Clash FAQs and Troubleshooting

Mihomo is a proxy core compatible with the Clash configuration ecosystem. It handles protocol connections, DNS, rule matching, and traffic forwarding. Graphical clients such as Clash Plus and Clash Verge Rev import configurations, switch policies, and manage the core. When troubleshooting, first determine whether the issue is in the client interface, configuration file, or core runtime.

Rule mode uses the top-to-bottom matches in rules to decide whether traffic is direct or proxied, making it suitable for everyday use. Global mode sends traffic to a selected policy group for temporary node testing. Direct mode bypasses the proxy. After changing modes, revisit the target address and check the connection or log page to confirm where the new request actually went.

A subscription link is a remote configuration endpoint that the client uses to retrieve nodes, policy groups, and rules. A configuration file is YAML downloaded locally for the core to read. Local edits are not synced back to the subscription service, and a later subscription update may overwrite them. For persistent changes, use the client's override or merge feature.

Clash clients and the Mihomo core do not provide proxy nodes. Before use, import a working subscription link or create a configuration containing proxies, proxy-groups, and rules. Installing the client alone is not enough: even with the system proxy enabled, there is no proxy exit available without a valid configuration.

A web page may request its main domain, static assets, API endpoints, and third-party content delivery domains at the same time. Those requests can match different rules. Also consider IP rules after DNS resolution and the current rule-set version. In the connection log, review each request by time, including its Host, matched rule, and policy, rather than checking only the domain in the address bar.

First, open the subscription URL in a browser to confirm that it is reachable and has not expired. Then check for spaces, line breaks, or escape characters accidentally added during copying. Verify the system clock and the client's network permission, and temporarily disable other proxy tools that may also be taking over the connection. If the response is a login or error page, obtain a new valid URL from the subscription provider.

First confirm that the active configuration is the subscription you just updated, not an older configuration with the same name. Check the update time and configuration path, manually reload the configuration, and then inspect the proxy groups. If local overrides or configuration merging are enabled, make sure the override rules have not removed the new nodes. If necessary, disable the override temporarily and update again.

Start with the reported line and the line above it. Common causes include inconsistent indentation, a missing space after a colon, a list item without a hyphen, mixed tabs and spaces, or an unquoted name containing special characters. YAML indentation expresses hierarchy and cannot be aligned arbitrarily. After editing, run the client's configuration check before reloading the core.

First confirm that the installer came from a client source listed on this site's download page. Then review the exact filename, publisher, and reason shown in Windows Security. Managed devices may also be restricted by application-control policies and require approval from an administrator. Do not disable all security protection to handle one file; assess the specific installer and its source.

Open Privacy & Security in System Settings and check for pending app approvals. Follow the client's prompts to approve the network extension or VPN configuration. Enabling TUN for the first time usually also requires administrator authorization. After approval, quit the client completely and reopen it. If the app is on a temporary mounted volume, move it to Applications before running it.

Open the client's connections or logs page, clear the old entries, revisit the target address, and filter the new connections by domain. Check the matched rule, policy group, final node, and connection type. A policy group name identifies the selection point; the final node field identifies the actual exit. During testing, do not run other tools that modify the system proxy.

Clash evaluates rules from top to bottom in the order shown in the configuration, so an earlier rule or rule set may already have captured the request. Place more specific DOMAIN, DOMAIN-SUFFIX, or IP-CIDR rules before broad rules, and confirm that the referenced policy group exists. Save and reload the configuration, then verify the match in the logs.

First check whether the issue occurs only in Fake-IP mode. Then add LAN domains, printer domains, or domains used by incompatible apps to fake-ip-filter. LAN addresses should also be sent direct by private-address rules. After editing, clear the system DNS cache and restart the affected apps. Avoid excluding overly broad domains, or domain-based rules may become less effective.

Enable allow-lan in the configuration, confirm that mixed-port or the relevant HTTP and SOCKS ports are listening on the LAN address, and allow only the required ports through the system firewall. On other devices, set the proxy server to the computer's LAN IP and that port. Use this only on a trusted network, and make sure the router's client isolation is disabled.

Rules, policy groups, and most DNS settings usually take effect after reloading the configuration; a full system restart is not required. Changes involving the TUN driver, network interfaces, listening ports, or permissions may require restarting the core or client. Check the active runtime configuration and startup logs to confirm the change instead of relying only on the edited file.

Switch between at least two nodes to distinguish a single-node failure from a broader network issue. Then confirm that the subscription has not expired, the local clock is correct, and the current network can resolve DNS. Disable duplicate proxy or VPN tools and test again. If every node times out, inspect the core logs for handshake, certificate, DNS, or connection-refused errors and respond according to the error type.

In the system network settings, confirm that the proxy address and port were applied, and verify that the port matches the client's current listening port. Browser extensions, enterprise policies, and manual proxy settings may override system settings, so disable them temporarily and test again. Also confirm that the core is running: the system proxy only sends requests to a local port; it cannot replace the core.

On Windows, check that the service component is installed and that initial setup was completed with administrator privileges. On macOS and Linux, confirm that the network extension, administrator approval, or required capability has been granted. Check whether another VPN is using the virtual network adapter, and review device-creation errors in the logs. Restart the core after fixing permissions, and avoid rapidly toggling TUN on and off.

Some UWP apps cannot access a local loopback proxy by default. In the client's UWP loopback tool, select the affected app and save the change. Then close the app completely and relaunch it, while confirming that the system proxy port is still listening. On managed devices, loopback exemptions may be restricted by organizational policy; check the system policy instead of repeatedly changing Clash rules.

A standard system proxy and TUN forwarding do not require replacing website certificates. First check the system clock and the issuer shown in the browser's certificate warning, and see whether HTTPS decryption, security-software traffic inspection, or another proxy tool is enabled. Disable duplicate network-interception components and test again. If the error occurs only with one node, stop using that node and inspect its transport settings.