FAQ

Clash is a general term for a family of rule-based proxy tools. The original Clash core stopped receiving updates in 2023, and the actively maintained successor core today is mihomo (formerly Clash Meta), which stays compatible with the original config format while adding support for more protocols. Everyday GUI clients such as Clash Verge Rev and FlClash are essentially interfaces built on top of the mihomo core, handling subscription management, node switching, and system proxy settings.

Rule mode matches traffic against the rules in your config one by one and routes it accordingly—this is the recommended everyday mode. Global mode sends all traffic to whichever node is currently selected, with no splitting, and is mainly used for quick testing. Direct mode sends all traffic out without going through any node, effectively disabling the proxy. All three modes can be switched from the client's main screen and take effect immediately, with no restart needed.

Clash Plus is the top pick, covering every platform with active maintenance. Clash Verge Rev and FlClash are also mainstream choices, sharing the same mihomo core and compatible configs, so switching clients doesn't require touching your subscription. Clash for Windows and ClashX Meta are no longer maintained and are kept only as archives—new installs aren't recommended. Compatibility notes and installers for each client are on the download page.

A subscription link is an HTTP(S) address generated by a provider; visiting it returns config content containing nodes and rules, and the client periodically fetches this address to auto-update its node list. Without a subscription, you can still manually import a local config.yaml file or enter connection parameters for self-hosted nodes one by one—the client's functionality isn't affected either way.

config.yaml is the core's single source of configuration, mainly made up of six sections: the port (mixed-port), run mode (mode), DNS, nodes (proxies), proxy groups (proxy-groups), and rules (rules). When using a subscription, this file is generated from the subscription content and doesn't need to be hand-written; manual editing is only needed for advanced tweaks like custom rules or changing the port—after saving, just reload the config from the client.

Three steps: first, turn on the system proxy toggle inside the client; second, open Windows Settings under Network & Internet, go to the Proxy page, and confirm the manual proxy points to 127.0.0.1:7890; third, refresh any webpage while watching the client's Connections or Logs page—new connection entries confirm traffic is passing through the core. If all three check out but pages still won't load, see the Troubleshooting category.

This is Gatekeeper's default block on apps outside the App Store. To fix it: open System Settings > Privacy & Security, scroll to the bottom to find the blocked-app notice, and click "Open Anyway"; or run xattr -cr /Applications/ClientName.app in Terminal to clear the quarantine attribute, then relaunch. Download the installer matching your chip type—Apple Silicon or Intel—since the wrong architecture won't launch.

Two things: first, VPN connection permission—Android clients take over traffic via VpnService, and the first launch triggers a system authorization dialog that must be allowed; second, background-run and battery-optimization whitelisting—ROMs like MIUI and ColorOS aggressively kill background apps by default, so add the client to autostart and exclude it from battery optimization in system settings, or the proxy will drop after the screen locks for a while.

On iOS, install Clash Plus from the App Store—search for it directly, or jump straight to the store listing from the iOS section on the download page. On first launch, allow the system prompt to add a VPN configuration, then import your subscription inside the app to start using it.

On Windows, typically under %USERPROFILE%\.config\ in the client's folder, or in the profiles subfolder of the install directory; on macOS, in ~/Library/Application Support/ClientName/; on Linux, in ~/.config/ClientName/. Every client provides an "Open Config Folder" option in its settings page—clicking that from the UI is the most reliable way when you're unsure of the path.

Click the speed-test icon in the top-right corner of a proxy group on the Proxies page; the client sends an HTTP request to the test URL configured in your setup (often http://www.gstatic.com/generate_204 by default), and the millisecond figure shown is the full round-trip time. It only reflects the link's condition at that moment—anywhere from tens of milliseconds up to 300ms is generally usable; a timeout means the node is currently unreachable.

System proxy only covers apps that actively read proxy settings—CLI tools, games, and some client software ignore it entirely. TUN mode creates a virtual network adapter and takes over all traffic at the network layer, with no app cooperation required. The trade-off is higher privileges: Windows needs administrator rights or a system service installed, while macOS and Linux need root authorization. System proxy is fine for everyday browsing—only switch on TUN when you hit an app that won't route through the proxy.

Add DOMAIN-SUFFIX,example.com,DIRECT at the very top of the rules list; to force it through the proxy instead, swap DIRECT for a proxy group name. Rules match top to bottom, and the first match wins, so custom entries must sit above the rules bundled with your subscription. Clash Verge Rev supports appending rules via the prepend syntax in its global extension config, so they survive every subscription update.

Every client's subscription or config page offers an update-interval setting—the usual approach is editing the subscription entry and setting the interval to 1440 minutes, i.e. once a day. You can also set the interval field under proxy-provider in the config file. A failed update doesn't affect existing nodes; the client just keeps using the last cached config.

mixed-port is the hybrid port the core listens on, accepting both HTTP and SOCKS5 protocols, defaulting to 7890. The simplest way to route CLI tools through the proxy is setting environment variables: export https_proxy=http://127.0.0.1:7890 http_proxy=http://127.0.0.1:7890 all_proxy=socks5://127.0.0.1:7890, after which git, curl, pip, and similar tools pick it up automatically. Environment variables only apply to the current terminal session—add them to your shell config file to make them persist.

Check in order: first, paste the subscription link directly into a browser and see if it returns base64 or YAML text—an error page means the link has expired or is invalid, so ask the provider to reset it; second, if it loads fine but the client reports a parse error, it's usually a format mismatch—confirm the subscription is in Clash format rather than another client's proprietary format, converting it via a subscription-conversion service if needed; third, if the update request itself times out because it's routed through a dead node, switch the update method to direct connection and try again.

Work through these from easiest to hardest: test the current node's latency and switch nodes if it times out; switch to Global mode to rule out a rule mismatch; confirm the system proxy port matches mixed-port—both default to 7890; disable browser proxy extensions like SwitchyOmega if installed, to avoid double-proxy conflicts; and if the logs show a lot of DNS errors, enable fallback under the dns section of your config. Working through each item usually pinpoints exactly where things broke.

This means port 7890 is already taken by another program—commonly another proxy client running at the same time, or a leftover process from last time that didn't fully exit. To locate it: on Windows, run netstat -ano | findstr 7890 to find the PID, then end that process in Task Manager; on macOS and Linux, run lsof -i :7890. If ending the process isn't convenient, just change mixed-port to a free port like 7891 in the client's settings—the system proxy port will follow automatically.

Windows UWP apps are blocked from connecting to the local loopback address by default, so system proxy doesn't apply to them. Two fixes: run CheckNetIsolation LoopbackExempt -a -n=PackageName as administrator to exempt a single app—some clients even include a built-in UWP loopback-exemption tool; or simply enable TUN mode, which takes over traffic at the network layer and no longer depends on loopback. When non-UWP software bypasses the proxy, it usually has its own independent proxy setting—just point it manually to 127.0.0.1:7890 inside that app.

A whole list timing out is rarely a single-node issue: switch to Direct mode first to confirm your own network is fine; check whether the subscription has expired—once data runs out or the plan expires, the server rejects all connections; a poisoned test-speed URL can also make every node look timed out, so swap it for http://cp.cloudflare.com/generate_204 and test again; and a large system clock offset can break the handshake for some encrypted protocols, so sync your clock and retry.