▶Help Center: Clash FAQ Quick Reference
STAGE 01 / help.htmlPick a category, jump to a question, click to expand the answer. 20 Q&As cover subscription imports, TUN permissions, port settings, system proxy, UWP loopback, and more; for full step-by-step setup, see the Getting Started Guide; for protocol and core comparisons, see the Protocol Guide.
▶Basics
CAT 1/4 · BASICStart by understanding how the client, core, and subscription relate, then see how modes and clients differ.
What is Clash? How does it relate to the mihomo core?
Clash is a general term for rule-based traffic-splitting proxy tools. After the original core stopped receiving updates, the community continued maintenance on the Clash.Meta fork, which was later renamed mihomo. Mainstream clients today (Clash Plus, Clash Verge Rev, FlClash, etc.) all bundle the mihomo core, and its config format stays backward-compatible with the original. For details on the differences between core generations, see the protocol guide.
Is the Clash client paid?
No. Every client listed on this site is open-source and free forever, with installers available directly from the download page. What usually costs money is the node service (i.e., the subscription), which is provided by third-party providers and has nothing to do with the client itself.
Can I get online with just the client installed? What is a subscription?
Installing the client alone isn't enough. The client is a dispatcher — it also needs a configuration (usually delivered as a subscription link) containing node addresses and routing rules. Paste the subscription link into the client and update it; once the node list appears, you can start using it. This site does not provide any subscription service.
What's the difference between Rule, Global, and Direct mode?
Rule mode matches traffic against the rules section in the config line by line — traffic that hits a direct rule skips the proxy, and everything else goes through the assigned proxy group; this is recommended for daily use. Global mode ignores the rules entirely and routes all traffic through the currently selected node. Direct mode routes nothing through the proxy, equivalent to temporarily disabling it. The switch is usually in the mode selector on the client's main screen.
Which should I choose: Clash Plus, Clash Verge Rev, or FlClash?
Core functionality is the same across all three; the difference lies in platform coverage and interface style. Clash Plus runs on every platform and has the lowest learning curve, so it's our top pick; Clash Verge Rev offers the most complete desktop feature set for users who want fine-grained control; FlClash has a clean interface and works well on mobile. If unsure, start with Clash Plus — the download page has a full list organized by platform.
▶Setup
CAT 2/4 · INSTALLInstall blocks, first-run permissions, subscription imports, and auto-start — matched to each platform.
What if Windows SmartScreen blocks installation or the first run?
Click "More info" in the prompt, then click "Run anyway" to continue. Most open-source clients haven't purchased a commercial code-signing certificate, so Windows shows this warning for any unsigned program — it's normal. Just confirm the installer came from this site's download page or the project's official release channel before allowing it to run.
How do I fix macOS saying "can't be opened because the developer cannot be verified"?
Open System Settings → Privacy & Security, scroll to the bottom to find the notice about the blocked app, and click "Open Anyway". If the message "app is damaged and can't be opened" keeps recurring, the download was likely interrupted — re-download the installer matching your chip architecture (Intel or Apple Silicon) and try again.
Should I approve the VPN connection prompt when Android starts the app?
Yes. On Android, the client takes over traffic through the system's VpnService, and this permission must be granted on first launch, otherwise the local virtual network adapter can't be created. This authorization only covers local traffic forwarding; once approved, a key icon appears in the status bar to confirm it's active.
How do I troubleshoot a subscription that fails to import or keeps spinning?
Check three things in order: first, whether the subscription link is complete with no extra spaces and the https:// prefix intact; second, whether your current network can reach the subscription address — some subscriptions need a different network to update; third, whether the client runs the mihomo core, since older cores don't recognize newer config fields and will error out.
If it still fails, paste the subscription link into a browser — if it downloads a yaml file, the link itself works and the problem is in the client settings.
How do I set Clash to launch at startup?
On desktop, just enable "Launch at startup" in the client settings — both Clash Verge Rev and Clash Plus offer this option. Users who need TUN mode should also enable "Silent start" so it minimizes to the tray automatically after boot. Android's background restrictions mean you'll need to allow auto-start and add the app to the battery-saver whitelist in system settings, with exact steps varying by manufacturer.
