Clash FAQ

The original Clash for Windows project is discontinued. The old installer will not receive support for new protocols, core fixes, or Windows compatibility updates. A working setup is not necessarily a good choice for a new device. Before installing a replacement, compare Clash Plus, Clash Verge Rev, and FlClash, then check your system architecture and config format. Before migrating, keep your subscription source, custom rules, and proxy group selections. Don’t overwrite the old folder or assume every client can read configs supported by the old core.

The client reads the config, listens on local ports, and forwards connections; it is not a proxy service by itself. Subscriptions usually come from a service provider and contain nodes, proxy groups, and rules. They may also be subject to plan limits, expiration dates, or data caps. Make sure you have a config subscription URL supported by your client—not a sign-in or payment page. A subscription link may grant access to your account, so protect it like a password. When troubleshooting, share the error details, not the full link in public comments or with an unfamiliar conversion site.

A desktop client provides the interface for importing configs, selecting proxy groups, and managing the system proxy. The core handles connections, while a YAML config defines ports, DNS, nodes, and rules. The old Clash for Windows core is not equivalent to newer clients that use Mihomo; some fields and protocols work only with specific cores. If a config fails to parse, first check the client’s core and which fields it supports instead of repeatedly reinstalling it. Downloading a core on its own does not provide a full desktop interface or subscription management.

That depends on your provider’s device limits, the subscription format each client accepts, and the protocols and fields supported by each platform’s core. A successful import on Windows does not guarantee that a mobile client will accept everything. Choose the client-specific format on your provider’s site, then import it on each device. If you exceed connection or device limits, you may need to change your plan. For iOS, check the download page for the Clash Plus App Store link and the official site, clashplus.io. Mobile traffic routing works differently from the Windows system proxy.

You can’t tell from the mode name alone. Global selects the policy for connections that reach the core; it does not make every app send its traffic to the core. TUN uses a virtual network interface to capture traffic that matches its routing rules, but route exclusions, DNS, IPv6, and other VPNs can affect what gets through. First check whether traffic reaches the client, then see which policy handles it. For sensitive activity, verify the paths used by the specific app, DNS, and IPv6 separately. A changed browser IP does not prove that every connection on the PC is being captured.

Open Windows Settings and go to System > About to check your system type and processor. Most Intel and AMD desktop PCs use x64; for ARM-based devices, choose an ARM64 package if the client offers one. Don’t infer the architecture from the Windows 10 or Windows 11 label alone. Renaming an installer cannot add support for an architecture missing from the download page. If the app won’t launch after installation, note the error and check your Windows version, architecture, and runtime requirements before disabling security protections or trying random compatibility settings.

In Clash for Windows, paste the subscription URL into Profiles and download it. Once the config appears, click it to select it. Other clients usually label this section Config or Subscriptions. Next, open Proxies, make sure the proxy groups and nodes have loaded, and choose a policy. Finally, return to General and enable System Proxy. Visit a site to test it, then check Connections or Logs for the request. A successful download alone isn’t enough: an unselected config, a proxy group still set to DIRECT, or a disabled system proxy can leave traffic going direct.

First, make sure the client supports TUN on your version of Windows, then check that its service mode is installed and running. Older Clash for Windows versions typically need Service Mode configured first; newer clients may have their own service installer. Don’t use service components from different clients interchangeably. Follow the client’s instructions to grant administrator access, then try enabling TUN again. If it still fails, check service startup and virtual network adapter logs, and temporarily disable other VPNs for comparison. On a work PC managed by your organization, contact your administrator rather than bypassing its access controls.

Start with the line number and field named in the error. YAML structure depends on indentation: use spaces, never tabs, and keep fields at the same level aligned. Then make sure the download is the config itself—not a login, expiration, or verification page. If the syntax is valid but the client reports an unknown proxy type or unsupported field, the core may be outdated or the subscription format may not match. Keep a copy of the original and make one small change at a time. Don’t use global find-and-replace to remove error fields; that can break proxy group references and cause new errors.

Close any duplicate proxy clients first and check whether the same app is running twice. If you need multiple clients, assign each a different listening port and change the relevant field in the active config or the client’s override settings. mixed-port shares one port for HTTP and SOCKS; port and socks-port are separate listeners, so don’t set them as though they were the same option. Reload the config and check that the logs no longer report a bind error. Then update the system proxy and any manually configured proxy addresses in browsers or terminals. Changing the port in the client doesn’t automatically update other apps.

For a config with a complete set of rules, start with Rule: connections are matched against rules in order and sent to the relevant proxy group. Global is useful for briefly checking whether a routing rule is causing a problem, but you still need to select a working proxy in the global group. Direct sends connections that reach the core straight to their destination. Changing modes won’t fix an expired subscription or route apps that never reach the client. Once you’ve finished troubleshooting, restore your usual rule-based mode and check which rule and policy match the destination. Don’t use Global indefinitely to mask routing rules that need fixing.

