Clash FAQ

Start by separating the core from the interface. The core loads configuration, matches rules, and forwards connections; a GUI client manages subscriptions, switches modes, and controls system settings. mihomo is the core project renamed from Clash Meta, not a particular desktop app. When troubleshooting, note both the client name and core version. An open interface only confirms that the client launched; it doesn’t mean the core is listening on its ports.

First, get a valid subscription from your service provider. Subscription links typically provide server addresses, connection parameters, and proxy groups; the client itself does not include a proxy service. Before importing, check the service’s validity period, data allowance, and supported formats. Treat the link like a password because it may contain access credentials. When asking for help, hide the full link, account details, and server authentication fields. Never post a subscription in a public comment.

For everyday use, start with Rule mode, which routes requests according to your configuration. Global mode sends traffic to the outbound selected by the global policy. It can help with a quick comparison, but only affects traffic that reaches the core, and the selected outbound is not necessarily a proxy. Direct mode connects requests handled by the core straight to their destinations. Switching modes does not enable the system proxy. Restore your original settings after testing rather than leaving a temporary option in place.

Start by enabling the system proxy and confirming that your browser connects. The system proxy registers a proxy address with the operating system, but whether an app uses it depends on the app. TUN creates a virtual network interface that can route traffic from more apps, but it requires permissions and may conflict with other VPNs, routes, or DNS settings. Leave TUN off unless you need it. If an app ignores the system proxy, test TUN separately.

Think of the local entry point and remote exit as separate parts. An app connects to a port listening on your device. The core then routes the request directly to its destination or forwards it to a proxy server, according to the rules. mixed-port accepts both HTTP and SOCKS proxy requests; 7890 is a common value, but check your client’s settings. 127.0.0.1 means this device. On a phone, it points to the phone itself, not your computer.

First, open the subscription update log and confirm that the download succeeded. Then check that the configuration is selected and enabled. Remove leading or trailing spaces from the copied link, and make sure it is not the URL of your account dashboard. A successful download with no proxies may mean the server returned a login page, the format is incompatible, or the provider supplied no content. Don’t import webpage HTML as YAML. Ask your provider for a mihomo-compatible subscription format, and keep a copy of the original configuration for recovery.

Check whether your service account has expired or the subscription was reset, then copy the link again from your provider’s dashboard. A 401 usually indicates an authentication issue; a 403 may indicate an access restriction or a response from website protection. Neither status code alone proves that your account is out of credit. If the link works in a browser but fails in the client, check the update interval, request method, and any client identifier required by your provider. Don’t repeatedly test the full link publicly or send credentials to an unfamiliar conversion service.

Follow the client’s instructions to install its service component or grant the required network permissions, then enable TUN again. On Windows, check that the service is installed and running. On macOS, look for a network extension or VPN request that needs approval. On Android, confirm the VPN connection prompt was accepted. Then check whether another VPN is using the network routing channel. Don’t disable system protection or repeatedly remove network adapters. Keep the specific error from the log to determine whether the cause is permissions, a driver, or a routing conflict.

Back up the current configuration, then roll back to the last working version. YAML uses indentation to define structure: use spaces, not tabs, and check colons and list indentation around the line number shown in the log. If the log says address already in use, check whether another proxy process is running. Stop the conflicting process or change the local listening port. If you change the port, update the system proxy and the proxy address in your apps too.

First, check whether you edited the original subscription file or a client-provided override. Subscription updates usually download a fresh configuration, so direct edits to the downloaded file may be overwritten. To keep custom ports, DNS settings, or rules, use the client’s override, merge, or extension features, and check where custom rules are inserted. Merge behavior varies by client. After saving, verify the effective configuration and core log—not just the editor contents.

Open the client’s connection list, visit a site you want to test, and check the destination domain, matched rule, and outbound. An enabled system proxy does not mean every app is using it. A request in the connection list does not prove it used a proxy outbound, either. You can test the local HTTP entry point with curl -I -x http://127.0.0.1:7890 https://example.com, replacing the port with your configured value. The result applies only to that request.

