Clash Troubleshooting & FAQ
Work from the symptom down through the network stack: verify the underlying connection first, then inspect the configuration, proxy entry point, routing rules, and DNS. Change one variable at a time so the logs remain useful.
Core Concepts
Distinguish the core, client, traffic-capture method, and policy mode first so you do not troubleshoot the wrong component.
How are Clash, the Mihomo core, and GUI clients related?
The core reads configurations, establishes connections, applies routing rules, and handles DNS. The GUI client manages subscriptions, policy selection, system proxy controls, and logs. Mihomo is a widely used compatible core. When troubleshooting, record the client name, core type, and operating system instead of listing Clash alone as the version.
What is the difference between Rule, Global, and Direct modes?
Rule mode evaluates configuration rules from top to bottom and sends each connection to the policy matched first. Global mode generally routes all traffic the client can capture through a selected policy group. Direct mode attempts to bypass the proxy. Use Rule mode for everyday use, switch temporarily to Global mode when testing node connectivity, and restore the original setting afterward.
Should I use the system proxy or TUN mode?
The system proxy is usually sufficient for browsers and desktop apps that follow OS proxy settings, and it is easy to configure and disable. Games, command-line tools, some store apps, and programs that ignore the system proxy may require TUN. Test the system proxy first, then enable TUN only when an app requires it. Changing several network layers at once makes troubleshooting harder.
Why doesn't the latency test reflect actual browsing speed?
A client latency test usually makes one brief connection or request to a specified URL. It mainly reflects the test target, the route at that moment, and the handshake. Web and video performance also depends on bandwidth, packet loss, distance to the destination, congestion, and protocol behavior. Compare several tests, open the actual service, and review the logs rather than choosing a node solely because it has the lowest number.
Setup and Configuration
Subscription imports, system permissions, and network interfaces are the three most common checks during initial setup.
Why are there no nodes after importing a subscription?
First confirm that the subscription URL is still reachable and that a new profile appears in the client's configuration list. If the profile exists but contains no nodes, check the update log for formatting errors, authentication failures, or an unexpected response. Also make sure the newly imported profile is active rather than an older one. Subscription URLs are sensitive; redact the full URL and its parameters in troubleshooting screenshots.
What should I do if a subscription update fails or is reported as expired?
Check the provider's page for the subscription status, expiration date, and data allowance, then verify that no parameters were lost when copying the URL. If the existing profile still works but cannot update, check the system clock, DNS resolution, and update request logs. Avoid repeatedly refreshing the subscription because some services impose rate limits. Wait briefly and retry to distinguish a temporary limit from an invalid URL.
Why does Windows report insufficient permissions when enabling TUN?
TUN creates a virtual network interface and changes routes, so it usually requires administrator privileges. Exit the client, run it as administrator, and check whether security software is blocking driver or service registration. If the client offers a service mode, install it from the settings page and restart. If it still fails, identify the device or service named in the logs instead of repeatedly installing similar virtual adapters.
What should I do if the system proxy does not work on macOS?
First confirm that the client has the required network permissions and that the active interface is the Wi-Fi or wired connection currently in use. After switching networks, proxy settings on the old interface may not carry over to the new one. Disable the system proxy, quit the client completely, restart it, and then check whether the HTTP, HTTPS, or SOCKS entries in macOS network settings have been updated.
What should I do if Microsoft Store or UWP apps cannot use the proxy?
Some UWP apps are subject to local loopback restrictions and cannot directly access a proxy port on localhost. Use the client's UWP loopback tool to grant loopback access to the affected apps, then restart them. If TUN is already enabled, first check whether the issue still occurs. Do not repeatedly change loopback permissions, the system proxy, and firewall settings at the same time, or you will not know which change worked.
Why doesn't Android show a VPN connection prompt after importing a configuration?
Android requires system authorization the first time a client creates a local VPN. If no permission dialog appears, check whether another VPN, an always-on VPN, or a work profile policy is occupying the connection. Disable the conflicting VPN, return to the client, and start it again. Some Android versions also restrict background launches, so allow the client to run while connecting and check the status bar for the VPN indicator.
Usage Tips
Use connection logs, health checks, and overrides to keep everyday changes observable and easy to roll back.
How can I tell which rule matched a domain?
Open the client's connection history or live log, then visit the target domain again. The entry usually shows the destination host, matched rule, and final policy group. If it only shows an IP address, check whether the core is handling DNS. After editing rules, reload the configuration and create a new connection for testing. Existing persistent connections may continue using the old route and cannot confirm whether the new rule is active.
Why does an automatic policy group keep switching nodes?
Automatic policy groups reorder nodes or fail over based on health-check results. Frequent switching can result from a short check interval, an unreliable test URL, minimal differences between nodes, or brief packet loss. Increase the interval, use a stable small test resource, and set a reasonable switching tolerance. For sign-ins that require a consistent source IP, manually selecting a policy is usually better.
How can I prevent subscription updates from overwriting configuration changes?
Editing a subscription-generated configuration directly usually means it will be replaced in full by the next update. Prefer the client's override, merge, scripting, or preprocessing features so custom rules remain separate from subscription content. Keep a known working configuration before making changes, and validate the syntax with a small set of rules first. Override formats vary by client, so recheck all fields when migrating.
What should I check first if every node test times out?
Disable the proxy and confirm that the underlying connection can open ordinary websites, then check the system clock, subscription status, and DNS resolution for node addresses. Next, try a known working network to rule out restrictions on the current Wi-Fi, router, or ISP connection. If only some nodes time out, the nodes or routes are usually at fault. If all of them time out, focus on core startup logs, firewall blocks, and configuration parsing errors.
Troubleshooting
Use the underlying connection with the proxy disabled as your control, then restore the node, traffic capture, routing rules, and DNS one layer at a time.
What should I do if no websites load after enabling Clash?
Disable the system proxy or TUN and see whether connectivity returns. If it does, the issue is in the client, configuration, or node route. Restart the client, select a known working node, and temporarily test in Global mode. If Global mode works but Rule mode does not, inspect the rules and DNS. If both fail, check the logs for connection refusals, timeouts, or ports already in use.
How do I troubleshoot DNS errors when the node connects successfully?
First determine whether every domain fails or only specific ones. Check whether the DNS module is enabled, whether its listening port conflicts with another service, and whether another tool has changed the system DNS. Before switching between fake-ip and redir-host, confirm that the client and core support the chosen mode. Flush the system DNS cache, reconnect, and use the logs to see whether queries reach the core and what responses are returned.
What should I do if the internet still does not work after closing Clash?
An unexpected exit may leave the system proxy pointing to a local port or retain TUN routes that were not removed. Disable the manual proxy in the operating system's network settings, reopen the client, and use its normal exit process to turn off proxy features. If TUN was enabled, restart the system to restore network interfaces and routes. If connectivity is still unavailable, verify that the current network can assign the IP address, gateway, and DNS settings automatically.
Why do some apps still connect directly when the system proxy is enabled?
The system proxy only affects apps that actively read that setting. Some command-line tools, games, and software with custom network stacks may bypass it. First check the connection log to see whether the app's requests appear, then inspect the app's own proxy settings. If all traffic must be captured, consider TUN mode, but disable duplicate per-app proxies first to prevent loops or port conflicts caused by multiple forwarding layers.