Clash FAQ

Clash is an open-source, rule-based proxy client. It doesn't provide any nodes itself — it just routes your traffic to different exits based on rules.

Nodes come from a proxy provider (subscription service). Import the subscription link the provider gives you into Clash, and only then do the two pieces work together to get you online.

Think of it this way: Clash is the outlet panel, the subscription is the power cord. Without either one, nothing lights up.

The original author stopped maintaining it in late 2023, and the repo is archived. Old versions still run, but they no longer get security updates and can't keep up with newer protocols.

Switch to a client that's still maintained, like Clash Plus or Clash Verge Rev. The config format is the same, so you can carry your subscription link over as-is — migration takes just a few minutes.

It's a URL starting with https:// that, when accessed, returns a complete Clash config file — nodes, groups, and rules all included.

It's provided by your proxy provider in their user dashboard. Copy the whole link and paste it into the client's Subscription / Profiles page to import it.

Treat your subscription link like a login credential — don't post screenshots of it anywhere.

Rule mode: matches traffic against your config line by line — local sites go direct, everything else routes through a proxy. This is what you use day to day.

Global mode: sends all traffic through the currently selected node, handy for temporary troubleshooting.

Direct mode: skips the proxy entirely, like unplugging it for a moment.

You'll find the switch on the client's main screen under Proxy Mode / Outbound Mode. If you pick the wrong one, just switch back.

mihomo (formerly the Clash Meta core) is the engine that actually does the work: parsing configs and routing traffic.

GUI clients like Clash Plus and Clash Verge Rev are control panels built around that core, and they already bundle it in, so installing one is enough.

You only need to deploy the core separately on headless setups like servers or routers.

Clash Plus is the top pick, with Clash Verge Rev as a solid alternative — both are actively maintained and support current protocols.

Grab the installer from this site's Windows download section, double-click to install — just like any other app. Windows 10 64-bit or newer is all you need.

Skip the old Clash for Windows installer — if something breaks in an unmaintained app, nobody's fixing it.

This is macOS blocking apps that aren't from the App Store — the installer itself is fine.

Open Terminal and run sudo xattr -rd com.apple.quarantine /Applications/YourClient.app, enter your password, then launch it again.

You can also go to System Settings → Privacy & Security, scroll to the bottom, and click "Open Anyway."

Check three things first: ① that you copied the entire link with no stray spaces at either end; ② whether the subscription has expired — check the validity period in your provider's dashboard; ③ whether the subscription domain is being blocked — try switching to Global mode or a different network, then update again.

Still empty? Paste the subscription URL into your browser: if it downloads a yaml file, the link is fine and the issue is on the client side; if it won't download, contact your provider's support.

Android: grab the APK for Clash Plus or Clash Meta for Android from the Android download section. Allow "install from unknown sources" during setup, and approve the VPN connection prompt on first launch.

iOS: search for and install Clash Plus from the App Store (official site: clashplus.io). On first launch, allow it to add a VPN configuration when prompted. Importing a subscription afterward works the same as on desktop.

Most desktop clients have two toggles in Settings: "Launch at Startup" and "Set System Proxy Automatically." Turn both on and you're connected the moment you log in.

On Windows, if TUN mode is enabled, the client needs admin rights to auto-start — most clients offer a "Service Mode / Install System Service" option, which you set up once so you're not stuck approving a UAC prompt every time.

Click the lightning bolt or speed test icon on the node list, and the client pings a test server and shows the response time in milliseconds.

Lower is better: under 100ms is great; 100–300ms is normal and usable; over 500ms or a timeout is worth avoiding.

Note: latency only measures handshake speed, not bandwidth. Whether video actually streams smoothly is a separate test. If everything times out, check your own network connection before blaming the subscription.

Add a line at the very top of the rules section in your config, e.g. - DOMAIN-SUFFIX,example.com,DIRECT forces that domain direct; swap DIRECT for a proxy group name to force it through the proxy instead.

Rules are matched top to bottom, first match wins — custom rules need to sit above the general ones.

Most clients also support an Override / Merge feature, letting you layer on extra rules without touching the original subscription, so they survive subscription updates.

The system proxy setting only affects apps that actively check for a system proxy — games and command-line tools often ignore it entirely.

TUN mode creates a virtual network adapter and intercepts all traffic at the network layer, catching those stubborn apps too.

The tradeoff is it needs admin or root privileges, and on macOS and Windows you'll need to grant permission or install a system service. For everyday browsing, the system proxy is enough — turn on TUN only when something won't route through the proxy otherwise.

Yes. On the subscription page in your client, find "Update Interval / Auto Update" for that profile and enter a number of hours, like 24.

Whenever your provider updates their nodes, the client will pull the new config on that schedule without you having to update manually.

Note: auto-update overwrites any direct edits you've made to the subscription file. If you want to keep custom rules long-term, use the Override feature instead.

7890 is Clash's default mixed-port (mixed-port), which accepts both HTTP and SOCKS5 traffic.

To set up a manual proxy in another app, use address 127.0.0.1 and port 7890; from the command line you can run export https_proxy=http://127.0.0.1:7890 for a temporary session.

Always check the actual port shown in your client's settings — if you've changed it, use that value instead.

Check these four things in order:

①whether the "System Proxy" toggle in the client is actually switched on; ②whether the address and port in your OS proxy settings match the client — usually 127.0.0.1:7890; ③whether a proxy-related browser extension has taken over control — switch it back to "System Proxy" mode; ④some browsers have their own independent proxy settings — make sure it's set to "Use system settings."

Work through the list and you'll usually find the culprit.

Don't panic — work through this in order: ①quit the client and open any webpage with no proxy running, to confirm your own network connection is fine; ②check whether your subscription has expired or run out of data; ③update your subscription once — the provider may have swapped out their servers; ④try a different speed test URL in settings.

If your raw connection is fine, the subscription is valid, and everything still times out after updating, it's likely a temporary issue on the provider's end — wait it out, or reach out to their support.

Windows Store apps are blocked from accessing the loopback address by default, so they can't reach a proxy on 127.0.0.1 — you'll need to add a loopback exemption.

Some clients have a built-in "UWP Loopback / Loopback Exemption" tool right in Settings — just check the app you need and save. Otherwise, run CheckNetIsolation LoopbackExempt -a -n=YourAppPackageName from an elevated prompt.

Turning on TUN mode also bypasses this restriction entirely.

A bind failure means something else is already using port 7890 — usually because two proxy clients are running at once.

On Windows, run netstat -ano | findstr 7890 to find the PID of the process holding the port; on macOS and Linux, use lsof -i :7890. Close that process and you're set.

You can also just change the mixed-port to something free, like 7891, in the client's settings — the system proxy port will update to match automatically.

This is almost always a DNS issue. Check in order:

①switch to Global mode and try loading a page — if it works, the problem is with rule-based routing; ②check that enhanced-mode is set to fake-ip in your DNS config, and restart the client after making changes; ③if your browser has "Secure DNS / DoH" turned on, it bypasses Clash's resolution entirely — turn it off and retry; ④flush your system DNS cache — on Windows, run ipconfig /flushdns.