Clash FAQ

The core handles protocol handshakes, rule matching, and traffic forwarding. It only exposes a command-line interface, and the current mainstream community core is mihomo. The graphical clients on each platform (such as Clash Verge Rev, FlClash, Clash Plus) sit on top of the core as a control panel, handling day-to-day tasks like subscription management, node switching, system proxy, and the TUN toggle.

Choosing a client essentially means choosing a front end for the core you like; configuration file formats are largely interchangeable between clients, so switching between them is low-cost.

Two things: first, the installer for your platform, available on this site's download page by operating system; second, a working configuration source — usually a subscription link from your service provider, or a config.yaml file you've written yourself.

The client itself ships with no nodes at all; until a subscription or node info is imported, all traffic goes direct.

Rule mode matches traffic against the rules section in the config file one by one, sending matched traffic through the corresponding policy — this is the recommended mode for everyday use. Global mode skips the rules and routes all traffic through the currently selected proxy policy. Direct mode sends all traffic out without any proxy.

When troubleshooting, you can temporarily switch to Global mode: if Global works but Rule mode misbehaves, the problem lies in the rules, not the nodes.

These are two DNS handling approaches. In Fake-IP mode, the client first returns a fake address from a reserved range (default 198.18.0.0/16) for domain lookups, deferring the real resolution until a connection is actually established — this skips a local DNS round trip and resists DNS poisoning, making it the default choice for TUN scenarios. Redir-Host preserves real resolution results, offering better compatibility but depending on the quality of local DNS.

When using Fake-IP, domains that need a real IP — LAN devices, gaming platforms, etc. — should be added to the fake-ip-filter list.

Most open-source clients don't purchase a commercial code-signing certificate, so SmartScreen shows a warning for installers with low signing reputation — this is expected. After confirming the installer came from this site's download page or the project's official release channel, click "More info → Run anyway" to continue; if third-party antivirus quarantines it, add the install directory to the trusted zone and reinstall.

If you're unsure about the source, re-download from a trusted page rather than run an installer of unknown origin.

Apps downloaded via a browser get a quarantine attribute attached by Gatekeeper. Go to "System Settings → Privacy & Security", scroll to the bottom to find the blocked app, and click "Open Anyway"; if it says the file is damaged, run xattr -cr /Applications/ClientName.app in Terminal to clear the quarantine attribute, then launch again.

On Apple Silicon, make sure you downloaded the arm64 build; on Intel Macs, download the x64 build.

The Android client uses the system's VpnService interface to set up a local virtual network adapter and take over traffic. The first time you enable the proxy, the system shows a connection confirmation prompt — you must tap Allow for it to work, and this does not route traffic to any third party beyond the system prompt.

If the proxy keeps disconnecting afterward, it's usually the manufacturer's battery-saving policy killing the background process; add the client to the battery-saving whitelist and allow it to run in the background.

On the client's Profiles or Subscription page (the naming varies slightly between clients — commonly Profiles, Config, or Subscription), choose New or Import, paste the subscription URL from your provider, and confirm. The client will download and parse the full configuration automatically.

It's also worth setting an auto-update interval (e.g., 24 hours) so the node list stays current as the provider makes changes; you can also import a local YAML file for self-hosted nodes or offline configs.

On iOS, install Clash Plus from the App Store — see its official site at clashplus.io for details. After installing, import your subscription inside the app, and when you enable the proxy for the first time, allow the VPN configuration when prompted by the system.

The iOS section of this site's download page includes a link to the App Store listing.

The client's latency test sends a single HTTP request to a designated test URL and measures how long it takes, in milliseconds — lower is better. Generally, under 100ms feels smooth, above 300ms introduces noticeable lag, and a timeout means the node is currently unusable.

Keep in mind latency only reflects handshake speed, not bandwidth; when picking a node, test two or three times in a row to get a stable reading rather than being misled by a single fluctuation.

When an application doesn't respect system proxy settings (common with command-line tools, games, and some desktop software), enabling TUN mode creates a virtual network adapter that takes over all traffic at the network layer, without configuring each program individually.

On Windows, this requires running as administrator or installing the system service the client provides; on macOS, the first activation prompts for system authorization; on Android, VPN mode is itself the same kind of mechanism and needs no extra steps. For everyday browsing, the system proxy is enough — there's no need to keep TUN on all the time.

These are geographic databases used for rule matching: GeoIP matches by IP location (e.g., GEOIP,CN,DIRECT), while GeoSite matches by domain category. Both gradually become outdated as network conditions change, which can cause some sites to be routed incorrectly — it's worth updating manually every month or two in the client's settings, or simply turning on auto-update.

If an update download fails, try connecting through the proxy first, then retry.

Android clients generally support Per-App Proxy, letting you choose an allow-list or exclude-list of apps that go through the proxy in settings.

On desktop, you can route by process name in the rules using PROCESS-NAME, for example PROCESS-NAME,Telegram.exe,PROXY; without TUN enabled, apps that don't read the system proxy naturally go direct anyway, which can serve as a coarse form of per-app routing.

A common setup uses two layers: an automatic url-test group that lets the client pick the fastest node by latency, and a manual select group that includes both the automatic group and nodes from various regions as candidates.

Leave things on the automatic group for everyday convenience, and manually switch to a specific node when you need a fixed region — for example, to access a region-restricted service — balancing convenience with control.

First confirm the client's system proxy toggle is on, and check that your system network settings show a proxy address like 127.0.0.1:7897 (the port depends on your client's setting).

If that's correct and it still doesn't work, check whether your browser has a proxy-management extension installed — these can override the system proxy and need to be set to follow system settings or disabled outright. Some browsers also have a separate proxy settings page, which should likewise be set to use the system proxy.

For security reasons, Windows blocks UWP apps from accessing the local loopback address by default, so these apps can't reach a proxy listening on 127.0.0.1.

The fix is a loopback exemption: some clients include a built-in UWP Loopback exemption tool that can whitelist a specific app with one click; alternatively, you can use the built-in CheckNetIsolation command to exempt it manually. Restart the affected app after exempting it for the change to take effect.

Check in this order: first, whether the subscription has expired or run out of data — log in to your provider's panel to confirm its status; second, paste the subscription link directly into a browser — if it downloads YAML text, the link itself is valid; third, if the link is valid but the client update still fails, try enabling "Update subscription via proxy" in the client — it's common for subscription domains themselves to be interfered with; fourth, confirm the provider hasn't changed the subscription address, and if necessary, reset the subscription link in the provider's panel and re-import it.

First switch to Direct mode to confirm your local network is fine, then switch back to proxy mode and check whether the subscription has expired or the node list is empty. If nodes exist but all time out, try updating the subscription, changing the latency test URL, and switching to Global mode to test a single node directly. Congestion on cross-border links during peak hours in a particular region can also cause widespread timeouts, so try comparing nodes from different regions.

If none of this helps, contact your provider to check the server-side status.

There are three common causes: first, misconfigured DNS — in TUN scenarios, it's recommended to enable fake-ip enhanced mode and make sure enable under the dns section is set to true; second, a conflict with another VPN or virtual-adapter software — quit any other program that's taking over networking and try again; third, on Windows, not running as administrator or as a service, which causes the virtual adapter creation to fail.

If the issue persists after ruling these out, turn off TUN, verify the nodes work via the system proxy instead, then revisit your TUN-related configuration.