Clash FAQ

These sit at different layers: Clash was the original open-source proxy core project; after the original repository was archived, the community fork mihomo took over maintenance. Clash Verge Rev, FlClash, and similar apps are GUI clients built around the core, handling the interface, subscription management, and system integration. When people say "using Clash," they usually mean a GUI client paired with the mihomo core.

For the full lineage of these projects and platform-specific recommendations, see our article "How Clash, mihomo, and Verge Rev Relate to Each Other".

It will still run, but long-term use isn't recommended. Clash for Windows no longer receives updates, so it won't track new protocols or config fields added to mihomo, and newer subscription formats may fail to parse. Security issues also won't be fixed.

Windows users should migrate to Clash Plus or Clash Verge Rev; your existing subscription link can simply be re-imported into the new client without changes. Get the installer from the Windows section of the download page.

Every client and the mihomo core listed on this site are free, open-source software with no charge for download or use.

Keep in mind that the client is just a tool; proxy nodes are provided by subscription providers, and whether that service is paid depends entirely on the provider, not the client.

Rule mode (rule) matches traffic against the rules in your config file one by one, sending direct traffic straight through and proxying what should be proxied; this is the recommended everyday mode. Global mode (global) routes all traffic through the selected node, useful for debugging rules or temporary use. Direct mode (direct) sends all traffic without a proxy.

Rule mode is the right default for most situations; see the config field reference for exact syntax of the mode field.

Copy the subscription URL starting with https:// from your provider, open the client's Profiles page, paste it into the new profile's address field, and confirm. The client will automatically download and parse the config file. Once imported, the node list will appear on the Proxies page.

See the usage guide for full step-by-step instructions on every platform.

This is macOS Gatekeeper blocking an app that isn't from the App Store; it doesn't mean the installer is faulty. Right-click (or Control-click) the app icon in Finder and choose Open, then confirm once to launch it normally. You can also go to System Settings → Privacy & Security and click Open Anyway near the bottom of the page.

TUN mode needs to create a virtual network adapter, which requires administrator privileges. Clash Verge Rev can install a system service (Service Mode) in its settings so you don't need to elevate manually every time; other clients can be run via "Run as administrator."

After enabling TUN mode, also turn on the DNS hijacking option, otherwise some traffic may still bypass the virtual adapter.

Yes, that's expected. Proxy clients on Android take over traffic through the system's VpnService interface, so the first launch must request the "Create VPN connection" permission — this is a standard system mechanism, and a key icon appears in the status bar once granted.

If you accidentally decline, simply reconnect from within the client to trigger the authorization prompt again.

Clash Plus is the recommended option for iOS — search for it directly in the App Store, or visit clashplus.io for the store link. On first launch, you'll also need to authorize the VPN configuration; just confirm the prompt in system settings.

The store link is also available in the iOS section of the download page.

On the Proxies page, click the latency test (lightning bolt icon); the client sends HTTP probes to each node and displays the result in milliseconds — lower is better, and timed-out nodes are flagged in red.

For everyday use, put your frequently used nodes into a url-test policy group so the client automatically picks the lowest-latency node without manual switching.

Add a custom rule at the very top of the rules section in your config file, for example DOMAIN-SUFFIX,example.com,node-or-group-name. Rules are matched top to bottom, and the first match wins, so custom entries must be placed above the rules that come with your subscription, or they may get intercepted by a broader wildcard rule further up.

See the config field reference and the article "How to Write Custom Clash Rules" for full syntax and priority details.

Providers adjust their nodes from time to time, so it's a good idea to refresh your subscription regularly to get the latest node list. Most clients support setting an auto-update interval (for example, every 24 hours), and you can also refresh manually from the Profiles page.

If a lot of nodes change after an update, double-check that the policy group names referenced in your custom rules still exist — referencing a group that no longer exists can prevent the core from starting.

Yes. Rule mode already routes traffic based on domain and IP; if you need control at the app level, Android clients generally support per-app proxying, letting you include or exclude specific apps in settings.

On desktop, you can use a PROCESS-NAME rule to route by process name, which matches most reliably under TUN mode.

Check in order: whether the client's "System Proxy" toggle is actually on; whether the system proxy port matches the client's mixed port (default 7890); whether a browser extension like SwitchyOmega is overriding the system setting.

Some apps don't read the system proxy at all and need 127.0.0.1:7890 entered manually in their own settings, or you can switch to TUN mode to take over all traffic.

UWP apps are blocked by the system from accessing the local loopback address 127.0.0.1 by default, so the system proxy has no effect on them. To fix this, use the CheckNetIsolation command to add a loopback exemption for the specific app, or use the client's built-in UWP loopback exemption tool and check the target app, then save.

See the article "Why Windows Store Apps Skip the Proxy" for the mechanism and step-by-step fix.

This means the listening port (usually 7890) is already taken by another process, commonly from running two proxy clients at once or a leftover process that didn't exit. On Windows, use netstat -ano along with Task Manager to find the process; on macOS and Linux, use lsof -i:7890. End the conflicting process, or change mixed-port in your config to another free port.

See the article "Fixing 'Port Already in Use' in Clash" for the full troubleshooting flow.

Check these in order: whether the subscription has expired or run out of data, confirmed via the provider's dashboard; whether your system clock is accurate, since a large drift can break the handshake; switch to Global mode to test a single node and rule out interference from rule configuration.

If only a few nodes work while most time out, it's usually a fault on the provider's side, so wait for a fix or refresh the subscription.

A certificate error isn't necessarily the website's fault: first verify the system clock is accurate; check for leftover root certificates from packet-capture tools like Fiddler or Charles; then try a different node. If the error only occurs on one specific node, that link may carry a man-in-the-middle risk — stop using that node immediately and report it to the provider.

See the article "Common Causes of HTTPS Certificate Errors Behind a Proxy" for how to diagnose each cause.