Clash Proxy Modes Explained: Rule, Global, and Direct Compared

What Exactly Do the Three Modes Switch

Open Clash or any client built on the mihomo core, and one of the first things you'll notice on the main panel is a three-way toggle: Rule, Global, and Direct. Many people flip through these the first time they use the app, sticking with whichever connects, and end up stuck on a mode that doesn't fit their needs — either burning proxy traffic for no reason, or unable to reach a site that should have gone through the proxy in the first place. Understanding these three modes really boils down to one idea: they decide who evaluates a connection request before it goes out, and which path it ultimately takes.

In Rule mode, every connection request is checked against the rule list in the config file, matching conditions like domain, IP, or GEOIP location one by one. Whichever rule it hits determines how it's handled — routed through the proxy, sent directly, or blocked outright. Global mode skips that matching step entirely; no matter the destination, everything is handed to whichever proxy node is currently selected. Direct mode goes further still, turning off the proxy function completely — all traffic leaves through the local network exit as-is, with Clash sitting quietly in the background and not forwarding anything.

None of the three modes is inherently better than the others; the difference lies in who makes the routing decision. Rule mode hands that decision to the rule set written into the config file, Global mode hands it to whichever node you've manually selected, and Direct mode removes the decision altogether, leaving traffic exactly as it would be without Clash.

Rule Mode: The Default Choice for Config-Based Routing

Rule mode is the mode enabled by default in the vast majority of subscription configs, and the one official documentation consistently recommends for everyday use. Its core logic is need-based routing: commonly used sites in mainland China, local network addresses, and system update services are typically tagged by the rule set for direct connection, while overseas sites and blocked services are tagged to go through the proxy. This way, everyday access to domestic sites stays at full speed, and only the parts that need the proxy get forwarded through a node.

Rules are usually evaluated top to bottom, with the first match applying — once a connection hits a rule, matching stops and that rule's policy takes effect. Common rule types include:

• DOMAIN / DOMAIN-SUFFIX / DOMAIN-KEYWORD: exact, suffix, or keyword matching on domain names, used to pin down the routing for a specific site;
• IP-CIDR / IP-CIDR6: matching by IP range, commonly used to whitelist local network addresses or specific servers;
• GEOIP: matching based on the country or region the target IP belongs to — a common pattern is mapping GEOIP,CN to direct connection;
• MATCH: the fallback rule, placed at the end of the list to catch anything none of the preceding rules matched.

Config files also typically pull in remote rule sets (Rule-Providers), which maintainers update regularly with categorized domain lists — ad domains, streaming domains, common office and collaboration tool domains, and so on — so nobody has to hand-write thousands of rules themselves. With Rule mode, as long as the subscription is well maintained, day-to-day use requires almost no manual intervention; whatever URL you type into your browser, Clash has already worked out the right path behind the scenes.

Global Mode: Use Cases and Trade-offs

Global mode pulls all routing decisions back to a manual level: it ignores domain names and geolocation entirely, only recognizing the currently selected node, and sends every request out through that node. Its use cases are fairly narrow, mainly falling into two categories.

The first is troubleshooting verification. If you suspect a site is unreachable because of a rule-matching error, you can temporarily switch to Global mode to force traffic through the proxy node and see whether the problem disappears. If switching to Global fixes it, that's a strong signal the issue lies in the rule configuration rather than the node or network itself — a common diagnostic technique.

The second is scenarios where you deliberately want all traffic to exit through the same channel — for example, needing every connection on your machine to appear to come from the same regional IP, or testing the stability of cross-border access without the rule set's automatic direct-connection behavior interfering with the results.

The trade-off with Global mode is straightforward: requests to domestic sites, local network devices, and system services all get forcibly routed through the proxy node, which not only slows things down but also counts traffic that would normally be free as proxy usage. Staying in Global mode for extended periods usually makes for a noticeably worse day-to-day experience, so it's better suited to short verification runs than as a long-term setting.

Direct Mode: When to Turn Off the Proxy Entirely

Direct mode essentially makes Clash go temporarily invisible — all traffic follows the machine's original network path, without passing through any node or being checked against any rule. This is useful in two situations.

The first is figuring out whether a network issue is even related to the proxy software. If a site or app won't connect, switch to Direct mode and test it first: if it still won't connect in Direct mode, the problem lies with the local network or the target server, unrelated to Clash's rules or nodes; if Direct works but the proxy doesn't, you've narrowed the problem down to the node or the rule configuration. This is the most basic and effective first step in troubleshooting.

The second is situations that call for temporarily using the machine's real network environment — for example, accessing banking or government sites that only allow access from specific regional IPs, or running baseline latency and bandwidth tests. These scenarios need the proxy node ruled out of the equation, and Direct mode provides a "clean" baseline for comparison.

One thing worth noting: in Direct mode, TUN mode (if system-level takeover is enabled) usually stops working correctly or behaves oddly too, since the proxy layer is bypassed entirely. So after switching back from Direct mode, it's worth confirming that TUN-related settings have returned to normal.

How to Switch Modes and Verify They're Working

Different client interfaces vary slightly, but the core action is the same everywhere: find the mode selector on the main panel or sidebar, usually shown as a button group or dropdown with Rule / Global / Direct options — click to switch, no restart required. Some clients also let you switch modes directly from the system tray menu for quick, on-the-fly adjustments.

After switching, it's worth running a quick check to confirm the mode actually took effect:

1. Open the client's built-in connection log or active connections panel and watch which policy new requests are taking;
2. Visit a site you know needs the proxy and confirm it loads correctly;
3. Visit a domestic site you know should be direct and confirm speed is back to normal, with no proxy detour slowing it down.

If nothing changes after switching, first check that you clicked the right option and that the config actually saved and took effect; next, consider whether the browser or app itself has an independent proxy setting, or whether stale DNS caching is throwing off your observations.

Which Mode Should You Leave On Day to Day

Based on everything above, the recommendation for everyday use is to default to Rule mode. It balances speed and usability: domestic services stay on direct connection without any speed hit, while the parts that need the proxy get forwarded automatically — no need to memorize which site needs the proxy toggled on. Global and Direct mode are better suited as temporary tools for troubleshooting, verification, or short-lived scenario-specific switches; once you're done, remember to switch back to Rule mode so you don't end up stuck in an unusual state without noticing.

The table below summarizes the core differences between the three modes for quick reference: