Clash FAQ and Troubleshooting

Clash usually refers to the rule-based proxy ecosystem and configuration format. mihomo is a maintained, compatible core, while graphical clients such as Clash Plus, Clash Verge Rev, and FlClash handle configuration imports, node switching, and log display. The core actually processes connections, DNS, rule matching, and TUN traffic. When troubleshooting, first determine whether the problem lies in the interface, configuration content, or a failed core startup.

For everyday use, choose Rule mode. Traffic is matched against rules from top to bottom and sent to DIRECT, PROXY, or REJECT. Global mode sends most connections through the current proxy group and is useful for temporarily checking whether a node works, but it should not replace rules long term. Direct mode bypasses the proxy and helps determine whether the client configuration is causing the problem. Reopen the target application after switching modes so it does not reuse an old connection.

The system proxy only handles programs that follow the operating system's proxy settings. Browsers and most desktop apps usually work with it, but some games, command-line tools, and applications with their own network stack may bypass it. TUN mode uses a virtual network adapter to handle a broader range of IP traffic, but it also involves administrator permissions, routing tables, DNS interception, and conflicts with other virtual adapters. Start with the system proxy for basic verification, then enable TUN if needed for clearer troubleshooting.

A subscription link is a remote configuration source that the client fetches again during updates. A configuration file is a YAML document downloaded locally and read by the core. A subscription may include nodes, proxy groups, rules, and DNS settings, or it may provide only nodes for the client to combine with a template. Direct edits to a locally generated subscription file are usually overwritten on the next update. Keep long-term custom rules in the client's supported override, merge, or script features.

A latency test usually measures only the handshake time needed for the client to reach a test address through a node. It does not represent available bandwidth, sustained packet loss, peak-hour congestion, or the route between the destination website and the node. A low-latency node may still have poor throughput, while a high-latency node may be more stable for large transfers. Use latency to eliminate obvious timeouts, then judge nodes by page loads, video buffering, and sustained download performance.

Open the client's configuration or Profiles page and find the option for importing from a URL, adding a remote configuration, or creating a subscription. Paste the complete link and start the download. After importing, select the configuration so it becomes active; downloading it without switching leaves the core using the old file. For the first import, check the update time, proxy groups, and node list, then review the logs to confirm that the configuration loaded. Do not paste a subscription link into a node-name field or a local-file picker.

Start by checking the configuration update notice and core logs. If the response is a login page, error page, or empty body, the client cannot parse it as a configuration. If the YAML downloads but contains only rules, no nodes will be created. Make sure a chat app did not truncate the subscription URL and that its ending parameters and special characters remain intact. Opening the link in a browser only checks whether the server responds; do not publish its contents. Once the link is confirmed valid, delete the failed configuration, import it again, and switch to the new one.

First disable the system proxy and test whether the subscription URL can be fetched directly. If it is reachable only through a proxy, activate a working older configuration before updating. Check the system clock, subscription validity, and server status, since an incorrect time can affect HTTPS connections. If the client uses a proxy for updates, make sure the selected proxy group has a working node. If it still times out, copy the URL into a new remote configuration to rule out cached data, incorrect request headers, or corrupted metadata in the old entry.

Start with the line and column reported in the logs, then inspect the preceding line, since indentation and quoting errors are often reported on the following line. YAML uses spaces for indentation and must not contain tabs; a colon usually needs a space after it, and names containing special characters must be quoted correctly. Node names referenced by proxy groups must exactly match those under proxies. Keep the original file before editing and use the client's configuration checker when available. Change one thing at a time to avoid stacking multiple syntax errors.

TUN needs to create or control a virtual network adapter and modify routes and DNS, which normally requires elevated permissions. Fully exit the client, relaunch it as an administrator, and enable TUN again; elevating only the settings window without restarting the core is usually insufficient. If the client supports service mode, install the service from its settings and start it afterward. Company-managed devices may also be restricted by security policies. Check system events and client logs, and avoid repeatedly reinstalling the virtual adapter driver.

First confirm the HTTP or mixed listening address and port shown by the client. A common local address is 127.0.0.1, but use the port from the current configuration. Tools that support environment variables can use HTTP_PROXY, HTTPS_PROXY, and ALL_PROXY. Tools that only recognize the system proxy should be restarted after you enable it. With TUN enabled, most programs need no separate variables. During troubleshooting, use the tool's verbose logging option to verify whether requests use environment variables, the system proxy, or a direct connection.

Place a more specific DOMAIN or DOMAIN-SUFFIX rule before general rules, and point its policy field to an existing proxy group. For example, a target-domain rule must come before GEOIP, GEOSITE, or MATCH; otherwise traffic will match the broader condition first. Reload the configuration and check the matched rule and policy in the connection log. If subscription updates overwrite the original file, preserve this custom rule through an override or rule-merge feature.

First confirm the domain the app is accessing in the connection log. Add domains that are incompatible with Fake-IP to fake-ip-filter, then clear the system DNS cache and restart the app. Local-device discovery, printers, some sign-in components, and software that depends on real DNS responses are more likely to be affected. Do not disable Fake-IP entirely at the outset. Exclude one domain at a time to retain domain mapping while identifying the incompatible part of the resolution path.

Open the client's Connections page, repeat the target request, and inspect the domain, destination address, process, matched rule, and final policy. If process information is unavailable, narrow it down using the domain and timestamp. If the result is always MATCH, the earlier domain, IP, or rule set did not match. If the rule is correct but the exit route is not, check the proxy group currently selected by that rule. Existing connections are not rebuilt automatically, so close the original connection and test again after changing rules.

Enable LAN access in the client and make sure the listening address is not restricted to 127.0.0.1. On other devices, set the proxy server to this computer's LAN IP and the client's actual listening port, not localhost. Then check that Windows Firewall allows the program to communicate on the current network type. Enable this only on a trusted LAN, and do not expose the listening port to the public internet through a router. Turn LAN access off when testing is complete.