First, specify a proxy for a single command and confirm the local port works. Then consider setting environment variables. Many command-line tools don’t use the system proxy; curl accepts an address with -x, while other tools have their own proxy options. Environment variable syntax and behavior vary by shell and tool, so HTTP_PROXY, HTTPS_PROXY, and ALL_PROXY are not universally supported. After closing the client or changing the port, clear any outdated variables and reopen the terminal.

Check the rule order first. Rules are generally matched from top to bottom, and evaluation stops at the first match. Put specific domain rules before broader rules and the MATCH fallback. Then check that the proxy group exists and its capitalization matches, and that the request includes a domain the rule can match. If the connection list shows only an IP address, check DNS and domain detection. Reload the configuration and test with a new connection.

First, confirm that your configuration actually uses GEOIP or GEOSITE rules, then use the client’s data update feature. GeoIP classifies IP addresses by location; GeoSite matches domain collections. They are not interchangeable. For manual configuration, check that mihomo’s geox-url setting, automatic update options, and the data format are compatible. If a download fails, check the specific log entry. After updating, reload the data or restart the core, then use the connection log to confirm the rule matched.

On a trusted network, enable connections from the LAN and check the bind address, firewall, and proxy authentication. On each other device, enter your computer’s LAN IP and actual listening port—not 127.0.0.1. The devices must be able to reach each other; guest networks and wireless client isolation can block connections. Don’t expose the listening port to the public internet, and turn sharing off when you’re done. Check whether each LAN device supports HTTP or SOCKS proxies.

Confirm that the core is running and that its local port matches the system proxy settings. Then check whether a browser extension, separate proxy setting, or organization policy is overriding them. Temporarily disable proxy extensions, test in a new browser window, and watch the connection list for requests. If no request appears, check the traffic entry point. If a request appears but goes direct, check the mode, rules, and proxy group. Don’t change DNS, subscriptions, and TUN all at once, or it will be hard to tell what fixed the issue.

Turn off the proxy and confirm that your basic connection can reach ordinary websites. Check whether you’re on public Wi-Fi that requires sign-in. Then check your service account, system time, and client logs, and compare results on another network. A timeout only means the test did not finish in time; it doesn’t prove the subscription is invalid. The test destination itself may also be unreachable. If one proxy fails, check that server first. If all proxies fail, investigate DNS, network restrictions, and the firewall.

First, identify whether DNS failed for the destination website or the proxy server. DNS resolves domain names to IP addresses. If the proxy server’s own domain can’t be resolved, switching to a similar proxy may not help. Check the log for timeouts, connection refusals, and resolution loops, and confirm that the upstream DNS service is reachable. With TUN, also check that DNS interception is working. Don’t enable DNS interception in multiple apps at once. Back up your settings, change one thing at a time, clear the cache using your client’s instructions, and test again.

First, confirm that the affected app is actually subject to app container restrictions; this does not apply to every app installed from the Store. Some UWP apps have loopback restrictions that prevent them from accessing a local proxy port. If your client provides a loopback exemption tool, grant access only to the apps that need it. You can also use Windows’ CheckNetIsolation LoopbackExempt tool to inspect exemptions and add one using the exact package family name. Administrator permissions are usually required. Restart the affected app afterward, and don’t exempt every app in bulk.

First, distinguish a stale connection from a network-switching issue. On Android, check the VPN status, background activity restrictions, and Always-on VPN setting. On iOS, check the system VPN status and reconnect. After switching between Wi-Fi and mobile data, wait for the network to stabilize before reconnecting. If your computer can’t get online after you close the client, check whether the system proxy still points to the stopped local port. Restore connectivity, then restart the client and test one setting at a time. Don’t reset all network settings as a first step.