Clash FAQ

Clash is an umbrella term for a family of open-source, rule-based proxy clients. Its core function is to route a device's network traffic to different outbound destinations according to the rules in a configuration file. The software itself does not provide any node services; node information comes from subscriptions or configuration files that users import themselves.

Most mainstream clients today are built on the mihomo core and support five platforms — Windows, macOS, Android, iOS, and Linux — all available as free downloads.

Development of the original Clash core stopped in 2023, and its repository was removed. The community continued maintenance through the Clash.Meta fork, which was later renamed mihomo. mihomo remains compatible with the original configuration file format while adding support for newer protocols such as VLESS, Hysteria2, and TUIC.

All actively maintained GUI clients today — including Clash Plus, Clash Verge Rev, and FlClash — use the mihomo core under the hood. For how these three relate and where their features diverge, see the protocol handbook.

Clash for Windows has been discontinued, and its repository no longer receives updates; continuing to use it means falling behind on support for newer protocols. You can migrate to Clash Plus or Clash Verge Rev, both built on the mihomo core. Your subscription URL and configuration format carry over directly — just re-import your subscription, no rule rewriting needed.

Available clients for each platform are listed by platform on the download page; for a side-by-side comparison, see our client comparison page.

All Clash clients and the mihomo core are open-source and free to download and use — there's no license fee involved.

What you actually pay for is the node service itself: subscription links are provided by third-party providers, and their pricing and service quality are entirely up to them, unrelated to the client software or this site.

Rule mode checks each connection against the configuration file's rules one by one, deciding whether it goes direct or through a proxy — this is the recommended mode for everyday use. Global mode routes all traffic through whichever node is currently selected, useful for quickly testing a node's connectivity. Direct mode sends all traffic without any proxy.

You can switch modes from the outbound mode or proxy mode option on the client's main screen, and the change takes effect immediately without restarting.

Copy the subscription link from your provider's user dashboard, open the client's configuration or subscription page, choose Import from URL, paste the link, and confirm — the client will download the configuration automatically. Once imported, you'll see the node groups appear on the proxy page.

It's also worth turning on auto-update for the subscription, with an interval of 12 to 24 hours. For the full step-by-step walkthrough, see our Getting Started guide.

SmartScreen shows a "Windows protected your PC" warning for open-source software that hasn't purchased a commercial signing certificate — this is a routine signature-related notice, not a virus detection. Click "More info," then "Run anyway" to continue installing.

If your antivirus flags a false positive, add the install folder to its exclusion list. Just make sure the installer actually came from our download page or the client's official release channel before you allow it through.

macOS Gatekeeper blocks apps that aren't distributed through the App Store. If it's blocked on first launch, go to "System Settings → Privacy & Security," scroll down to find the blocked app, and click "Open Anyway"; alternatively, right-click (or Control-click) the app in Finder and choose "Open."

When downloading, be sure to pick the right build for your chip: arm64 for Apple Silicon Macs, x64 for Intel Macs.

Yes, this step is normal and required. The Android version of Clash uses the system's VpnService API to set up a local virtual network adapter that intercepts app traffic. The first time you start the proxy, the system shows a "Connection request" permission dialog; tap OK, and a key icon will appear in the status bar, confirming the virtual adapter is active.

This virtual adapter only operates locally on the device — the actual traffic exit point is still determined by whichever node you've selected.

Check these three things in order: first, whether the subscription link was copied in full — a missing trailing parameter can cause the server to return an empty configuration; second, whether the subscription has expired or run out of data, which you can verify by logging into your provider's website; third, whether the subscription is actually in Clash format.

Some providers default to a generic share link, so you may need to select the Clash-specific subscription URL on their site, or convert the subscription format before importing.

Find the subscription entry on the configuration or subscription management page, enable auto-update, and set an interval — 720 or 1440 minutes are common choices. When a provider changes node domains or ports, the old configuration can stop working entirely, so keeping auto-update on saves you from having to refresh manually every time.

Many clients also offer an "update on launch" option — it's worth enabling that too, so you're always running the latest node info at startup.

System proxy settings only affect programs that actively read them — command-line tools, some games, and background services will bypass it entirely. If you need traffic from those to go through the proxy too, turn on TUN mode: the client creates a virtual network adapter and intercepts all traffic at the network layer. On Windows, the first time you enable it you'll need to install a system service or run the app as administrator.

For everyday browser use, system proxy is enough — see our protocol handbook for a closer look at how the two approaches differ.

In Rule mode, add a rule near the top of the rules section in your configuration file, for example DOMAIN-SUFFIX,example.com,DIRECT, to send that domain and its subdomains direct. Clash matches rules top to bottom and stops at the first match, so custom rules need to go above any rules that came with your subscription.

To bypass by app instead, Android has a per-app proxy feature where you can simply check off the apps you want to exclude.

In the client's settings, turn on "Allow LAN connections," then note your device's LAN IP address and mixed port (7890 is the common default). On other devices on the same network, point their HTTP or SOCKS proxy settings to that IP and port.

Just make sure your firewall allows that port through, and only enable this on a trusted home or office network.

Work through these four checks in order: confirm a node is actually selected in the client and that it passes a latency test; check whether the system proxy port matches the client's listening port — a port change by other software is a common culprit; disable any leftover proxy extensions in your browser, since overlapping proxy settings can conflict.

Finally, switch temporarily to Global mode to test — if that works but Rule mode doesn't, the issue lies with rule matching, so update your subscription or review your custom rules.

Start by running a latency test on the node group in the client. If everything times out: switch to Direct mode to confirm your own network connection is working; update your subscription, since your provider may have migrated to new routes entirely; and check that your system clock is accurate, as some protocols are sensitive to time drift and can fail the handshake if it's off by even a few minutes.

If none of that helps, contact your provider to check the server-side status.

A timeout usually means the subscription URL itself is being blocked on the network — try selecting a working node first, enable the option in the client's settings to fetch subscription updates through the proxy, then retry.

A 403 error usually means the subscription token has expired or the device limit has been reached, so you'll need to reset the subscription in your provider's dashboard and re-import it; a 404 means the link has changed, and you'll need to grab the new URL.

UWP apps are blocked by default from accessing the local loopback address due to Windows' network isolation feature, so even with the system proxy enabled, these apps can't reach the local proxy port.

You can use the client's built-in UWP loopback exemption tool to select the app and lift the restriction — many clients offer this under Settings or a Tools menu. Alternatively, run CheckNetIsolation LoopbackExempt -a -n=应用包名 as administrator to exempt apps individually.

This is usually caused by the system's battery-saving features killing background processes. To fix it: add the client to your battery optimization exclusion list and set it to "unrestricted"; lock the app in the recent apps view; allow it to auto-start and run in the background in system settings; and on some device brands, you may also need to whitelist it separately in their own security center app.

Keeping the persistent notification visible also significantly reduces the chance of the process being killed.