Clash Help Center: Common Questions & Troubleshooting Steps
Organized by fundamentals, installation and configuration, usage tips, and troubleshooting. First identify which layer the problem belongs to, then change the relevant setting instead of changing the node, rules, and DNS at the same time.
Fundamentals
Start by distinguishing the client, core, configuration, and operating mode. Once the concepts are mapped correctly, troubleshooting becomes more direct.
How are Clash, the Mihomo core, and graphical clients related?
Clash generally refers to a rule-based proxy tool and its ecosystem. Mihomo is a actively maintained compatible core responsible for connections, DNS, rule matching, and traffic forwarding. Graphical clients such as Clash Verge Rev and Clash Plus handle subscription management, toggles, and interface controls. When troubleshooting, distinguish the client version, core version, and configuration file. Interface problems and core connection failures are different types of issues.
What is the difference between Rule, Global, and Direct mode?
Rule mode matches the configured rules from top to bottom and is best for everyday use. Global mode sends most connections through the currently selected proxy policy and is useful for temporarily testing a node. Direct mode connects to the network without a proxy and helps determine whether the proxy path is causing the problem. Switching modes does not change subscription content automatically, so switch back to Rule mode after testing.
Should you use the system proxy or TUN mode?
The system proxy mainly handles browsers and applications that follow the operating system proxy settings. It is simple to configure and is the recommended first choice. TUN mode uses a virtual network interface to capture more traffic, making it suitable for programs that ignore system proxies, command-line tools, and some games. Start with the system proxy for basic connectivity. Enable TUN only when an application cannot be captured, then address administrator permissions, routing, and security-software access.
Can different Clash clients use the same subscription?
Most standard Clash or Mihomo subscriptions can be imported across clients, but compatibility depends on the proxy protocols, rule providers, scripts, and core-specific fields used in the configuration. If an import reports unsupported fields, first check which core the client uses, then request a compatible format from the subscription provider. Do not bulk-delete configuration sections without understanding their purpose, as this can change routing or DNS behavior.
What is the difference between a configuration file and a subscription link?
A configuration file contains the YAML that the client actually reads, usually including proxies, proxy groups, rules, and DNS settings. A subscription link is a network address used to retrieve or update that configuration. Deleting a local configuration does not cancel the subscription service, and local edits usually are not written back to the server. Those edits may also be overwritten during the next subscription update. Use the client's override feature or a separate configuration to preserve rules long term.
Installation & Configuration
Covers common post-installation issues involving subscription imports, the system proxy, TUN permissions, and Windows app loopback.
Why can't I import a subscription after pasting its link?
First confirm in a browser that the link is still accessible, and check that copying did not add spaces, line breaks, or trailing punctuation. If it returns a login page, a regular webpage, or blank content, the client cannot recognize it as a configuration. Make sure the system clock is correct, the subscription domain is reachable, and try importing again with the system proxy temporarily disabled. If the link contains a temporary token, generate a new one from the subscription service instead of editing its parameters manually.
How do you fix an expired Clash subscription or a 404 during updates?
A 404 usually means the subscription path no longer exists, the token was reset, or the server changed its endpoint. Sign in to the subscription service, copy the link again, replace the old address in the client, and run a manual update. If the new link also returns 404 in a browser, the subscription provider must resolve it. An old configuration can help with short-term troubleshooting, but node availability depends on the server and does not prove that the subscription is still active.
What should I do if a subscription update times out or downloads empty content?
Switch to a network that can access the subscription address normally, then test both with the proxy disabled and enabled. Some clients let you choose a Direct or proxy policy for subscription updates; avoid routing update requests through a node that is already failing. If the browser downloads the content but the client continues to time out, check TLS, DNS, and timeout messages in the client log and make sure security software is not blocking the client.
Why does my browser still connect directly after enabling the system proxy?
Open the operating system's network settings and confirm that the proxy address and port were applied and match the client's mixed port. Some browsers, extensions, or enterprise policies use separate proxy settings, so temporarily disable related extensions and restore the browser's system-proxy setting. Also check whether the target domain matches DIRECT in Rule mode. If the system still retains the proxy after closing the client, disable the system proxy before restarting the client.
How do you fix insufficient permissions when enabling TUN on Windows?
Exit the client and restart it with administrator privileges, then enable TUN. If the client offers service mode or a helper service, install it as prompted and confirm that the service is running. If it still fails, check whether security software is blocking virtual adapter or service creation, and look for abnormal virtual adapters in Device Manager. Fully exit the client before removing leftovers so an active interface is not deleted accidentally.
