This page covers questions with a one-line answer. For a more complex symptom — intermittent issues, one app not connecting, or inconsistent behavior across devices — go straight to the troubleshooting handbook and locate it by symptom chapter; if you're setting up a client for the first time, start with the five-step flow in the setup guide.
Basics
5 questions · Clarifying what Clash is and its relationship to mihomo
What's the relationship between Clash, Clash Meta, and the mihomo core?
Clash is a general term for a family of open-source proxy cores. After the original core was archived and stopped receiving updates, the community fork Clash Meta took over maintenance, later renaming itself mihomo, which continues to this day. Mainstream clients today — Clash Verge Rev, FlClash, Clash Plus, and others — all run on the mihomo core under the hood.
The impact on end users is minimal: config file format stays compatible with the original Clash, and mihomo adds support for more protocols and rule types on top. When you see "Meta core" or "mihomo core" mentioned for a client, they all refer to the same maintenance lineage — no need to overthink it.
Clash for Windows is discontinued — can I still use it?
It still runs, but staying on it long-term isn't recommended. Clash for Windows is no longer maintained, and its core version is frozen on an old release: new protocols and rule types aren't supported, and nobody fixes compatibility issues from subscription format upgrades or OS updates.
Windows users should migrate to Clash Verge Rev or FlClash — config files can mostly move over as-is. For migration steps, see the blog post on choosing and migrating to alternative clients; the download page also keeps the archived version available for transition.
How do I choose between Clash Verge Rev, FlClash, and Clash Plus?
All three run on the mihomo core; the differences are in interface and platform coverage. Clash Plus has the lowest learning curve and has an App Store version for iOS, good for multi-device users; Clash Verge Rev is the most feature-complete across Windows, macOS, and Linux desktop — rule editing, TUN, and scripting are all there, suited to power users; FlClash has a clean interface and a good mobile experience.
If unsure, check the download page for platform-by-platform scores — each card lists who it's best suited for and a hands-on take.
Does the Clash client come with nodes built in? Where do subscription links come from?
No, it doesn't. Clash-family clients are just "proxy dispatchers" — they route traffic to nodes according to rules. The nodes themselves come from a subscription link, usually from a service you purchased or self-hosted. After importing a subscription, the client periodically fetches the node list; swap in a new link if one expires.
Free nodes circulating online tend to have unstable quality and security risks — avoid routing sensitive account traffic through unknown-origin nodes.
When should I use Rule mode, Global mode, or Direct mode?
Rule mode is the everyday default: common sites connect directly and traffic that needs a proxy goes through a node, per your routing rules — saves bandwidth and stays fast. Global mode sends all traffic through the current node; use it only briefly when you need everything proxied temporarily (e.g. to check a rule misfire). Direct mode effectively turns off the proxy while keeping the client running, useful for isolating whether an issue is "actually proxy-related."
Stick with Rule mode day-to-day — leaving Global mode on long-term is both slow and a waste of bandwidth.
Setup
5 questions · From install blocks to first subscription import, the early gotchas on each platform
What if Windows SmartScreen or antivirus software blocks installation?
Most open-source clients don't have a purchased code-signing certificate, so SmartScreen shows "Windows protected your PC" — click "More info" → "Run anyway" to proceed. Some antivirus software flags the TUN driver or proxy components as false positives; you can temporarily whitelist the install directory beforehand.
This assumes the installer source is trustworthy: download from this site's download page or the project's official release page, not a third-party repack found via search engines.
What to do about macOS saying "can't be opened because Apple cannot check it for malicious software"?
This is Gatekeeper's default block on apps that haven't been notarized. After the first blocked attempt, go to "System Settings → Privacy & Security," scroll to the bottom, and click "Open Anyway"; or run xattr -cr /Applications/AppName.app in Terminal to clear the quarantine attribute.
Also check architecture: download the arm64 build for Apple Silicon and the x64 build for Intel Macs — the wrong architecture simply won't open.
How do I import a subscription link into the client?
General flow: copy the subscription URL from your provider → open the client's "Profile/Subscription" page → New or Import → paste the URL → confirm the download. On success, a new profile entry appears in the list — select and activate it to see node groups on the Proxies page.
Make sure the URL is copied in full with no stray spaces; some clients support QR scanning or clipboard detection. After the first import, turn on auto-update — an interval of 12 to 24 hours works well. See the full walkthrough in the setup guide.
Android shows a "VPN connection request" on first launch — should I allow it?
Yes. On Android, Clash clients take over traffic through the system's VpnService, and this permission dialog is a standard OS flow. After tapping "OK," a key icon appears in the status bar, indicating local traffic is being routed by the client on-device — not handed off to some third-party VPN service. If you accidentally decline, tapping the start button in the client's main screen again will trigger the prompt once more.
Some customized Android systems also require whitelisting the client in battery optimization settings, or the background process gets killed by the system and connectivity drops.
Why does TUN mode need administrator rights or a system service install?
TUN mode works by creating a virtual network adapter and routing all system traffic through the core for processing. Creating that adapter is a system-level operation: Windows needs administrator rights or a system service that starts at boot, while macOS and Linux need root authorization. Clash Verge Rev offers one-click "Service Mode" installation, after which you won't get a permission prompt every time you launch.
If you only need to proxy regular apps like browsers, system proxy mode is enough — no need to enable TUN.
Usage Tips
5 questions · Custom rules, DNS modes, auto latency testing, LAN sharing
How do I force a specific site or app to always go direct or through a specific node?
