Clash FAQ and Troubleshooting
Covers the kernel, subscriptions, nodes, system proxy, TUN, DNS, and Windows loopback restrictions. First identify which layer is failing, then change the corresponding setting.
Core concepts
Start by separating the kernel, client, subscription, and proxy modes. When these concepts are mixed together, problems are often assigned to the wrong layer.
How are Clash, the mihomo kernel, and graphical clients related?
mihomo is the kernel responsible for reading configuration, establishing proxy connections, applying routing rules, and handling DNS. Graphical clients such as Clash Plus, Clash Verge Rev, and FlClash add subscription management, node selection, log viewing, and system proxy controls around the kernel. When troubleshooting, distinguish interface problems from kernel errors: an open interface does not mean the kernel has started, and a successfully started kernel does not guarantee that system traffic is entering the proxy.
Where do subscription links come from, and does the client provide nodes automatically?
The client does not generate subscription links or include working nodes. Subscription URLs usually come from the network service provider you use, which manages account status, routes, and traffic quotas. Before importing one, make sure you copied the complete subscription URL—not a webpage address, order number, or individual node name. For renewals, suspended accounts, or route maintenance, contact the relevant service provider.
Which should you use: Rule, Global, or Direct mode?
Rule mode is usually best for everyday use. Traffic is matched against the configured rules from top to bottom and sent through proxy, direct, or reject policies. Global mode sends most connections through the currently selected proxy node and is useful for checking whether rules are causing an access problem. Direct mode mainly pauses proxying or provides a comparison test. Changing modes will not fix an inactive node or automatically change the rules in a subscription.
What is the difference between system proxy and TUN mode?
A system proxy uses the operating system’s HTTP or SOCKS proxy settings to handle applications that follow them. It is simple to configure and works well with browsers and common desktop software. TUN mode creates a virtual network interface and processes traffic at a lower level, covering apps, some games, and command-line tools that ignore system proxy settings. It usually requires administrator privileges and may conflict with other VPNs, virtual adapters, or security software.
Setup and configuration
Subscription imports, configuration parsing, and port listening happen before a connection is made. Resolve these errors first so node tests are meaningful.
Why are there no nodes after importing a subscription?
Open the configuration or subscription page, run an update manually, and check the update result instead of only watching the node list. If it is still empty, check for spaces at either end of the URL, incomplete copying, an expired subscription, and whether the current network can reach the subscription address. The server may also have returned a login page, error page, or empty configuration. Do not import a web dashboard URL as a subscription URL; they are usually different links.
What should you do if a subscription update fails or times out?
Open the subscription URL in a browser first and confirm that it returns configuration content or starts a download. If the browser cannot reach it either, check the network, account status, and service availability. If the browser works but the client fails, temporarily disable the system proxy and TUN and try again to prevent the request from being routed through the old configuration in a loop. Then check the client clock, proxy port, and certificate-related errors. Keep the status code and error lines from the log to distinguish a timeout, connection refusal, or authentication failure.
How can you locate a YAML parsing error in a configuration file?
YAML uses indentation to express hierarchy. Use spaces, keep indentation widths consistent at the same level, and never substitute tabs. Start with the line number shown in the log, then inspect upward for a missing colon, misplaced list dash, unclosed quote, or duplicate key. Keep a copy of the original file before editing. If the error came from a subscription update, download the configuration again instead of guessing line by line through generated content.
What should you do when startup reports address already in use or a port conflict?
This means another process is listening on mixed-port, port, socks-port, or the controller port. First close duplicate Clash clients, then check Task Manager or system processes for a leftover kernel. On Windows, use netstat -ano to find the process ID listening on the port; on macOS and Linux, use lsof -i to identify the process. If the port cannot be freed, change the configured listening port to an unused value and update applications that require a manually entered proxy port.
Usage tips
A working node is only the starting point. Whether traffic passes through the kernel also depends on the app’s proxy method, system permissions, DNS, and rule matching.
What should you check first when every node shows a timeout?
