Clash Frequently Asked Questions

The Clash core is a command-line program responsible for proxy forwarding and rule matching, with no graphical interface of its own. What people commonly call Clash Verge Rev, Clash Plus, or ClashX Meta are all GUI clients wrapped around that core, handling subscription management, proxy toggles, and visual settings. When choosing a client, what matters most is the core version and platform support; the underlying capabilities are largely the same. See the download page for options on each platform.

The repositories for the original Clash and Clash Premium have been archived, so no fixes are issued and newer protocols are not supported. The mainstream community option now is the mihomo core (also known as Clash Meta), which stays compatible with the original YAML config format while supporting more protocols. It's best to use a client that bundles mihomo directly, such as Clash Verge Rev or Clash Plus — pick one by platform on the download page.

A subscription link is an HTTPS address that returns configuration content containing nodes and rules when accessed, usually provided by your proxy service in its user panel. Paste the link into the client's subscription or config field to import it; the client can then automatically pull updates on a set schedule. This site only provides client downloads and tutorials, not any proxy/node service — you need to obtain the link from your service provider.

Rule mode (rule) matches traffic against the rules block in the config one entry at a time, sending each match through its corresponding outbound — this is the recommended everyday mode. Global mode (global) routes all traffic through the currently selected node, useful for quick testing. Direct mode (direct) bypasses the proxy entirely. The mode can be switched with one tap in the client's main interface, corresponding to the mode field in the config file.

The clients listed on this site are all open-source projects that can be downloaded and used for free, with publicly available source code. What costs money is the proxy/node service itself, provided by third-party operators, which has nothing to do with the client. If you come across a so-called Clash client demanding payment to unlock features, check its open-source repository first before deciding whether to use it.

Open the client and paste your subscription link into the subscription or config page, then download the config. Go back to the main screen, turn on the system proxy switch, and pick a node with normal latency on the proxies page. Finally, open a site you normally can't reach to confirm connectivity. The full walkthrough is on this site's tutorial page — import the subscription, choose a mode, then verify the connection.

The first time you open it, right-click the app icon and choose Open, then confirm in the dialog — this bypasses Gatekeeper's default block. Alternatively, go to Privacy & Security in System Settings and click Open Anyway near the bottom. If it says the app is damaged, run xattr -dr com.apple.quarantine followed by the app's path in Terminal to clear the quarantine flag before launching it again.

On Windows, most clients have a launch-at-startup toggle in Settings — enabling it lets the app start with the system. On macOS, you can add the app to Login Items in System Settings, or use the client's built-in option. On Android, you need to allow the app to auto-start in system settings and add the client to the battery optimization whitelist, otherwise the proxy service may get killed in the background by the system.

TUN mode creates a virtual network adapter that takes over all system traffic. On Windows, you need to run as administrator or install the system service the client prompts for. On macOS, you need to authorize a network extension, or enter an admin password to install a helper tool. On Linux, you need root privileges, or grant the binary the cap_net_admin capability. Just follow the authorization prompt the first time you enable it — it only needs to be done once.

Providers adjust their nodes from time to time, so it's best to enable auto-update. Most clients let you set an update interval on the subscription entry — 1440 minutes (once a day) is common — or you can control it via the interval field under proxy-providers in the config. If a large number of nodes are timing out, try manually updating the subscription first before looking into other causes.

Clicking the speed-test icon on the proxies page runs a URL test against each node; the millisecond figure shown is how long a single HTTP request took to complete. It reflects connectivity and responsiveness, not bandwidth — a low-latency node isn't necessarily fast for downloads. When picking a node, it also helps to judge by real page-load and video start-up speed; see this site's technical notes for a full explanation in the latency testing article.

Set allow-lan to true in the config — most clients have a corresponding toggle in Settings. Then, on the phone, TV, or other device's Wi-Fi proxy settings, enter the computer's LAN IP and the mixed port (7890 by default). Make sure the system firewall allows that port and both devices are on the same subnet, or the connection will fail.

Rule mode itself already splits traffic by condition: matches on DIRECT go straight through, matches on a proxy group go through a node. For finer control, customize rules in the config's rules block — for example, DOMAIN-SUFFIX for a domain, PROCESS-NAME for a process, or IP-CIDR for a subnet. Rule syntax, match order, and priority are covered in detail in this site's YAML manual.

Yes. GEOIP and GEOSITE rules rely on a local database to determine which region a domain or IP belongs to; an outdated database can cause misrouting, such as some sites being wrongly sent direct or wrongly sent through the proxy. Most Meta-based clients support one-click updates or scheduled updates in Settings. See the GeoIP update guide in the technical notes for both manual file replacement and automated update setups.

Change mixed-port (or port, socks-port) in the config to a free port, such as 7897, save, and restart the client; then update the port in your system or browser proxy settings to match. On Windows, use netstat -ano to see what process is holding the port — a common cause is a previous client instance that didn't fully exit.

First, open the subscription link directly in a browser to confirm it returns actual content rather than an error page. If what comes back is Base64 or some other format, the link isn't Clash YAML — you'll need to get a Clash-format subscription from your provider's panel, or convert it through a subscription converter service before importing. When copying the link, strip any leading/trailing spaces or line breaks, and make sure links containing a token are copied in full. See how to identify and convert subscription formats for more detail.

Check in this order: first, whether the network is fine with the proxy off, to rule out a local outage; second, whether the current node's speed test is timing out — switch nodes or update the subscription if so; third, whether the mode has accidentally been switched to Global with a dead node selected; fourth, whether DNS is misbehaving — try enabling enhanced-mode: fake-ip in the dns block of the config and observe; fifth, whether another proxy or VPN app is running at the same time and conflicting — quit it and try again.

Windows UWP apps are blocked from accessing the local loopback address by default, so even with the system proxy on they can't reach the local port. Use the client's built-in UWP loopback exemption tool — for example, the corresponding option in Clash Verge Rev's settings — and check the target app to remove the restriction. Alternatively, enable TUN mode directly, which takes over traffic at the virtual adapter level and bypasses the loopback restriction entirely.

First check whether the browser has a proxy-managing extension installed, such as SwitchyOmega — it overrides the system setting, so switch it to system-proxy mode or disable it. Firefox uses its own independent proxy settings by default, so you need to switch it to use the system proxy under network settings. Some software simply doesn't read the system proxy at all; that kind of traffic can only be caught by TUN mode, or by manually entering 127.0.0.1:7890 inside the app itself.