Clash Frequently Asked Questions

Clash is a rule-based network proxy client that reads nodes and rules from a configuration file to decide, request by request, whether traffic goes through a proxy or connects directly. The original Clash core repository has been archived and is no longer updated, but the community-maintained mihomo core continues active development and remains compatible with the original configuration format.

Clients built on mihomo — such as Clash Verge, Mihomo Party, and FlClash — are all available for download and use today.

Clash for Windows stopped receiving updates in late 2023 and no longer gets core or security patches. On Windows, we recommend switching to Clash Verge or Mihomo Party — both are built on the mihomo core and support subscription import, rule-based routing, and TUN mode. Your existing subscription link works as-is, with no reconfiguration needed.

Installers for all platforms are available on this site's download page.

Clash is the name of the original open-source core project. mihomo (formerly known as Clash Meta) is a fork built on top of it that has continued active development, adding support for more proxy protocols and rule types. Nearly all mainstream clients today bundle the mihomo core, so when people say "Clash client" in everyday usage, they usually mean one of these mihomo-based graphical apps.

A subscription link is a URL provided by a proxy service. When a client fetches it, it downloads a full configuration file containing the node list and routing rules. You need to obtain this link from your proxy service provider's account dashboard.

This site only provides client installers and usage guides — it does not offer any nodes or subscription services.

Rule mode matches traffic against the routing rules in your configuration file one by one — traffic matching a proxy rule goes through a node, everything else connects directly. This is the recommended default for everyday use. Global mode sends all traffic through the currently selected node, useful for temporarily debugging rule issues or when you need everything proxied. Direct mode uses no node at all — all traffic leaves your machine directly.

After switching modes, it's best to disconnect existing connections on the Connections page so they don't keep using the old path.

Some antivirus tools generate false positives for proxy-related software, and SmartScreen may flag newer installer signatures. First confirm the installer came from this site's download page or the client's official release channel, then choose "Run anyway" in the SmartScreen prompt, or add the install directory to your antivirus's trusted list.

If the installer gets deleted right at download time, temporarily disable real-time protection, install the app, then turn protection back on.

This is macOS's default block for apps that haven't been notarized — it does not mean the installer is faulty. Open System Settings → Privacy & Security, scroll to the bottom where the blocked app is listed, and click "Open Anyway." Alternatively, run sudo xattr -cr followed by the app's full path (for example, the .app bundle under /Applications) in Terminal to remove the quarantine attribute, then launch it again.

On Android, we recommend Clash Meta for Android (CMFA) or FlClash. After downloading the APK from this site's download page, the system will prompt you to allow installs from unknown sources — grant that permission to finish installing.

On first launch, create a new profile, paste in your subscription link, and save. Back on the main screen, tap the start button; the system will show a VPN connection request, and once you allow it, a local virtual network interface is created and proxying begins.

Using Clash Verge as an example: open the client's Subscriptions page, paste the subscription link into the input field, and click import. The client downloads the configuration file automatically and displays the node count and traffic info. Once imported, go to the Proxies page, pick a node with normal latency, and enable the system proxy in Settings to activate it.

Other clients follow a similar flow: paste the link, import, choose a node, enable the proxy. See the full step-by-step guide in the tutorial.

TUN mode works by creating a virtual network interface that takes over all system traffic, and creating a virtual interface is a system-level operation: on Windows this requires administrator rights or installing a system service first, while macOS and Linux require entering an admin password.

With Clash Verge, for example, you need to run "Install Service" once in Settings before first enabling TUN; after that, you can toggle TUN normally without running the client as administrator each time.

On the Proxies page, click the latency test icon — the client sends a request to a test URL and displays each node's response time in milliseconds. Under roughly 200 ms generally feels smooth, and lower is better; nodes showing a timeout are currently unavailable.

It's worth setting frequently used proxy groups to the url-test type so the client automatically picks the lowest-latency node instead of testing each one manually.

The system proxy only affects apps that honor system proxy settings — browsers and most desktop apps fall into this category, and it has lower overhead, making it the default choice for everyday use. Command-line tools, some games, and software that ignores proxy settings won't use the system proxy; for these, TUN mode is needed, since it intercepts all traffic at the network layer via a virtual interface.

The two don't need to run together — if TUN is on, it's best to turn off the system proxy to avoid processing traffic twice.

Add a rule above the existing entries in the rules section of your configuration file: use DOMAIN-SUFFIX to match a domain and point it to DIRECT, or use PROCESS-NAME to match a process name so that app connects directly. Rules are matched top to bottom, first match wins, so custom rules should be placed before the general ones.

If a subscription update overwrites manual edits, maintain custom rules in a client that supports global overrides or merge scripts (such as Clash Verge), so they persist across subscription updates.

Yes. Mainstream clients let you set an update interval per subscription — for example, in Clash Verge's subscription edit page, enter an interval in minutes, and the client will fetch the latest configuration on that schedule. Mihomo Party and FlClash offer similar options. Setting the interval to 1440 minutes (once a day) means no manual action is needed when nodes change.

If auto-update fails, check whether "Update via proxy" was enabled and confirm your current network can reach the subscription URL.

Check things in this order: make sure the link was copied in full, with no extra spaces or line breaks; open the subscription link directly in a browser — if it downloads a file, the link itself is valid; if the browser can't open it either, the subscription domain may be blocked on your current network, so connect to a working node first, enable "Update via proxy," and try again; if you get a format error, confirm the provider is serving a Clash-format subscription, and add any format parameter the provider specifies to the link if needed.

If the issue persists, contact your provider to check whether the subscription has expired.

First refresh the subscription to rule out outdated node info, then confirm your local network works fine with the proxy off. If the network is fine but every node still times out, check in order: whether your system clock is accurate (some protocols are sensitive to time drift), whether a firewall or antivirus is blocking the client process, and whether the latency test URL is reachable (you can change it in Settings).

A single node timing out is normal — just switch to a node in another region; if all nodes time out and everything above checks out, the issue is usually on the provider's side, so contact them to confirm.

First confirm the client's main screen shows the proxy as running, and that the selected node on the Proxies page passes its latency test rather than timing out. Then check that the system proxy port matches the client's listening port — the default mixed port is 7890. If your browser has a proxy-switching extension installed, set it to follow the system or point directly to 127.0.0.1:7890.

If it still doesn't work, test in Global mode: if Global mode works but Rule mode doesn't, the routing rules aren't matching as expected, so review your rules and the destination of the final MATCH entry.

For security reasons, Windows blocks UWP apps from accessing the local loopback address by default, which prevents them from reaching the local proxy port. There are two fixes: find the UWP tool or loopback exemption option in a client's settings (such as Clash Verge) and enable exemption for the Store apps that need internet access, or simply turn on TUN mode, which intercepts traffic at the network layer and bypasses the loopback restriction for all UWP apps at once.

This usually means the default port (such as 7890) is already taken by another program — often a leftover client or core process that didn't fully quit, or another proxy tool running at the same time. First end any lingering client/core processes in Task Manager and restart. If another program genuinely needs that port, change the mixed port in the client's settings to an unused one, such as 7891, and update your system proxy settings accordingly.

On Windows, netstat -ano together with Task Manager can help you identify which process is holding the port.