Clash Beginner’s Guide: Import Subscriptions, Choose a Mode, and Understand Proxy Ports

1. What are Clash, a Clash client, and mihomo?

“Clash” can refer to the core engine or to a desktop client with a graphical interface. The core handles connections, matches rules, and connects to proxy servers. The client manages subscriptions, provides the interface, configures the system proxy, and controls the core process. When troubleshooting, note both the client and core names—not just “the latest version of Clash.”

Clash Meta is a fork in the Clash ecosystem that later adopted the name mihomo. Different clients may bundle different cores, with varying support for protocols, rule fields, and TUN settings. A configuration that loads in mihomo may still contain fields an older Clash core cannot recognize.

• Client version: Usually listed on the About page; it determines the menu layout and available configuration management features.
• Core version: Usually listed on the Core or About page; it determines supported configuration syntax and protocols.
• Subscription service: Provides server details or configuration. It is separate from the client and is not included just by installing one.

Further reading: Choose a client for your operating system on the client download page, then check core compatibility in the protocol reference.

2. How do I import a subscription URL, and why isn’t it working?

A subscription URL retrieves a configuration or a list of proxy nodes. It may return a complete Clash YAML file, or just a list of nodes. A node list may not work as a complete configuration on its own; the service should provide a subscription format compatible with your client or core.

Typical import steps

1. Copy the subscription URL for Clash or mihomo from your subscription service. Don’t copy the URL for the account management page.
2. Open the client’s Configuration or Profiles page and look for Add, Import from URL, or a similar option.
3. Paste the URL and download it. Check that the configuration appears in the list and that no parsing error is shown.
4. Select or enable the configuration, then open the Proxies page and confirm that proxy groups and nodes are listed.
5. Choose an available node, then enable the system proxy if needed. Importing a configuration alone does not route app traffic through the core.

Menu names vary by client; these are general steps, not a fixed path that applies to every app. If you see HTTP 401 or 403, check your subscription access and expiry date. If the download succeeds but YAML parsing fails, check whether the response is a login page, an error message, or an incompatible format.

Further reading: Follow the quick-start guide to import and enable a configuration. If the download fails, visit the Help Center.

3. When should I use Rule, Global, or Direct mode?

Mode determines how connections that reach the core are routed; it does not determine which apps send traffic to the core. Global mode alone won’t route every app through the client unless the system proxy or TUN is also configured.

Rule mode typically checks rules from top to bottom and uses the first match. This snippet is not a complete, importable configuration. “default-outbound” must be replaced with the name of an existing proxy or proxy group in your configuration.

rules:
  - DOMAIN-SUFFIX,example.com,DIRECT
  - MATCH,default-outbound

This example sends example.com and its subdomains direct, and routes all other connections through “default-outbound.” If that group currently selects DIRECT, fallback traffic still goes direct. So enabling Rule mode does not guarantee that a request will use a proxy server.

Further reading: Check rule types, policy names, and match order in the protocol reference.

4. What’s the difference between a node and a proxy group, and how do I switch nodes?

A node usually represents a specific proxy server. A proxy group is a selection layer that rules can reference. A group can contain nodes, other proxy groups, or DIRECT. To switch routes, check which group the request actually matches—not just the node name shown on the home screen.

• select: Manually choose one of the available options. Use this when you want a specific outbound.
• url-test: Automatically chooses an option based on configured probes. Results depend on the test URL, tolerance, and other settings.
• fallback: Selects the first available option that passes a health check; it does not simply choose the option with the lowest latency.

Open the Connections page, find the connection for the target domain, and check its matched rule and proxy chain. Then switch the corresponding proxy group. Changes usually affect new connections; existing downloads, video streams, and other long-lived connections may keep using the previous route until reconnected.

A displayed latency of 80 ms only tells you how long that probe took; it does not indicate download speed. Throughput also depends on bandwidth, congestion, the destination server, and your local network. A probe timeout may simply mean the test URL is unreachable, so check actual requests as well.

Further reading: Use the quick-start guide to choose a proxy group, then follow the Help Center troubleshooting steps to check the connection.

5. What are ports 7890, 7891, and 9090 used for?

These are common example values, not fixed defaults for every client. Check the client’s port settings or the active configuration before using them. In particular, distinguish the proxy listener from the management API—never enter the API port in your browser’s proxy settings.

mixed-port: 7890
allow-lan: false
external-controller: 127.0.0.1:9090

In the snippet above, 7890 is a mixed HTTP and SOCKS proxy listener, while 9090 is the controller API used by the management interface. Set allow-lan: false when you don’t want to provide proxy access to devices on your local network. Some older configurations use separate HTTP and SOCKS listeners, such as port: 7890 and socks-port: 7891; don’t guess the protocol from the port number alone.

Test the proxy listener with a command

curl --proxy http://127.0.0.1:7890 --connect-timeout 10 --head https://example.com

This command explicitly uses the local port 7890 and sets a 10-second connection timeout. In Windows PowerShell, use curl.exe to avoid differences with aliases in older environments. If the connection is refused, first check that the core is running and the port matches. An HTTP response means the request received a response, not that every website is reachable.

Further reading: Check listener fields in the protocol reference, and troubleshoot port conflicts in the Help Center.

6. Why don’t my browser or terminal use the proxy when the system proxy is enabled?

The system proxy is a setting that apps can choose to use; it does not force all system traffic through a proxy. Most browsers can use it, but command-line tools, games, and apps with their own networking stack may ignore it. Browser proxy extensions can also override the system setting.

