Clash FAQ: From Concepts to Troubleshooting, All on One Page
Subscription import failures, nodes all timing out, system proxy not working — most of these have well-known causes and fixes. Below are 20 frequent questions organized into four categories, each with concrete steps. Click a category to jump straight there.
Getting Started
Get a few unavoidable concepts straight first — everything after this goes more smoothly.
What is Clash, and how does it relate to a "provider" and a "subscription"?
Clash refers to a family of open-source proxy clients whose core job is to route network traffic to different outbound paths based on rules. It does not provide any nodes itself.
Nodes come from a service provider, which gives you a subscription link. Import that link into the client and the node list and routing rules are generated automatically. In short: the client is the tool, the subscription is the key, and both are needed together.
Clash for Windows is no longer maintained. What's recommended now?
The Clash for Windows repository has been archived and no longer receives new releases. Old versions still run but are not recommended for long-term use.
Mature alternatives now exist for every platform: on Windows and macOS you can choose Clash Plus or Clash Verge Rev; on Android, Clash Plus or Clash Meta for Android. All of these are built on the actively maintained mihomo core. The download page lists the full set by platform.
What's the difference between Rule mode, Global mode, and Direct mode?
Rule mode decides each connection's route according to the rules in your configuration file — ordinary sites go direct, sites needing a proxy go through a node. This is the everyday default. Global mode routes all traffic through the proxy, useful as a temporary fix when rules misfire. Direct mode bypasses the proxy entirely, effectively turning off routing.
Staying in Rule mode is usually enough; leaving Global on long-term wastes bandwidth and slows down access to local sites.
How do the core and the client relate to each other? What is mihomo?
The core is the command-line program that actually handles traffic — parsing configs, matching rules, and establishing connections. The client is the graphical shell around the core, handling subscription import, node switching, and toggling the system proxy.
mihomo is the mainstream Clash-family core today, carried forward from the Clash Meta project, supporting more protocols and rule types. Every action you take in the interface is ultimately carried out by the core.
Do you need to pay to use Clash?
The client itself is free and open-source on every platform — there's no charge for the software.
The actual cost comes from the node service: subscription links are provided by a provider, usually billed monthly or by data usage. In other words, downloading the client from this site costs nothing, but you'll need a working subscription of your own to connect.
Setup
The most common sticking points during install on each platform, with fixes for each.
How do you import a subscription link into the client?
Copy the full subscription URL from your provider, open the client's "Profiles" or "Subscription" page, choose "Import from URL," paste it, and confirm — the client will download the config and generate the node list automatically.
After importing, remember to activate that profile, then turn on the system proxy toggle. Platform-specific steps are covered on this site's quick-start page.
What if Windows SmartScreen or antivirus software blocks the install?
Open-source clients don't purchase commercial code-signing certificates, so SmartScreen flags unfamiliar installers — this is normal. Click "More info" and then "Run anyway" to continue.
If antivirus software flags it as a false positive, add the install directory to your allow list. Just make sure the installer really did come from this site's download page or the project's official channel before proceeding.
What about macOS saying "can't be opened because it is from an unidentified developer"?
The first time you open it, right-click the app icon and choose "Open," then confirm in the dialog — macOS remembers this choice afterward.
If you instead see "file is damaged," that's usually caused by the quarantine attribute; run xattr -cr followed by the app's path in Terminal to clear the flag and reopen it. The full command sequence for macOS is in the multi-platform guide.
Android imports the subscription but won't connect, or never prompts for VPN permission?
The Android client takes over traffic through the system VPN interface, and on first launch it must show a "Create VPN connection" permission prompt that you allow. If you tapped deny, go to the VPN section of system settings, remove the entry, and relaunch the client to trigger the prompt again.
Some customized Android systems also aggressively kill background apps — add the client to your battery optimization allow list and permit auto-start.
How do you install a Clash client on iOS?
On iOS, the recommended option is installing Clash Plus from the App Store, which is actively maintained alongside system updates — see clashplus.io for details.
After installing, import your subscription inside the app; the first time you start the proxy, iOS will ask to add a VPN configuration, which you simply allow. The iOS section of the download page links directly to the App Store.
Tips
Installing is just the starting point — these settings make everyday use noticeably more stable.
What is TUN mode, and what permissions does it need?
