Clash FAQ

The client manages subscriptions, switches modes, and integrates with the operating system. The core parses configuration, applies rules, and establishes connections. mihomo is a core project that continues the work of Clash Meta, so the name shown in the interface may differ from the core name. A subscription is a remote source for configuration content, usually maintained by a service provider. Installing a client does not automatically provide a working subscription. When something goes wrong, first identify whether the issue is with the interface, a core error, or the subscription content.

A subscription link retrieves remote content, while a local YAML file is a snapshot stored on your device. Updating a remote subscription may replace existing proxies, proxy groups, or rules; local files usually need to be edited manually or imported again. Some links return proxy entries only. These must be added as a proxy provider to a complete configuration, not used as a complete profile. Before importing, check the format your client requires and keep a copy of your working configuration.

For everyday use, start with Rule mode, which routes connections according to the rules in your current configuration. Global mode sends connections handled by the core to the global proxy group, where you still need to select an available proxy. Direct mode connects handled traffic straight to its destination. These modes affect only traffic routed through the client, not every app on your device. For troubleshooting, briefly switch to Global mode as a comparison, then return to Rule mode. This can help distinguish a rules issue from a proxy issue.

A system proxy registers an HTTP or SOCKS proxy with the operating system, mainly for apps that honor that setting. TUN mode uses a virtual network interface to capture traffic that matches its routing rules. It can help with apps that ignore system proxy settings, but also requires the right permissions, routes, and DNS setup. For a first-time setup, enable only the system proxy and verify it works before testing TUN if needed. Some clients allow both at once, but it isn’t required. Test them separately when troubleshooting to reduce variables.

Fake-IP mode returns a mapped address from its configured address pool. The core uses the mapping to identify the domain and handle the connection, so a DNS lookup may not show the destination’s real IP address. This does not by itself mean DNS resolution failed. Some local network services and apps that rely on real IP addresses may not work with Fake-IP. Add exceptions for the affected domains instead of broadly expanding the bypass list. After changing DNS mode, reload the configuration as your client requires and clear any stale DNS cache held by the operating system or apps.

On the configuration or subscription page, confirm the new entry downloaded successfully, then select, enable, or set it as the active configuration. Button names vary by client. Saving a subscription URL does not mean the core has loaded its configuration. Next, check the load result in the logs and open the proxy groups page. If the download succeeded but no groups appear, check whether the content contains proxy entries only or uses a format your client does not support. Keep the old configuration for now, and avoid repeatedly importing the same URL, which can make it unclear which entry is active.

First check your device’s clock, internet connection, and subscription URL. Watch for spaces or line breaks added when copying the link. Then review the update log: 401 or 403 errors often point to authorization or access restrictions; a 404 may mean the URL is no longer valid; a timeout calls for checking the network path. Status codes are clues, so follow your provider’s guidance. If your client supports a proxy for subscription downloads, test both a direct connection and an existing working proxy. If it still fails, ask your provider to check the link—and never share the full URL if it contains credentials.

Note the field, proxy type, and line number shown in the log, then check which core and version the client is actually running. Newer configurations may use protocols or options that an older core cannot handle; updating the interface does not always update the core. If you edited the file manually, check YAML indentation, spaces after colons, and list nesting. Do not use tabs. Ask your subscription provider for a compatible format or use a client that supports the configuration. Don’t blindly remove the flagged field and overwrite your original file.

Check whether your client requires service mode to be installed or started, then grant the required permissions through the operating system’s standard authorization process. On Windows, check the background service status; on macOS, look for system permission prompts; on Linux, consult the client documentation for permission and virtual interface requirements. Then check the logs for permission errors, interface creation failures, or route conflicts. Running everything with elevated privileges is not a general fix. Close other VPN or TUN apps first, then restore the service as documented by your client.

Before switching, save your subscription source, local YAML file, and client overrides separately. Note proxy group selections and port settings if needed. Exit the old client and turn off its system proxy and TUN, then import copies into the new client. Make sure its core supports the protocols and fields in your configuration. Don’t copy the entire app data folder: interface settings and database formats may differ. Once the new client has loaded the configuration and passed connection and restart tests, decide whether to remove the old app and configuration.

Check the auto-update toggle and interval in the subscription settings, and follow your provider’s recommended schedule. Frequent requests may trigger access restrictions. Remote subscriptions usually download fresh content, so edits made directly to a downloaded file may be overwritten. For rules or DNS changes you need to keep, use the client’s supported override, merge, or extension configuration. After an update, check the active configuration and logs to confirm your custom settings remain—not just the editor page.

A manual selection group usually uses `select`, letting you choose the active proxy. An automatic test group usually uses `url-test`, which selects based on the configured test URL, interval, and tolerance. A `fallback` group prioritizes available proxies in order; it does not simply pick the fastest one. Test results show connectivity to the specified test URL, not necessarily how every app or service will perform. Verify a switch with a new connection, since existing long-lived connections may continue using the previous proxy.

In the client, enable LAN access and check the listen address and mixed port. On devices on the same trusted network, enter the computer’s LAN address and the corresponding port. Also check that the operating system’s firewall allows connections from that network. Enabling LAN listening alone does not configure other devices to use the proxy; each device still needs proxy settings or a clearly defined gateway setup. Never expose the proxy port to the public internet. Turn off LAN access and remove firewall exceptions when they’re no longer needed.

Many command-line tools read only their own options or environment variables such as `HTTP_PROXY`, `HTTPS_PROXY`, and `ALL_PROXY`; they do not use the desktop system proxy setting. First check the client’s local listening address and port. Then check which variables and proxy protocols your tool supports, including its conventions for uppercase and lowercase names. `HTTPS_PROXY` does not necessarily require an `https` URL scheme. Test in the current terminal session before editing global startup files. Remove temporary variables afterward so the terminal doesn’t keep pointing to an old port when the client exits.

Include your operating system, client name, core version, time of the error, and steps to reproduce it. Share only the relevant log lines for configuration loading or connection errors around that time. Before sharing, remove full subscription URLs, access tokens, passwords, private domain names, and other identifying details. You can temporarily increase the log level to investigate, then restore your usual setting. Don’t upload an entire configuration folder or an unchecked diagnostic archive. If you need to share YAML, keep the field structure but replace sensitive values with clearly fake examples.

Turn off the proxy first and confirm your basic internet connection works. Then check that the subscription updated successfully and the current proxy group has a working proxy selected. Use the same proxy with different destinations, and, if possible, compare results on another network. If the logs show a domain resolution failure, check DNS first. If the connection times out while being established, check the proxy address, port, and network path. Built-in tests report results only for their test destination. One proxy timing out does not mean the whole subscription is invalid, so don’t reset all settings right away.

First compare the proxy address and port registered with the operating system against the client’s actual listening address and port, and confirm the core is running. Then check browser extensions, separate browser proxy settings, PAC, and bypass lists. If needed, compare in a temporary browser profile. Open the client’s connection log and make a new request: if nothing appears, check how traffic is being captured; if the request appears but uses a direct connection, check the matched rule. A page loading—or failing to load—doesn’t prove whether the proxy is working. Avoid changing all DNS and routing settings at once.

Some Windows apps isolated with AppContainer cannot access a local loopback proxy directly. That can leave your browser working while a specific app fails. First confirm the affected app uses the local proxy, then check whether your client includes a UWP loopback or loopback exemption tool. Add exemptions only for the apps that need them and authorize them as the tool requires. You can also use `CheckNetIsolation` as described in Microsoft’s documentation. Not all Store apps have the same restriction. If the issue persists, check your account, system network, and firewall settings.

Turn off TUN temporarily to confirm the issue is related to the virtual interface or traffic routing. Check whether another VPN, virtual machine network, or security app is also changing routes, and whether the service depends on LAN discovery or a dedicated DNS server. If needed, configure a bypass for specific subnets, interfaces, or domains according to your core and client documentation. Don’t exclude an unnecessarily broad address range. Change and test one setting at a time, and follow your network administrator’s requirements on work networks.

Check whether the operating system still has a manual proxy or PAC URL pointing to a local port, and turn off any stale proxy setting. If you were using TUN, restart the original client, disable TUN and the system proxy, then exit normally so the client can clean up. Also check whether another VPN, terminal proxy variables, or DNS settings are still active. Don’t remove network adapters or reset all network settings right away. If basic connectivity is still broken, use the operating system’s diagnostics to guide your next steps and keep a record of the original settings.