Clash Frequently Asked Questions

Clash is a general term for a family of rule-based network proxy tools. At its core is an engine program (such as mihomo), which matches traffic against the routing rules in a configuration file and decides where it exits. Graphical clients for each platform (Clash Verge, Clash Meta for Android, etc.) sit on top of the engine and provide subscription management, node switching, and on/off controls. The engine supports multiple proxy protocols including VMess, VLESS, Trojan, and Shadowsocks.

For a full explanation of protocol and rule terminology, see the glossary.

mihomo is the engine: a command-line program with no graphical interface, responsible for actual traffic processing. Clash Verge is a desktop GUI client with the mihomo engine built in, covering Windows, macOS, and Linux. Clash for Windows stopped receiving maintenance in 2023 and its official repository has been removed, so it no longer receives any updates; on desktop, Clash Verge is recommended as a replacement.

See the download page for where to get clients for each platform.

Both the client and the engine are open-source software, free to obtain. The client itself does not include any server nodes; accessing proxy service requires node information obtained separately, commonly known as a subscription. Subscriptions are provided by third-party providers, and whether they are paid and how much data they include is determined by the provider, not the client.

The client is only a traffic routing tool and does not provide nodes. After installation, you need to import a subscription link or configuration file containing node information, select a working node, and enable the system proxy before traffic passes through a proxy exit. With no available node, the client remains idle and produces no proxy effect.

See the setup guide for the full process from import to verification.

This is usually because the open-source installer was not signed with a commercial code-signing certificate, so the system shows a default risk warning for unsigned programs rather than flagging malicious behavior. To proceed: in the SmartScreen prompt, click More info, then Run anyway; if antivirus software flags it incorrectly, add the installation directory to the trusted list.

Open Privacy & Security in System Settings, find the blocked app under the Security section, and click Open Anyway to complete first-time authorization. If it says the app is damaged and cannot be opened, this is usually caused by a quarantine attribute attached to the downloaded file. Run xattr -cr followed by the app path (for example, the client app under /Applications) in Terminal to clear the attribute, then relaunch.

Copy the subscription URL provided by your service provider, open the client's Subscriptions or Profiles page, choose Import from URL, paste the link, and confirm the download. Once imported successfully, the Proxies page will list all nodes included in the subscription. Most clients also support clipboard import and local file import; see the subscription import guide on this site's blog for the differences between these three methods.

Check three things in order:

1. Whether the subscription link was copied in full and no parameters were truncated;
2. Whether the subscription has expired or run out of data, which can be confirmed in your provider's dashboard;
3. Whether your device can reach the subscription server during import—some subscription URLs require temporarily enabling another working node before they can be fetched successfully.

A format error usually means the link points to a non-Clash-format subscription; ask your provider for a Clash-specific subscription link.

Traffic interception on Android is implemented through the system's VpnService interface, and the client needs to create a local virtual network adapter to process traffic from each app. This permission is only used to establish the local tunnel; traffic is still handled according to your configured routing rules. If you decline, the client cannot take over traffic. It is also recommended to set the client as unrestricted in the system's battery settings to prevent the background process from being killed by the system and causing disconnections.

Rule mode matches traffic against the routing rules in the configuration file one by one: traffic matching a proxy rule goes through a node, traffic matching a direct rule bypasses the proxy—this is the recommended mode for daily use. Global mode sends all traffic through the proxy, suitable when rules are incomplete or you temporarily need everything proxied. Direct mode sends no traffic through the proxy at all, often used as a baseline when troubleshooting. The switch is available on the client's main screen or in the mode selector on the Proxies page.

The system proxy only affects programs that actively read the system's proxy settings—browsers and most programs comply, but command-line tools, some games, and desktop programs ignore the system proxy. To route this kind of traffic through the proxy too, enable TUN mode, which lets a virtual network adapter intercept all traffic at the network layer. Enabling TUN on Windows requires administrator privileges or installing the system service first; macOS and Linux require corresponding authorization. See the TUN mode guide on this site for the mechanics and platform-specific notes.

The client's latency test sends a single HTTP request to a test URL and measures the response time in milliseconds. A lower number means a faster response; a timeout means the node is currently unreachable. Latency only reflects handshake response speed, not bandwidth—for high-throughput scenarios like video, an actual speed test is still needed. It's best to test two or three rounds before drawing conclusions, since a single result can be affected by momentary network fluctuations.

Add a custom rule at the very top of the rules section in your configuration file. For example, DOMAIN-SUFFIX,example.com,DIRECT forces that domain to bypass the proxy; changing the last field to a proxy group name forces it through the proxy instead. Clash matches rules from top to bottom, and the first match wins, so custom rules must be placed before general rules. Some clients (such as Clash Verge's global extension config) support appending rules without modifying the original subscription file, so they persist across subscription updates.

See Understanding Rule Priority for rule ordering and common syntax.

The auto-update interval can be set in the subscription's edit screen, with 1440 minutes (once per day) being a common value. Node information does not change often, so a shorter interval provides little real benefit while adding load to the subscription server. If your provider changes nodes, you can also click the manual update button at any time to pull the latest configuration immediately.

First confirm the system proxy toggle is actually turned on—the client running does not mean the system proxy is enabled; they are independent switches. Next check whether the browser has a proxy extension installed that overrides system settings, and whether the browser's own proxy option is set to use the system proxy. Finally verify the port: the port the system proxy points to must match the client's mixed port (default 7890). See the connection troubleshooting article for a complete step-by-step checklist.

Windows blocks UWP apps from connecting to the local loopback address by default, so these apps cannot use the local proxy port regardless of whether the nodes are working fine. There are two solutions:

• Use a UWP loopback exemption tool in a supporting client (Clash Verge provides an entry point in Settings) to lift the loopback restriction for the target app;
• Or simply enable TUN mode, which intercepts traffic at the network layer and bypasses the loopback restriction entirely.

Narrow it down step by step:

1. Switch to Direct mode and visit an ordinary site to confirm your basic network connection is working;
2. Manually update the subscription to rule out outdated node information;
3. Retest with two or three nodes from different regions to rule out an isolated failure;
4. Check whether your system clock is accurate—protocols like VMess are sensitive to time drift, and a deviation of more than about 90 seconds from standard time will cause the handshake to fail;
5. If everything above checks out but all nodes still time out, contact your provider to confirm server-side status.

When the default mixed port 7890 is occupied by another program, the engine fails to start. On Windows, use netstat -ano to find the process holding the port; on macOS and Linux, use lsof -i :7890. Common causes are a leftover old engine process that didn't exit cleanly, or another proxy application—simply end that process. Alternatively, change the mixed port to an unused value in the client's settings, and the system proxy port will update to match automatically.

This is usually a permissions or DNS issue. Check three things:

1. TUN requires administrator or system service privileges—on Windows, install service mode in the client's settings before enabling TUN;
2. Confirm DNS is enabled in the configuration with enhanced-mode turned on (fake-ip is commonly used), otherwise domain resolution may fail;
3. Avoid running other VPN or virtual network adapter software at the same time, since multiple virtual adapters competing for the default route can cause a full disconnect.

If turning TUN off restores the network immediately, the problem falls within the scope above.