Rule vs Global vs Direct: Which Clash Mode Should You Use?

What each mode actually controls

In Clash and Clash Meta (mihomo core), the client interface usually shows a "mode" toggle with three common options: Rule, Global, and Direct. All three operate at the same layer — deciding which exit a given outbound connection ultimately leaves the device through. The difference lies in how that decision is made:

• Rule mode: checks the rules section of the config file line by line, matching against domain, IP, GEOIP, process name, and other conditions, then hands the connection to the corresponding proxy group or direct routing. If nothing matches, it falls through to the trailing MATCH catch-all.
• Global mode: skips rule matching entirely and sends every connection through whichever proxy node (or proxy group) is currently selected, with no distinction by domain or region.
• Direct mode: also skips rule matching, but in the opposite direction — every connection bypasses all proxy nodes and goes straight out through the local network exit as-is.

In other words, rule mode routes traffic conditionally, global mode proxies everything, and direct mode proxies nothing. The three are mutually exclusive states — the client is only ever in one of them at a time.

How traffic actually flows in rule mode

Rule mode is enabled by default in most Clash config files and is what subscription providers recommend for long-term daily use. It evaluates rules in the exact order they appear in the config's rules list. Common rule types include:

Once a connection is issued, the core checks rules starting from the top of the list and stops as soon as one matches — there's no such thing as "matching two rules at once," since whichever rule appears earlier always takes priority. This is exactly why many subscription configs place direct-connection rules for frequently used local services near the top, and put proxy rules for foreign services along with the trailing MATCH catch-all near the bottom: it cuts down on unnecessary comparisons and prevents ordering mistakes from routing traffic that should go direct through the proxy instead.

The advantage of rule mode is precision: local cloud storage, maps, and payment apps can go direct for speed and stability, while foreign sites and apps are routed through the proxy — neither interferes with the other. The downside is that its effectiveness depends entirely on the quality and update frequency of the rule set. If a provider's rule set has gaps, a newly appeared domain may briefly be routed incorrectly until the rule set is updated or a custom rule is added manually.

When global mode makes sense — and its cost

Global mode hands the decision of "should this be proxied" entirely over to the user — the core no longer reads the rules section, and every connection goes through whichever node is currently selected. This is a reasonable, even necessary, choice in a few specific scenarios:

1. Verifying whether a node actually works: switch to global mode, select the target node, and visit a few sites in different regions. This gives a direct read on the node's connectivity and latency without rule-based routing getting in the way.
2. Troubleshooting "site fails under rule mode but works after switching nodes": if you suspect the rule set has miscategorized a domain, global mode lets you first confirm whether the issue is with the node itself or with the routing rules.
3. Accessing a site or service faster than the rule set can keep up: for example, needing to reach a newly launched foreign site that the rule set hasn't caught up with yet — global mode works immediately without waiting for a rule update or writing a custom rule.

When direct mode makes sense

Direct mode is the opposite of global mode — every connection bypasses all proxy nodes. Its use cases are narrower, mostly centered on ruling out the proxy itself as the source of a problem:

• When you suspect a site's inaccessibility is a local network issue rather than a proxy node issue, switch to direct mode to check — if it still fails under direct mode, the problem has nothing to do with Clash, and you should check your local network or the target site itself.
• When you need temporary access to LAN-only addresses such as a router admin page, NAS dashboard, or printer configuration page — these should never be routed through a proxy node in the first place.
• During OS or app store updates, if the rule set hasn't marked the relevant domains for direct connection, temporarily switching to direct mode can speed up downloads and avoid consuming proxy node bandwidth.

Worth noting: under direct mode, foreign sites will become unreachable since the proxy is no longer in the loop — that's expected behavior, not a malfunction. Remember to switch back to rule mode once troubleshooting is done.

Why rule mode should be your daily default

The core reason to keep rule mode as the default state is that it balances both efficiency and stability, while global and direct mode each satisfy only one side of that trade-off:

Staying in global mode long-term means every visit to a local site, every LAN device connection, and every system update gets routed through an extra proxy hop — this slows things down and adds to node bandwidth usage, which is especially noticeable on subscriptions with traffic caps. Staying in direct mode long-term is effectively the same as turning off the proxy entirely, defeating the point of running Clash at all. Rule mode lets the rule set handle both extremes automatically, so as long as the rule set is well maintained, most scenarios need no manual intervention.

The correct sequence for switching modes

Treat switching modes as a one-off diagnostic step rather than a lasting state. Follow the sequence below, and remember to confirm the issue is resolved before switching back to rule mode:

If the root cause turns out to be a rule set miscategorization, the more reliable fix isn't staying in global mode indefinitely — add a custom rule for that domain near the top of the rule list in your config, specifying which proxy group or direct routing it should use. That way, the same issue won't require manually switching modes again in the future.

Common questions

Some users confuse "mode" with "node selection within a proxy group" — these are two independent dimensions. Mode determines how traffic gets routed in the first place; node selection within a proxy group determines which specific server handles traffic once it's been routed to the proxy side. Switching modes doesn't clear your selected node — once a connection matches a rule under rule mode and gets handed to a proxy group, it still uses whichever node you've manually selected in that group, or whichever one was picked automatically by latency testing.

Also, TUN mode is a different concept from the three modes discussed here: TUN is a method of intercepting system-wide network traffic at the network layer, while rule/global/direct is the routing logic applied after that traffic has been intercepted. With TUN mode enabled, you can still switch between rule, global, and direct — the two operate independently and don't conflict with each other.