Clash FAQ: Common Questions and Troubleshooting
Find a solution by the stage where the issue occurs, from subscription import to an active proxy connection. Each entry starts with a reproducible check sequence for common Windows, macOS, Android, iOS, and Linux clients.
Separate the client, core, and configuration
Clash issues often involve the graphical client, Mihomo core, subscription content, and system proxy at the same time. Identify each layer’s role before troubleshooting installation or networking to avoid mistaking a client interface problem for a node failure.
What is the relationship between Clash, Clash Meta, and Mihomo clients?
Clash refers to an ecosystem of proxy clients and proxy cores. Most current desktop clients use the Mihomo core or another compatible core. The client handles the interface, configuration imports, and system proxy, while the core parses configuration, matches rules, and establishes connections. When choosing a client, check platform support, core capabilities, and maintenance status first.
What is the difference between a subscription link and an individual node?
An individual node describes one connection. A subscription link usually provides multiple nodes, proxy groups, and rule configuration. Clients periodically fetch updates from the subscription URL, so an update failure may leave the existing configuration usable while new nodes and policy changes remain unsynchronized.
How should I choose Global, Rule, and Direct modes?
Rule mode chooses the connection path according to the configured rules and is best for everyday use. Global mode sends most requests through the selected proxy and is useful for temporarily verifying the proxy route. Direct mode bypasses the proxy and helps determine whether proxy settings are causing access problems. Rule mode is usually the best default.
Why does the same subscription look different in different clients?
Clients may use different core versions, configuration compatibility ranges, default DNS settings, and rule-processing behavior. First confirm that the client recognizes the subscription format, then check the core type, override settings, and rule mode. Do not judge whether an import is complete solely by the number of nodes.
Verify every step from authorization to the first connection
Installation does not mean that the proxy is already handling traffic. The client must read the configuration, obtain system permissions, and create a system proxy or VPN interface according to the platform. Use the following questions when deploying for the first time or moving to a new device.
What should I check before installing a Clash client on Windows?
Make sure the Windows version meets the client’s requirements and that the client has normal file read and write access. After the first launch, check the configuration directory, system proxy switch, and firewall prompts. If other VPNs, proxy tools, or network-filtering software are already installed, record their current status first to prevent multiple programs from controlling the system proxy at once.
Why does an Android client need VpnService permission?
An Android client uses VpnService to create a local VPN interface and send app traffic to the proxy core. This permission does not authorize a remote VPN service; it allows the client to take over traffic on the device. Approve the system prompt the first time you enable it, and check that no other VPN is running.
What should I check if an iOS client does not connect after importing a configuration?
First confirm that the configuration imported successfully, then allow the client to add a VPN configuration in system settings. Return to the client, choose Rule or Global mode, select an available policy, and connect. If the VPN indicator does not appear in the status bar, check the authorization prompt, the system VPN list, and possible conflicts with other VPN configurations.
What is the correct troubleshooting order when a subscription update fails?
First verify in a browser or the client log that the subscription URL is reachable. Then check the system time, network connection, and whether the URL is complete. Confirm that the client has a usable proxy, and if necessary update directly or switch networks temporarily. If the URL returns HTML, a login page, or an error instead of configuration data, contact the subscription provider to verify its status.
Keep subscriptions, nodes, and proxy modes under control
Reliable use depends on an observable configuration workflow: verify content after updating, confirm the policy before connecting, and distinguish the test target when access fails. Do not treat a single speed-test result as the verdict for every network request.
Why does the node list stay the same after a successful subscription update?
The client may have retained an old configuration, or the subscription server may not have published new content. Check the response status and import result in the update log, and confirm that the configuration timestamp changed. Then reload the configuration and check whether the proxy group references the new nodes. If the subscription content has not changed, the client cannot generate new nodes on its own.
A node test times out, but my browser still opens websites. How can I identify the problem?
The node test URL and your actual destination may use different routes. A timeout can result from an unreachable test target, node restrictions, DNS resolution, or an overly short timeout. First use proxy mode to access a known-working target, then review the client log and compare other nodes and test URLs. Do not conclude that a node is unusable based on a single latency or timeout result.
What should I prepare before enabling TUN mode?
Before enabling TUN, confirm that the client supports your operating system, prepare administrator or system authorization, and disable conflicting VPNs, virtual adapters, and other traffic-capture tools. After enabling it, check TUN status, DNS settings, and rule mode, then use a command line or browser to verify that traffic is entering the proxy. If the network goes offline, disable TUN first and compare it with system proxy mode.
What should I do if TUN reports insufficient permissions or turns off immediately?
Check that the client is running with the required permissions and that security software is not blocking the virtual adapter or network service. Windows users should also check driver installation prompts and existing VPN adapters; Linux users should check execution permissions, routing, and kernel capabilities. Review the specific log error before trying again, rather than repeatedly toggling TUN and leaving behind multiple interfaces.
Trace the issue layer by layer, from system proxy and loopback to DNS
When only certain apps cannot connect, the problem is often not whether the node is online. Check whether the app follows the system proxy, whether it needs local loopback access, and whether DNS returns the expected address. This sequence narrows the scope of the problem.
Why do some apps still connect directly even though the system proxy is enabled?
The system proxy mainly affects apps that follow system proxy conventions. Some apps use an independent network stack, fixed proxy settings, or only specific protocols, so they ignore the system proxy. Confirm the client’s listening address and port first, then check the target app’s proxy settings. To capture this traffic, consider TUN mode and its additional permission, DNS, and routing requirements.
How do I fix loopback access when a Windows UWP app cannot connect through the proxy?
Some UWP apps cannot access local loopback addresses by default, preventing them from connecting to a proxy port running on the same device. Use the system-provided app loopback exemption tool, enable loopback access for the target UWP apps, save the settings, and restart them. Select only apps that genuinely need access to the local proxy, then recheck the system proxy and client log.
What should I do if LAN devices or special apps cannot connect in Fake-IP mode?
Fake-IP assigns virtual addresses to domains, which can cause compatibility issues for apps that depend on domain resolution and rule matching. Confirm that the target domain is included in the Fake-IP exclusion list or the nameserver-policy setting, then clear the client’s DNS cache and reconnect. For LAN devices, printers, game consoles, and apps that need real addresses directly, configure Direct mode or an exclusion based on the actual requirement.
How can I tell whether a DNS problem is caused by resolution or by the node?
Resolve the same domain in Direct mode first, then switch to Rule mode and compare the results. If direct resolution fails while proxy resolution works, the issue may be the local network or DNS. If both resolve successfully but the connection fails, continue checking the node, rules, and destination service. DNS requests, returned addresses, and matched rules in the log are more useful for diagnosis than repeatedly changing nodes.
Why do rule changes not take effect immediately?
After a rule file is edited, the client may still be using an older in-memory configuration or DNS cache. Save the configuration and reload it, then verify the rule file path and syntax. Clear relevant connections or reopen the app afterward. When reviewing rule matches, also check rule order: fallback rules such as MATCH appearing too early can prevent later rules from matching.