Clash FAQ and Troubleshooting

A subscription link is the address a client uses to fetch remote configuration, typically including proxy nodes, proxy groups, and rules. It is not an individual node address or an installer. Keep the full URL and all parameters when copying it, including tokens after the question mark. Only enter subscription URLs in trusted clients; never post them on public pages.

A subscription is a remote configuration source. When a client updates it, the client creates or replaces a local configuration. The configuration organizes ports, DNS, nodes, proxy groups, and rules; a proxy node is only one part of it. A working node does not guarantee that the entire configuration works. Proxy group selection, rule order, and traffic interception must also be checked.

Rule mode is usually best for everyday use: the rules section determines whether each domain or address uses the proxy, connects directly, or is rejected. Global mode sends all intercepted traffic through one proxy policy and is useful for temporarily testing a node. Direct mode bypasses the proxy and helps determine whether a network problem comes from the Clash configuration. Switch back to rule mode after troubleshooting.

Some clients temporarily retain the last successfully loaded local configuration, but remote updates, node availability, and service authorization may already have expired. A remaining local configuration does not prove that the subscription is valid. Check the status on the subscription service first, then update the configuration manually. Empty responses, authorization errors, or expiration notices must be resolved at the subscription level.

If you edit a configuration generated from a subscription directly, the next update may overwrite your changes. Put rules that must persist in the client’s supported override, merge, or extended configuration, and verify their application order. Before editing, copy the current configuration for reference. After updating, check that proxy group names and rule targets still match.

Open the client’s configuration, subscription, or Profiles page and choose Import from URL. Paste the complete address into the input field and start the download. After a successful import, select the profile so it becomes the active configuration. Saving the URL without enabling the configuration will not apply its proxy groups or rules to traffic.

First confirm that the Clash core is running, then check that the system proxy switch and local mixed port match. A browser’s independent proxy, proxy extension, or security software may bypass the system settings. Disable these extra routes temporarily and test in the browser. If there is still no effect, verify that Windows proxy settings show the correct local address and port.

The system proxy usually requires permission for the client to change network settings. TUN may also require a network extension, helper service, or administrator credentials. After granting permission, return to the client and confirm that the switch remains enabled. If System Settings shows that an extension was blocked, allow the relevant item, then fully quit and restart the client.

Turn off TUN first. Use the client’s provided entry point to install its service mode, network extension, or virtual network adapter, then restart the client. On Windows, check driver installation and administrator authorization; on macOS, check network extension approval; on Linux, check CAP_NET_ADMIN, device permissions, and route-write permissions. Do not run multiple proxy tools that create virtual network adapters at the same time.

Android generally allows only one app to use the system VPN interface at a time. Disconnect other VPNs, accelerators, firewalls, or apps that filter traffic through a local VPN, then return to Clash and connect again. If always-on VPN is enabled, remove the previous app’s binding in the system network settings before authorizing the current client to establish a connection.

Update the subscription first and confirm that the configuration loads successfully. Then open the proxy groups and select an available node. Finally, enable the system proxy or TUN. This separates configuration retrieval, proxy selection, and traffic interception for easier testing. If something fails, disable them layer by layer in reverse order to identify whether the problem is with the subscription, node, or system interception.

Not necessarily. The address and method used for a latency test may differ from a real service connection, and a blocked test target can also produce a timeout. Try another test address or open the target website directly, then check the node protocol, port, and system time. If every node times out at once, prioritize checking the local network, DNS, subscription content, and core status.

A common setup uses mixed-port to accept both HTTP and SOCKS traffic. You can also configure port and socks-port separately. Choose ports that are not already in use on the device, and point the system proxy, browser, or other applications to the same port that is actually listening. Reload the configuration after changing a port, and check the firewall and port usage if necessary.

Fake-IP returns a virtual address first, then Clash restores the domain and matches it against rules. This usually reduces cases where applications bypass domain-based rules. Redir-Host returns the actual resolution result and can be more intuitive for some LAN devices and specialized applications. For games, LAN domains, or device-discovery problems, first add the relevant domains to the exclusion list instead of disabling DNS entirely.

Some UWP apps are restricted by the Windows app container and cannot directly access a local loopback proxy. Use the client’s UWP loopback tool, select the apps that need local proxy access, save the changes, and restart those apps. Do not select every item by default. Check the entries again if settings stop working after a system update or app reinstallation.

Confirm that the subscription URL is complete and contains no extra spaces, then open it in a browser to see whether it returns configuration content or a clear error. Next check the system time, current network, DNS, and client logs. If the browser cannot fetch it either, the problem is usually the subscription status or network path. If the browser succeeds but the client fails, inspect the client’s update proxy, User-Agent requirements, and configuration parsing errors.

Switch to direct mode first to confirm that the basic network is working. Then check the device time, whether the core is running, and whether the subscription was recently replaced. Check whether DNS resolves the node server address and whether the firewall is blocking the client. Simultaneous failure across all nodes is usually not a set of individual node failures, so avoid repeatedly deleting the configuration before identifying the cause.

The browser may be using its own proxy extension, while other applications neither read the system proxy nor fall under TUN. Check whether the browser has an independent proxy configured, then verify that the system proxy is enabled. For applications that do not support system proxies, use TUN when permissions and compatibility allow it. Also check whether the application forces a direct connection, a fixed proxy address, or custom DNS.

Turn off TUN and quit the client first, then confirm that basic connectivity returns. Next inspect the virtual network adapter, default route, DNS hijacking, and auto-route settings, and remove route or adapter conflicts left by other proxy tools. When enabling TUN again, start with the default configuration and no complex overrides. If the network remains disconnected after quitting the client, reset the system proxy and reconnect to the current network.

Rules that depend on GEOIP, GEOSITE, or rule sets may not load the latest classifications. In severe cases, the configuration may fail to start because a file is missing. Check the logs to determine whether the failure involves database download, path writing, or a rule reference. Then verify storage permissions and whether the update address is reachable. Reload the configuration after the update and confirm that the rule provider no longer reports an error.