Clash FAQ

Clash is the original proxy core released in 2019, written in Go; the original repository was archived in late 2023. Clash Meta is a community-maintained enhanced fork, renamed mihomo in 2024, and is the current active kernel.

The clients featured on this site, such as Clash Verge Rev, FlClash, and Clash Plus, all run mihomo underneath. In everyday conversation, "Clash" usually refers to the whole ecosystem rather than one specific piece of software.

No. The mihomo kernel and mainstream GUI clients are free, open-source software with public source code; downloading, installing, and updating never cost anything. What you actually pay for is the proxy node service (the subscription), which is on the provider's side and unrelated to the client itself.

Any installer claiming to be a "paid official Clash version" or "Clash professional license" is not trustworthy; get your client from this site's download page or the project's official channels.

A subscription link is a URL issued by your provider that points to a list of node configurations. The client requests this address at set intervals and automatically pulls the node list and routing rules, saving you from entering nodes one by one.

The link usually carries a token parameter, making it equivalent to an account credential: do not share it, post screenshots of it, or paste it into public forums. If you suspect a leak, reset the subscription in your provider's dashboard, then import the new link into the client.

Use Rule mode for daily use: it follows the rule table, sending traffic bound for outside mainland China through the proxy while traffic within mainland China goes direct, giving the best balance of speed and compatibility. Global mode routes all traffic through the selected node; enable it only temporarily when troubleshooting or when a service demands a single exit. Direct mode effectively disables proxying, so no traffic passes through any node.

Switch modes with one click on the client's home page or proxy panel; changes take effect immediately.

In Rule mode, sites in mainland China connect directly by default, so online banking, government portals, and office software are generally unaffected. A few banks' security controls are sensitive to the system proxy; if login fails, switch to Direct mode first, or add that bank's domain to a DIRECT rule.

Corporate intranet ranges are usually on the default bypass list; if they become unreachable, check the system proxy bypass settings and add the intranet ranges.

SmartScreen flags any open-source software without a paid code-signing certificate, so this is a common false positive. After confirming the installer came from this site's download page or the project's official release channel, click "More info" and then "Run anyway" to continue.

Never allow packages of unknown origin from third-party mirror sites or group file shares; the blue warning is your last line of defense.

Open-source clients lack Apple's paid developer signature, so Gatekeeper blocks them by default. Fix it in this order: first click "Open Anyway" at the bottom of System Settings > Privacy & Security; if it still reports damage, run sudo xattr -rd com.apple.quarantine /Applications/AppName.app in Terminal to strip the quarantine attribute.

On Apple Silicon machines, also confirm you downloaded the arm64 build; the wrong architecture triggers the same "damaged" error.

Check three directions:

1. The subscription link is dead or the plan's data is used up: paste the link into a browser; an error or empty response means a provider-side problem.
2. Connectivity between your machine and the subscription server: switch networks, or update again while a working proxy is active.
3. The link was rewritten by a third-party converter that the client cannot parse: re-import the original link from your provider.

Troubleshoot in four steps:

1. Test node latency in the client first; if every node times out, toggling the proxy switch achieves nothing.
2. Confirm the system proxy was actually written: on Windows, Settings > Network & Internet > Proxy should show 127.0.0.1 with the matching port.
3. If the browser has a proxy-switching extension, it overrides the system proxy; disable it and retest.
4. Security-suite software may revert proxy settings; quit it and turn the switch back on.

Mainstream clients include a built-in autostart option. In Clash Verge Rev, enable "Launch at Login" under Settings > System Settings; in Clash Plus, turn on "Start at Login" under General. Also enable "Silent Start" or "Minimize to Tray" so the main window does not pop up at every boot.

Linux desktop users can hand the kernel to systemd, which restarts it automatically after crashes and is more reliable than desktop autostart.

Click "Latency Test" in the client's node list; it measures handshake time against a fixed URL, not bandwidth limits. Judge nodes on three points: latency stability, packet loss, and slowdowns during evening peak hours.

If you prefer not to pick manually, use an auto-select (URLTest) group: it benchmarks nodes at set intervals, locks onto the fastest one, and switches automatically when a node dies.

A proxy group is a container for nodes: rules point traffic at a group, and the group lands it on a specific node. Common types: select for manual choice, url-test for automatic benchmarking, fallback for failover, and load-balance for load balancing.

Switch in the client's Proxy panel: click a group name to expand its node list, then click the target node for an instant change. If the groups bundled with your subscription are not enough, build your own in the config; see the advanced configuration page for the syntax.

Use rules: they match top to bottom and stop at the first hit. Put custom rules at the very top of the rules section in the config file:

• DOMAIN-SUFFIX,example.com,PROXY forces that site through the proxy;
• DOMAIN-SUFFIX,example.cn,DIRECT forces a direct connection;
• Use IP-CIDR for IP ranges and PROCESS-NAME for per-process matching, same idea.

Reload the config in the client to apply. For large volumes, manage them as rule-set subscriptions instead; the advanced configuration page covers the full syntax.

24 hours is recommended. Node lists do not change often, so an interval of a few hours just wastes requests, and some providers throttle update frequency or even ban links that poll too often.

With auto-update enabled, the manual update button remains: when nodes fail en masse, refresh the subscription manually first, then start troubleshooting.

Turn on "Allow LAN" in the client; it then listens on the mixed port at 0.0.0.0, default 7890. Phones, tablets, and TVs on the same LAN can use the proxy by entering the computer's LAN IP plus port 7890 as the proxy server.

Enable this only on trusted networks like your home; on public Wi-Fi it hands your proxy port to everyone on the same network segment.

Four steps:

1. Switch to Global mode and retest, ruling out a rule misjudgment that sent test traffic direct.
2. Retest over a phone hotspot to separate a broadband line problem from a node problem.
3. Update the subscription manually; the nodes may have been replaced wholesale.
4. Open the client's log panel and read the error keywords: timeout points to unreachable networks, while connection refused usually means a subscription or port problem.

If everything still times out after four steps, it is almost certainly a provider-side outage; check the provider's announcements.

TUN creates a virtual network adapter, so elevated privileges are required. On Windows, run the client as administrator; Clash Verge Rev can install its built-in service mode, which removes the need to elevate every time. On macOS, the first launch asks for password authorization. On Linux, grant the kernel binary the cap_net_admin capability or run it as root.

TUN and the system proxy can run together, but do not stack other VPN software on top; multiple virtual adapters fight over routes.

With the proxy on, visit a DNS leak test site and check who owns the DNS servers in the results: if your local ISP's DNS shows up, you have a leak.

Fix in this order: confirm the client's DNS module is enabled; switch nameserver to encrypted DoH or DoT queries; point fallback at DNS servers outside China. For strict requirements, combine TUN mode with fake-ip so domains resolve to virtual IPs locally, minimizing the leak surface; see the DNS chapter of the advanced configuration page for the full setup.

This is a system restriction: UWP apps are blocked from loopback addresses by default, and Clash's system proxy is exactly a 127.0.0.1 loopback proxy. Use the client's built-in "UWP Loopback Exemption" tool: tick the Store apps that need network access and save; or add exemptions manually with the CheckNetIsolation LoopbackExempt command.

The blog post "Windows UWP Apps Cannot Use the Proxy" walks through every step.

Some process is already holding that port. Find it first: on Windows, run netstat -ano | findstr :7890 to get the PID, then end that process in Task Manager; the most common culprit is a previous client that never fully exited and still sits in the tray.

If you cannot find it or do not want to bother, change the port: set the mixed port to a free value like 7891 in the client settings, and the system proxy updates in sync. Never run two clients at once; the ports are guaranteed to clash.