10 Common Clash Questions for Beginners: Subscription Setup, Proxy Modes, Node Selection, and Startup

01 · Why can’t I connect after installing the client?

The client manages your configuration and starts the proxy core; nodes provide remote exit points. Installing the client only prepares your device to run it—it doesn’t give you a usable node. Before you can connect, you need to import and activate a configuration, select an exit, and route app traffic through the proxy.

Clash is a commonly used name for a family of rule-based proxy cores and related clients. Clash Meta continued development under the name mihomo; graphical clients using mihomo typically support more protocols and configuration fields. The client version and core version are separate details. When troubleshooting, record both rather than simply saying you installed the latest version.

1. In the client’s About or core information screen, note the client name, version, and core name.
2. Make sure your subscription provider explicitly supports Clash or mihomo configurations, especially the required node protocols.
3. Start with rule mode and the system proxy to test browser access before deciding whether to enable TUN.

02 · Where do subscription links come from? Can I share one?

Subscription links usually come from the account dashboard of a node service, or can be generated by a self-hosted service. The client does not provide remote nodes automatically. Choose a subscription format labeled for Clash or mihomo. Don’t copy a website login URL, purchase page, or account page from your browser’s address bar.

Subscription URLs often contain a token that identifies your account. Anyone with the full URL may be able to retrieve node details, use your traffic allowance, or view account-related information returned by the subscription. Treat it like a credential: don’t post it in public support tickets, screenshots, chat groups, or code repositories.

• Before importing, check that the domain matches the provider’s dashboard and use the official HTTPS URL they provide.
• When asking for help, hide the entire query string and any sensitive path—not just the username.
• If a link is exposed, reset it in the provider’s dashboard and replace the saved URL in your client.
• Online subscription converters require you to submit the original URL to their service. Assess whether you trust that service before using it.

This article does not provide public nodes or subscription links. If you self-host, you can maintain your own YAML configuration. If you only have a single ss:// or vmess:// link, check whether your client supports importing individual nodes; a single link is not a complete Clash configuration.

03 · How do I import a Clash subscription? What should I check if it fails?

Menu names vary between clients, but the usual process is to create a remote configuration on the Subscription or Profiles page, paste the URL, and download it. Then select that configuration to make it active. Seeing a profile card doesn’t necessarily mean it’s active—check the current-profile indicator and core logs.

Diagnose the problem from the response

A complete configuration usually includes proxies, proxy-groups, and rules; it may also use proxy-providers to load nodes. A subscription containing only a Base64-encoded node list may not load directly as a YAML configuration. Changing the file extension won’t fix a format mismatch.

If the logs show a connection timeout, first check that your computer’s clock is correct and that your network can reach the subscription domain. If updates need to go through a proxy, you’ll also need an already working proxy connection—a blank configuration can’t create one from scratch.

04 · What’s the difference between Rule, Global, and Direct modes?

Proxy mode determines how connections that have reached the core choose an exit; it does not route every app through the core automatically. Even in Global mode, an app that ignores the system proxy and isn’t captured by TUN can bypass the client entirely.

• Rule mode: Matches entries in rules from top to bottom and applies the policy for the first match. This is usually the best place to start for everyday use.
• Global mode: Sends connections to the global policy. You still need to choose an actual node or group in that policy. Useful for temporarily troubleshooting routing rules.
• Direct mode: Connections use a direct route. This does not turn off the client or disable the system proxy.

Minimal rule example

mode: rule
rules:
  - DOMAIN-SUFFIX,example.com,DIRECT
  - MATCH,PROXY

This is an example of rule syntax, not a complete configuration you can import as-is. PROXY must match the name of a node or policy group in your configuration. DOMAIN-SUFFIX,example.com,DIRECT matches that domain and all its subdomains. MATCH is the final fallback rule. If you put MATCH earlier in the list, no rules after it will be reached.

When troubleshooting a website, temporarily switch to Global mode and select the same node. If the site works globally but not in Rule mode, focus on the matching rule and its target policy instead of assuming the node is down.

05 · How do I choose a node? Is the lowest latency always best?

The latency shown by a client usually comes from probing a specific test URL. Results depend on the test address, timeout, network congestion, and how the core runs the test. They don’t represent the speed of every website or video download throughput. A successful latency test only confirms that the probe completed.

1. Select a node within the policy group you’re actually using; don’t just run a test from the node list.
2. Test the actual destination. Check connection time, whether all page resources load, and whether errors keep occurring.
3. Compare candidate nodes on the same network and against the same test URL to minimize changing variables.
4. Check the connection log for the final exit to make sure another policy group didn’t route the traffic elsewhere.

A select group lets you choose manually; a url-test group picks a node based on probe results; a fallback group generally chooses the first available exit in order. Groups can reference other groups, so the displayed group name may not be the final node name.

For example, selecting an “Auto” group inside a manual group means the actual exit may still change based on probe results. To reproduce an issue consistently, temporarily select a specific node and note the test time, destination domain, and error. Don’t change the node, DNS, and rules all at once, or you won’t know which change made a difference.

06 · Why can’t my browser connect when the system proxy is on?

The system proxy provides a local proxy address to apps that support it; it does not force all traffic through the proxy. First check which port the client is actually listening on, then make sure the operating system is using the same address and port. The examples below use 127.0.0.1:7890; use the values shown in your client.

Windows checks

1. Go to Settings → Network & internet → Proxy and check the proxy address and port managed by the client.
2. Check the HTTP or mixed port in the client settings. Don’t use the control API port by mistake.
3. Pause other proxy tools to prevent multiple apps from repeatedly changing the system proxy settings.
4. Check whether a browser extension has its own proxy configured. If needed, disable related extensions and try again.

