Clash FAQ

Clash is a rule-based proxy core project; its original repository was archived in 2023. mihomo (formerly Clash Meta) is a community-maintained fork that continues development on top of it, adding more protocols and features.

Most mainstream clients today, such as Clash Plus, Clash Verge Rev, and FlClash, ship with the mihomo core, and the configuration format stays compatible with the original Clash. In everyday usage, "Clash" generally refers to this whole core-plus-client combination.

Rule mode matches traffic against the rules in your configuration file one by one, routing each connection according to the first match - this is the recommended default for daily use. Global mode ignores all rules and sends every connection through the currently selected node, useful when rules aren't working or you need everything proxied temporarily. Direct mode sends all traffic out without going through any node, which is handy for checking whether an issue lies with the proxy or the local network.

All three modes can be switched at any time from the client's main window, taking effect immediately.

No. Clash and its derivative clients are purely traffic-forwarding and rule-scheduling tools - nodes (proxy servers) need to be set up yourself or obtained as a subscription link from a service provider.

"Free Clash nodes" circulating online are usually public shared nodes with no guarantee of speed or safety, and shouldn't be used for anything sensitive like account logins.

Their final releases still run, but they no longer receive feature updates or security fixes, and their core versions are frozen at the point they were archived, so newer protocols or config fields may fail to parse.

It's best to migrate to an actively maintained client: Clash Plus or Clash Verge Rev on Windows, and Clash Plus, Clash Verge Rev, or FlClash on macOS. Your existing subscription link can be imported directly - no need to purchase a new plan. See the download page for where to get each client.

Fake-IP is a DNS handling strategy: when the client receives a domain resolution request, it immediately returns a placeholder address from a reserved range (default 198.18.0.0/16) so the connection can start right away, while the real resolution happens along the proxy chain. This makes the first packet faster and reduces DNS leaks.

Redir-Host instead returns the real resolved address and then matches rules by IP, offering better compatibility at the cost of an extra resolution wait. Services sensitive to real IPs, like LAN printers or gaming platforms, need to be added to fake-ip-filter to exclude them.

This is macOS Gatekeeper's default block on apps distributed outside the App Store - it doesn't mean the installer is faulty.

To fix it: open System Settings → Privacy & Security, scroll to the bottom to find the blocked app notice, and click Open Anyway; or right-click the app icon in Finder, choose Open, and confirm again in the dialog. You only need to do this once, and the app will launch normally with a double-click afterward.

Copy the full subscription URL from your provider's account center, open the client's Profiles page, paste it into the subscription field, then click Download or Import - the client will fetch and parse the node list and rules.

After a successful import, remember to select and activate that profile from the list. Most clients let you set an automatic update interval, which is worth turning on so nodes stay in sync as they change. See the getting started guide for the full walkthrough.

On macOS, check "Launch at Login" in the client's settings, or manually add the app to System Settings → General → Login Items. Windows clients usually have an "Auto-start" toggle in their settings page.

It's also worth enabling any "reconnect to last profile" option, so the proxy state is restored automatically after a restart without manual steps.

TUN mode creates a virtual network adapter to take over all traffic, which requires system-level permission. On macOS, the first time you enable it, an authorization prompt asks for your administrator password, and some clients also require installing a system extension or helper service beforehand. On Windows, run the client as administrator and install its bundled service-mode component.

If installation still fails, check for conflicts with other VPN or virtual adapter software, quit them, and try again.

GEOIP and GEOSITE rules rely on a local geographic database to determine IP ownership and domain categories; an outdated database can cause misrouting, such as certain regional IPs being wrongly sent direct.

Most clients offer an "Update GeoIP / Geo Data" button in settings that fetches the latest data files online, and some support scheduling automatic updates. Restart the core or reload the configuration afterward for the update to take effect.

Check it at two levels: first, look at the client's Connections or Logs panel - browsing a page should produce new connection entries showing which rule and node were matched; second, visit an IP-checking website in your browser, where the displayed exit IP should match the node's region rather than your local ISP.

