Clash Frequently Asked Questions

Clash is a rule-based open-source network proxy client supporting major encrypted protocols like Shadowsocks, VMess, Trojan, VLESS, and Hysteria2. It acts as a local routing hub, distributing network requests based on custom rules.

The core difference from a traditional VPN isSmart Split-Tunneling: Clash allows local sites to connect directly while international sites use proxy nodes, maintaining top speed for both. Traditional VPNs often force all traffic through remote servers, significantly slowing down local browsing.

Yes, the Clash core and most community clients follow GPL-3.0 and arecompletely free with no built-in subscriptions or ads.

Common free clients include Clash for Windows, ClashX (macOS), Clash for Android, Clash Verge Rev, FlClash, and OpenClash (routers).

Clash itselfdoes not include built-in nodes or servers. To use it, you must:

1. Obtain a subscription link from a provider or set up your own server
2. Import the link or YAML config file into the Clash client
3. Select an available node
4. Toggle the "System Proxy" switch to ON

Once completed, you should be able to access the internet. If issues persist, please refer to the Troubleshooting section below.

The Clash ecosystem supports nearly all major platforms:

Visit ourSupported Platforms pageto find recommended clients and download links for each platform.

The original Clash Core stopped maintenance in 2023. Clash Meta (maintained by the community, now renamedMihomo) is currently the officially recommended active branch.

Main improvements of Mihomo over the original:

A "Provider" (often called Jichang in the community) refers to service providers offering proxy node subscriptions, usually across multiple regions via a YAML link imported into Clash.

Using Clash requires two parts:1. Client (Clash software, free) + 2. Nodes/Subscription (from a provider, usually paid or self-hosted). If you have the technical skills, you can set up your own server on an international VPS instead of buying a subscription.

The original author of Clash for Windows (CFW) stopped maintenance in 2023. Current recommended alternatives include:

All the above clients include the Mihomo kernel, offer more features, and are actively maintained.

Using Clash Verge Rev as an example (steps are similar for others):

1. Open the client and click the "Profiles" or "Subscription" menu
2. Click the "New" or "+" button
3. Paste your provider subscription URL into the input field
4. Click "Save" and wait for the download to complete
5. Click the subscription card to activate it (it will be highlighted)
6. Go back to the main interface and toggle "System Proxy" to ON

Clash uses the YAML format, primarily consisting of these top-level fields:

Most users get a full config automatically via a provider link and don't need to write one. For deep customization, refer to theOfficial Mihomo Wiki。

Subscription download failures are usually caused by:

1. The link has expired or is invalid; check your provider's dashboard
2. Network issues preventing access to the provider's server; try using an existing node temporarily while updating
3. Outdated client version; try upgrading to the latest version
4. Special characters in the link; ensure there are no trailing spaces or newlines when pasting

A Proxy Group is a strategy for managing multiple nodes. Common types include:

Provider subscriptions usually come pre-configured with these groups, so most users don't need to change them.

You can addrulesrules to thePROCESS-NAMEsection of your config to route traffic by process name:

You can also useIP-CIDR(by IP range) orDOMAIN-SUFFIX(by domain suffix) for fine-grained control. Rules are matched from top to bottom.

Most graphical clients support auto-update intervals. In Clash Verge Rev, for example, you can find the "Auto Update" option in the profile settings. The client will then pull the latest config from your provider automatically.

It's recommended to set this to12-24 hours; updating too frequently may consume data and trigger rate limits.

mixed-portis a hybrid listening port provided by Mihomo/Clash Meta that supports both HTTP and SOCKS5 protocols, satisfying all proxy needs with a single port (usually7890）。

Older versions of Clash required separateport(HTTP) andsocks-port(SOCKS5) ports. mixed-portcombines them for a cleaner config. Unless you have specific needs, just use mixed-port.

Based on the Mihomo kernel, it supports the following major protocols:

Actual support depends on your client version; new protocols are added regularly.

TUN (Virtual Network Card) mode creates a virtual NIC to force-capture all network traffic at the OS level. This is useful for apps that don't support system proxy settings, such as most games, some CLI tools, and UWP apps.

In contrast, standard "System Proxy" only affects apps that actively look for proxy settings (mostly browsers).

Fake-IP: Clash immediately returns a fake internal IP (e.g., 198.18.x.x) for DNS queries, while forwarding the domain info to the proxy node for remote resolution. This offers faster speeds and avoids DNS pollution; it is recommended for most users.

Redir-Host: Resolves the real DNS first before deciding between direct or proxy. It has slightly better compatibility but is slower and risks DNS leaks.

Shadowsocks: Mature, TCP-based protocol with wide compatibility and stable latency for daily tasks.

Hysteria2: Based on the QUIC (UDP) protocol, specifically optimized for high-loss and high-latency networks. Large file downloads are significantly faster than TCP under poor network conditions.

