Clash FAQ

Clash is an open-source, rule-based proxy core project; the original core stopped development in 2023. Clash Meta is a community fork that carried the project forward, later renamed mihomo, adding more protocols and rule types.

Today, mainstream clients (Clash Plus, Clash Verge Rev, FlClash, and others) all bundle the mihomo core. In everyday usage, "Clash" usually refers to the entire client ecosystem rather than one specific program.

No. The client only forwards traffic according to rules; nodes (proxy servers) must be provided by the user, typically imported via a subscription link.

Without any usable nodes, the client still runs normally, but every proxy group will appear empty or time out during latency tests.

Its code repository has been deleted, so there are no more security updates or core upgrades, and continued use is not recommended. Windows users can migrate to Clash Plus or Clash Verge Rev; both are compatible with the same subscription format, so importing the same subscription link works with minimal migration effort.

The download center keeps an archive of the last release for transitional use only.

Rule mode matches traffic against the rules in the config file one by one and routes accordingly — this is the recommended default for daily use. Global mode routes all traffic through the currently selected proxy node. Direct mode bypasses the proxy entirely.

Switch to Global temporarily to test node connectivity, or to Direct to check whether the proxy is affecting a particular site, then switch back to Rule mode afterward.

Every client listed in the download center is open-source or free software, free of charge. The only thing that costs money is the node service itself, which is provided by a third-party provider and has nothing to do with the client.

Any channel that charges money for a "Clash client installer" is not an official source.

Copy the full subscription URL, open the client's "Profiles" page, paste it into the input field, then click download or import. On success, a new profile appears in the list — select it, then go back to the "Proxies" page to see the node list.

If the import fails, first confirm the link wasn't truncated, then check whether your current network can reach the subscription URL directly.

Each client has a launch-on-startup toggle in its settings: Clash Plus and Clash Verge Rev have a "Launch at startup" checkbox in the General section of Settings; on macOS, the first time you enable it, the system will request Login Items permission, which you need to allow in System Settings. It's also worth enabling "Silent start" so the app minimizes to the tray automatically after launch.

Note that launch-on-startup only starts the program — if you also want it to take over traffic automatically, enable "Auto-enable system proxy" as well.

Proxy software needs to modify system proxy settings and create a virtual network adapter, which easily triggers heuristic false positives in security software. First confirm the installer came from this site's download center or an official release channel, then add the install directory to your security software's whitelist (exclusions).

If the TUN mode driver component gets deleted, you'll need to restore it from quarantine and reinstall.

Some open-source clients aren't Apple-notarized, so they get blocked the first time you open them. Go to "System Settings - Privacy & Security," scroll to the bottom to find the blocked app, and click "Open Anyway."

If it says the app is damaged, run xattr -cr /Applications/AppName.app in Terminal to remove the quarantine attribute before launching again.

TUN mode takes over all traffic at the system network layer by creating a virtual network adapter — both creating the adapter and modifying the routing table are system-level operations: Windows requires running as administrator or granting service permissions, macOS shows an authorization dialog, and Linux needs root or the cap_net_admin capability set on the core binary.

Clash Verge Rev offers a service mode: install and authorize once, and subsequent TUN activations won't require elevated permissions each time.

On the "Proxies" page, click the latency-test icon on a proxy group; the client sends a request to the configured test URL and displays the response time in milliseconds. This number only reflects a single HTTP handshake's latency, not actual bandwidth — favor nodes with consistently low, stable latency and avoid ones that repeatedly time out.

You can also set the proxy group type to url-test so the core automatically picks the lowest-latency node at fixed intervals.

Editing the config file generated by a subscription directly means the next update will overwrite everything. The correct approach is to use the client's extension mechanism: Clash Verge Rev supports global extension configs with Merge and Script processing, so custom rules live in an extension layer and get merged automatically on every subscription update; Clash Plus offers a similar rule-append option.

Rules match top-to-bottom, so custom rules need to come before subscription rules to take priority.

Fake-IP answers DNS queries with virtual addresses from a reserved range, skipping real resolution and giving lower first-packet latency — it's the default recommendation under TUN mode. However, LAN device-to-device access, some multiplayer games, and software that needs the real IP may misbehave, requiring the relevant domains to be added to the fake-ip-filter whitelist.

Redir-Host behaves more like traditional resolution, with better compatibility but potentially extra resolution latency. When unsure, start with Fake-IP and whitelist specific domains as issues come up.

The client's Profiles page supports saving multiple profiles; click one to switch, and only one is active at a time. It's a good idea to give each subscription a recognizable name and an auto-update interval.

Before switching, check whether both profiles use the same port settings — if the local listening port changes after switching, any software with a hardcoded proxy address will stop working. Delete profiles you no longer use to avoid switching to the wrong one by accident.

mixed-port is a listening port that accepts both HTTP and SOCKS5 protocols simultaneously, commonly defaulting to 7890 — local software just needs to point its proxy at 127.0.0.1:7890.

To share it with phones, TVs, and other devices on the same LAN, enable "allow LAN connections" (allow-lan) in the client, then set the proxy server on those devices to this machine's LAN IP plus the port, and make sure your system firewall allows that port.

Check these four things in order: first, whether the client's logs show a connection record for that domain — if not, the traffic never reached the client at all; second, whether the address and port in the system proxy settings match the client's listening port, and whether another program has overwritten them; third, whether the browser has a separate proxy extension overriding system settings.

Fourth, some command-line tools and desktop apps don't read the system proxy at all and need environment variables set individually, or you can switch to TUN mode to take over at the network layer.

First, open the subscription link directly in a browser: if a file downloads, the link is valid and the problem is with the client's network — try enabling "update via proxy" or temporarily switching networks and retrying. A 404 or 403 usually means the subscription has expired or the link was reset by the provider, and you'll need a new one.

If the update succeeds but nodes behave oddly, check whether the provider changed the config format, and if needed, delete the profile and re-import it.

Every node timing out is usually not about the nodes themselves. First switch to Direct mode to confirm your local network is fine; then check whether your system clock is accurate, since a large drift can break TLS handshakes; check the logs for DNS resolution errors and try switching DNS servers in the config; if the subscription hasn't been updated in a long time, the server addresses may have changed entirely, so update it manually and test again.

If only a handful of nodes time out, that's normal fluctuation — just pick a different node.

UWP apps run in a network-isolated sandbox by default and are blocked from accessing the local loopback address, so they can't reach the proxy port on 127.0.0.1.

There are two fixes: use a "UWP loopback exemption" tool in supporting clients (which internally calls CheckNetIsolation to lift the restriction for a specific app), or enable TUN mode to take over traffic at the network layer, bypassing the loopback restriction entirely.

Visit a DNS leak test site in your browser; if the results show your local ISP's resolver, there's a leak.

Fixes: confirm enhanced-mode is set to fake-ip in your config; or under Redir-Host, point nameserver at an encrypted DNS provider (DoH or DoT); enabling TUN mode with dns-hijack forces the client to intercept all system DNS queries, which is the most thorough fix. Re-test after making changes to confirm the result.

The most common causes, in order, are: a YAML syntax error in the config file, the listening port already in use by another program, or a corrupted core binary. To diagnose: check the logs first — every client has a menu option in Settings or Help to open the log directory; a port conflict can be fixed by changing the mixed-port value; if the log points to a config error, roll back your recent changes or start with a blank config temporarily; if it still won't launch, reinstall the client while keeping the data directory.

The launch-crash troubleshooting guide in our technical notes covers the full step-by-step verification sequence.