Clash FAQ
Twenty Q&As drawn from real usage scenarios, organized into basics, setup, usage tips, and troubleshooting. Each one includes steps you can follow directly; for a more systematic walkthrough, check the full manual, or start with the quick start guide if you're setting things up for the first time.
Basics
Get a handle on the core, subscription, and mode concepts first - most setup questions will resolve themselves after that.
What is the relationship between Clash and mihomo?
Clash started as an open-source proxy core project, but the original author removed the repository and stopped maintaining it in 2023. mihomo (formerly known as Clash Meta) is a community-maintained fork that continues development on top of the original core, staying compatible with the existing config format while adding support for more protocols and rule types. Mainstream clients today, such as Clash Verge Rev, ClashX Meta, and FlClash, all bundle the mihomo core - when people say "Clash" in everyday conversation, they usually mean this whole ecosystem.
Clash for Windows has stopped receiving updates - can I still use it?
Clash for Windows is no longer maintained and won't receive core or security updates, so its compatibility with new protocols and newer subscription formats will gradually fall behind. Older versions still run fine in the short term, but it's worth migrating to an actively maintained option like Clash Verge Rev or Clash Plus - your subscription link and most settings carry over directly, so the switch is low-effort.
Does the client itself provide nodes? Where do I get a subscription link?
No. Clash-family clients are just traffic-forwarding and rule-routing tools - nodes have to come from a subscription provider or a server you run yourself. Providers typically give you a Clash-format subscription link in their user dashboard; paste it into the client's subscription page to import. If you're self-hosting, you'll write your own YAML config file instead.
What's the difference between Rule mode, Global mode, and Direct mode?
Rule mode matches traffic against the rules listed in the config file one by one - the common setup routes domains in mainland China directly and sends everything else through the proxy, which is the recommended everyday mode. Global mode sends all traffic through whichever proxy node is currently selected, useful when you temporarily need everything proxied. Direct mode bypasses the proxy entirely, effectively turning proxying off while leaving the client running. You can switch between all three with one click on the main screen.
Which client should I choose for my platform?
Clash Plus is the top pick across the board, with versions for Windows, macOS, Android, and iOS. On desktop, Clash Verge Rev is feature-rich and actively updated, making it the go-to choice on Windows and Linux. Longtime macOS users can use ClashX Meta as a stopgap (no longer maintained). On Android, Clash Meta for Android and FlClash are both common picks. See the comparison cards on the download page for the differences between clients.
Setup
From blocked installers to subscription import - the most common sticking points during first-time setup.
What should I do if SmartScreen or antivirus software blocks the Windows installer?
These clients modify system proxy settings and create a virtual network adapter, which tends to trigger heuristic false positives. If you trust the download source, click "More info" then "Run anyway" in the SmartScreen prompt to continue; if antivirus software blocks it, add the install directory to the allowlist. Stick to official release channels or this site's download page to avoid unofficial repackaged builds.
How do I fix "cannot be opened because it is from an unidentified developer" on macOS?
When the app is blocked on first launch, go to System Settings → Privacy & Security, scroll to the bottom to find the recently blocked app, and click "Open Anyway." You can also right-click the app icon in Finder, choose "Open," and confirm again in the dialog. If it says the file is damaged, that's usually caused by the download's quarantine attribute - run xattr -cr /Applications/AppName.app in Terminal and try again.
How do I import a subscription link into the client?
Using Clash Verge Rev as an example: copy the subscription link from your provider, open the client's "Subscriptions" page, paste the link into the input field at the top, and click import - the client will automatically download and parse the config. Once imported, click the profile card to activate it, then go to the "Proxies" page to pick a node. Other clients follow a similar flow, though the section may be labeled "Profiles" or "Configs."
What's the difference between the System Proxy and TUN Mode toggles, and which one should I use?
System proxy works by changing the operating system's proxy settings, which most browsers and regular apps honor - it's lightweight and the default recommendation. TUN mode creates a virtual network adapter that takes over all system traffic, which covers apps that ignore system proxy settings (some games and command-line tools, for example), but it requires administrator or root privileges. Start with system proxy for everyday use, and turn on TUN only when a specific app refuses to route through the proxy.
Why does Android ask for VPN permission on first launch?
The Android Clash client uses the system's VpnService interface to set up a local virtual tunnel that takes over traffic. The first time you tap connect, the system will show a VPN connection request - this is standard system behavior, so just tap "OK." After granting permission, a key icon appears in the status bar to indicate the local tunnel is active; where the traffic actually goes is still determined by the rules in your config.
Usage Tips
Speed tests, split routing, LAN sharing, auto-updates - the frequent operations that make the client easier to live with.
