Clash FAQ

Clash is the original proxy core developed by Dreamacro; it stopped receiving updates and was archived in 2023. Clash Meta is a community-driven fork built on top of it, adding protocols and features like VLESS, Hysteria2, and TUN mode. Starting in 2024, Clash Meta was renamed mihomo and continues to be actively developed. Nearly every desktop and mobile client still maintained today is built on the mihomo core, so just look for "mihomo core" when downloading. For a full breakdown of the differences, see our article "Clash Kernel Differences Explained."

Yes, it's free. The mihomo core is open source under the GPL-3.0 license, and the mainstream GUI clients (Clash Verge Rev, FlClash, Clash Meta for Android, etc.) are likewise free and open source — there's no cost to download, use, or update them. The client itself doesn't come with any proxy nodes, so you'll need to supply your own valid subscription link. Installers are available in the Download Center.

The client is just the forwarding engine — you still need a valid subscription with proxy nodes. The standard workflow has four steps: install the client → import your subscription link → pick a proxy mode (Rule mode is recommended for everyday use) → enable the system proxy or TUN mode. Once that's done, sites outside your region will route through the proxy. For a step-by-step walkthrough, see our Getting Started guide.

Rule mode matches traffic against a rule set — domestic sites connect directly, sites abroad go through the proxy. It's the recommended mode for daily use. Global mode forces all traffic through whichever node is currently selected, handy for quick testing or as a fallback when rules aren't behaving. Direct mode routes nothing through the proxy at all, effectively pausing it. All three modes can be switched with one click from the main window, and switching doesn't touch your subscription or node settings.

No. All routing and forwarding happens locally on your machine — the client never uploads your browsing activity to any server. The Connections panel in the UI only shows domains and matched rules for currently active connections, purely for troubleshooting, and it clears the moment you close it. The party that actually handles your encrypted traffic is whoever provides your subscription's proxy nodes, so it's worth vetting that provider's trustworthiness yourself.

That's just SmartScreen's standard warning for newly released installers that haven't racked up many downloads yet — it's not a virus alert. Click "More info" then "Run anyway" to proceed. Since open-source clients ship frequent updates, it's normal for fresh releases to trigger this warning early on. Installers from our Download Center match the official release channels exactly.

Two fixes to try: 1) Open System Settings → Privacy & Security, scroll to the bottom where the blocked app is listed, and click "Open Anyway." 2) If it still says the app is damaged, run sudo xattr -rd com.apple.quarantine /Applications/AppName.app in Terminal to strip the quarantine flag, then relaunch. On Apple Silicon Macs, make sure you download the arm64 build — installing the wrong architecture will simply fail to launch.

The general flow: copy your subscription link → open the client's Profiles/Subscriptions page → create a new profile, paste the link, and name it → save, then click "Update" to pull the nodes → select that profile to activate it. Clash Verge Rev lets you drag a link straight into the window to import it; FlClash uses the plus button on the Profiles page. For platform-specific steps, see our Getting Started guide.

Check these four things in order: 1) Subscription status — log in to your provider's dashboard to confirm it hasn't expired or run out of data. 2) Update channel — switch the subscription update method to "update via proxy," or flip to Global mode before clicking update. 3) Local network — disable the proxy and try opening the subscription link directly in a browser to see if it loads. 4) System clock — a clock that's too far off can break TLS handshakes; sync it and try again. These four steps cover the vast majority of update failures.

Three usual suspects: 1) A proxy-management browser extension is overriding the system proxy — disable it and test again. 2) Leftover entries in the system proxy's bypass list ("Don't use proxy for these addresses") still include the target domain — clear it and retry. 3) Port mismatch — make sure the client's mixed port (7890 by default) matches the port set in your system proxy settings. If it's still not working, switch to TUN mode, which intercepts traffic at the network adapter level and doesn't rely on the system proxy at all.

Leave it on Rule mode long-term: domestic sites stay fast via direct connection, and sites abroad automatically route through the proxy. Switch to Global mode or enable TUN only when you need it — say, an app that ignores the system proxy, or testing a node — then switch back afterward. Direct mode is mainly useful as a control test when you're trying to figure out whether an issue is proxy-related. Switching modes never touches your routing rules themselves, so it's safe to change anytime.

