#Clash FAQ: Subscriptions, Nodes & System Proxy Troubleshooting

Clash is a rule-based proxy tool ecosystem whose core idea is describing nodes, proxy groups, and routing rules with a YAML config file. After the original Clash core stopped receiving updates, the community fork Clash Meta continued development and was later renamed mihomo. Current mainstream clients (Clash Plus, Clash Verge Rev, FlClash, and others) all bundle the mihomo core, and the config format remains backward compatible.

The core (mihomo) is the command-line program that actually forwards traffic and performs rule matching. The client is the graphical interface wrapped around the core, providing subscription management, node switching, and a system proxy toggle. Regular users just need to install a client — the core ships with it and updates alongside it, so there's no need to download it separately unless you're deploying on a server or router.

Every client listed on this site is an open-source project or software released for free — downloading and using it costs nothing. What usually costs money is the subscription service itself (the proxy nodes), which is unrelated to the client. Any channel charging for a "Clash activation code" or "client membership" has nothing to do with the open-source community; only get installers from the official release page or this site's download page.

A subscription provider is a third-party service that offers proxy nodes. A subscription is simply a URL that the client periodically fetches to pull down the node list and routing rules. This site only provides client downloads and configuration documentation — it does not operate or recommend any node service. You need to get the subscription URL from your own provider's user dashboard.

Rule mode matches traffic against the routing rules in the config file one by one and sends it wherever it matches — this is the recommended everyday mode. Global mode routes all traffic through the selected proxy node, which is useful for temporary troubleshooting when rules aren't behaving. Direct mode sends all traffic without a proxy, effectively disabling routing temporarily. Switching modes doesn't immediately affect already-established connections; you can manually close them on the Connections page if needed.

Clash Plus is the top recommendation — it ships an x64 installer with a complete interface and active updates. Clash Verge Rev and FlClash are also common choices. Clash for Windows has stopped receiving maintenance and is kept only as an archive; it's not recommended for new users. See the client comparison page for details, and the Windows tab on the download page for install links.

This is Gatekeeper's default block on apps that haven't been notarized. Go to System Settings → Privacy & Security, scroll to the bottom, and click "Open Anyway" next to the blocked app. If it says the app is damaged, run xattr -dr com.apple.quarantine followed by the app's path in Terminal to clear the quarantine flag, then reopen it. Make sure you downloaded the correct Intel or Apple Silicon build — the wrong architecture will also fail to launch.

Using Clash Plus or Clash Meta for Android as an example: open the Profiles page, tap New, choose the URL type, paste the subscription URL from your provider, and save — the client will download the config automatically. Back on the home screen, select that profile and tap the start button. On first launch you'll be asked to authorize a VPN connection at the system level; approve it and the client takes over your traffic.

The iOS version of Clash Plus is distributed through the App Store — the iOS tab on the download page links straight to the store listing, or you can visit clashplus.io for version details. After installing, import your subscription the same way by pasting the URL on the Profiles page, and approve the system's VPN configuration prompt on first connection.

Desktop clients generally offer a launch-at-startup toggle in Settings: on Windows this registers a startup entry, on macOS it adds a login item. If you also enable "auto-connect / restore last state," the proxy resumes silently after a reboot. When using TUN mode, the Windows client usually needs to run its service mode with administrator privileges, otherwise TUN can't be established after auto-launch.

Every client's proxy page has a latency test button, which works by sending a request to a test URL (usually Google's generate_204 by default) and timing the response. The number only reflects the handshake latency between your network and that node — it's not the same as bandwidth. Run several rounds when picking a node, and also watch stability under real usage. You can also use the url-test group type so the core automatically picks the lowest-latency node.

A proxy group bundles multiple nodes — or even sub-groups — into a single selectable unit, and routing rules point traffic at the group rather than a specific node. Common types include select (manual choice), url-test (auto-pick the lowest latency), and fallback (failover). A typical setup is assigning different nodes to groups for different purposes (e.g. general traffic, streaming, AI services) on the client's proxy page, instead of editing every rule individually.

The system proxy only covers apps that respect proxy settings — command-line tools, some games, and certain clients ignore it entirely. TUN mode takes over all traffic at the network layer through a virtual network adapter, giving much more complete coverage. The trade-off is higher privileges: Windows needs administrator or service mode, macOS needs a system extension authorization or a password prompt during install, while Android and iOS's VPN mode is already the same underlying mechanism and needs no extra setup.

On the computer's client, enable "allow LAN connections" (allow-lan), note the mixed port (mixed-port, commonly 7890), and make sure your firewall allows that port. Then, in the Wi-Fi advanced settings on your phone or TV, manually configure a proxy with the server set to the computer's LAN IP and the port set to the mixed port. Both devices need to be on the same local network.

Yes. Most clients offer an auto-update interval setting on each profile entry, commonly set to 1440 minutes (once a day). When it expires, the client re-fetches the subscription URL in the background and hot-reloads it. If your provider changes rules frequently, you can shorten the interval. If an update fails, the client keeps the previous config, so you won't lose connectivity.

Check in order: first, whether the subscription URL is complete and free of stray spaces or truncation from an input method; second, whether the subscription itself has expired — open the URL directly in a browser to see if it returns content; third, whether the update went through the proxy — if the subscription domain is being tampered with on your network, try toggling "update via proxy" on the client and test again; fourth, switch networks (e.g. a phone hotspot) and try updating again to tell apart a local network issue from a provider-side one.

First confirm your local network is fine — can you load a web page in Direct mode? Next check whether your system clock is accurate, since some protocols are sensitive to time drift. Then check the client logs for the actual error: DNS resolution failures are usually caused by local DNS tampering, which encrypted DNS in the config can work around. If only nodes on certain ports time out, your ISP may be blocking that port range — contact your provider about switching ports or nodes.

There are two scenarios. If the browser isn't using the proxy: check whether the client's system proxy toggle is on, and whether the browser has an extension that manages its own proxy and overrides the system setting. If a command-line tool isn't using the proxy: terminals don't read the system proxy by default, so you need to manually export the http_proxy and https_proxy environment variables pointing at the mixed port, or switch to TUN mode to take over at the network layer instead.

Windows blocks UWP apps from reaching the local loopback address by default for security reasons, so they can't connect to a proxy port on 127.0.0.1. To fix this: use the client's built-in UWP loopback exemption tool (based on the EnableLoopback mechanism) and check the target app to allow it, or simply enable TUN mode to bypass the loopback restriction entirely.

This is usually a port conflict or a leftover setting: first, check whether the mixed port is already in use by another program and try a different port; second, if the client crashed previously, the system proxy may still point at a stale 127.0.0.1 setting — turn it off manually in your system's network settings, then let the client re-enable it; third, running multiple proxy tools at once causes them to fight over the system proxy setting, so keep only one running; fourth, check whether you accidentally selected a dead node, and switch to a working node or Rule mode to verify.