Clash FAQ: Find your issue by category
18 frequently asked questions drawn from real recurring scenarios — subscription imports, node timeouts, TUN permissions, system proxy issues. Each one starts with how to confirm the problem, then walks through the fix. If you're still stuck, look for the linked in-depth guides and troubleshooting articles throughout.
Basics
Get the terminology straight first. If config, subscription, and core aren't clear, every step after gets harder.
What is Clash? What do config file, subscription, and node mean?
Clash is an umbrella term for rule-based proxy clients, built around a YAML config file. Three fields matter most: proxies are your nodes, i.e. available proxy servers; proxy-groups are selector groups that decide which node gets used; rules determine which traffic goes through the proxy.
A subscription is a URL from your provider that the client periodically fetches to auto-generate the config above. Remember this: the client is just a shell — behavior is entirely driven by the config. See the concept reference for details on each field.
Clash for Windows is discontinued — which client should I use now?
The original author stopped maintaining it and the repo is archived, so it no longer supports newer systems or protocols. On Windows, the main replacements are Clash Verge Rev and FlClash, both built on the mihomo core with broader protocol support — most existing subscriptions migrate over without changes.
If you already have Clash for Windows installed, you can keep using it for now, but if you hit protocol recognition errors or compatibility issues, don't bother troubleshooting the old client — just switch. The download page lists currently working clients by platform.
How are the original Clash core, Clash.Meta, and mihomo related?
Three names, one lineage. The original Clash core is where it started, and it's no longer developed. Clash.Meta was a community fork that added support for newer protocols like VLESS and Hysteria2. Meta was later renamed mihomo, which is now the only actively maintained mainline.
Clients you download today — Clash Verge Rev, FlClash, and others — all bundle mihomo under the hood. Config fields are backward-compatible, so older configs generally run fine as-is. See the protocol reference for a feature comparison across the core family.
When should I use rule mode, global mode, or direct mode?
Rule mode (rule) is your everyday default: traffic gets matched against rules one by one, and whichever rule matches decides the route, with direct and proxied traffic staying independent. Global mode (global) routes everything through a single exit — only use it briefly for testing a node or when rules are clearly misfiring. Direct mode (direct) is basically the proxy turned off while the client keeps running.
Leaving global mode on long-term wastes bandwidth and slows down access to local sites — stick with rule mode day to day. This is covered in more detail in step two of the tutorial.
Setup
From install to a working subscription, this is where the most issues pile up: format mismatches, system blocks, missing dependencies.
Node list is empty after importing a subscription link — what now?
Check three things in order. First, whether the subscription has expired or run out of data — check your provider's dashboard, since expired subscriptions commonly return empty content. Second, whether the subscription format matches your client — some subscriptions default to V2Ray format, which Clash clients can't read; you may need to append a Clash parameter to the link as instructed by your provider, or run it through a subscription converter. Third, how you imported it — make sure you pasted the subscription URL itself, not the page content you got after opening it in a browser.
After fixing any of these, manually refresh the subscription in the client and check again. The full import walkthrough is in step one of the tutorial.
Clash Verge Rev shows a white screen or WebView2 error on Windows after install?
Clash Verge Rev's interface depends on Microsoft's WebView2 runtime. Windows 11 includes it by default, but some Windows 10 installs and lite editions don't, which shows up as a white screen or an outright error on launch. Download and install the WebView2 Evergreen runtime from Microsoft's site, then relaunch.
Another common cause is installing to a path with special characters — install to the default path instead. For the full walkthrough from choosing an installer to verifying your routing, see the blog post Installing Clash Verge Rev on Windows: The Complete Walkthrough.
macOS says the app is from an unidentified developer or is damaged?
This is Gatekeeper's default block on apps not distributed through the App Store — it doesn't mean the installer is broken. Fix: go to System Settings → Privacy & Security, and click "Open Anyway" under the blocked-app notice. If you see "is damaged and can't be opened," run xattr -cr /Applications/YourApp.app in Terminal to clear the quarantine flag, then reopen it.
Also watch for chip architecture: download the installer matching Apple Silicon or Intel, both listed separately in the macOS section of the download page.
My client won't recognize my subscription — what does "subscription conversion" do?
Different clients expect different formats: Clash-based clients read YAML, while V2Ray-based ones read Base64-encoded link lists. A subscription converter is essentially a format translator — it turns the link your provider gave you into a format your client understands, often bundling in a routing rule template along the way.
Your best bet is to ask your provider for a Clash-specific subscription URL, which most offer; only fall back to a converter if that's unavailable. Keep in mind subscription links contain account credentials, so avoid submitting them to sketchy online converters. See the protocol reference for subscription format compatibility across clients.
Usage Tips
Once you're connected, getting routing, latency testing, and sharing right makes a huge difference in day-to-day experience.
How do I route different sites through different nodes?
It's handled through "rules + proxy groups." Each rule in rules can point its outbound to a specific proxy group: streaming domains routed to a "Streaming" group, general overseas traffic routed to an "Auto" group. You pick nodes for each group in the client interface, and once a rule matches, traffic follows whatever that group currently has selected.
Most subscriptions ship with this grouping already set up, so you can just switch things on the proxy page; to customize it, add a DOMAIN-SUFFIX rule pointing to your target group in the config or the client's rule settings. Rules are matched top to bottom and stop at the first hit, so place new rules before the catch-all MATCH rule.
What's the difference between url-test and select proxy groups?
select is a manual group: whichever node you click is the one used, until you change it. url-test is an automatic group: it periodically pings a test URL through each node, picks the fastest one by latency, and switches automatically if one drops. A common setup is layering the two — put a url-test group inside an outer select group as an "Auto" option, leaving it on auto day-to-day and switching to a specific node manually when needed.