Add a custom rule at the very top of the rules section in your config — for example, DOMAIN-SUFFIX,example.com,DIRECT sends that domain direct; writing a proxy group name as the action routes it through that group instead. Rules match top-down on a first-match basis, so custom rules must sit above the general ones.
Clash Verge Rev's "global extended config" and FlClash's overlay feature let you layer rules on top without editing the subscription's original text, so subscription updates won't wipe them out. See the "Rules & Routing" category in the glossary for a rule-type quick reference.
Which DNS mode should I use, fake-ip or redir-host?
Most scenarios call for fake-ip: the core returns a fake IP from a reserved range for each domain and records the mapping, skipping a real lookup, so connections establish faster — it's also the default pairing under TUN mode. redir-host returns the real IP and tends to be more reliable for IP-based auth in some games or LAN services.
When using fake-ip, remember to configure fake-ip-filter to exclude LAN domains, NTP services, and the like, or you may see resolution errors for local network services. See the blog's DNS configuration breakdown for a full parameter walkthrough.
How do I set up subscription auto-update? Will updates overwrite my edits?
Mainstream clients offer an "auto-update interval" setting on each subscription entry — 720 minutes gets you roughly twice a day, plenty for everyday use.
One caveat: edits made directly to the subscription config file itself get overwritten by the server's latest content on the next update. To keep custom rules permanently, use the client's override/extended config mechanism (Merge, Script) so your changes layer on top of the subscription rather than editing the subscription file directly.
What's the difference between url-test and fallback groups, and how do I auto-select the fastest node?
url-test groups periodically ping all nodes in the group and auto-switch to the one with the lowest latency; fallback groups check nodes in list order and move on to the next only when the current one is down — good for a "primary plus backup" setup.
To auto-pick the fastest node, put your commonly used nodes into a url-test group with interval set to around 300 seconds. For a manual check, click the latency test icon on the client's Proxies page to run a round of tests across all nodes in a group.
How do other devices on the LAN (TV, game console) share this computer's proxy?
Enable "Allow LAN connections" (allow-lan) in the client, then note down the computer's LAN IP and mixed port (commonly 7890). On the TV or console's network settings, manually enter the proxy: server as the computer's IP, port as 7890. Make sure the computer's firewall allows that port, and both devices are on the same subnet.
This kind of sharing uses HTTP/SOCKS proxy — for devices that don't support proxy settings, consider a router-based setup; the blog has a bypass router deployment overview.
Troubleshooting
5 questions · System proxy not working, node timeouts, subscription 403s, UWP loopback
System proxy is on, but the browser still can't get online?
Check three things in order: first, whether the client's "System Proxy" toggle is actually on — some clients don't enable it by default on launch; second, whether the system-level proxy settings are being overridden by other software — open the OS proxy settings page and confirm the address/port point to 127.0.0.1 plus the port shown by the client; third, whether a proxy-related browser extension is overriding system settings — disable it temporarily and retry.
If it still fails, switch to Direct mode as a control test: if direct also fails, it's a local network issue unrelated to the proxy.
All nodes are timing out — not a single one works?
When every node times out, it's usually a link-level issue rather than a node problem. First confirm the subscription hasn't expired (check the provider's dashboard); then check whether your device's clock is accurate — some protocols are sensitive to time drift, and a difference of a few minutes can break the handshake; then refresh the subscription to pull the latest node list; finally, try a different network (e.g. phone hotspot) as a control — if it works there, the current network is interfering with the proxy protocol.
The complete step-by-step process is in the "Node timeouts" chapter of the troubleshooting handbook.
Subscription update fails with a timeout or 403 error?
A timeout usually means the subscription server itself needs a proxy to reach: turn on "update subscription via proxy" in the client (assuming you still have a working node), or switch to Global mode before updating. A 403 error commonly means the subscription link has expired or been reset — go back to your provider's dashboard and copy a fresh link; it could also mean the client's user-agent got rejected by the server, so try setting a custom UA in the subscription settings.
If it keeps failing, open the subscription URL directly in a browser: seeing YAML text confirms the link itself is fine and the issue is on the client side.
What if Microsoft Store (UWP) apps won't go through the proxy?
Windows UWP apps are restricted by network isolation policy by default and can't reach the local loopback address 127.0.0.1, so system proxy doesn't apply to them. The fix is a "loopback exemption": clients like Clash Verge Rev have a built-in UWP loopback exemption tool in Settings — check the target app and save; you can also use Microsoft's official CheckNetIsolation command to allow apps individually.
Enabling TUN mode bypasses this restriction entirely, since traffic gets intercepted at the network adapter level.
Connected, but speeds are slow — how do I troubleshoot?
First figure out whether the node or your local setup is the bottleneck: try 2-3 nodes in different regions — if all are slow, check locally, confirming you don't have multiple proxy tools nested on top of each other, and check whether Global mode is routing traffic that doesn't even need a proxy. If it's just one slow node, check your provider's rate multiplier and peak-hour congestion — evening slowdowns are common.
On desktop, also confirm you're on a recent mihomo core version, since older cores perform worse on some protocols. The "Slow speeds" chapter of the troubleshooting handbook has a more complete diagnostic path.
Question not covered in these 20?
For symptom-level systematic troubleshooting (no internet access, subscription failures, client crashes, mobile-specific issues), head to the troubleshooting handbook and find it by chapter; if you haven't installed a client yet, pick a top-scoring one for your platform first.