HELP DESK · Service Bay
Troubleshooting
Twenty high-frequency questions sorted into four work stations. Client choice, subscriptions, permissions, fixes — all on one page. Can't find it here, check the troubleshooting handbook and deep-dive articles at the bottom.
Q01–Q05 · Station One
Basics
Understand what this ecosystem is, who maintains it, and how free it really is — before you install anything.
What is the relationship between Clash and mihomo?
Clash is the umbrella name for an open-source proxy core and rule-based routing scheme. After the original core repository was archived, the community fork
mihomo (formerly Clash Meta) took over maintenance, adding more protocols and features. Mainstream clients today (Clash Plus, Clash Verge Rev, FlClash, etc.) all bundle the mihomo core, and the config file format stays backward-compatible, so most older configs still work as-is.With so many clients available, which one should I install?
Clash Plus is the top pick across all platforms: it ships official installers for Windows, macOS, Android, iOS, and Linux, and works right after you import a subscription. On desktop, Clash Verge Rev is an equally capable alternative. See the client comparison page for a feature-by-feature breakdown, and always grab installers from the Download Center rather than unverified sources.
Is the Clash client paid? Can it work without a subscription?
The client and its core are open-source and free forever — there is no paid unlock. But the client only handles traffic routing; it doesn't ship with any nodes. You need a subscription link from a provider, or a config generated from your own server, before it can actually connect anywhere. Without any usable node, the client simply falls back to direct connections.
What's the difference between Rule mode, Global mode, and Direct mode?
Rule mode matches the
rules in your config top to bottom and routes each connection according to the first hit — this is the recommended everyday mode. Global mode forces all traffic through the currently selected node, useful for quickly checking whether a node works. Direct mode is effectively a bypass, sending everything without a proxy. Remember to switch back to Rule mode after testing, or local traffic will also detour through a node and speeds will noticeably drop.What is subscription conversion, and when do I need it?
Subscription conversion turns a node list in another format from your provider into Clash-readable YAML. If your provider already gives you a Clash-format subscription link, just import it directly — no conversion needed. Only consider converting if the import fails with a "format not supported" error. Conversion services see your full node details, so prefer self-hosting one or using a trusted source rather than pasting your subscription link into a random site.
Q06–Q10 · Station Two
Setup & Config
Each of the five platforms has its own hurdle: importing, allowing, authorizing, the store, autostart. Cleared one by one.
After installing the client on Windows, how do I import a subscription?
Open the client, go to the Subscriptions (or Profiles) page, paste the link from your provider, and click download. Once the profile appears in the list, select it to activate, then head back to the home screen and turn on the system proxy toggle. Visit a site outside your region in a browser to confirm connectivity. Full screenshots and checkpoints for each step are on the tutorial page.
What if macOS says "can't be opened because the developer cannot be verified"?
This is Gatekeeper's default block on apps outside the App Store — it doesn't mean the installer is corrupted. Open "System Settings → Privacy & Security", scroll to the bottom for the blocked-app notice, and click "Open Anyway"; alternatively, right-click the app icon in Finder and choose "Open". Also double-check your chip: download the arm64 build for Apple Silicon and the x64 build for Intel Macs — both are in the Download Center's macOS section.
Why does Android prompt a VPN connection request on first launch?
The Android client uses the system's VpnService to build a local tunnel that intercepts traffic — this permission dialog is standard system behavior, and both ends of the tunnel stay on your device. Tap Allow, and a key icon will stay pinned in the status bar afterward. If the app keeps getting killed in the background and traffic drops, add it to your device manufacturer's battery-saving allowlist — see the Android deep-dive article for exact steps.
How do I install the Clash client on iOS?
On iOS, search for Clash Plus in the App Store, or jump straight to the store page from the iOS section of the Download Center (official site: clashplus.io). On first launch, you'll also need to allow the VPN configuration prompt from the system. After that, importing a subscription and picking a node works the same way as on desktop.
After installing the .deb package on Linux, how do I set it to start at boot?
For Clash Verge Rev's .deb package, launch it once from the app menu, then enable "Start on boot" in Settings. For servers or routers, running the mihomo core directly is preferable: write a systemd service unit pointing to the core binary and config directory, then run
systemctl enable so it starts with the system. The core download is in the Kernel section of the Download Center.Q11–Q15 · Station Three
Usage Tips
Getting connected is only the starting point. Modes, proxy groups, routing rules, and DNS — get these four right and you actually know how to use it.