If the auto-picked node isn't ideal, check its test interval (interval) and tolerance (tolerance) settings — raising the tolerance helps avoid the client flip-flopping between nodes with similar latency.
How is node latency measured, and what do the numbers mean?
Every client's proxy page has a latency test button — it sends an HTTP request to a test URL through that node and times how long it takes, in milliseconds. That number reflects "connection setup + one round trip," not download speed: an 80ms node might have very little bandwidth, while a 300ms node could stream video smoothly.
Latency is good for filtering out nodes that time out or are clearly degraded. When picking a node, look for two things: stable latency that doesn't jump around, and smooth performance in actual use. If everything shows a timeout, don't blame the nodes first — follow the order in the troubleshooting section below.
How do I share my computer's proxy with a TV or game console?
Enable "Allow LAN" (allow-lan) in the client, and note your computer's LAN IP and mixed port (commonly 7890). On your TV or console's network settings, set the proxy server to your computer's IP and the port to 7890, with the protocol set to HTTP.
Requirements: both devices need to be on the same router, and your computer's firewall needs to allow that port — Windows will prompt for firewall permission the first time, so check "Private networks." The proxy stops working if the computer sleeps, so disable sleep mode for extended use.
Do subscriptions need manual updates? How often should I refresh?
Yes, but not often. Providers periodically change node addresses and ports, and if your local subscription isn't refreshed, it's still holding stale nodes — which shows up as nodes timing out one after another. Most mainstream clients support auto-refresh, and an interval of 12–24 hours is enough; when you see widespread node issues, manually refreshing the subscription is the first thing to try.
Note that failed auto-refreshes often happen silently. The client shows the subscription's "last updated" time — check that timestamp first when troubleshooting.
Troubleshooting
Can't connect, not taking effect, won't turn on — these all follow a fixed troubleshooting order. Don't skip steps.
General rule for troubleshooting: change one thing at a time and verify immediately. Change three settings at once and even if it works, you won't know which one fixed it — and if it breaks, you can't roll back cleanly.
System proxy is on, but the browser still isn't using it?
First confirm the client's "system proxy" toggle is actually on, then check three things. First, whether the OS-level proxy setting got reset — on Windows, Settings → Network & Internet → Proxy should show 127.0.0.1 with the client's port; some software clears this setting when it exits. Second, leftover PAC scripts — if you previously used other proxy software, the "automatic configuration script" might still point to a dead address, so clear it. Third, browser proxy extensions take priority over system settings, so switch the extension to "system proxy" mode.
Fix these one at a time and restart the browser to verify. For the full walkthrough covering both browser and terminal, see the blog post System Proxy Enabled But Not Working.
All nodes are timing out — what order should I troubleshoot in?
Nodes timing out across the board is rarely actually a node problem. Check in this order: ① whether the subscription has expired or run out of data (check your provider's dashboard); ② whether your system clock is accurate — some protocols are time-sensitive, and even a few minutes of drift can break the handshake, so enable auto time sync; ③ whether the port is already in use — if another proxy app is holding 7890, the client logs will show a bind failure; ④ whether the core matches the protocol — if your subscription uses newer protocols like Hysteria2 or VLESS but your client still runs an older core, switch to a client built on the mihomo core; ⑤ retest on a different network, like your phone's hotspot, to rule out local network interference.
Step-by-step confirmation and fixes for each of these are in the blog post The Troubleshooting Order for Clash Nodes All Timing Out.
TUN mode won't turn on and says permission denied?
TUN needs to create a virtual network adapter at the OS level, which requires administrator/root privileges. Windows: Clash Verge Rev needs "Service Mode" installed and enabled in settings first — authorize the system service, then turn on TUN, since enabling it directly will fail. macOS: the first activation triggers a system extension or permission prompt that you need to approve in System Settings. Android: you must tap Allow on the VpnService permission prompt.
If the network still doesn't work after enabling TUN, check whether you've set up the DNS hijacking config as recommended by the client — misconfigured DNS under TUN mode is the most common cause of a dead connection. For the mechanical differences between TUN and system proxy, see the blog post TUN Mode vs. System Proxy: What's the Difference.
UWP apps (Microsoft Store apps) won't use the proxy?
Windows applies network isolation to UWP apps, blocking them from accessing the local loopback address 127.0.0.1 by default — which is why the system proxy doesn't affect Store apps. Two fixes: first, use the client's built-in "UWP loopback exemption" tool (available in Clash Verge Rev's settings) and check the box to exempt the target app; second, just enable TUN mode, which intercepts traffic at the network layer and bypasses the loopback restriction entirely.
If the same app has a desktop (Win32) version, switching to it also works around this restriction.
Browser works fine, but the terminal and command line still don't use the proxy?
This is expected behavior: commands in the terminal don't read system proxy settings — they only respect environment variables. As a temporary fix, run export https_proxy=http://127.0.0.1:7890 http_proxy=http://127.0.0.1:7890 all_proxy=socks5://127.0.0.1:7890 in your current session (adjust the port to match your client's actual mixed port); to make it permanent, add these to your shell config file. On Windows PowerShell, use the $env:https_proxy syntax.
Note that tools like git and docker have their own separate proxy settings and don't read environment variables, so those need to be configured individually. See the blog post the system proxy troubleshooting guide for the full comparison of both paths.
Try a different starting point
For scenarios the FAQ doesn't cover, pick a page based on what you need: follow the tutorial for setup, check the protocol reference for choosing a client, or look up terms in the quick reference.