Fundamentals
Understand how the client, core, configuration file, and proxy modes work together, so node services, graphical interfaces, and traffic-capture methods are not confused with one another.
What does a Clash client do?
A Clash client reads configuration files, uses rules to decide whether connections should go direct, through a proxy node, or be rejected, and receives application traffic through the system proxy or TUN mode. The client itself usually does not provide usable nodes, so a valid subscription URL or YAML configuration is still required for first-time setup. Interfaces, core versions, and system integration vary between clients, but core concepts such as proxy groups, rules, and DNS remain largely the same.
How are Clash, mihomo, and graphical clients related?
mihomo is a commonly used Clash-compatible core that parses configuration, establishes connections, applies rules, and handles DNS. Graphical clients such as Clash Plus, Clash Verge Rev, and FlClash add subscription management, system proxy controls, log viewing, and configuration editors around the core. When choosing a client, check operating-system support, the core it uses, and configuration compatibility rather than judging features by the interface name alone.
What does a Clash configuration file usually contain?
Configuration files typically use YAML and include listening ports, proxy nodes, proxy groups, rules, DNS, and LAN access settings. Configurations generated by subscription services may also contain rule-set URLs and update parameters. When editing manually, keep indentation consistent and avoid tabs; after saving, reload the configuration in the client. If loading fails, check the line and field named in the logs, then inspect colons, list indentation, and duplicate keys.
What is the difference between Rule, Global, and Direct modes?
Rule mode matches domains, IPs, or rule sets from top to bottom in rules and sends each connection to the specified proxy group, making it suitable for everyday use. Global mode sends most connections through the currently selected proxy group and is useful for temporarily testing whether a node works. Direct mode bypasses the proxy and helps isolate the client's impact on the network. After switching modes, make sure the relevant proxy group has a working node selected.
Installation and Configuration
From choosing a client and importing subscriptions to parsing YAML and granting system permissions, follow the practical order of checks for a first installation.
How should I choose a client for Windows, macOS, Android, iOS, or Linux?
Start by choosing a client that still supports your operating-system version, then check whether you need features such as TUN, rule sets, scripts, or core switching. Windows and macOS users generally benefit from desktop clients with full system proxy management; Android and iOS users should install from the appropriate platform entry. Linux desktops can use graphical clients, while servers are often better suited to running the mihomo core directly. Keep the original configuration file and subscription URL before migrating.
How do I import a Clash subscription URL?
In the client's subscription, configuration, or Profiles page, choose Import from URL, paste the complete HTTPS subscription URL, and start the download. After importing, set the new profile as active, then open the proxy page and choose a node in the relevant proxy group. If the URL returns YAML text in a browser, do not save it as a web page first; import it directly into the client. Manually downloaded configurations usually use the yaml or yml extension.
What should I do if a subscription URL has expired or fails to update?
Open the subscription URL in a browser first and check whether it has expired, been reset, or requires you to sign in again. If it returns a blank page, login page, error, or ordinary web page, generate a new URL through the subscription provider. If the browser returns YAML but the client cannot update, check the system clock, the client's network permissions, and TLS or timeout details in the logs. You can also download the YAML and import it locally. Never expose the full subscription URL on public pages or screenshots.
How do I fix a configuration parse error after importing YAML?
Use the field and line number shown in the logs to locate the problem. Pay particular attention to YAML indentation, spaces after colons, dashes before list items, and matching quotation marks. Proxy group names referenced in the configuration must exactly match the actual names, and every policy named by a rule must exist. Older clients may report unknown fields or type errors when they encounter fields from a newer core; update the client or remove unsupported extension fields before loading the configuration again.
What should I do if the firewall or system permissions block the client after installation?
On the first Windows launch, allow the client to communicate on the network types it needs. If access was previously denied, re-enable it in the allowed-apps list in Windows Security Firewall settings. Enabling the system proxy on macOS usually requires no extra driver, but service mode or TUN components may require administrator approval. TUN on Linux requires the appropriate network-management permissions. Install only through the system prompts provided by this site's download pages and by the client itself.
Usage Tips
Covers rule order, system proxy settings, TUN, and LAN access, with practical guidance on when to use each traffic-capture method and what to check.
How can I send commonly used websites direct while routing other traffic by policy?
Rules are evaluated in the order listed in the configuration, and matching usually stops at the first hit. Put exact domain and DOMAIN-SUFFIX rules first, use GEOIP or rule sets for broader ranges, and finish with MATCH as the fallback proxy group. Reload the configuration after editing and check connection records to see which rule actually matched. If a broad rule appears before a specific one, the later specific entry may never run.
Why does the browser still bypass Clash even though the system proxy is enabled?
First confirm that the client is running, the active configuration has loaded, and no other program is using the mixed port. Then check that the address and port in the operating system's proxy settings match the client. A browser may bypass the system proxy when using a separate proxy extension, enterprise policy, or custom network settings; temporarily disable conflicting options. If the issue persists, switch to Global mode to test the node, then use the logs to determine whether requests are reaching the client.
When should I enable Clash TUN mode?
Some applications do not read the system proxy, while game launchers, command-line programs, and software using specialized network stacks may bypass ordinary proxy settings. In these cases, TUN mode can let the client receive more types of traffic through a virtual network interface. Before enabling it, install the required service component and grant network-management permissions. Avoid letting it take over the default route alongside another VPN, virtual adapter, or traffic-filtering tool. For ordinary browser use, start with the system proxy.
How can I configure LAN access safely?
Enable LAN access only when other devices on the same local network genuinely need to use this machine's proxy. After enabling it, verify the listening address, port, and firewall scope, and preferably restrict access to a trusted home or office network. Other devices must use the LAN address of the device running Clash as the proxy server, not the loopback address. Disable the option when finished so the proxy port does not continue listening on unnecessary network interfaces.
Troubleshooting
Identify causes from different node, port, application-isolation, and DNS symptoms instead of repeatedly reinstalling the client or changing settings without a clear target.
What should I do if nodes time out or none of them can connect?
Switch to Direct mode first to confirm that the local network works, then update the subscription and test several different nodes. A timeout affecting only one node usually indicates a node or route problem; when all nodes fail at once, check the system clock, subscription expiry, configuration loading, proxy port, and DNS. Also inspect the logs for timeout, connection refused, or TLS errors. Do not rely only on latency tests; verify connectivity with an actual web page as well.
How do I configure Clash UWP loopback when a Windows app cannot connect?
Some Windows apps using UWP network isolation cannot directly access a local loopback proxy. In the UWP loopback tool provided by the client, select the apps that need the proxy and save the exemption settings. Restart the affected app and keep the system proxy enabled. If the client does not include this tool, use Windows' loopback exemption management instead. Do not add every system component indiscriminately, as that makes troubleshooting harder.
How do I troubleshoot a port 7890 conflict?
Exit other proxy clients first and make sure the same program has not been started twice. On Windows, use Resource Monitor or netstat to identify the process listening on 7890; on macOS and Linux, use lsof to inspect port usage. Confirm what the process does before stopping it, or change the Clash mixed port to an unused one. After changing the port, update the system proxy settings, browser extensions, and proxy port on LAN devices as well.
What should I do if DNS fails or some websites stop opening after enabling Clash?
Switch to Direct mode and pause TUN first to determine whether the issue comes from proxy nodes, rules, or DNS interception. Then check the logs for DNS timeout, query loops, or failed rule-set downloads. With fake-ip, some LAN domains and special applications may need to be added to the filter list; with redir-host, confirm that the upstream DNS is reachable. After changing DNS settings, reload the configuration and clear the operating system and browser DNS caches before testing again.