What should I do when Microsoft Store or UWP apps cannot use the proxy?
Some UWP apps cannot access a local loopback proxy by default, so the browser works while Store apps fail to connect. In the client's UWP loopback tool, select the target app, save the changes, and reopen the app for testing. If the client has no such tool, try TUN mode first. If the change has no effect, check whether the app uses a separate network service and confirm that the rules are not incorrectly sending its domains DIRECT.
Usage Tips
Practical guidance for startup behavior, rule maintenance, Fake-IP, subscription updates, and connection records.
How do you start Clash automatically with Windows or macOS and enable the proxy?
Enable launch at startup in the client settings, then enable restoration of the system proxy or TUN state after launch if needed. On Windows, also check the Startup apps list in Task Manager. On macOS, check Login Items and background items. If the client is running after startup but traffic is not captured, the system-proxy restore option is usually disabled or the TUN helper service has not started. Confirm that manual startup is stable before configuring automatic restoration.
How do you add custom Clash rules without losing them after an update?
Prefer the client's override, configuration-merge, or scripting features, and keep custom rules in a separate file instead of editing the subscription-generated configuration directly. Rules are matched from top to bottom, so specific domain rules should come before broad rules, with the final catch-all rule kept at the end. Validate the configuration after every change, then use connection records to confirm that the target domain matched the intended policy. Keep a working copy before updating the subscription.
What should I do if LAN devices or apps behave unexpectedly in Fake-IP mode?
Fake-IP returns a mapped address for a domain, then the core restores the domain and matches rules. Devices or apps that require real addresses, LAN discovery, printers, screen casting, or some games may behave unexpectedly. First add the relevant domains to fake-ip-filter and keep Direct rules for local network ranges. If the domain is unknown, check DNS and connection logs. Do not disable the entire DNS module immediately; narrow the exceptions first to avoid affecting routing for other domains.
What is a reasonable interval for automatic subscription updates?
For normal use, update every few hours to once a day, depending on the subscription provider's schedule. A shorter interval does not make nodes faster and may add unnecessary network requests at startup. Devices that frequently switch between mobile networks can be updated manually after connectivity returns. For stable, long-running devices, keep a reasonable interval and make sure a failed update does not automatically delete the last working configuration.
How can I confirm which rule a website actually matched?
Open the client's connection records, refresh the target website, filter for its domain, and inspect the rule, proxy group, and final node fields. If the record shows only an IP address, check whether Clash is handling DNS or whether the application bypassed the system proxy. Re-establish the connection after changing rules; existing browser keep-alive connections will not be rematched immediately. You can temporarily use Global mode for comparison, then switch back to Rule mode.
Troubleshooting
Narrow the cause by checking nodes, rules, DNS, and logs—useful for connection failures and access problems.
What should you check first when every node shows a timeout?
Confirm that the device itself can access the internet, then check whether the subscription was just updated, whether the system clock is accurate, and whether node domains resolve. Do not rely only on the client's latency test, because an unreachable test address can make every node appear to time out. Try opening a webpage through one node and inspect DNS, connect timeout, or connection refused messages in the log. If results differ across networks, investigate restrictions on the current network first.
What should I do if some websites stop opening after enabling Clash?
Compare Rule, Global, and Direct modes first to determine whether the issue comes from the node or the rules. If Global works but Rule mode fails, inspect the matched rule in the connection records. If every proxy mode fails, switch nodes and check DNS. You can also clear the browser's DNS cache and retest with QUIC disabled. Do not run multiple proxy clients at the same time, as they may repeatedly modify the system proxy, routes, or virtual adapters.
How do you troubleshoot Clash DNS leaks or unexpected DNS results?
Confirm that the client's DNS module is enabled, and check whether the system or browser is using separate encrypted DNS. In TUN mode, also verify that DNS hijacking covers the requests that need to be captured. When results are unexpected, test nameserver and fallback reachability separately and look for timeouts in the log. DNS leak-test results can be affected by browser cache, network egress, and the test site, so interpret them alongside connection records.
What should you focus on in Clash runtime logs?
Record the exact time the problem occurred, then review errors and warnings from the same period. DNS timeout points to the resolution path; connection refused usually means the destination rejected the connection; connect timeout may indicate an unreachable node or network; configuration parsing errors identify a field or line number. Before sharing logs, remove subscription URLs, authentication details, and node credentials. Keep only the relevant error context and necessary configuration structure.