Windows UWP Apps Not Using the Proxy: How to Lift the Loopback Restriction
With the system proxy on, browsers work fine, yet Microsoft Store, Mail, Weather, and other Store apps can't get online or fall back to a direct connection — this isn't a Clash misconfiguration but Windows' loopback restriction on UWP apps. This article explains how the restriction works, covers two exemption methods (a graphical checkbox tool and the command line), and offers TUN mode as an alternative that takes over all traffic.
Symptoms: Only Store Apps Misbehave
The typical scenario: Clash's system proxy is enabled and browsers reach international sites smoothly, yet the built-in Store apps all fail at once. Common signs include:
- Microsoft Store spins endlessly after opening, reports no network connection, or app downloads stall at 0
- System apps such as Mail and Calendar, Weather, Sticky Notes, and Xbox fail to refresh or show as offline
- Third-party UWP apps installed from the Store can't sign in or load content
- On the same PC, regular desktop programs like Chrome and Edge use the proxy without any issue
The cause is neither your subscription nor your rules. Regular desktop programs (Win32) read the system proxy settings directly and send traffic to the local port 127.0.0.1:7890. Store apps, however, run inside an AppContainer sandbox, and Windows blocks them from connecting to any loopback address by default — requests are stopped by the system before they ever reach Clash.
How It Works: AppContainer and the Loopback Restriction
Since Windows 8, Store apps (UWP, formerly called Metro) run inside an isolated AppContainer environment, which comes with a Network Isolation policy at the network layer: by default, apps are not allowed to initiate connections to local loopback addresses (127.0.0.1, ::1). The design goal was to prevent malicious Store apps from probing and attacking services running on the local machine.
Clash's system proxy essentially hands traffic to the local mixed port (7890 by default). Win32 programs are not bound by Network Isolation and connect as usual; UWP apps are rejected by the system the moment they try to reach 127.0.0.1. Two outcomes follow: the app reports a network error and can't connect at all, or it bypasses the proxy and connects directly — showing as "online, but not through the proxy."
The fix is called LoopbackExempt — loopback exemption: add specific apps to an allowlist so they may access loopback addresses. Exemptions are written into the system configuration and survive reboots; adding and removing them both require administrator privileges.
Exemption Is Not the Same as Using the Proxy
Loopback exemption only answers the question "can this app reach the local machine." After being exempted, the app still has to go through the system proxy settings (or be taken over by TUN) before its traffic actually enters Clash. The two steps work in sequence — one does not replace the other.
Method 1: The Client's Built-In Exemption Tool
The graphical option is the easiest and suits most users.
- Open Clash Verge Rev, go to the settings page, and find the "UWP Loopback Exemption" entry.
- Click it and the system shows an app list (it calls Windows' built-in EnableLoopback interface); check the apps you want to exempt.
- Save, confirm the administrator prompt, and the setting takes effect immediately.
Older versions of Clash for Windows ship EnableLoopback.exe in the installation directory; double-clicking it opens the same checkbox list. Exempt on demand: check only the apps that genuinely need the proxy, such as Microsoft Store, Mail and Calendar, Xbox, and Weather. There's no need to select everything — the smaller the exemption scope, the better.
Method 2: The CheckNetIsolation Command Line
When the graphical tool can't find the target app, or you want precise control, use the built-in CheckNetIsolation.exe. First, open PowerShell as administrator.
Step one: look up the app's PackageFamilyName:
Get-AppxPackage -Name "*store*"Find the PackageFamilyName field in the output — for the Store it's Microsoft.WindowsStore_8wekyb3d8bbwe. Then run the commands as needed:
| Operation | Command |
|---|---|
| Add exemption | CheckNetIsolation.exe LoopbackExempt -a -n=Microsoft.WindowsStore_8wekyb3d8bbwe |
| List entries | CheckNetIsolation.exe LoopbackExempt -s |
| Remove one entry | CheckNetIsolation.exe LoopbackExempt -d -n=Microsoft.WindowsStore_8wekyb3d8bbwe |
| Clear all | CheckNetIsolation.exe LoopbackExempt -c |
Parameter notes: -n accepts a PackageFamilyName or AppContainer name, and -p accepts a SID; -n is enough for everyday use. Running -s lists all currently exempted apps, which is handy for double-checking.
Privilege Requirement
Adding, removing, and clearing all require an elevated terminal; otherwise you'll get "The requested operation requires elevation." A normal window can only list entries.
Method 3: Full Takeover with TUN Mode
If you'd rather not exempt apps one by one, take a different approach. The mihomo core's TUN mode creates a virtual network adapter that takes over all traffic at the network layer, independent of the system proxy settings. UWP app connections are routed into Clash just like any other program, and the loopback restriction no longer gets in the way.
TUN mode requires installing the service mode and granting administrator privileges; the configuration entry is on the client's settings page. It suits machines with many UWP apps, or situations where new apps frequently fail to use the proxy. When troubleshooting other network issues, stick to either the system proxy or TUN — not both — so the two takeover methods don't stack up and interfere with your diagnosis.
Verification and FAQ
After exempting an app, open Microsoft Store and search for anything — if pages load normally, it worked. A more direct confirmation: open the client's Connections panel, use the target app, and watch for matching domain connection records. If records appear, the traffic is genuinely passing through Clash.
App Still Can't Connect After Exemption
Check in order: whether the system proxy is still enabled; whether the mixed port has been changed (default 7890); whether the target app was fully quit and reopened — some apps cache network state.
Command Errors
A "requires elevation" message means the terminal isn't running as administrator. Close it, right-click PowerShell, choose Run as administrator, and run the command again.
Exemption Stops Working After an App Update
Exemptions are recorded by PackageFamilyName and usually survive version updates. A few apps change their package name after a major overhaul; in that case, add the exemption again with the new PackageFamilyName — use -s to compare against the list.
Summary
Store apps ignoring the proxy comes down to Windows' loopback isolation, not a Clash fault. For a handful of apps, exempt them one by one with the graphical tool or CheckNetIsolation; with many apps, switch to TUN mode and solve it in one go.