1. Run the explicit proxy command from the previous section first. This helps determine whether the proxy listener is unavailable or the app simply isn’t using it.
2. Check for browser proxy extensions, app-specific proxy settings, and exception lists. Avoid having multiple tools change proxy settings at the same time.
3. Check the client’s Connections page to see whether the request appears. If there’s no entry, investigate how traffic reaches the client before trying different nodes.
4. Set environment variables or proxy options as documented by your terminal tool. If you need to route traffic from more apps, consider enabling TUN mode.

For example, in the current shell on macOS or Linux, you can temporarily set:

export http_proxy=http://127.0.0.1:7890
export https_proxy=http://127.0.0.1:7890
curl --head https://example.com
unset http_proxy https_proxy

The value of https_proxy can still use http://: it tells the client to establish a tunnel to an HTTPS destination through an HTTP proxy listener. export affects only the current shell and child processes started afterward; it does not change system-wide settings. Support for these variable names varies by tool.

Further reading: See the Help Center for app proxy settings and connection troubleshooting.

7. What is TUN mode, and do I need to enable it?

TUN routes traffic through a virtual network interface. Combined with routing and DNS settings, it sends connections that don’t use the system proxy into the core. TUN and Rule mode operate at different layers: TUN controls how traffic enters the core; rules determine where it goes next.

If your browser and everyday tools already work with the system proxy, there’s no need to enable TUN just to complete your setup. Enable it when you need to route games, some command-line programs, or other apps that ignore proxy settings, following your client’s instructions. Windows clients may need a service installed or elevated permissions; macOS and Linux also require the appropriate permissions and network configuration.

What to check before and after enabling TUN

• First confirm that the system proxy works, so you don’t mistake a node problem for a TUN issue.
• Note any existing VPNs, virtual network adapters, and corporate network requirements. Multiple apps changing the default route can conflict.
• After enabling TUN, check that the target connection appears in the client and that local network, DNS, and IPv6 access still work.
• After quitting the client, check that your network is working again. If not, disable TUN first, then check for leftover routes or services.

Support and defaults for stack, auto-route, and dns-hijack vary across cores and clients. Don’t copy an entire TUN configuration from the internet over your subscription, and don’t use TUN to bypass network access controls.

Further reading: Check TUN fields in the protocol reference, then use the Help Center to troubleshoot routing issues.

8. Why did my custom rules disappear after a subscription update?

Updating a remote subscription usually fetches the server configuration again. If you edit the downloaded YAML directly, those changes may be overwritten during the next update. Subscription updates, proxy provider updates, and rule provider updates are separate operations that retrieve different data.

1. Keep the remote subscription as your upstream source; don’t rely on it as the only place to store custom rules.
2. If your client supports overrides, merges, or scripts, put local changes there and confirm which configurations they apply to.
3. If you need to manage everything manually, save a separate local configuration. Keep in mind that server information will no longer update automatically from the remote subscription.
4. After each update, check the final active configuration—not just the original content in the editor.

Pay close attention to where rule overrides are inserted. If you append custom rules after MATCH, the catch-all rule has already routed the connection, so later rules won’t take effect. Referencing a proxy group that doesn’t exist can also prevent the configuration from loading.

Check the units when setting update intervals. For example, in mihomo’s proxy-providers, interval: 3600 means 3,600 seconds, or one hour. A client’s subscription page may show update intervals in minutes, so don’t copy the number without checking the units.

Further reading: Check provider and rule fields in the protocol reference, and follow the quick-start guide for setup steps.

9. Are startup launch, proxy on launch, and automatic updates the same thing?

No. These settings control different actions. Launch at startup usually just opens the client after you sign in. Check separately whether it starts the core, enables the system proxy, or restores TUN. Installing a system service also doesn’t necessarily open the desktop app at sign-in.

After setup, fully quit the client and sign in again at least once to test everything. Check the core status before testing connectivity; don’t rely on the tray icon alone. If you move a portable client to another folder, its registered startup path may stop working, so set it up again.

If your browser reports a proxy connection error after you quit the client, check whether the operating system still has 127.0.0.1:7890 set as its proxy. If the local listener has closed but the system still points to that port, the internet may stop working when the client closes.

Further reading: Confirm the startup sequence in the quick-start guide, and check proxy settings after quitting in the Help Center.

10. What order should I follow when troubleshooting connection problems?

Check one layer at a time: basic network → core listener → configuration and nodes → routing rules → app. This is usually more effective than changing DNS, ports, modes, and nodes all at once. Change one setting at a time and record the results before and after.

1. Basic network: Temporarily disable the system proxy and TUN, then check whether your local network can reach sites that are normally accessible. If not, troubleshoot Wi-Fi, the gateway, or network authentication first.
2. Core listener: Confirm the configuration is enabled, the core is running, and the port matches. Test with a command that explicitly specifies the proxy; if the connection is refused, check the local listener first.
3. Subscription and nodes: Confirm the subscription is valid, then try another known-working node for comparison. A configuration can parse correctly even when its server is unreachable.
4. Routing: Check the connection’s matched rule and proxy chain. Temporarily switch to Global mode for comparison, then restore the original mode. If Global works but Rule doesn’t, check the rule’s outbound first.
5. DNS and apps: If only some domains fail, check DNS logs, encrypted DNS in the browser, caches, and app-specific proxy settings. Don’t assume every issue is caused by DNS.

What to include in a support request

Include your operating system, client and core versions, current mode, whether TUN is enabled, the listening port, and the time of a failed request with relevant logs redacted. Say whether all apps fail or only a browser, terminal, or specific site—this can greatly narrow down the cause.

Further reading: Continue troubleshooting in the Help Center. To rebuild a basic configuration, follow the quick-start guide and verify each step: import, enable, select an outbound, and route traffic into the core.