Clash FAQ: Common Issues and Troubleshooting
Break troubleshooting down by where the problem occurs: first establish the relationship between the client, core, and configuration, then check subscription imports, the system proxy, TUN, routing rules, and DNS. Each answer provides a practical sequence of checks.
Core Concepts
Understand the relationship between the interface, core, configuration, rules, and exit first. This prevents subscription issues from being mistaken for client failures later.
What do the Clash client, core, and configuration file each do?
The client provides the graphical interface, subscription management, system proxy controls, and startup integration. Cores such as mihomo establish connections, parse rules, handle DNS, and forward traffic. YAML configuration files store nodes, proxy groups, rules, and DNS settings. When something fails, first determine whether the issue is with the interface, core, or configuration instead of repeatedly reinstalling the client.
What is the difference between a subscription link, a single-node link, and a YAML file?
A subscription link is usually generated by a service provider, and the client periodically fetches the complete node and rule configuration from it. A single-node link describes only one connection and cannot replace a complete Clash configuration. A YAML file is a complete configuration that can be imported locally. Before importing, confirm whether the client expects a subscription URL, node link, or local configuration file; a format mismatch causes parsing errors.
How should I choose between Rule, Global, and Direct mode?
Rule mode is usually best for everyday use: the configuration rules decide whether traffic goes through the proxy or connects directly. Global mode sends most proxyable traffic through the current global policy and is useful for temporarily testing whether a node can reach a target site. Direct mode bypasses the proxy and helps determine whether the proxy route is causing the problem. After troubleshooting, switch back to Rule mode to avoid sending unnecessary traffic through one exit.
What is the difference between Clash's mixed-port, HTTP port, and SOCKS port?
mixed-port accepts both HTTP and SOCKS5 proxy requests on one port, making it suitable for most desktop apps that require manual proxy settings. port provides HTTP proxy access only, while socks-port provides SOCKS5 access only. The client usually writes system proxy settings automatically, so manual entry is unnecessary. When another app connects to Clash, use the listening address and port currently shown by the client, and make sure no other process is using them.
How are proxy groups related to nodes?
A node is a specific connection exit, while a proxy group combines multiple nodes or other policies for use by rules. Rules usually point to a proxy group rather than a fixed node, so changing the selected option in that group changes the exit used by a category of traffic. If a site still follows the old route after switching nodes, check which proxy group the matching rule ultimately targets and make sure you edited that group rather than another one with a similar name.
Installation and Setup
A successful import does not mean that traffic is already being intercepted. Check the subscription format, core status, system permissions, and operating system network settings separately.
What should I check when a Clash subscription link fails to import?
First, open the subscription URL in a browser to confirm that it is still accessible, and check that copying did not add spaces, line breaks, or trailing punctuation. Then verify that the client supports the returned format and that the system clock is accurate. If the URL downloads content but the client reports a parsing error, the response is often not Clash YAML, the indentation may be damaged, or required fields may be missing. Generate a subscription in a compatible format and try again.
What should I do when a subscription is expired, invalid, or returns 401 or 403?
A 401 or 403 usually means that the subscription credentials are invalid, the URL has been reset, the plan status has changed, or the server is blocking the request. Do not keep refreshing only in the client. Sign in to the subscription service first, verify the account and subscription status, then copy the latest URL and replace the old configuration. If the URL also fails in a browser, the problem is on the subscription server. If it works in a browser but not in the client, check the client's network access, request-header compatibility, and system time.
Why does my browser still connect directly after I enable the system proxy?
First confirm that the Clash core is running, then check whether the operating system proxy settings point to the current HTTP or mixed port. Some browsers, download tools, and security software use separate proxy settings or ignore the system proxy, so they must be configured inside the app. Also check for a port conflict, a browser extension that forces direct connections, or a LAN proxy script that overrides system settings.
How do I fix insufficient permissions when enabling TUN mode?
TUN needs to create a virtual network adapter, modify routes, or install a system service, so administrator privileges are usually required. On Windows, try launching the client as an administrator or reinstalling it in service mode. On macOS, allow the network extension when prompted and enter administrator credentials. On Linux, verify that the process can create a TUN device and modify routes. After changing permissions, fully exit the client and start it again.
Windows Store apps cannot use Clash. How do I configure UWP loopback?
Some UWP apps are affected by app-container network isolation and cannot directly access a proxy port on the local loopback address. Use the client's UWP loopback tool to remove the restriction for apps that genuinely need the proxy, then restart those apps. Do not select every system component at once. If an app already connects normally through TUN, loopback configuration is unnecessary and only adds variables to the diagnosis.
Why doesn't Clash take over traffic automatically after starting with Windows?