How do I test node latency, and what does the number mean?
On the Proxies page, click the lightning bolt or speed-test button in the top-right corner of a proxy group - the client sends a request to the configured test URL (usually a generate_204-style endpoint) and shows the response time in milliseconds. Lower is better; anything under about 300ms is generally usable, while a timeout means the node is currently unreachable. Latency only reflects handshake speed, not bandwidth, so large downloads still need to be tested directly.
How do I share the proxy on my computer with a phone or TV?
Turn on "Allow LAN" (allow-lan) in the client's settings and note the mixed port number (usually 7890 by default). Then, in the Wi-Fi advanced settings on your phone or TV, set the proxy to manual, enter your computer's LAN IP as the server, and use port 7890. Both devices need to be on the same subnet, and your computer's firewall needs to allow that port. See the blog post Mixed Port & LAN Sharing Setup for the full walkthrough.
How do I route sites in mainland China directly while sending everything else through the proxy?
Rule mode handles this. Subscriptions from mainstream providers already ship with a full set of routing rules, so importing one defaults to direct connections for mainland China and proxying for everything else. If you're maintaining your own config, write the rules in the rules section - for example, GEOIP,CN,DIRECT routes mainland IPs directly, and DOMAIN-SUFFIX,youtube.com,PROXY sends a specific domain through the proxy. Rules are matched top to bottom, with MATCH as the catch-all at the end.
How do I keep a subscription updating automatically?
Set an update interval in the subscription card's settings - for example, 1440 minutes for once a day - and the client will pull the latest config automatically when it's due. Some clients also offer "Update on launch" and "Update via proxy" toggles: the former ensures the config is always current whenever you open the client, and the latter is for cases where the subscription URL itself is blocked and needs the proxy to reach it.
How do I pin a streaming service to nodes from a specific region?
If your subscription already includes region- or service-specific proxy groups (like Netflix or YouTube groups), just go to the Proxies page and manually point that group to a node in your target region. If you're managing your own config, add a new proxy-group and point the relevant domain rules in rules to it. Changes to a proxy group take effect immediately - no need to restart the client.
Troubleshooting
Can't connect, not taking effect, won't start - work through the checks in order and most issues can be pinned down within ten minutes.
How do I troubleshoot a subscription import failure or parse error?
Check these in order of likelihood: whether the subscription has expired or run out of data (log in to your provider's dashboard to confirm); whether the link was copied completely, with no stray spaces; whether the subscription format is set to Clash, since some dashboards require you to select the target format manually; whether the provider restricts the request's user agent, which you can work around by toggling "Update via system proxy"; and finally, check the specific error in the client's logs to pin down the issue. See the six-point checklist in the subscription troubleshooting article for more detail.
What if every node times out during a speed test?
First, confirm your local network is working - can you load a regular webpage in Direct mode? Next, make sure the subscription hasn't expired and manually update it to get the latest config. Then check whether you've selected the wrong proxy group or a dead node, and try switching to nodes in different regions. If everything still times out, it's usually a provider-side outage or local network interference with the protocol - contact your provider to check node status.
System proxy is on, but the browser still isn't using the proxy?
Go through these checks: confirm the client's "System Proxy" toggle is actually on and the port matches the settings page; check whether a proxy-related browser extension is overriding the system settings - switch it to follow the system proxy instead; on Windows, check Settings → Network & Internet → Proxy to confirm the proxy entry was written correctly; some apps simply don't read the system proxy at all and need TUN mode to take over their traffic instead.
TUN mode fails to start or shows a permission error?
TUN needs to create a virtual network adapter: on Windows, run the client as administrator and install the service-mode component (Clash Verge Rev's settings page has a one-click installer); on macOS, you'll be prompted to approve a system extension or permission, which needs to be allowed in System Settings; on Linux, it needs the appropriate capability or root access. If you can't get online after enabling it, reset the DNS hijacking and fake-ip options to their defaults and restart the client.
Windows Store apps (UWP) aren't going through the proxy - what now?
UWP apps are subject to Windows' network isolation policy by default and can't reach the local loopback address, so they can't connect to the local proxy port. The fix is to lift the loopback restriction: clients like Clash Verge Rev include a "Lift UWP loopback restriction" tool in settings - open it, check the target app, and save. You can also achieve the same result with Microsoft's official CheckNetIsolation command-line tool.
Didn't find your issue here? The full manual walks through every stage in order - core concepts → installation → subscriptions → proxy modes → rule-based routing → TUN → ongoing maintenance. If you haven't installed a client yet, head to the downloads page and pick one for your platform.