Troubleshooting index
Clash FAQ and Troubleshooting
From subscription imports and proxy modes to TUN, system proxy settings, and Windows app loopback restrictions, follow the checks for each symptom and avoid the noise caused by repeatedly changing configuration.
01 / Basic concepts
Core concepts
Clarify the roles of the client, core, proxy port, and operating mode first so you know which layer to inspect when diagnosing a problem.
What do Clash and the Mihomo core each do?
The Clash client provides the graphical interface, configuration controls, and system proxy management. The Mihomo core parses the configuration, matches rules, selects proxy groups, and establishes connections. Different clients may share similar core capabilities while offering different interfaces and platform support.
Should a Clash client use Rule, Global, or Direct mode?
For everyday use, start with Rule mode so rules such as DOMAIN and IP-CIDR in the configuration determine the connection path. Temporarily switch to Global mode when checking whether rules match; use Direct mode briefly to compare the proxy path with the local network.
Where can I find Clash's local proxy port?
Open the client's settings or configuration details and look for fields such as Mixed Port, HTTP Port, and SOCKS Port. Mixed Port usually accepts both HTTP and SOCKS requests, but use the value shown in the current configuration. A terminal or browser proxy address typically uses 127.0.0.1 followed by that port.
Why are no proxy nodes or proxy groups visible after importing a subscription?
First confirm that the subscription URL returns accessible content, then update the configuration in the client. If the update succeeds but proxy groups are still missing, check the active configuration file, the subscription conversion result, and any YAML parsing messages. A web page, login page, or expired response cannot be used as a valid configuration.
02 / Setup
Setup and configuration
Configuration issues usually involve the subscription response, configuration file version, or fields changed during an update. Keep a recoverable working state before troubleshooting.
What should I check first when a Clash subscription update fails?
First verify that the subscription URL is accessible in a browser or network tool, then check the client's network permissions, system time, and current proxy status. Review the HTTP status code in the update log: 401 or 403 usually indicate authorization issues, 404 means the URL is no longer valid, and a timeout requires checking the network path or server response.
What should I do if proxy groups disappear or rules behave unexpectedly after a subscription update?
Do not delete the original configuration yet; keep the last working version as a fallback. Check whether the new configuration parsed successfully, whether proxy group names changed, and whether the rules, proxy-groups, and proxies fields are present. If the client supports configuration backups, restore the old version and ask the subscription provider whether the template changed.
Why does Clash report a parsing error even though the subscription URL opens?
A URL opening in a browser does not mean it returns a Clash configuration. Common causes include an HTML login page, additional authorization requirements, a response truncated by a gateway, or indentation and field-format errors in the YAML. Check the client's configuration preview or logs, compare the beginning of the response with the reported error line, and handle the returned format accordingly.
What should I configure first when there is no proxy effect after installing the client?
First import a configuration file that parses successfully, confirm it is selected and the core is running, then enable the system proxy. Note the client's current HTTP, SOCKS, or Mixed Port, visit a test address in the browser, and review the connection log. Enabling the system proxy alone cannot create a working proxy path without a valid configuration.
03 / Daily use
Usage tips
Rule routing, Global mode, and TUN mode suit different scenarios. Review connection details first, then decide whether to change the mode or expand the scope of system-level interception.
Why isn't a website using the proxy as expected in Rule mode?
Check the matched rule and final proxy group in the connection details, then confirm that a more specific rule did not match the domain first. Browser cache, an application's built-in DNS, IP rules, and the FINAL fallback rule can all affect the result. After changing rules, reload the configuration and create a new connection instead of relying on old connection records.
What is the practical difference between Global mode and Rule mode?
Rule mode evaluates connections in the order defined by the configuration and sends requests to the relevant proxy group. Global mode generally sends all proxyable requests to the currently selected proxy group, bypassing most routing decisions. Use Global mode briefly to test the proxy path; return to Rule mode and verify the routing results before using it long term.
Why is no traffic passing through Clash after enabling TUN mode?
Confirm that the client has the system permissions required to create a virtual network adapter and modify routes. Check the TUN switch, stack type, and auto-route settings. Then verify that the corresponding virtual adapter appears, restart the client or refresh the network connection, and use the connection log to confirm that application traffic reaches the core.
What permissions are required to enable TUN mode on Windows?
TUN mode usually requires the client to create a virtual network adapter, add routes, or configure DNS, so administrator approval may be required. Follow the client's instructions when a permission prompt appears. If enterprise device policies block driver installation or route changes, ask the device administrator rather than repeatedly toggling the setting.
04 / Diagnosis
Troubleshooting
When a connection fails, first determine whether the local proxy never received the request or whether the request entered the core and failed during rule matching, DNS resolution, or node connection.
What should I do if the system proxy is enabled but the browser still connects directly?
First confirm that the browser uses the system proxy rather than a separate proxy extension. Then verify that the system proxy address and port match the client's current listening port. Check that the client is running and that the application is not set to bypass the proxy. Use a new uncached request and watch the connection log to confirm that it reaches the HTTP or Mixed Port.
Does a timeout during a node latency test mean the node is dead?
Not necessarily. The test URL, DNS resolution, ISP routing, and the node's handling of test requests can all affect the result. Try another test address or network, then make a real connection directly. If every node times out, check the local port, configuration protocol, and system time before replacing nodes.
Clash shows as connected, but an application still cannot access the internet. How can I troubleshoot it?
Check the local port, system proxy, rule matching, DNS, and node path in that order. First visit a simple website in a browser and review the connection log, then confirm that the application follows the system proxy. For applications that do not support system proxy settings, consider TUN mode or the application's own proxy configuration. If only one domain fails, continue by checking the rules and DNS.
What should I do if a Windows UWP app cannot use the Clash proxy?
Some Windows UWP apps are restricted by loopback isolation and cannot directly access a local proxy port. Use the system tool for removing UWP loopback restrictions, select the apps that should be allowed, apply the change, and restart them. If connectivity still fails, check the system proxy port, whether the app is routed Direct by a rule, and firewall permissions.
Why do HTTPS certificate errors appear after enabling the proxy?
First confirm that the system date and time are correct, then determine whether the error occurs only on a particular network or in a particular application. Check the proxy configuration, DNS, and network for HTTPS interception. Do not permanently ignore certificate warnings just to bypass the prompt. If direct connections work but proxied connections fail, save the error code and connection path, then check the client configuration and network environment separately.