Update the subscription and confirm that the local network works, then test only one node to avoid misleading results from concurrent tests. Check that the system clock is accurate, since clock drift can cause TLS connections to fail. Next, switch networks—for example, from a company network to a mobile hotspot—to rule out local restrictions. If every node times out on different networks, the subscription routes or account status are more likely at fault. If only some nodes time out, avoid those routes.
What should you do if the system proxy is enabled but the browser still connects directly?
Confirm that the client kernel is running, that the active policy group has a working node selected, and that the operating system proxy points to the local machine and correct port. A browser proxy extension, enterprise policy, or manual proxy setting may override the system proxy; disable it temporarily and test again. You can also use a page that displays your exit address for comparison, but do not rely only on the client’s toggle state. If the browser clearly ignores the system proxy, use its own proxy settings or consider TUN mode.
How do you handle insufficient permissions when enabling TUN mode?
TUN creates a virtual network interface and changes routing. On Windows, the client usually must run as administrator; macOS may request the system password and approval for a network extension; Linux requires the appropriate network-management permissions. If it still fails after authorization, check whether an old virtual adapter, another VPN, a container network, or security software is occupying the interface. Close conflicting programs before restarting the client, and do not enable multiple tools that modify the default route at the same time.
What should you do if Fake-IP breaks LAN devices or specific websites?
Fake-IP returns a mapped address for a domain, then the kernel restores the domain and applies rules. LAN services, printer discovery, corporate intranets, and some applications that depend on real DNS responses may therefore behave unexpectedly. First confirm that the issue occurs only in Fake-IP mode. Then add the relevant domains to fake-ip-filter, or configure direct DNS and direct rules for LAN domains. Do not add an overly broad wildcard range, as it can weaken domain-rule matching and increase the risk of DNS leaks.
Troubleshooting
Narrow the problem down layer by layer, from the basic network to the application entry point. Change only one variable at a time; the first error in the log is usually more useful than the follow-on failures.
Clash is connected, but no websites open. What should you do?
Check the path layer by layer: disable the proxy first to confirm that the basic network works, then start the kernel without enabling the system proxy. Next, select a node that has passed testing, and finally enable the system proxy or TUN. If the connection drops immediately after proxying is enabled, check whether the log reports DNS failure, connection refusal, or an incorrect policy group selected by the rules. Also confirm that the listening port is not in conflict, the configuration loaded successfully, and other VPNs are temporarily disabled. Enabling components step by step is more useful than repeatedly reinstalling the client.
What should you do if Windows UWP or Store apps bypass the Clash proxy?
Some UWP apps are affected by Windows loopback restrictions and cannot directly access a proxy listening on the local loopback address. As a result, the browser may work while Store apps fail to connect. In the client’s UWP loopback tool, select the target apps and save the exemption, or use Windows CheckNetIsolation for the relevant package. Fully close and reopen the app afterward. If the app can connect when TUN is enabled, you usually do not need to configure a loopback exemption as well.
The browser works, but command-line tools, games, or other apps cannot connect. What should you do?
This usually means the browser reads the system proxy or has a proxy extension, while other programs do not use the same setting. Command-line tools may require separate HTTP_PROXY, HTTPS_PROXY, or SOCKS settings, while games and some desktop programs may support direct connections only. Check whether the application has its own proxy option first; if not, use TUN to capture its traffic. Also verify that the rules have not mistakenly classified the domains or IP addresses used by the application as Direct or Reject.
How can you restore the proxy after sleep or a network switch?
Waking from sleep, switching Wi-Fi, and reconnecting Ethernet can change interfaces, DNS, and the default route, leaving TUN or the system proxy with stale state. Disable the system proxy and TUN, wait for the network to recover, and enable them again. If that does not help, restart the kernel rather than merely closing the window. Check that the intended configuration is still selected and retest a node. If this happens often, update the client, avoid multiple network-management tools taking over routing at once, and consider refreshing the subscription and DNS manually after wake-up.