Clash FAQs and Troubleshooting

mihomo is the core responsible for reading configuration, matching rules, and establishing proxy connections. Graphical clients such as ClashX and Clash Verge Rev build on the core to provide subscription management, policy switching, and system proxy controls. When troubleshooting, distinguish UI settings from core status: an open UI does not mean the core has started, and a running core does not mean system traffic is being routed through it.

Rule mode matches domains, IPs, or rule sets from top to bottom according to rules in the configuration and is suited to everyday use. Global mode sends connections that can be intercepted to one policy group and is useful for temporarily testing a node. Direct mode bypasses the proxy. When troubleshooting, briefly switch to Global mode: if it works while Rule mode does not, check rule order, policy-group selection, and rule-set loading status.

A subscription link retrieves configuration from a server, and the client can fetch it again on a schedule. A local configuration file stays on the device and is not automatically overwritten by the remote source after edits. Subscriptions are useful for maintaining node lists, while local overrides are suited to adding DNS, TUN, or custom rules. Temporary files generated from subscriptions may be replaced during the next update, so long-term changes should use the client’s supported override or merge features.

A system proxy relies on applications reading the operating system’s proxy settings. Browsers and most desktop apps usually work, but some games, command-line tools, and applications that force direct connections may bypass it. TUN mode uses a virtual network interface to capture a wider range of traffic at the network layer, but requires administrator privileges and correct DNS settings. Use the system proxy for everyday browsing, then enable TUN when more applications need to be covered.

First check the subscription update result and core logs to confirm that the server returned Clash-compatible YAML rather than a login page, notice, or empty response. Then check whether the configuration contains proxies, proxy-providers, and proxy-groups. If nodes are supplied through a provider, verify that the provider downloaded successfully. Before deleting a broken configuration, switch back to the last working one to avoid interrupting the current connection.

First confirm in a browser that the subscription URL is still accessible, then check that it was not truncated, expired, or padded with spaces. If the current network cannot reach the subscription server directly, connect using a working configuration before updating, or check whether the client has a proxy configured for subscription updates. Timeouts in the error log usually indicate a network-path problem; HTTP status errors call for checking subscription access and server status.

On Windows, start the relevant service with administrator privileges and confirm that the virtual network adapter driver installed successfully. On macOS, installation of a network extension or helper service usually requires approval in System Settings. On Linux, creating a TUN device typically requires root privileges or CAP_NET_ADMIN. If authorization does not help, close other virtual-network software and restart the client, then use the logs to determine whether the failure occurred during driver, route, or DNS initialization.

Some UWP apps are restricted by local loopback isolation and cannot connect directly to the proxy port that Clash listens on at 127.0.0.1. Use the client’s UWP loopback tool, select the target app for loopback exemption, save the change, and restart the app. Only exempt apps that actually need the proxy. If TUN is enabled and traffic is being captured normally, loopback exemptions are usually unnecessary.

select lets you choose a node manually, providing stable and predictable control. url-test probes candidate nodes at the configured interval and selects the one with the quickest response, making it suitable for everyday automatic selection. fallback uses the first available node in order and switches only after the current node fails, which suits continuity-focused scenarios. Automatic-group results depend on the test URL, interval, and tolerance, and do not represent the actual speed of every website.

Latency tests usually measure only the connection or response time to a specified URL. They reflect a small amount of traffic at one moment, not bandwidth, packet loss, or long-connection stability. Test URLs, timeouts, and connection reuse can also differ between clients. Choose nodes based on repeated tests, actual page loads, and download performance rather than a single lowest-latency result.

First confirm that Clash is handling DNS requests, then check that fields such as enhanced-mode, nameserver, and fallback are complete. LAN devices, game platforms, or applications that require real IP addresses may not work well with Fake-IP; add their domains to fake-ip-filter. If resolution failures persist in the logs, test upstream DNS reachability separately and check whether encrypted DNS, browser secure DNS, or the local firewall is bypassing the current configuration.

Prefer the client’s built-in configuration merge, override, or scripting features. Use remote subscriptions as node sources and local files as an additional layer for rules, DNS, and policy groups. Make sure every node name or provider name referenced by a policy group actually exists, and check the precedence of duplicate fields. Validate the configuration after each change before switching to it, preventing YAML indentation errors or duplicate keys from stopping the core from loading.

First switch to another node in the same policy group to determine whether the failure affects one node or the entire group. Then verify the device clock, whether the network restricts the relevant protocol, and whether the node address and port accept connections. A dial tcp timeout in the logs usually indicates an unreachable destination or blocked path; TLS errors call for checking the system time, domain, and transport parameters. Close duplicate proxy clients during testing to prevent port and routing conflicts.

Many command-line tools do not automatically read the desktop system proxy. Configure the tool with the HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY environment variable, using the port on which Clash actually listens: mixed-port, port, or socks-port. Check the variables in the current terminal, then use curl to access a test URL. To proxy only one command, add the variables temporarily to that command so package managers and LAN connections are not affected.

Keep the last working configuration and avoid overwriting it repeatedly. Open the subscription URL in a browser and check for an access notice, expiration message, web page content, or incomplete YAML. Also verify the device clock and subscription account status. If the client reports a parse error, use the logs to locate the line and inspect indentation, duplicate keys, and fields unsupported by the current core. Until the server recovers, continue using the cached configuration.

First identify in the logs whether the failure involves the GeoIP database, GeoSite database, or a remote rule-provider; their download URLs and update processes differ. Check that the storage directory is writable, that sufficient disk space is available, and that the current network can reach the data source. Do not delete the old file immediately during an update. If the new file is incomplete, exit the client, remove the relevant temporary files, then restart and try the update again.