Clash FAQ

Using Clash Plus as an example: download the Windows installer from the download page and run it, following the setup wizard. On first launch, go to the subscription (profile) page, paste your subscription link, and save it — the client will fetch the node list right away. Back on the main screen, turn on the system proxy toggle, and your browser and most desktop apps will start routing traffic according to the rules. Clash Verge Rev, FlClash, and similar clients follow the same steps, just with different layouts.

See alsoGetting Started Guide, Download page

Menu labels vary slightly between clients, but generally you go to the profiles (or subscriptions) page and click New or Import, paste the subscription URL, give it a name, and confirm — the client will download and parse it right away. Once imported, you need to select that profile to activate it (some clients select it automatically). After that, you can refresh it manually from the same page or set an auto-update interval to keep the node list synced with your provider.

First check the link itself: paste the subscription URL into your browser's address bar — if it downloads a chunk of text, the link is still valid. If it loads fine in a browser but the client can't fetch it, the usual cause is a conflict between the client's own proxy settings and its current node state — try turning off the system proxy before updating, or toggle off the option to use the system proxy when updating subscriptions, then retry. If the browser can't load it either, the link has expired and you'll need to get a new one from your provider.

This is Gatekeeper's default block on third-party apps that haven't been notarized by Apple — it doesn't mean the installer is actually broken. There are two fixes: go to System Settings → Privacy & Security, find the relevant prompt, and choose Open Anyway; or run xattr -cr /Applications/Clash Plus.app in Terminal to clear the quarantine flag, then relaunch the app. Both are standard steps for running open-source clients on macOS.

Most clients have a launch-on-startup toggle right in their settings — just turn it on, no need to add a startup entry manually. Combine it with start-minimized-to-tray for a fully silent launch. On Windows, this works through a startup entry or scheduled task; on macOS it uses login items, so if the toggle is off but the app still launches at startup, check System Settings → General → Login Items and remove it there.

Rule mode matches traffic against the rule list in order: traffic matching a proxy rule goes through a node, traffic matching a direct rule connects straight through, and anything left over falls back to the catch-all MATCH rule at the end — this is the recommended everyday mode. Global mode ignores the rules entirely and routes all traffic through whichever node is selected, useful for temporarily proxying everything at once. Direct mode routes nothing through a proxy at all, effectively pausing proxying.

This is handled by proxy groups in your config: a proxy group bundles nodes into a selectable exit, and rules then point specific domains or IPs at a given group. For example, you might point a streaming group at low-latency nodes and a downloads group at high-bandwidth ones. You can pick nodes manually per group in the client UI, or use a url-test group that auto-selects based on latency. Rules are matched top to bottom and stop at the first hit, so their order determines priority.

See alsoA Deep Dive Into Custom Rule Syntax, Rule-Based Traffic Splitting in Practice

The latency test sends a single HTTP request to the node and shows the round-trip time. That number only reflects connectivity and latency to the node's server — it says nothing about actual download bandwidth, so weigh both when picking a node. A node showing as timed out is currently unreachable; try another node, or update your subscription and re-test.

TUN mode creates a virtual network adapter that takes over all TCP/UDP traffic on the device, independent of any app's own proxy settings. The default system proxy mode only affects apps that respect system proxy settings — games and some command-line tools ignore it entirely, and TUN mode is the only way to catch that traffic. Enabling TUN requires admin/root privileges and installs a virtual adapter driver. You don't need it for everyday browsing — turn it on specifically when you need to proxy one of these stubborn apps.

There are two approaches. First, add a direct rule near the top of your rule list, e.g. DOMAIN-SUFFIX,example.com,DIRECT — anything matching it connects directly. Second, on Windows, the system proxy settings let you maintain a bypass list; addresses on it skip Clash entirely, which is handy for LAN addresses and domains you always want direct. For quick one-off cases, you can also switch the relevant proxy group to DIRECT, or switch the whole client to Direct mode.

Work through this checklist: update your subscription to rule out a stale node list; switch networks — say, from Wi-Fi to a phone hotspot — to rule out local network interference with the proxy port; check your system clock, since TLS-based protocols like Trojan and VLESS are sensitive to time drift and a gap of even a minute or two can break the handshake; and try the same subscription on another device or client to see whether the problem is on the node side or your machine. If every node times out across multiple networks, the subscription itself is most likely dead.

First confirm the client's system proxy toggle is actually on and that its listening port isn't already taken by another proxy app — running two proxy clients at once is the single most common cause. Next, check whether your browser has an extension with its own built-in proxy feature; extension proxies take priority over the system proxy, so if they conflict, the extension wins. Finally, double-check that the system proxy setting points to 127.0.0.1 and the client's listening port, commonly 7890.

TUN requires OS-level privileges. On Windows, run the client as administrator, or enable the client's service mode so a background service holds the permissions instead. On macOS, you'll be prompted for your password the first time you enable it, to authorize installing a helper tool. On Linux, you need root, or add the cap_net_admin capability to the executable. If it still fails after granting permissions, check for conflicts with other VPN or accelerator software — multiple virtual adapters fighting over the routing table is a common cause; quit the conflicting software and try again.

This comes down to UWP's sandboxed loopback restriction: UWP apps are blocked from reaching 127.0.0.1 by default, so they can't connect to Clash's local proxy port. There are two fixes: enable TUN mode, which intercepts traffic at the network adapter level and isn't affected by the loopback restriction; or exempt the specific app from loopback isolation — some clients include a built-in UWP loopback tool where you just check the target app. Once exempted, the UWP app routes through the system proxy like any regular desktop app.

The typical symptom is a domain that won't load while its IP address works fine, or a site that redirects to the wrong page. Clash has a built-in DNS module — nameserver in the config handles regular resolution, while fallback handles domains affected by DNS poisoning. Start by confirming the client's DNS settings are actually enabled, then check whether your browser's secure DNS (DoH) is conflicting with Clash's own resolution — browser DoH bypasses Clash's DNS entirely, so try disabling it temporarily to compare.

See alsoA Complete Guide to Clash DNS Configuration