Proxy groups are collections of nodes with a shared selector. Most subscription profiles ship with an "Auto" group (picks the fastest node by latency) and a "Select" group (manual choice). On the Proxies page, click a group name to expand its node list and tap one to switch; the speed-test button can benchmark latency across the whole group at once. Pin a specific node by selecting it in the manual group, or just let the auto group handle it if you don't want to manage it yourself. For advanced proxy-group setups, see our article "Clash Rule-Based Routing in Practice."

Add a direct-connect rule near the top of the rules section in your config: DOMAIN-SUFFIX,example.com,DIRECT sends that entire domain (subdomains included) straight through; PROCESS-NAME,AppName.exe,DIRECT does the same for a specific process (requires the mihomo core). Rules are matched top to bottom and stop at the first match, so custom rules must sit above the ones from your subscription — reload the config after editing for it to take effect. Just swap in your target domain for example.com.

Subscription conversion is an online service that rewrites node subscriptions from other formats (V2Ray, Surge, etc.) into Clash-compatible config format. You only need it if your provider doesn't offer a native Clash link — most mainstream providers give you a Clash/mihomo subscription URL directly in their dashboard, and that's always the better option. Third-party conversion services process your entire subscription, including your node details, so avoid them unless you genuinely need to.

Yes, but not often. The mihomo core relies on GeoIP to determine where an IP address is located and GeoSite to classify domains (like geosite-cn) — the accuracy of your domestic/international routing depends directly on these two datasets. Most clients have an "Update GeoIP/GeoSite" button in settings; update roughly once a month, or right away if routing starts behaving oddly. If an update fails, try a different network or enable the proxy first and retry.

Diagnose this in two layers. Subscription layer: an expired subscription, exhausted data, or a provider outage can take down every node at once — check your provider's dashboard first. Local layer: a clock that's out of sync can break TLS, and DNS poisoning can cause node hostnames to resolve incorrectly. Suggested order: sync your system clock → update your subscription → switch to Global mode and test a site outside your region → if it's still not working, check the client logs. "dial tcp timeout" usually points to dead nodes, while x509 certificate errors usually point to a clock issue. For DNS specifics, see our article "Clash DNS Configuration Explained."

TUN mode needs to create a virtual network adapter, which requires system-level permissions. On Windows: right-click and "Run as administrator," or install the service mode from settings (Clash Verge Rev offers a one-click installer, after which you can toggle TUN with regular permissions). On macOS: enter your login password when prompted to authorize it. On Linux: grant the core binary the cap_net_admin capability, or run it as root. If it still fails, check whether another VPN or accelerator app is running at the same time — conflicting virtual adapters need the other app closed first.

This comes from Windows' loopback restriction on UWP apps — it's not a client bug. Two fixes: 1) Use the client's built-in loopback exemption tool (Clash Verge Rev has one in Settings), check the target app, and save. 2) Just switch to TUN mode, since it intercepts traffic at the network adapter level and isn't affected by the loopback restriction. The second option is recommended long-term — set it up once and it just works from then on.

This usually happens when a rule mistakenly routes these sites through a proxy node, and the site itself blocks access from foreign IPs. To fix it: 1) Confirm you're in Rule mode, not Global mode. 2) Check the Connections panel to see which rule matched that domain — if it's going through the proxy, add a DIRECT rule for that domain near the top of your rule list. 3) For payment pages, you can temporarily switch to Direct mode to complete the transaction. See our article "Clash Rule-Based Routing in Practice" for rule-writing examples.

Port conflict: on Windows, run netstat -ano | findstr 7890 to find the process using that port and close it, or change the mixed port in the client's settings to something else free (like 7897), then update the port in your system proxy settings to match. Proxy settings resetting: if you have multiple proxy or accelerator apps installed, they can fight over the system proxy toggle — keep just one running at a time. On managed work computers, group policy can also periodically reset proxy settings; in that case, switching to TUN mode is a more reliable workaround.