Clash FAQs

A client provides the interface for importing configs, switching policies, and viewing logs. The Mihomo core and similar components handle connections, rule matching, and DNS. A subscription supplies proxies and some configuration data. Installing a client does not provide proxy service. Before setting up, check the subscription source, expiry date, and supported formats, then choose a compatible client. When troubleshooting, distinguish interface issues from core startup failures and subscription service problems.

For everyday use, start with Rule mode, which routes traffic according to the rules in your current config. Global mode sends requests that reach the core through the global policy, but you still need to select a working proxy. Direct mode connects requests that reach the core straight to their destinations. Global mode does not capture all device traffic: whether an app reaches the core depends on system proxy, app proxy, or TUN settings. Comparing modes can help identify rule issues; restore your original settings after testing.

Avoid sharing it publicly. Subscription URLs often contain account-linked credentials, and anyone with the full link may be able to view proxy details or use your service allowance. Before sharing a screenshot, hide the URL path, query parameters, proxy passwords, and controller secrets—not just the domain. If the link has been exposed, reset it in your provider’s account portal and replace it on every device. Deleting chat messages will not invalidate a leaked link.

Install Clash Plus from the App Store on iOS. Its official website is clashplus.io, and our download page links to the store. Before importing, check that your subscription provider supports a format the client can use; support for scripts, rule sets, and extra fields varies by client. A config that works on a computer may not work unchanged on a phone. Start with a compatible subscription from your provider, confirm the basic connection works, then add custom rules one at a time.

No. Most proxy speed tests measure response time to a specific test address—the time it takes to connect and receive a response—not sustained download bandwidth. Real-world speed also depends on the destination, network congestion, service limits, and your local connection. For a fair comparison, use the same test address and network, then test the services you actually use. If latency is low but video still buffers, check throughput, packet loss, and which rules are being matched.

Make sure you copied the complete subscription URL, not an account login or purchase page. Check that a messaging app hasn’t cut off the end. Then confirm in your provider’s account portal that the service is active and the link hasn’t been reset, and verify that the format is supported by your core. If the logs show an authentication error, check the URL and account. If they show a config parsing error, check whether the response is a web page or an incompatible config. Never submit a full subscription URL to a public checker.

Consider conversion only when the subscription format is incompatible with your client and your provider does not offer a compatible link. Use the provider’s built-in format options first, or a local conversion tool you control. Third-party online converters may access your full subscription and proxy credentials, so assess whether you trust the service. After conversion, check proxy protocols, policy group references, and rule-set URLs. Conversion only changes the format; it cannot restore an expired account or fix inactive proxies.

Check whether the client offers service mode or an option to install a helper service. Follow the instructions for your version, then restart the client. On Windows, installing the service usually requires administrator rights. macOS may require approval for a helper tool or network extension. Linux needs permission to create a virtual network interface and configure routes. If it still fails, check the logs for permission errors, interface creation failures, or route conflicts. Don’t run privilege-escalation commands from untrusted sources or leave security protections disabled.

First confirm the core is running and the system proxy points to the address and port the client is actually listening on—not a port left behind by an old client. Check whether a browser extension sets a separate proxy and whether the destination domain is on the system proxy bypass list. Make a new request and look for it in the connection log. If it appears but goes direct, check the rules or mode; if it doesn’t appear, check how the app is routed. Some apps ignore the system proxy and need their own proxy settings or TUN.

Use the listening port shown in the client’s current config; example ports are not universal. A mixed port usually accepts both HTTP and SOCKS proxy requests. For an HTTP proxy, enter the HTTP or mixed port; for SOCKS5, use the SOCKS or mixed port. Apps on the same device generally use 127.0.0.1. Other devices need the proxy host’s LAN address. The same port number does not mean the same protocol—choose the type requested by the app.