Starting with the system only means that the client process launches; it does not necessarily start the core, enable the system proxy, or restore TUN. Check the client's startup option, automatic core launch, automatic system proxy settings, and automatic TUN enablement separately. If the network is not ready immediately after sign-in, add a startup delay. In service mode, also verify that the service is running and prevent an older client version from starting at the same time and causing a port conflict.
Usage Tips
Node selection, rule matching, and the DNS path can all change the result. Use connection history and logs to confirm where the traffic actually went.
How can I tell whether node timeouts are caused by the node or by my local setup?
Test several nodes from the same subscription in succession. If only a few time out, the likely causes are node maintenance, route congestion, or expired connection parameters. If all nodes time out at once, check the local network, system time, firewall, core status, and subscription configuration. The latency test endpoint may also be temporarily unreachable, so try loading an actual webpage and inspect the logs for DNS errors, handshake failures, or connection refusals.
Where should I start when rules do not route traffic as expected?
Find the target request in the connection history or logs and confirm the matched domain, destination IP, rule type, and proxy group. Clash rules are usually matched from top to bottom, so a broad rule placed early can capture traffic before a more specific rule. Also check the difference between domain and IP rules, sniffing results, rule-set updates, and the proxy group targeted by the final MATCH rule.
How can I check whether Clash is leaking DNS requests?
First determine whether you are using the system proxy or TUN, because a system proxy does not automatically take over DNS queries from every app. Then inspect dns.enable, the listening address, mode, upstream servers, and rule policy in the configuration to ensure that DNS requests follow the intended path. During testing, disable the browser's Secure DNS or configure it to match the current setup, and use core logs to identify the upstream server that actually receives each query.
Will updating a subscription overwrite manually selected nodes and local rules?
Whether a node selection is preserved depends on the client's configuration cache. Most clients try to restore the previous selection by proxy group name, but cannot do so if a group was renamed or a node was removed. Direct edits to subscription-generated YAML are usually overwritten at the next update. Put custom local rules in the client's supported overrides, extensions, or scripts, then check the merge order after updating.
How can other devices on my LAN use Clash on my computer?
Allow LAN connections in Clash and bind the listening address to the LAN interface instead of listening only on 127.0.0.1. On other devices, set the proxy server to the LAN IP address of the computer running Clash and use its actual HTTP, SOCKS, or mixed port. Also check that the operating system firewall allows inbound connections to that port, and never expose the management interface directly to an untrusted network.
Troubleshooting
Start with the basic network, then check DNS, node connectivity, route interception, and system conflicts step by step. Error types in the logs are more reliable than the connection status shown in the interface.
Clash says it is connected, but no websites open. What should I do?
Switch to Direct mode first to confirm that the underlying network works. Then switch to Global mode and test with a node known to be working. If Direct works but Global fails, check the logs for DNS failures, connection refusals, handshake timeouts, or authentication errors. Also verify that the system proxy port matches the client, that the selected proxy group does not point to a dead node, and that another VPN, firewall, or proxy app is not modifying the routes at the same time.
Why do I get HTTPS certificate errors after using a proxy?
Normal Clash forwarding does not usually replace a website's certificate. First check the system time and time zone, the browser's certificate state, HTTPS scanning in security software, an intercepting proxy on a corporate network, and the target site's certificate chain. If the error appears only after enabling a particular traffic-interception tool, disable related features one by one to identify the source. Do not simply ignore the browser's certificate warning.
What should I do if TUN causes a network outage, proxy loops, or conflicts with another VPN?
Exit other VPNs and network tools that create virtual adapters, modify the default route, or take over DNS, then restart Clash. Check whether TUN auto-route, strict routing, interface selection, and DNS hijacking settings suit the current system. Also make sure the proxy server's own address is not sent back through TUN and routed in a loop. If the system proxy works with TUN disabled, restore the TUN settings one at a time to identify the conflict.
How do I stop Clash from disconnecting or being killed after the Android screen locks?
Android vendors' battery-saving policies may restrict VpnService or clean up background processes after the screen locks. Allow the client to run in the background, add it to the battery-optimization exemption list, and keep it enabled in the system's autostart, background activity, or task-lock settings. Make sure notification permission is enabled as well, since a persistent VPN foreground service usually relies on an ongoing notification. Reconnect the VPN after making these changes, then test with the screen locked.
What information matters most when reviewing Clash logs?
Record the exact time the problem occurred, then use that timestamp to find the request target, matched rule, proxy group, actual node, and error type. DNS timeout points to the resolution path; connection refused commonly indicates a target-port or local-listener problem; i/o timeout usually means the network is unreachable or responding too slowly; authentication failed means the node credentials should be checked. Keeping the continuous log before and after the error is more useful than capturing a single line.