▶Usage Tips
CAT 3/4 · USAGEHow to choose between TUN and system proxy, change ports, add rules, and read latency numbers.
What is TUN mode, and when do I need to enable it?
TUN mode takes over all traffic at the system level through a virtual network adapter, independent of whether an app honors the system proxy setting. Command-line tools, game clients, and other apps that ignore the system proxy can still be routed once TUN is on. The switch is in the client's TUN (or virtual adapter) settings; on Windows, the first activation needs administrator rights to install the driver, and macOS requires authorizing a system extension.
What's the difference between system proxy and TUN mode, and which should I use?
System proxy just advertises an HTTP/SOCKS proxy entry point to the OS — whether an app actually uses it is up to the app. TUN forcibly intercepts traffic at the network layer, covering every process. System proxy is enough for everyday browser use and uses fewer resources; switch on TUN when a stubborn app refuses to go through the proxy. When both are on, TUN takes priority.
How do I change Clash's mixed port (mixed-port)?
On desktop, find the port setting on the settings page, edit it, and press Enter to save — the common default is 7890. The change is written to the running config immediately, and the port the system proxy points to updates automatically. If you've manually configured a proxy in a browser or other app, remember to update it to the new port too, or you'll get connection-refused errors.
How do I route a specific site or app around the proxy (direct connection)?
Add a rule near the top of the rules section, e.g. DOMAIN-SUFFIX,example.com,DIRECT to send that domain direct; use the PROCESS-NAME rule to split by process instead. Most clients also offer a graphical rules or override panel, so editing yaml by hand isn't required. Rules match top to bottom, so a rule placed higher takes priority.
What does the latency number next to each node mean? Is lower always faster?
It's the round-trip time of a single HTTP request the client sends to a test address — it only reflects reachability, not bandwidth or stability. A node with a latency of a few dozen milliseconds can still stutter on video, since the bottleneck could be bandwidth or packet loss. Treat latency as a reference and confirm with real-world experience when picking a node.
▶Troubleshooting
CAT 4/4 · TROUBLEProxy not working, node timeouts, UWP without internet, expired subscriptions, TUN losing connectivity — worked through in order.
System proxy is on, but the browser still doesn't route through it?
First confirm the system proxy toggle on the client's main screen is actually on — on some clients, this toggle is separate from whether the core is actually running. Next, check whether the browser has a proxy extension installed, since those can override the system setting; switch it back to "system proxy" inside the extension. On Windows, you can also open the system's proxy settings page to confirm the address and port point to 127.0.0.1 and the client's current port.
What if every node in the list shows a timeout?
Rule out issues in order: first, check your local network is fine by opening a regular webpage directly; second, check whether the subscription has expired or run out of data in the provider's dashboard; third, update the subscription once, since node server addresses may have changed; fourth, try a node using a different protocol, since the current network may be unfriendly to a specific one. If everything still times out and the subscription is valid, restart the core or the client and test again.
Windows Store apps (UWP) won't go through the proxy or can't get online?
UWP apps are network-isolated by default and blocked from accessing the local loopback address, so even if the system proxy points to 127.0.0.1 they still can't connect. Fix it by finding the UWP loopback exemption (Loopback) tool in the client, checking the box for the affected app, and saving; or switch to TUN mode, which intercepts at the network layer and bypasses the restriction entirely.
Subscription suddenly stops working — update fails with 404 or 403?
A 404 usually means the subscription address has changed; a 403 usually means the provider reset or restricted the subscription. Log into the provider's dashboard, copy the latest subscription link, and re-import it; if the dashboard shows the data quota used up or the plan expired, renewing usually restores the subscription automatically. This isn't something the client itself can fix.
No internet after enabling TUN?
This is usually a DNS problem. Check that the dns section in the config is enabled and enhanced-mode is set to fake-ip — if DNS requests aren't being intercepted, traffic can't reach the core correctly. On Windows, try switching the TUN stack type (system/gvisor/mixed); for configs upgraded from an older core, clear the dns section and regenerate it from the client's default template. If it still doesn't work, turn off TUN, fall back to the system proxy, and compare settings item by item.
▶Still stuck?
NEXT / help.htmlHead to the right page for your issue: setup and first-run config in the Getting Started Guide, protocol and core comparisons in the Protocol Guide, installers organized by platform on the download page.