Clash Client FAQ and Troubleshooting Order

The client is the graphical interface: it handles subscription management, rule editing, mode switching and the system proxy toggle. The core parses the configuration, opens connections and applies routing. Desktop clients such as Clash Verge Rev and FlClash ship with the mihomo core built in, and every change made in the interface ends up in the core's config.yaml. To check whether the two match, look at the core version in the client settings and whether fields used in your configuration, such as tun and proxy-providers, are recognized; an unknown field warning usually means the bundled core is out of date.

A subscription URL is a link the client fetches on a schedule to obtain a node list, rules and proxy group configuration; a node is an individual server entry inside that subscription. The same subscription URL can be imported into several clients, and the node list is updated by the provider on the backend, while the client only fetches and displays it. Node changes therefore do not require re-importing — refreshing the subscription once is enough.

System proxy only captures programs that honor the system proxy setting — browsers and most desktop apps fall into this group. TUN mode creates a virtual network adapter and routes all traffic into the core, so command-line tools, games and Microsoft Store apps are covered as well. Enhanced mode is the name used in the Clash for Windows era and is essentially one implementation of TUN. Keep system proxy for everyday browsing and turn on TUN only when you need system-wide capture.

Rule mode matches traffic against the rule list in your configuration and sends each connection to the policy of the first matching rule; it is the default choice. Global mode ignores the rule list and sends everything through the currently selected node, which makes it useful for testing whether a node works at all. Direct mode bypasses the proxy entirely and is meant for temporarily disabling it. Stay in rule mode day to day, treat mode switching as a diagnostic step, and avoid leaving the client in global mode for long.

Discontinued means no new releases and no core updates. An installed client still runs, but newer fields such as Hysteria2, TUIC and some DNS options may not be recognized by the old core. Migration is straightforward: export the configuration file from the old client, import the same subscription URL into the new one, and rebuild rules and proxy groups as they were. A fuller checklist is in the technical notes: client migration after discontinuation.

First paste the subscription URL into your browser's address bar and confirm it returns content, usually base64 or YAML text. Then check the subscription fetch status in the client log: 401 and 403 usually mean the link has expired or the plan's traffic has run out, and an empty response means you should ask the provider. Finally, confirm the imported profile is actually selected and applied on the profiles page — importing without selecting is the step beginners miss most often.

Open Privacy & Security in System Settings, click Open Anyway next to the blocked item and confirm once more. You can also right-click the app icon and choose Open to allow it. For builds installed from an archive or a package manager, you may need to allow the app again after each major update — this is the standard macOS flow for apps distributed outside the App Store.

In the battery settings, set the client to unrestricted and allow it to auto-start. Some customized Android builds also require locking the app in the recent tasks view so a one-tap cleanup does not end it. The persistent notification icon is normal behavior for a VPN service — dismissing it disconnects the tunnel, so leave it alone.

On Windows, run the client as administrator; the first time you enable TUN it installs a virtual adapter driver, so do not cancel the installation. On macOS, the client requests system extension approval — allow it in Privacy & Security and confirm after the restart. On Linux, root privileges are required, or you can grant the core binary network management capabilities. Once authorization is complete, toggle TUN on again and it will take effect.

Download the core archive for your architecture and unpack it to get a single executable, then run it with a config.yaml and a systemd service. On routers it is usually managed by an OpenWrt plugin — paste the subscription URL into the plugin's interface and skip hand-editing the configuration. The core has no graphical interface, so every change goes through the configuration file and a service restart.

Add a domain suffix rule on the client's rules page, set its policy to DIRECT and place it above broader rules; you can also add it by hand in the rules section of the configuration file. Rules are matched from top to bottom and stop at the first hit, so order matters more than quantity. Save and reload the configuration for it to take effect, then confirm the rule is being hit in the connection log.

Three common causes: your local network cannot resolve the subscription server's domain, so switch DNS or turn the proxy on before updating; the subscription server is temporarily unavailable, so retry in a few minutes; or the system clock is far enough off that the TLS handshake fails, which a time sync fixes. None of these are problems with the URL itself — retry first, then work through them one by one.

Open the client's connections or logs page, visit the target site and check which rule and policy the connection matched. If the log shows the final fallback rule instead of the domain rule you expected, the rule's syntax or its position is the problem. You can also test against a site that only loads through the proxy to confirm the proxy path itself is working.

Enable launch at startup in the client settings and also enable minimizing to the tray on launch. On Windows, if there are too many startup items, keep only the client itself in Task Manager's startup list. What really slows boot is fetching subscriptions and running latency tests immediately at launch — turning off the update check on startup makes a noticeable difference.

Prefer rule mode over global mode to cut unnecessary proxy connections; lower the log level, since writing logs has a cost of its own; and disconnect when you are not using it instead of leaving it idle in the background. On iOS, enable on-demand connection so the system takes over when the network changes — it uses less power than an always-on tunnel.

Start by switching to direct mode to confirm your local network works on its own. Then switch back to rule mode and open the client log to see whether any connections are being established. If every connection times out, the node is probably unavailable or the system proxy port is taken; if only some domains fail, check your DNS settings and rule list. Errors in the log are more specific than the messages in the interface — the full step-by-step walkthrough is in the Usage Guide.

First check that the browser has no extension that takes over proxy handling — those extensions override system settings. Then check whether another program has rewritten the system proxy settings; when you close the client, the system proxy entry should revert on its own. If the client shows the proxy as enabled but nothing changes in system settings, restart the client and make sure it has permission to write them.

Most command-line tools do not read the system proxy and need their own configuration: set the HTTP_PROXY and HTTPS_PROXY environment variables for your terminal, or specify the proxy address in the tool's own config file. Docker also needs the daemon configured separately. Turning on TUN mode captures this kind of traffic in one go and saves you configuring each tool.

UWP apps run in an app container sandbox by default and do not inherit system proxy settings. On Windows, enable the UWP loopback exemption, add the target app to the exemption list and restart it. Client settings usually include a toggle for this, and you can also add entries by hand with the built-in command-line tool. The exemption only applies to apps on the list.

A DNS leak means resolution requests bypass the proxy and go to your local ISP's DNS, so the destination site can still see where the lookup really came from. To check, visit a DNS leak test site and see whether the resolver it reports belongs to the proxy's exit region — if it shows your local ISP, DNS is leaking. You can prevent this by specifying a remote DNS server in the client's DNS settings and enabling Fake-IP.

Latency tests use a separate probe request, so a timeout only means the probe failed, not that the connection is unusable. Some nodes block the port used for probing, and the test URL may be blocked by the provider. Judge by whether pages actually load and by the connection log rather than the latency numbers alone — and never delete a node that still works just because the tests all timed out.

Another process is holding the same port — possibly a previous client instance that did not exit, or another proxy program. Use a system command to find the process using the port and end it, or change the mixed port to an unused value in the client settings and restart the client. Port conflicts usually show up as a proxy toggle that will not turn on or a browser that cannot connect.