Clash FAQ

The client is the interface you interact with. The core is the program that handles connections and applies rules, such as mihomo. A subscription is an update URL for fetching configuration. They are three different things. After installing a client, you usually need to import a subscription you’re authorized to use or a local configuration, then select it to run. Being able to open the client doesn’t mean the subscription is working; a successful subscription update doesn’t mean every node can connect. When troubleshooting, first identify whether the issue is with the interface, fetching the configuration, or the connection itself.

Use Rule mode for everyday browsing. It routes requests according to the rules in your configuration. Global mode sends requests that reach the core through the global policy, making it useful for quick troubleshooting. Direct mode connects requests from the core straight to their destinations. The mode doesn’t determine which apps send traffic to the core; that depends on the system proxy, each app’s settings, or TUN interception. If websites still won’t load in Global mode, don’t assume the rules are at fault. Check the global policy, node connectivity, and DNS resolution too. Switch back to your original mode when you’re done testing.

A node is a specific proxy connection. A proxy group is a selection point that combines nodes, direct connections, or other groups. Rules usually refer to proxy group names rather than individual nodes. Changing a group won’t affect traffic if the current request doesn’t match it. Find the target domain in the connection list, check the matched rule and policy chain, then adjust the relevant group. For automatic selection groups, keep in mind that health checks may choose a different exit. To keep a fixed exit, use a manual selection group provided by your configuration.

There’s no need to enable both right away. The system proxy tells apps that follow system settings which proxy address to use. TUN uses a virtual network interface to intercept traffic that matches its routing conditions; coverage depends on the client and configuration. Beginners can start with the system proxy to test browser connections, then enable TUN if needed for games, command-line tools, or other apps. Change one setting at a time when troubleshooting to avoid interference between interception methods. TUN also doesn’t guarantee that all traffic goes through the proxy; routing, rules, and app behavior all play a part.

Check your provider’s account page for the service status, expiration date, and traffic allowance. Then copy the client-specific subscription URL again and check for extra spaces or line breaks. A website login URL isn’t necessarily a subscription URL. If the URL returns a web page, login prompt, or error page, the client can’t parse it as a configuration. Check the status code in the update log: 401 and 403 usually indicate an authorization issue, 404 may mean the URL has changed, and 429 means you should try again later. Never post a full subscription URL containing access credentials in a public forum.

Make sure the newly imported configuration is selected as the active one, not just listed in the client. Then check whether the import includes proxy nodes or proxy groups, and look for separate update errors affecting those groups. Some subscriptions provide only a node list and can’t be used as a complete running configuration; others need to download additional resources. Don’t overwrite your existing files yet. Keep a working configuration, then check the client format and core compatibility required by your provider. After a successful update, return to the proxy groups and check whether the options are available.

YAML uses indentation to represent structure. Make a copy of the original file, then use the line number in the log to inspect the surrounding lines, especially colons, list hyphens, and space indentation. Don’t mix tabs and spaces. Quote text containing special characters according to YAML syntax. Once the syntax check passes, confirm that the node names referenced by proxy groups and the group names referenced by rules actually exist and match exactly. Change one small section at a time and reload. If it still fails, restore the backup and check the file section by section against the manual instead of changing several fields at once.

Creating a virtual network interface and changing routes for TUN usually requires extra permissions. Follow the specific instructions shown by your client: Windows clients may require installing and starting a service, macOS may require authorization for a helper, and Linux requirements depend on how it’s deployed and managed. After granting permission, enable TUN again and check the logs for interface creation errors. Don’t use unfamiliar scripts to change system permissions in bulk. If the device is managed by your organization, check that its policies allow this first. If you have the required permissions and it still fails, look for conflicts with other VPNs, virtual network adapters, or security software.

Check the actual requests in the connection list rather than relying only on the proxy group button. Open the client’s Connections page, refresh the target website, and find its requests by domain or app name. Check the matched rule, policy, and final connection node. A page may request several domains, so the main page, images, and videos may use different routes. Rules are generally evaluated from top to bottom, and the first match determines how traffic is handled. MATCH at the end is the fallback for requests that didn’t match earlier rules. If you see an existing connection, close and reopen the site’s tab, then check the newly created connection.

A subscription update usually fetches the remote configuration again, which can overwrite changes made directly to the subscription file. Use the client’s override, merge, or extension features to keep custom content separate from remote content. Feature names and merge order vary between clients, so don’t copy instructions from another client without checking. After making changes, inspect the final active configuration to confirm custom rules appear near the top and their referenced proxy groups exist. Test with a manual update. If the client doesn’t support persistent overrides, keep a separate local configuration, but maintain its nodes and rules yourself as they change.

First make sure you changed the proxy group actually used by the request, then check whether an old connection is still active. Some apps reuse long-lived connections, so changing the policy may not end an existing session. Close the relevant webpage or quit the app, then make a new request. If needed, close only the corresponding connection in the client’s connection list to avoid interrupting other tasks. Exit-check websites may also cache results, so compare the connection list with a new test request. If the policy chain includes automatic selection or nested groups, expand it to see the final selected node instead of relying on the outer group name.

GeoIP data maps IP addresses to regions for use by relevant rules. It’s separate from the node information in a subscription. Updating it only affects decisions when your configuration actually uses this data. First check which data format your core uses, then update resources through an option supported by your client. Don’t swap files in different formats. After the update, reload the configuration or restart the core as required by the client, then check the matched rule for a test connection. Region data can’t guarantee that every service is routed as expected; for a specific website, an explicit domain rule is often easier to verify.

A timeout means only that this test didn’t return a result within the allowed time; on its own, it doesn’t prove the subscription has expired. Check your direct internet connection first, then test other nodes and see whether only one test address is failing. If some nodes work, the problem is more likely with a node or route. If none work, also check your device’s time, whether the configuration loaded, network restrictions, and interference from other VPNs. A latency test isn’t the same as loading a website, so test the target service too. Record the specific error and when it occurs. Hide subscription URLs, passwords, and other sensitive information when contacting your provider.

Check that the system proxy points to your local device and that its port matches the current core’s HTTP or mixed proxy port. Don’t guess based on common port numbers. Then check browser extensions, independent proxy settings, and bypass lists; some apps ignore system settings. Open a new webpage while watching the client’s connection list. If no new connection appears, check whether the traffic is reaching the core. If it does, check the rules and exit. Also make sure another proxy app isn’t repeatedly changing your system settings. When testing is complete, stick to one clearly defined traffic interception method.

First confirm that a regular browser can connect through the same proxy. Then check whether the target app is actually a UWP app affected by network isolation; not every Microsoft Store app is. Loopback means an app is accessing a local address, which some UWP apps are restricted from doing by default. If your client includes a loopback exemption tool, open it as instructed with administrator privileges, enable and save the exemption only for the app you need, then restart the app and test again. You can also use CheckNetIsolation to manage exemptions, following the Windows documentation. Don’t enable exemptions for every app. If that doesn’t help, check the app’s network permissions, proxy support, and logs.

Turn off TUN and the system proxy, then exit the client normally and check whether your regular internet connection returns. If it doesn’t, check whether the system proxy still points to a local address and whether another VPN is managing your routes. Don’t start by resetting all network settings. Once direct access works again, enable just one traffic interception method and retry. Check whether errors mention DNS, routes, or the virtual interface. DNS translates domain names into IP addresses, and a lookup failure can also make websites appear unavailable. Keep the logs and original configuration, undo recent changes one at a time, and restart the device if needed before testing direct access again.