Clash FAQ

Clash is the name of a rule-based proxy core. After the original project stopped maintenance, the community fork Clash Meta continued development and was renamed Mihomo. Mainstream clients today (Clash Plus, Clash Verge Rev, FlClash, etc.) all bundle the Mihomo core, and the config file format stays backward-compatible, so a "Clash config" works across all of them.

A subscription link is a URL that returns config data containing nodes and rules when accessed. Your client fetches this URL on a schedule to stay in sync with the latest nodes. Providers give you this link in their user dashboard, and self-hosted users can generate their own.

Treat a subscription link like a login credential — never paste it publicly in forums or chat groups.

Rule mode matches traffic against the rules in your config file one by one — a DIRECT hit goes straight through, a proxy-group hit routes through a node. It's the recommended mode for daily use. Global mode skips rule matching entirely and sends all traffic through the selected node. Direct mode sends all traffic without any proxy.

When troubleshooting, switching temporarily to Global or Direct helps isolate the problem; otherwise, stick with Rule mode.

No. Clash-based clients are just traffic forwarding and rule-routing tools — right after install, the config is empty, and you need to import a subscription or add node details manually before it works. You'll need to source nodes yourself: buy a subscription from a proxy provider, or run your own proxy server and plug the connection details into your config.

Free nodes floating around online are usually unreliable and may log your traffic, so use them with caution.

GEOIP is an IP-location database — rules like GEOIP,CN,DIRECT use it to check whether a target IP belongs to mainland China. GeoSite is a domain classification database that groups common websites by category. Both are the underlying data behind rule-based routing, and most clients have an update button in settings. An outdated database can cause websites to get routed incorrectly, so it's worth updating every month or two.

Clash Plus is the top pick — install and go, with subscription import and the system proxy toggle both right on the home screen, which suits most users. If you want more customization (scripts, external controller, merged configs), go with Clash Verge Rev. FlClash has a clean interface and works across platforms. The older Clash for Windows is no longer maintained — its core and rule data haven't been updated in a while, so it's not recommended for new installs.

All installers are organized by platform on the download page; see Client Picks for detailed comparisons.

This is Gatekeeper blocking an app that wasn't distributed through the App Store — the installer isn't actually damaged. Fix: open Terminal and run sudo xattr -rd com.apple.quarantine followed by the full app path (for example, /Applications/Clash Verge.app), enter your password, then reopen the app.

Alternatively, go to "Privacy & Security" in System Settings, find the blocked-app notice, and click "Open Anyway."

Check these four things in order: 1) the link was copied incompletely or has extra spaces — go back to the dashboard and copy it again; 2) the subscription's data has run out or expired — check the status in the dashboard; 3) the subscription returns a format your client doesn't recognize, such as pasting a V2Ray Base64 subscription directly into a Clash client — you'll need a subscription converter to turn it into Clash YAML; 4) the subscription domain is being blocked on your network — try updating once on a different network to confirm.

TUN mode creates a virtual network adapter and routes all system traffic through the core, and creating a network adapter is a system-level operation: Windows needs the client run as administrator or its service component authorized, macOS needs you to approve a network extension, and Linux needs root or the CAP_NET_ADMIN capability granted to the binary.

This permission is only used to set up the virtual adapter — if you deny it, TUN simply won't turn on, but regular system-proxy mode still works fine.

On iOS, search for and install Clash Plus directly from the App Store, or go through our iOS download section to reach the App Store listing — the official site is clashplus.io. On first launch, it'll ask you to add a VPN configuration, which is the standard permission flow for any proxy app on iOS. Once allowed, just paste your subscription link inside the app to import nodes and connect.

Go to the Proxies page in your client and find the node list, then tap the latency test (a lightning-bolt icon or "Test" button) — the client sends an HTTP probe to each node and shows the response time in milliseconds. This number only reflects the probe's response time — low latency doesn't mean high bandwidth — but a node showing "timeout" is definitely unusable.

For everyday use, set your proxy group to url-test type so the core automatically picks the lowest-latency node for you.

Every client supports periodic subscription updates: in Clash Verge Rev, set the update interval (in minutes) on the subscription card's edit page; in Clash Plus, turn on auto-update in subscription management; in FlClash, it's under the config details. 1440 minutes (once a day) is a good default — updating too often puts unnecessary load on the subscription server, and some providers rate-limit frequent requests.

If an update fails, the client keeps using the last working config.

Add a domain rule at the top of the rules section in your config — rules are matched top to bottom, and the first match wins. For direct access, use DOMAIN-SUFFIX,example.com,DIRECT; to force it through the proxy, swap in your proxy group name, like DOMAIN-SUFFIX,example.com,PROXY.

You don't have to edit the raw subscription either — Verge Rev lets you append rules via global override configs, and Clash Plus has an override settings page, so your custom rules survive subscription updates.

mixed-port 7890 is the mixed port the core listens on by default, accepting both HTTP and SOCKS5 proxy requests. To proxy a CLI tool or third-party app, set the proxy address to 127.0.0.1 and the port to 7890 — for example, with git you can run git config --global http.proxy http://127.0.0.1:7890.

If you've changed the port, always check the actual value shown in your client's settings page.

Isolate the problem link by link: first check the client's logs for connection records from the browser — no records means the system proxy isn't actually active, so verify the address and port in your OS proxy settings match the client, and check that another proxy tool hasn't overridden it. If there are records but pages won't load, switch to Direct mode and test a site inside mainland China — if that works, the issue is the node, so switch nodes and retest. Also make sure the browser doesn't have an extension that's hijacking the proxy settings.

A full column of timeouts is rarely about a single node. First, update your subscription — the provider may have swapped out all its servers. Second, check your system clock — some protocols are sensitive to time drift, and even a minute or two off can break the handshake for every node. Third, check whether your firewall or security software is blocking the client's process. Finally, retest on a different network (like your phone's hotspot) — if it works fine there, your current network is actively blocking the proxy protocol.

This error means the listening port (usually 7890 or 9090) is already taken by another process. On Windows, run netstat -ano | findstr 7890 to find the PID, then locate it in Task Manager; on macOS and Linux, use lsof -i :7890.

It's usually a leftover core process or another proxy app — just end it. If it's a process that needs to stay running, change the mixed port to something free like 7891 in your client settings, and update any other software pointing at the old port. See the full walkthrough in Clash Port Already in Use: How to Fix It.

UWP apps run inside a network-isolated sandbox that blocks access to 127.0.0.1 by default, so they can't reach the local proxy port. Two fixes: 1) use the client's built-in UWP loopback exemption tool (the UWP tool in Verge Rev's settings) and check the app you want to exempt; or 2) just turn on TUN mode — traffic gets intercepted at the virtual adapter level, bypassing the loopback restriction entirely, which fixes it for every UWP app at once.

A 404 means the subscription URL is no longer valid — usually because the provider changed dashboard domains or reset the subscription token, so log in to the dashboard and copy the new link. A timeout means your network can't reach the subscription server — try checking "update via proxy" in the client so it fetches through a node, or switch networks and retry.

If it keeps failing, open the subscription link directly in a browser and see whether it returns config text or an error page — that tells you quickly where the problem is.