Clash FAQ

Clash is an open-source proxy client built around rule-based traffic splitting: it can match traffic down to specific domains and IP ranges, deciding what gets proxied, what connects directly, and what gets blocked. A typical VPN routes all device traffic through one encrypted tunnel without distinguishing destinations.

Clash supports protocols like Shadowsocks, VMess, Trojan, and Hysteria, making it a good fit when you need fine-grained control over routing. For precise definitions of these terms, see the glossary.

The original Clash core stopped receiving updates and was archived in 2023. mihomo (formerly the Clash Meta core) is the actively maintained fork built on top of it, adding newer protocols like Hysteria2 and TUIC, and it's the core most mainstream clients now use.

When people say "Clash client" today, they usually mean a GUI built on the mihomo core, such as Clash Plus or Clash Verge Rev. The full breakdown of cores and clients is in the reference guide.

Pick by platform: Clash Plus covers every major platform (Windows, macOS, Android, iOS); Clash Verge Rev is also popular on Windows desktop; Android users can go with Clash Meta for Android; on Linux desktop, the deb or rpm build of Clash Verge Rev is recommended.

See the full client list, system requirements, and download links on the download page.

Every client listed on this site is free, open-source software with no charge to download or use. Keep in mind the distinction between the client and the proxy service: the client is just a tool, while proxy nodes (subscriptions) are typically sold by third-party providers. Pricing and plan questions should go to the provider directly.

A subscription link is a URL provided by your proxy service that lets the client periodically pull the latest node list and routing rules, so you don't have to maintain the configuration by hand.

Treat it like a login credential — never share it publicly. If you suspect it's been leaked, reset the subscription URL in your provider's dashboard, then update the configuration in your client.

Open-source clients typically don't carry a Microsoft EV code-signing certificate, so SmartScreen shows a blue warning the first time you run the installer. Once you've confirmed the installer came from our download page, click "More info" then "Run anyway" to continue.

If your browser blocks the download itself, choose "Keep" in the downloads list.

This message appears because the app isn't notarized by Apple — the file isn't actually damaged. Open Terminal and run xattr -d com.apple.quarantine /Applications/Clash\ Verge.app (using Clash Verge Rev as an example), then launch it normally.

Alternatively, go to System Settings → Privacy & Security, find the blocked app, and click "Open Anyway."

Four steps in general: copy the subscription link from your provider; open the client's Profiles (or Subscriptions) page, choose to add or import a new profile, and paste the link; click Update to fetch the node list; select this profile to activate it, then head to the Proxies page to pick a node.

For step-by-step instructions with screenshots on every platform, see our setup guide.

For Linux desktop, Clash Verge Rev is the recommended pick — the Linux section of our download page offers .deb and .rpm packages, and the interface matches the Windows version once installed.

On servers or headless systems, you can run the mihomo core binary directly and manage it through an external control UI; using systemd lets you set up launch-on-boot and auto-restart on crash — details are in the reference guide.

Most clients have a "Launch on startup" or "Silent start" toggle in Settings — just turn it on. On Windows, if the toggle doesn't seem to work, check Task Manager → Startup to make sure the entry isn't disabled; on macOS, check System Settings → General → Login Items.

Launching on startup only opens the app — whether it automatically takes over the system proxy depends on the "Auto-connect / Set system proxy automatically" option, and it's best to enable both together.

For everyday use, go with Rule mode: it splits traffic using built-in rules, sending mainland China sites direct and everything else through the proxy, without conflicts. Global mode routes all traffic through the current node — switch to it only temporarily, for troubleshooting or reaching a site the rules missed. Direct mode is effectively the proxy turned off, useful for comparison tests.

The mode switch is on the client's home screen or at the top of the Proxies page.

Proxy groups are containers for organizing nodes: a select group lets you pick a node manually; a url-test group runs periodic latency checks and automatically switches to the lowest-latency node; a fallback group automatically switches to a backup if the primary node fails.