TUN mode takes over all traffic at the system level through a virtual network adapter, which covers apps that ignore the system proxy setting, such as some games and command-line tools.
It requires higher privileges: on Windows, run the client as administrator and install the virtual adapter driver; on macOS, you'll need to authorize a system extension or enter an admin password; Android's VPN mode is inherently the same kind of mechanism. Regular browsing works fine with the system proxy — enable TUN only when a specific app won't route through it.
How do you let other devices on the LAN share this computer's proxy?
Enable allow-lan in the client, and note the mixed port number, commonly 7890 by default. Then, on the network settings of a TV, game console, or other device, set the proxy server address to this computer's LAN IP and the port to that mixed port.
Make sure the computer's firewall allows that port, and that both devices are on the same subnet.
How often does a subscription need updating? Can it update automatically?
Providers change node addresses from time to time, so a subscription left unupdated for too long will accumulate dead nodes. Most clients support setting an auto-update interval for subscriptions, commonly every 12 to 24 hours.
For a manual update, just click the refresh icon on the profile page. If the node list changes noticeably after an update, re-run a latency test before picking a node.
What does the latency number in milliseconds mean? Is lower always better?
The latency shown in the panel is the round-trip time for a single request from the client through a node to a test endpoint — it reflects handshake speed, not actual download speed.
It's useful for quickly ruling out timed-out nodes, but low latency doesn't guarantee smooth video, since bandwidth and route congestion are separate factors. Use latency first to filter out unusable nodes, then compare real browsing experience on your target site.
What is the GeoIP database for? Does it need updating?
Rule entries like GEOIP,CN rely on the GeoIP database to determine an IP's location; an outdated database can cause some local addresses to be misrouted through a node.
Most clients offer a one-click update option in settings — updating every few months is enough. If a local site is unexpectedly routing through a node, updating the GeoIP database usually fixes it.
Troubleshooting
Can't connect, lost internet, some apps won't route through the proxy — work through the following steps.
The system proxy is on, but the browser still won't route through it?
First confirm the client's system proxy toggle is actually on, then check whether your browser has a proxy extension installed — plugins like SwitchyOmega override system settings and need to be switched to the "system proxy" scenario.
Next, check the OS proxy settings to make sure the address and port were written correctly, pointing to 127.0.0.1 plus the client's port. If it still doesn't work, restart the browser, since some browsers only read the proxy config once at launch.
Subscription import or update fails with 404, 403, or a timeout?
A 404 usually means the subscription URL has expired or been replaced — go to your account portal and copy the latest link. A 403 may mean access to the subscription is restricted — contact the provider to check your account status. A timeout usually means the subscription domain itself is unreachable — try connecting through any working node first, then retry the update while the proxy is on.
When pasting, make sure the link is complete, since a trailing space or line break can also cause failures.
Every node times out and nothing connects at all?
Narrow it down in three steps. First, test direct access: turn off the proxy and try opening an ordinary site — if that fails too, the issue is with your local network itself. Second, check the subscription: update it and retry, ruling out a batch node failure. Third, check the port and firewall: confirm the client's port isn't taken by another app, and that no firewall or security software is blocking the client process.
If all three check out and it still won't connect, contact your provider to confirm server-side status.
Microsoft Store apps (UWP) won't route through the proxy?
For security reasons, Windows blocks UWP apps from accessing the local loopback address by default, so Store apps can't see a proxy running on 127.0.0.1.
The fix is to lift the loopback restriction: some clients include a built-in "UWP loopback exemption" tool where you just check the target app; alternatively, use Microsoft's official CheckNetIsolation command to allow apps one by one. Restart the affected app afterward for it to take effect.
The whole computer loses internet after turning on Clash, and only recovers when it's off?
This is usually caused by leftover proxy settings or TUN exiting abnormally. First check whether the system proxy is still pointing at a port that's now closed, turn off the system proxy manually, and let the client take over again; if TUN mode was used, an abnormal exit may leave behind a broken virtual adapter route — restart the client and close TUN normally, restarting the computer if needed to reset the network stack.
Also confirm the port in your config matches the port written into the system proxy.
Question not on the list?
Work through the step-by-step tutorial from the start and most setup issues resolve naturally along the way; for full per-platform detail, check the multi-platform guide.