A subscription update usually fetches the remote config again, so edits made directly to a generated subscription file may be overwritten. Back up your rules, then check whether the client supports overrides, merging, or separate rule files, and put your changes in one of those persistent locations. After merging, confirm that rule order and policy group names are still valid; custom rules should usually come before fallback rules. Exporting the subscription link alone generally won’t save local overrides, so back up those files separately when moving between devices.

Open the client’s Connections page, clear unrelated entries, then revisit the site. Check the destination domain, matched rule, policy chain, and final proxy. Rules are usually evaluated in order, so an earlier match can affect what happens next. After changing a rule, close existing connections and test again. A page may request several domains, so checking only the address bar can miss image or login requests. If the request is absent from the connection log, check how traffic is being routed before changing split-routing rules.

Yes, if the devices can reach each other on the same LAN. Enable LAN access in the computer’s client, allow the listening address to accept LAN requests, and open only the required port on the firewall for trusted networks. On the phone, set the proxy to the computer’s LAN address and its HTTP or mixed port—not 127.0.0.1. Some apps ignore Wi-Fi HTTP proxy settings. Turn off sharing when you’re done, and never expose the proxy port or external controller directly to the public internet.

Not by default. Apps such as browsers that follow system settings can usually start with the system proxy. Consider TUN when you need to route apps that ignore it. TUN changes the traffic entry point and some routing behavior, and may conflict with other VPNs, virtual adapters, or security software. When troubleshooting, use one traffic capture method at a time; confirm connections and DNS work before combining them. Note your original settings before switching modes so you can isolate problems and restore them.

You can re-import a subscription into compatible clients, but local overrides, rule files, policy selections, and app preferences may not sync with it. Before migrating, note the subscription source and local changes, and use the client’s export feature for backups. Listening addresses, file paths, and TUN settings may differ between devices, so avoid replacing the entire config. If you use cloud storage or WebDAV, restrict access. Store backups containing subscription credentials or proxy passwords securely.

Turn off the proxy and verify that your basic internet connection works. Check your system clock and subscription expiry, then update the config. Make sure the test address itself is reachable, try different routes manually, and check the logs for DNS resolution failures, connection refusals, or handshake errors. If the same subscription works on another network, check restrictions on your current network, your firewall, and DNS. If it fails across devices and networks, ask your provider to check the service. Don’t judge every proxy by a single test address.

Reopen the client, turn off the system proxy and TUN, then exit normally so it can undo its proxy and routing changes. If the client won’t start, check your operating system’s network settings for a manual proxy pointing to a local port. Remove only settings you can confirm belong to that client; keep any settings required by your work network. If the problem persists, check virtual adapters, other VPNs, and DNS settings. Record existing values before restoring anything, and don’t clear all network settings at once—you could disrupt a corporate network or static IP.

Some apps isolated with AppContainer can be blocked from accessing a local proxy by loopback restrictions; this does not affect every Store app. First confirm that a browser works through the system proxy. Then check whether your client provides a UWP loopback tool and grant access only to the apps that need it. This may require administrator rights. A loopback exemption only removes the restriction on accessing the local proxy; it does not make every app follow the system proxy. Restart the app and check the Connections page to confirm its requests reach the core.

Check the logs for an explicit DNS resolution error, then determine whether the unresolved domain belongs to a proxy server or the destination website. For a proxy server domain, check which DNS resolution path is available before the proxy connects. For a destination domain, also review DNS routing and rules in your config. Temporarily disable other DNS interception tools to avoid conflicts with TUN or the client’s DNS feature. Change one setting at a time, close old connections, flush the cache using your operating system’s usual method, and test again. Don’t replace your entire config just because a DNS address is widely used.

Back up your config and local overrides first. Note your operating system, device architecture, client name, and what you were doing before the issue started. Check the client’s supported log directory or your system’s crash reports, focusing on entries around the startup failure. If you suspect a config issue, test a minimal config after backing up; don’t delete all your data. Hide subscription URLs, passwords, and controller secrets before sharing logs. If you temporarily roll back to a previously working version, make sure it supports your config format.