Command-line environments need separate configuration - you can run something like curl -x http://127.0.0.1:7890 ipinfo.io to test through the proxy port, using whatever mixed port your client is set to.

A latency test typically sends a single HTTP request through the node to a fixed test address and measures how long it takes, reflecting the round-trip time to that node and back at that moment - lower numbers mean a faster response.

It doesn't equal bandwidth: a node at 50ms latency won't necessarily download faster than one at 150ms, and a single test is affected by momentary network fluctuations, so it's worth testing two or three times for a stable reading. A timeout doesn't always mean the node is dead - the test address itself might be restricted by the target network.

Enable "Allow LAN" in the client's settings, and note the computer's local IP address and mixed port (commonly 7890).

Then, on another device on the same Wi-Fi network, set the Wi-Fi's HTTP proxy to manual, entering the computer's IP as the server and 7890 as the port. Make sure your computer's firewall allows that port, and note that sharing stops once the computer goes to sleep.

Add a line near the top of the rules section in your configuration file - for example, to send example.com and its subdomains direct:

- DOMAIN-SUFFIX,example.com,DIRECT

To force traffic through a specific proxy group instead, replace DIRECT with the group name. Clash matches rules from top to bottom and stops at the first hit, so custom rules must be placed above the general rules to take effect. If your subscription overwrites the config on every update, use your client's override or Mixin feature to keep custom rules persistent. See the usage docs for the full rule syntax.

Global mode suits three scenarios: temporarily switching to it to check whether an incomplete rule set is the reason a site isn't routed correctly; needing all traffic from every app to go through one exit, such as a full system test; and using an unfamiliar new subscription before you've had time to configure rules.

For everyday use, switching back to Rule mode is still recommended, so local traffic goes direct, saving node bandwidth and keeping local service access fast.

Work through four checks: first confirm your current network can reach the internet, temporarily connecting through a working node if needed before retrying; then check whether the subscription link is complete and not truncated or expired, by pasting it into a browser to see if content downloads; next confirm whether the provider changed its subscription domain, since an old domain may be blocked or retired; finally try toggling between "update via proxy" and "update direct" in the client.

If the browser can download it but the client can't, the issue is usually the client's network settings.

Switch to Direct mode first to confirm the local network is fine, then re-test latency for all nodes to rule out a temporarily unreachable test address. If everything still times out, it's usually because the subscription's data allowance is used up, the plan expired, or the provider's nodes are down entirely - check your account status with the provider. Local firewall or security software blocking the client's network access is another possibility, so try disabling it temporarily and retesting.

A handful of individual nodes timing out is normal; just switch to a working one.

The system proxy setting only applies to apps that respect it, and most command-line tools in a terminal don't read that setting. There are two fixes:

Export environment variables in the terminal, which only apply to the current session (use whatever port your client is actually set to):

export https_proxy=http://127.0.0.1:7890 http_proxy=http://127.0.0.1:7890

Or simply enable TUN mode so the virtual network adapter takes over all traffic at the network layer, with no configuration needed in the command line.

Windows blocks UWP apps from accessing the local loopback address 127.0.0.1 by default as a security policy, so they can't reach the local proxy port.

You can use the client's built-in "UWP Loopback Exemption" tool and check the target app to lift the restriction, or simply enable TUN mode to bypass the loopback issue entirely. Restart the affected app after making the change for it to take effect.

This is leftover system proxy configuration: the client exited abnormally before it could revert the system proxy settings, so the system is still trying to connect through a local proxy port that no longer exists.

On macOS, go to System Settings → Network → Details → Proxies and turn off both Web Proxy and Secure Web Proxy; on Windows, go to Settings → Network & Internet → Proxy and turn off "Use a proxy server." Then restart the client so it can take over again. To quit normally in the future, use the Quit option in the client's menu.