System Proxy mainly changes Windows proxy settings, and only apps that honor those settings will use it. In Windows Settings, go to Network & internet > Proxy and check that the manual proxy address matches the client’s port. Then see whether a browser extension overrides the system settings. Terminal tools, development apps, and games may have their own proxy settings or ignore the system proxy entirely. Make a request in the affected app and watch Connections: if nothing appears, check how the app connects; if a connection appears but fails, check the rules, node, and DNS. Consider TUN if you need to capture traffic from more apps.

Some UWP apps are isolated from the network by AppContainer and can’t access a proxy listening on the local machine. First confirm that a regular browser can connect through the same proxy, then check whether the issue affects only certain apps. The UWP Loopback tool included with older Clash for Windows versions can grant loopback exemptions to selected apps and may require administrator permission. Select only the apps you need, and check again after app updates. A loopback exemption is not a general connectivity fix. If the app still fails with TUN enabled, check its sign-in, the system clock, service status, and connection logs.

Start with Windows usually controls whether the client launches when you sign in. It doesn’t guarantee that the subscription is up to date, a config is selected, or System Proxy or TUN has been restored. Check that the client hasn’t been disabled under Startup apps in Task Manager, then restart Windows and confirm that it actually launches. If it does but can’t connect, check the service mode, active config, and proxy group selection. The network may also be unavailable when the client tries to update its subscription at startup. Moving a portable version can leave a startup entry pointing to the old location; set it up again from the new folder and remove duplicate entries for installed and portable versions.

Allow LAN only lets devices on your local network reach the listening service. Your phone and PC must be able to communicate over the network, and you must enter the PC’s local IP address and the correct HTTP proxy port—not 127.0.0.1. Also check the listening address, Windows Firewall inbound rules, and whether the router has guest networking or client isolation enabled. Expose only the ports you need on a trusted network, and turn this off when using public Wi-Fi. A manual proxy set for the phone’s Wi-Fi may not cover every app and does not enable TUN on the phone; test it in the apps you want to use.

Keep your current working config for now; don’t delete it straight away. Check the update notice or logs in Profiles: 401 or 403 may indicate an access issue, an invalid link, or site blocking; for 404, verify the URL; for a timeout, check your network and DNS first. Sign in to your provider’s account page to check the expiration date, data allowance, and subscription URL. If content downloads but won’t parse, check whether it’s a web page and whether the subscription format matches the core. Updates may rely on the current proxy route; if your client supports it, try updating directly or switching to a working node. Don’t give your subscription URL to an unfamiliar conversion service.

Don’t judge by a single speed test. Check that your PC’s clock is accurate, your internet connection works, and the subscription hasn’t expired, then try other nodes and another network. Latency tests depend on the test URL, timeout, and request method, so a failed test doesn’t necessarily mean every real connection will fail. Make an actual request to a site and use Logs to distinguish a DNS failure, connection timeout, or authentication error. If every node fails on multiple networks, send your provider the time of the issue and redacted error details. Don’t share server credentials or repeatedly reinstall the client based on one latency result.

Check the connection log to confirm that the destination domain reaches the client and see which policy matches it. Then look for failed DNS queries in the logs. Browser Secure DNS, system DNS, TUN DNS interception, and the config’s DNS rules can follow different paths; changing a single public DNS address doesn’t necessarily fix the issue. Check the current client’s documentation for support for settings such as nameserver, fallback, and fake-ip, and verify that IPv6 follows the expected route. Interpret DNS test results in the context of the actual resolver and routing rules. A website may also be unavailable because of node restrictions, cached data, or an issue with the site itself.

In Windows Settings, go to Network & internet > Proxy and turn off any leftover manual proxy, keeping settings required by your organization. Alternatively, reopen the client, turn off System Proxy, and exit normally. If you used TUN, make sure the client has disabled it and released its routes. Check whether other VPNs are still running. If your browser works but the terminal doesn’t, check for a manual proxy saved in the terminal session or tool. Don’t start by removing network adapters or resetting all network settings. Clear only the settings you know are left over, so you don’t disrupt a work VPN or virtual machine networking.

Include your operating system and architecture, client name, core details, active mode, and an approximate time when the issue occurred. Capture a short log while reproducing the problem with steps you can repeat. Say whether all apps fail or just one, and include the results of any comparisons you’ve tried. Before sharing, remove full subscription URLs, account identifiers, node passwords, access tokens, and destination addresses that aren’t needed. Don’t upload the entire config folder; check screenshots and text for credentials first. Keep the original logs for your own reference and share only the details needed to diagnose the issue.