Test-NetConnection -ComputerName 127.0.0.1 -Port 7890
curl.exe -I --proxy http://127.0.0.1:7890 https://example.com/

The first command checks whether the local port is reachable from PowerShell; TcpTestSucceeded : True only means the listener is reachable. The second explicitly sends a request through the HTTP proxy, without relying on whether the app reads the system proxy setting. An HTTP response means that request received a response through the proxy; check the target site to determine whether the status code is expected.

If an explicit proxy request works but the browser doesn’t, check the browser settings, extensions, and secure DNS. If the explicit request also fails, check the local port, node, authentication, and logs. The control API is usually for communication between the client and core. An open port doesn’t make it a valid proxy address for your browser.

07 · What is TUN mode? Do beginners need to enable it?

TUN uses a virtual network interface and routing rules to capture IP traffic, which is useful for apps that don’t follow the system proxy. It’s a different way to route traffic into the core, not a “higher-level proxy mode.” Rule, Global, and Direct still determine the exit for traffic that reaches the core.

Start with the system proxy to verify the basics and reduce the number of variables. If your browser works but an app ignores the system proxy, consider TUN. Before enabling it, check whether your client requires administrator privileges, service mode, or additional network permissions. Requirements vary by operating system and client.

• Windows: Make sure any required service or permissions are in place, and check the logs for virtual adapter or route creation errors.
• Android: Traffic is usually captured through the system VPN permission. Enabling another VPN app may replace the current connection.
• Multiple VPNs on desktop: Corporate VPNs, virtual machine networks, and other tunnels can change route priorities. Troubleshoot them one at a time.

Don’t assume that enabling TUN automatically handles all UDP, IPv6, and DNS traffic as expected. Check the core’s capabilities, whether your nodes support the relevant transport, the routes being captured, and how DNS interception is configured. After enabling TUN for the first time, test your browser and any apps that previously bypassed the proxy separately.

08 · Should I change fake-ip and DNS settings together?

DNS resolves domain names to addresses. In mihomo’s fake-ip mode, relevant queries return virtual addresses used for mapping; the core uses them to recover the domain and handle the connection. Seeing a virtual address doesn’t necessarily mean DNS is broken—the key is whether the core still captures and handles the traffic correctly.

If you’re new to this, keep the working subscription and client’s default DNS setup. Avoid changing settings in the operating system, browser, and client all at once. Encrypted DNS in the browser may change the query path; TUN’s dns-hijack is not a universal way to intercept all encrypted DNS requests.

Record what happens before changing fields

• Only one domain fails: check the matching rule, the site’s status, and DNS logs first.
• Several domains fail to resolve: check whether the DNS upstream is reachable and queries are following the expected path.
• Local device names or a specific app behave oddly: check whether you need a precise fake-ip exclusion rather than disabling DNS entirely.
• Behavior changes when TUN is enabled or disabled: compare routing and DNS handling in both states instead of only changing nodes.

The output of the system’s nslookup only reflects the query path it uses; it doesn’t prove that your browser or every app uses the same DNS. For more on these fields, see the DNS and TUN sections in the Configuration Handbook.

09 · How do I launch the client at startup? Why is there no proxy after reboot?

Startup launch, core startup, restoring the system proxy, and TUN permissions are four separate things. A startup entry only attempts to launch the app; it doesn’t guarantee the configuration is valid, the network is connected, or the right policy group is selected. Desktop GUI clients usually start after you sign in, which doesn’t mean the proxy is available before login.

After-restart checklist

1. In the client settings, enable “Launch at startup” or the equivalent option.
2. On Windows, go to Settings → Apps → Startup and make sure the app hasn’t been disabled by the system.
3. After signing in again, check the tray icon, active configuration, and core logs—not just whether the window appears.
4. Check whether the system proxy has been restored. If you use TUN, also check the service status and permissions.
5. Once the network is connected, test the destination request again to rule out the network not being ready during startup.

In some clients, “Close window” only minimizes the app to the system tray; in others, it exits the program. When testing startup, distinguish between minimizing, quitting, and stopping the core. If the client has exited but the system proxy still points to 127.0.0.1, apps that use the system proxy may lose connectivity because nothing is listening on that local port.

If this happens, restart the client or turn off the manual proxy in system settings. Don’t create multiple startup tasks and services by hand; duplicate launches can cause port conflicts and prevent the normal configuration from loading.

10 · Do subscription updates overwrite settings? What should I include in a bug report?

Updating a remote subscription usually replaces the contents of that remote configuration. Direct edits to a downloaded YAML file may be lost on the next update. Client features such as overrides, merges, or scripts can keep personal settings separate from subscription content, but their capabilities and merge order depend on the implementation.

Before adding rules, find out whether an override replaces the entire rules array or appends to the beginning or end. If you need a particular policy group, make sure its name still exists after an update. Rules that reference a renamed group may cause the configuration to fail to load.

A useful troubleshooting report

• Environment: Operating system and version, client name and version, core name and version.
• Routing: System proxy or TUN, the actual local port, and whether another VPN is running at the same time.
• Policy: Rule or Global mode, the matching rule, and the final policy group and node name.
• Issue: When it happened, the destination domain, HTTP status code or exact error, and whether you can reproduce it consistently.
• Comparison: What changes when you disable the proxy, specify it explicitly, or switch to a known-good node.

Before sharing logs, remove subscription URLs, tokens, node passwords, and control API secrets. You usually only need the relevant lines from around the failure, not the entire configuration. If you’ve changed several settings, restore a working backup and retest by changing one thing at a time.