were overwritten after a subscription update. Use automatic switching carefully with services that need stable sessions.

Rules are generally matched from top to bottom, so put specific domain rules before broad rules and catch-all rules at the end. Make sure each rule references an existing proxy group, then save it using the client’s override, merge or persistent rules feature. Direct edits to a downloaded subscription file may be overwritten during the next update. Reload the configuration after adding rules and check the logs to confirm they match. Apps often connect to multiple domains, so adding only the homepage domain may not be enough. Adjust rules based on actual connections instead of adding a large number of unexplained entries at once.

Connect both devices to a local network where they can communicate. On the device providing the proxy, enable Allow LAN and check the listening address and proxy port. On other devices, set the proxy server to the host’s LAN IP, not their own loopback address. If they can’t connect, check the host firewall, guest network isolation and wireless access point isolation. Enable this only on trusted networks, and use access controls or authentication if the client supports them. Don’t expose the listening port directly to the public internet. Mobile hotspots and some campus networks may block communication between devices, so test them separately.

Some UWP or AppContainer apps may be blocked by loopback isolation when they use the system proxy to access a local proxy port, but this doesn’t affect every Store app. First confirm a regular browser can connect through the same proxy, then identify the specific app that’s affected. If the client provides a loopback exemption tool, run it with the required permissions and exempt only the target app. Then fully close and reopen that app. TUN may be another option, but verify it works in practice. Don’t exempt every app, and don’t mistake a remote node failure for a local loopback issue.

First disable the proxy and confirm the underlying network works. Complete any Wi-Fi sign-in and check that the device’s clock is correct. Then confirm the subscription is still valid, the node list isn’t stale, and no other VPN is occupying the connection. Restart the client core, select a node, try the actual destination and check the first relevant error in the logs. If only the latency test times out, try a trusted, reachable test address. If the logs show a server connection failure, compare results over mobile data or another network. Don’t start by reinstalling the app or deleting configuration; you could lose useful troubleshooting information.

Find the client in your system’s app settings and set battery usage to Allow background activity or Unrestricted. Enable any required auto-start permissions using your phone manufacturer’s settings. Some systems also require locking the app in the recent apps screen, but that doesn’t replace the battery setting. Lock the screen for a few minutes, then unlock it and check whether the VPN icon, notification and logs are still present. You can enable Always-on VPN if needed. Block connections without a VPN will cut off network access if the client disconnects, so understand the effect before turning it on. If the process is still killed, check system power-saving mode and the manufacturer’s background management rules.

DNS resolves domain names to addresses. First check the DNS settings in the original subscription and whether the upstream DNS servers are reachable on your current network. Also look for circular dependencies where a server’s own domain must be resolved first. fake-ip uses virtual addresses mapped to domains by the core; an unfamiliar-looking address alone doesn’t mean something is wrong. If a LAN service or app is incompatible, adjust the exclusions according to the core’s documentation, then clear the relevant cache using the client’s built-in feature. Also check whether private DNS on the system, secure DNS in the browser and the client are sending queries through different resolution paths.

Possibly, but don’t assume that’s the cause. Wi-Fi and mobile data can differ in IPv6, DNS, UDP support and routing restrictions. Keep the same node, destination and mode, change only the network connection, then compare the resolved addresses and connection errors in the logs. If IPv6 seems to be involved, temporarily disable the relevant option if the client supports it and reconnect to test. Also check IPv6-related DNS settings and which system traffic the client captures. Decide whether to keep the change only after testing. Disabling IPv6 isn’t a universal fix, and changing multiple settings at once makes troubleshooting harder.

Note the subscription source, active configuration, custom rules, overrides, selected proxy groups and DNS settings. If needed, export a backup using a feature supported by the client. Backups may contain credentials, so store them somewhere secure. Before migrating, disconnect the old client and turn off its system proxy, then import into the new client to avoid port or VPN conflicts. Don’t copy all of the old client’s private fields over; first confirm the new core supports them. After reconnecting, test websites, commonly used apps, LAN access and the connection after locking the screen, then remove the old configuration.