Expand a proxy group on the client's Proxies page and click a node name to switch. For a hands-off setup, set the group type to url-test — a test interval of 300 seconds or more is recommended, since testing too often just wastes resources.

The latency shown in the client measures a single handshake — it only tells you how quickly a node responds, not its bandwidth or stability. A node at 100ms isn't necessarily smoother for streaming than one at 300ms.

The more reliable way to pick a node is to actually open the target site or run a real download test — see the full explanation in how latency testing actually works.

Subscription conversion is an online service that converts subscriptions in formats like V2Ray or Shadowsocks into Clash configuration in real time. The risk is that the conversion server handles all of your node data and may even rewrite your rules.

Prefer a Clash-native subscription straight from your provider whenever possible; if you do need conversion, use a self-hosted open-source converter or a public service with a solid reputation.

Pick based on your situation: Rule mode already splits traffic, so for a stray site it missed, add a line like DOMAIN-SUFFIX,example.com,DIRECT near the top of the config; for the system proxy's bypass list, add the domain there, which only affects apps using the system proxy; if your browser has its own proxy extension, configure the direct-connect list inside the extension.

After editing rules, remember to reload the config in the client for changes to take effect.

The easiest approach is to use the same subscription link on every device — nodes and rules come from the server side, so they naturally stay in sync. If you rely on a lot of custom rules, you can keep the config file in a private repo or cloud storage and have each device pull it on a schedule.

See a comparison of all three approaches and step-by-step instructions in syncing Clash config across multiple devices.

Work through these in order: confirm the system proxy toggle is actually on; switch to Global mode as a test — if it works there, the rules are missing something; try a different node to rule out a single dead node; update the subscription to rule out an expired plan; and reset DNS back to the client's recommended default.

See how to verify each step in the full no-internet troubleshooting checklist.

Three common causes: a standalone proxy extension like SwitchyOmega is installed in the browser and overriding the system proxy — disable it and test again; the target domain got accidentally added to the system proxy's bypass list; or the client's listening port was changed and no longer matches the system proxy settings.

Check the port number in the client's Settings page (default is 7890) and confirm "Set system proxy" is enabled.

Windows blocks Microsoft Store (UWP) apps from reaching the local loopback address 127.0.0.1 by default, so the system proxy has no effect on them. Run PowerShell as administrator and execute CheckNetIsolation LoopbackExempt -a -n=your-app-package-name — you can look up the package name with Get-AppxPackage.

An easier fix is to just enable TUN mode, which takes over all traffic at the network layer and isn't subject to the loopback restriction.

TUN mode needs to create a virtual network adapter, which requires system-level permissions. On Windows: install "Service Mode" in the client first, then enable TUN. On macOS: the first time you enable it, you'll be prompted for your login password to install a helper tool.

On Linux: run as root, or grant permission to the core binary with sudo setcap cap_net_admin,cap_net_bind_service=+ep /usr/bin/mihomo. If it still fails, check for a conflict with another VPN's virtual adapter — quit it and try again.

Check these roughly in order of likelihood: update your subscription, since an expired plan or node changes can cause everything to time out at once; switch to a mobile hotspot to test, ruling out a network (work or campus) blocking the proxy protocol; and sync your system clock — TLS handshakes are sensitive to clock drift, and even a minute or two off can break every connection.

You can also paste the subscription link directly into a browser to confirm the provider's service is up.

First, paste the subscription link directly into your browser's address bar: if it downloads a config file, the link is valid and the issue is with the client's current network — switch to a direct connection and update again. If it returns an error, that usually means the plan expired, the data quota ran out, or the link was reset — check with your provider or grab a fresh link.

Some providers block requests without a client User-Agent, so it's normal for the link to fail in a browser but still update fine in the client.

This happens when the default proxy port 7890 is already taken by another program. Quit any other proxy or VPN software first, then start the client again. If you need them to run side by side, change the mixed port in the client's Settings to a free port like 7897, and update your system proxy settings to match.

On Windows, you can find the process holding the port with netstat -ano | findstr 7890.