Recommendation: There is little difference between the two when network quality is good. If you frequently encounter fluctuations or slow speeds, prioritize trying Hysteria2 nodes (requires provider support).

We recommend "Rule Mode" for daily use, as it provides optimal speed by routing local sites directly and international sites via proxy. Switch to "Global Mode" temporarily to test node connectivity or use "Direct Mode" for troubleshooting.

Clash/Mihomo includes a built-in RESTful API that allows visual management of node switching, traffic stats, and logs in a browser via Web dashboards (likeMetaCubeXD) or third-party tools.

The default access address ishttp://127.0.0.1:9090/ui (the port can be modified via the external-controller field in the config). Most graphical clients integrate this dashboard internally.

1. Confirm that a valid subscription profile is selected and activated.
2. Select a node and click "Speed Test" to ensure the latency is normal (not timed out).
3. Check for port conflicts: Ensure port 7890 is not being used by another application.
4. Try switching to "Global Mode" to see if specific rules are causing the issue.
5. Temporarily disable system firewalls or antivirus software to check for blocks.
6. Check the client logs for any error messages.

Low latency (Ping) doesn't always mean high speed; speed also depends on node bandwidth and server load. Try these steps:

1. Switch to other nodes in the same region and compare actual download speeds.
2. Change the proxy group strategy to url-test (automatically selects the fastest node).
3. If TCP protocols (SS/VMess/Trojan) are slow, try Hysteria2 nodes (UDP-based, better for weak networks).
4. Check your local network quality to rule out ISP throttling.

This is a common issue. If you exit Clash without turning off the "System Proxy" switch, your system settings still point to the local port, but Clash is no longer listening, blocking all traffic.

1. Restart the Clash client.
2. Manually toggle the "System Proxy" switch to OFF before exiting.
3. Or manually go to your system network settings and disable the proxy.

This is usually a routing rule issue where the site is incorrectly assigned to a proxy. Solutions:

1. Ensure the proxy mode is set to "Rule Mode" rather than "Global Mode".
2. Check if the domain/IP is misclassified as international traffic in your rules or subscription.
3. Manually add aDOMAIN-SUFFIX,example.com,DIRECTrule to force a direct connection.
4. Use community-maintained rulesets (likeACL4SSR), which offer better coverage and frequent updates.

TUN mode requires admin privileges to create a virtual network card. Solutions:

1. Right-click the Clash client icon and select "Run as Administrator".
2. Or enable "Service Mode" in the client settings to automatically gain the necessary permissions.

1. Enable "Power Saving Mode" or reduce the log level to Warning or Error.
2. Disable unnecessary real-time "Traffic Statistics" charts.
3. Check if your rule configuration is too complex (too many rules increase CPU usage).
4. Increase the DNS cache size to reduce frequent DNS requests.
5. In system settings, allow Clash to run in the background and exclude it from battery optimization.

Most graphical clients provide a real-time log panel (usually under "Logs") showing the handling of each request (DIRECT/PROXY/REJECT) and error messages.

When troubleshooting, set the log level todebug; after reproducing the issue, check the matched rule and error content. Set it back toinfoafterwards to save performance.

The Clash core and Mihomo are fully open-source projects hosted on GitHub. They are globally auditable,with no hidden backdoors or data collection practices. Your traffic is handled locally and forwarded to your chosen proxy node without passing through third-party servers.

We recommend the following settings to prevent DNS leaks:

1. UseFake-IPDNS mode (domains are resolved by the remote node; no local DNS requests are sent).
2. Use encrypted DNS (DoH/DoT) in your config, such ashttps://1.1.1.1/dns-query
3. Configureenhanced-mode: fake-ipwith a properfake-ip-filterwhitelist to avoid mis-proxying local services.
4. Enable TUN mode to capture all traffic, preventing apps from bypassing the proxy.

Subscription links contain your account credentials. If leaked, others can use your data, potentially leading to overages or account bans.

1. Log in to your provider's dashboard immediately and reset your subscription link (generate a new token).
2. Update the link on all your devices.
3. Never share your subscription link in public screenshots, forum posts, or GitHub repos.

Since Clash performs low-level operations like traffic interception and virtual NIC creation, some antivirus software may misidentify it as malware. This is a normal False Positive.

Recommended actions:

1. Download only from official GitHub Releases or this site to ensure the file is trusted.
2. Add the Clash installation directory to your antivirus whitelist.
3. Verify the file hash on VirusTotal to ensure it matches the official release.

Using Clash on public Wi-Fi is actually safer than not using it: all traffic is encrypted (via Shadowsocks/VMess/Trojan) before leaving your device, preventing others on the network from intercepting your data.

Furthermore, using encrypted DNS (DoH) prevents sniffers on the same network from seeing which sites you visit.