What's the difference between system proxy and TUN mode?
System proxy only "suggests" a HTTP/SOCKS port to apps — programs that ignore system proxy settings (many games and command-line tools) will bypass it entirely. TUN mode creates a virtual network adapter and intercepts all traffic at the network layer, giving full coverage, but it requires administrator or root privileges. System proxy is enough for everyday browser use; switch on TUN when you need to cover every program on the device.
How do I choose between the url-test, fallback, and load-balance proxy groups?
url-test periodically measures latency and auto-selects the fastest node — the default choice for daily use. fallback picks the first available node in list order, suited to a "stick with a primary node, switch only if it fails" setup. load-balance spreads connections across multiple nodes, useful if you have several lines in the same region. For a parameter-by-parameter breakdown and real-world test differences among the three, see the proxy group deep-dive article.How do I exclude a specific site or app from the proxy?
Add a rule pointing to DIRECT in your config's
rules section, for example DOMAIN-SUFFIX,example.com,DIRECT. For per-process routing, use a PROCESS-NAME rule instead. Rules match top to bottom and stop at the first hit, so this DIRECT rule needs to sit above any broader rule that would otherwise catch it first — otherwise it never gets a chance to apply.Should I use fake-ip or redir-host for DNS?
Prefer fake-ip: DNS requests get an instant fake address from a reserved range, connections establish faster, and it's a key part of preventing DNS leaks. A few programs that rely on the real IP (LAN device discovery, some game multiplayer) can be excluded individually with
fake-ip-filter — there's usually no need to fall back to redir-host entirely. See the DNS deep-dive article for leak testing and prevention techniques.Can subscriptions update automatically?
Yes. Mainstream clients let you set an update interval in the subscription settings (for example, 1440 minutes for once a day), and the latest config is pulled automatically on schedule. If an update fails, the old config stays active so you don't lose connectivity. After a provider makes large-scale node changes, it's worth manually refreshing the subscription and re-selecting a node to avoid staying connected to a retired address.
Q16–Q20 · Station Four
Troubleshooting
Five of the most common failure scenes, each with the shortest fix path. For a systematic workflow, see the troubleshooting handbook.
The system proxy is on, but the browser still connects directly — why?
First check whether a proxy extension in your browser (such as SwitchyOmega) is overriding the system setting. Next, confirm the client's listening port matches the system proxy setting (default is 7890). On Windows, open "Settings → Network & Internet → Proxy" to make sure nothing else has changed it. Note that terminals don't read the system proxy at all — you'll need to set environment variables separately or switch to TUN mode. See the dedicated article for a step-by-step breakdown.
How do I troubleshoot when every node times out?
Check four things in order: first, whether the device can reach the internet at all without a proxy — fix your network connection if not; second, whether the subscription has expired — refresh it manually; third, switch to Global mode and test a single node to rule out a rule misconfiguration; fourth, try a node on port 443 to rule out line interference. If everything fails at once, it's usually a subscription or local network issue; if only one or two nodes fail, the problem is with those nodes specifically. See the full workflow in the troubleshooting handbook.
What if a subscription fails to import or update?
Errors fall into two categories. A download failure is a network issue: try updating again through a currently working node, or switch networks and retry. A parsing failure is a format issue: confirm you actually have a Clash-format subscription and not a link meant for another client, converting it if needed. If the token in the link has been reset, go back to the provider's dashboard and copy the subscription address again.
Why can't UWP apps (Microsoft Store apps) connect to the internet?
Windows' UWP sandbox blocks apps from reaching the local loopback address by default, so when the system proxy points to
127.0.0.1, Store apps fail to connect. Desktop clients usually include a built-in UWP loopback exemption tool — enable it in Settings and check the target app to lift the restriction. Alternatively, switch to TUN mode, which intercepts traffic at the network layer and naturally sidesteps the loopback restriction.What if the client won't open or crashes right at launch?
Three common causes: a config that fails to parse — switch back to the default config and try launching again; a port already in use by another program — change
mixed-port in Settings and restart; or a leftover core process from the last exit — end it in Task Manager before reopening. The most direct way to pin it down is the logs; log locations per platform and a step-by-step fix are in the launch-crash deep-dive article and the troubleshooting handbook.
STILL BROKEN? · Escalation