Clash FAQ: Subscriptions, System Proxy, and Troubleshooting

Clash is a general term for rule-based network proxy tools. The original open-source core has stopped receiving updates, and the mihomo core (formerly Clash Meta) now carries on active community maintenance. Clients such as Clash Plus, Clash Verge Rev, and FlClash are all graphical wrappers built on top of the mihomo core: the core handles protocol implementation and traffic routing, while the client handles configuration management and the interface, each with its own job.

All clients load the same type of configuration file, and the difference mainly lies in platform coverage and interface features. Clash Plus covers Windows, macOS, Android, and iOS, good for using one setup across multiple devices; Clash Verge Rev has a full-featured desktop app with TUN mode and script extensions; FlClash is cross-platform with a clean interface. The same subscription works across all of them, so pick the recommended option for your platform on the download page first, and switch later if needed with no migration cost.

The three are nested inside each other: a subscription link is a downloadable remote address that returns a complete configuration file (profile); the config file contains a proxies node list, proxy-groups, and a rules section; a node is the smallest connection unit within the config. Updating a subscription re-downloads the whole config file, refreshing nodes and rules together, with no need to maintain them one by one.

The repository has been archived and no new releases are coming. Already-installed versions still run, but they won't get new protocol support or compatibility fixes, and there's no official channel for issues. On Windows, moving to Clash Plus or Clash Verge Rev is recommended; both can import your existing subscription link directly, so migration is just re-importing the subscription once.

Rule mode matches traffic against the rules list one by one in the config, routing each match to its designated outbound, so proxying and direct connections can coexist — this is the recommended everyday mode. Global mode sends all traffic through a proxy node with no routing at all. Direct mode sends all traffic without any proxy. You switch between the three modes in the client's outbound mode or proxy mode setting, and the change takes effect immediately.

SmartScreen shows a default risk warning for installers with a low signing reputation — that's a reputation-scoring mechanism, not a virus verdict. Click "More info" in the prompt, then choose "Run anyway" to continue. If the installer gets quarantined by security software directly, restore it from quarantine and add the install folder to the trusted list before running the installer again.

The first time you open an app not distributed through the App Store, Gatekeeper blocks it by default. There are two fixes: go to System Settings → Privacy & Security, scroll to the bottom to find the blocked app entry, and click "Open Anyway"; or right-click the app icon in Finder, choose "Open", and confirm in the dialog. Also make sure you download the installer matching your chip — Apple Silicon or Intel — the download page lists both separately.

The Android client takes over traffic through the system VpnService interface, so the first time you start the proxy, the system shows a "connection request" authorization dialog; tapping OK and seeing a key icon in the status bar means it's working normally. This authorization only sets up a virtual network interface on the device — traffic is still handled according to the rules in the config file. If you tapped decline by mistake, restarting the proxy in the client will trigger the prompt again.

Copy the subscription URL from your provider, go to the Profiles page in the client, choose "Import from URL" or "New Profile", paste it, and click download — a new entry appears in the list, and selecting it completes the setup. After importing, check the proxy page to confirm the node list isn't empty, then turn on the system proxy to start using it. Step-by-step screenshots for each platform are on the tutorial page.

On iOS, Clash Plus is installed through the App Store: search for the app name in the store, or go straight to the store listing from the iOS tab on this site's download page; app details are available on the official site clashplus.io. After installing, open the app and import your subscription link — the first time you start the proxy, allow the VPN configuration prompt from the system to begin using it.

The proxy page in the client usually has a latency test button; clicking it sends an HTTP probe to every node and shows the response time in milliseconds — lower means faster response. Note that latency only reflects handshake speed, not bandwidth, so when video is buffering, switch nodes based on actual playback tests rather than the latency number alone. For automatic selection, use the url-test proxy group in the config, which lets the core test speeds on a schedule and auto-switch to the fastest node.

select is manual — once you pick a node, it stays fixed, which suits cases needing a stable outbound IP, like logging into accounts sensitive to IP changes. url-test tests latency on a schedule and auto-switches to the lowest-latency node, good for everyday browsing where speed matters more than a stable exit IP. There's also fallback, which fails over through the list in order, and load-balance, which spreads connections across multiple nodes. Most subscriptions provide several group types, so switch between them in the client as needed.

Turn on "Allow LAN" in the client settings, note this machine's local IP and mixed port (commonly 7890), then enter that IP and port in the Wi-Fi proxy settings on your phone, TV, or other device. This requires both devices to be on the same local network and the firewall on this machine to allow that port; after the laptop sleeps or the IP changes, you'll need to check the address again.

Yes. Most clients offer an update interval setting in the profile details, re-downloading the subscription every set number of hours or days, and some also support auto-update on launch. A 12-to-24-hour interval is a good default — pulling too often can hit the subscription server's rate limit and cause update failures instead. When you need an immediate refresh, use the manual update button on the profile page.

The system proxy only works for apps that respect proxy settings (browsers and most common software), it's simple to set up, and it's enough for everyday browsing. TUN mode creates a virtual network interface that takes over all traffic, covering command-line tools and games that ignore system proxy settings, but it needs administrator or system-extension permission. You don't need both at once: use the system proxy for regular use, and switch to TUN when you need full traffic coverage.

First open the subscription link directly in a browser to check: a 404 or error message means the link has expired or the traffic quota is used up, and you need to reset the subscription with your provider; if it returns content but the client fails to parse it, the server is likely returning an incompatible format based on the User-Agent — try setting the UA to clash in the import settings and retry; if the download keeps timing out, the local network can't reach the subscription server, so try updating over a different network temporarily. The full checklist is in the subscription-failure troubleshooting article on this site's blog.

Check these in order: the "System Proxy" toggle in the client is actually turned on; the OS proxy settings show address 127.0.0.1 with a port matching the client's listening port; the browser doesn't have an extension overriding proxy settings (such extensions should be set to follow the system proxy); no other proxy software left leftover system proxy settings after quitting. Restart the browser and test again once all of these are confirmed.

Windows blocks UWP apps (Store apps and some system components) from accessing the local loopback address by default, so they can't reach the local proxy port and need a loopback exemption. Some clients include a built-in "UWP loopback exemption" tool in settings — check the target app and save to apply it. Alternatively, run the CheckNetIsolation LoopbackExempt command with administrator rights to allow apps one by one.

There are three common causes: insufficient permissions — Windows needs the client run as administrator or the system service installed, and macOS needs the system extension approved in System Settings; DNS not being taken over — enable DNS hijacking in TUN settings, or point the system DNS to the address the core provides; or a conflict with other virtual network adapter software. Turn off TUN first to confirm the network recovers, adjust settings one at a time, then re-enable and verify.

Narrow it down step by step: first turn off the proxy and visit a normal website directly to confirm the local network itself is fine; then update the subscription once to rule out stale node data across the board; next test nodes on different protocols or ports separately to check whether your ISP is restricting specific ports; if everything still times out, it's most likely an outage on the provider's side, so contact the provider directly. Repeatedly running latency tests while everything is down doesn't help much — waiting for recovery or switching networks works better.