TROUBLESHOOTING REFERENCE
Clash FAQs and Troubleshooting
Work through subscription imports, proxy modes, and configuration syntax, then check TUN, DNS, node connections, and system networking. Every answer provides a clear order of checks for quick post-install troubleshooting.
BASICS
Getting Started
First distinguish the client, core, subscription, and proxy modes. Once these concepts are mapped correctly, later configuration issues are much easier to isolate.
What are Clash, Clash Meta, and mihomo?
Clash usually refers to a rule-based proxy client and its configuration ecosystem. The original Clash core is no longer actively developed. Clash Meta extended support for protocols, DNS, and TUN while remaining compatible with common configurations, and was later renamed mihomo. Many current desktop and mobile clients are only graphical interfaces; mihomo handles the actual connections, rule matching, and DNS processing.
Where do subscription links come from, and does the client generate nodes automatically?
A Clash client reads configurations, selects policies, and forwards connections; it does not generate subscriptions or nodes automatically. Subscription links usually come from the network service provider you use, while local YAML configurations can also be maintained manually. Before importing one, confirm that the link is still valid, and never publish subscription URLs containing access credentials in screenshots, forums, or public documents.
How should you choose between Rule, Global, and Direct mode?
For everyday use, choose Rule mode first. Connections are routed according to rules such as DOMAIN, GEOIP, and MATCH in the configuration. Global mode sends most connections through the current proxy policy and is useful for temporarily checking whether a node works. Direct mode bypasses the proxy and helps determine whether a problem is caused by the proxy path. After troubleshooting, switch back to Rule mode.
What is the difference between system proxy and TUN mode?
System proxy mode mainly changes the operating system’s HTTP and SOCKS proxy settings, which browsers and apps that follow system proxy settings can use directly. TUN mode creates a virtual network interface and can handle more applications that ignore system proxy settings, as well as UDP traffic, but it requires additional permissions, routing, and DNS configuration. Use system proxy for ordinary browser traffic; consider TUN when an app does not follow system proxy settings.
INSTALLATION
Installation & Setup
Focus on the subscription response, configuration format, permissions, and virtual network adapter. Fix explicit errors first, then adjust feature settings.
What should you do if a subscription cannot be imported after pasting its link?
Open the subscription URL in a browser first and confirm that it returns configuration data or a download rather than a login page, error page, or empty response. Then check for spaces around the link, confirm that it was copied in full, and verify that the client can access the network. If the browser can download it but the client cannot import it, save it as a YAML file and import it locally, then check the logs for the HTTP status and configuration parsing messages.
How should you handle subscription update errors such as 401, 403, or an expired link?
A 401 usually means the subscription credentials are invalid, while a 403 means the server refused the request. An expired link may return 404, an empty file, or webpage content. Copy the current subscription URL again from the provider’s account page, then delete the old URL saved in the client and import the new one. Do not guess credentials by repeatedly changing URL parameters. If the new URL still fails, ask the provider to confirm the account status and access restrictions.
How can you locate a YAML parsing error in a configuration file?
Start with the line and column reported in the logs, then check upward from that point for indentation, spaces after colons, list hyphens, and matching quotation marks. YAML indentation must use spaces, not tabs. Keys at the same level must have consistent indentation, and values containing colons or special characters can be enclosed in quotes. After editing, run the client’s configuration check before reloading the core, and avoid changing multiple areas at once so the reported location remains useful.
What should you do if enabling TUN reports insufficient permissions or fails to create a network interface?
On Windows, start the client as an administrator and confirm that the virtual network adapter driver is installed correctly. On macOS, approve the network extension or helper service when prompted. On Linux, CAP_NET_ADMIN or a controlled privilege escalation is usually required. If another VPN or virtual adapter tool is installed, quit it temporarily and check for routing conflicts. After fixing permissions, restart the client and check whether the logs still contain create tun, route, or permission denied messages.
USAGE
Usage Tips
Validate node switching, rule order, Fake-IP, and LAN sharing against connection logs; switch states alone are not enough.
How do you switch nodes and determine whether a node works?
Choose a specific node in the proxy policy group, then use the client’s latency test as an initial reference. A successful latency test only shows that the test address accepted a connection; it does not mean every destination is reachable. A more reliable check is to open a known-working HTTPS page and confirm in the connection panel that the request used the expected policy. If several nodes fail at once, update the subscription and check the local network before repeatedly running latency tests.
Where should custom Clash rules be placed?
Rules are matched from top to bottom. Specific domains and service rules should come before broader GEOIP, GEOSITE, or MATCH rules. For example, to handle one domain consistently, put DOMAIN or DOMAIN-SUFFIX first and keep MATCH as the final fallback. If the client supports rule overrides, use that feature instead of editing the subscription directly so updates do not overwrite manual changes. Afterward, verify the rule actually matched in the connection log.
How can you fix domain resolution problems in Fake-IP mode?
First confirm that the enhanced DNS mode, listen address, and nameserver settings are complete. Then check whether the affected app depends on LAN domain names, device discovery, or special DNS responses. Add the relevant domains to fake-ip-filter so they return real addresses. After making changes, clear the operating system’s DNS cache and restart the client. If only one app is affected, temporarily switch to redir-host for comparison to determine whether it is a Fake-IP compatibility issue.
How can devices on the same LAN use the Clash proxy?
Enable LAN access in the client, confirm that mixed-port is listening on an address reachable from the LAN, and allow that port through the system firewall only for trusted local networks. On the other devices, set the proxy server to the LAN IP address of the computer running Clash and use the mixed-port value as the port. If the connection fails, check in order that both devices are on the same subnet, the port is listening, the firewall allows it, and guest Wi-Fi has not enabled client isolation.
DIAGNOSIS
Troubleshooting
First check whether requests reach the core, then distinguish local port, system proxy, DNS, node, and destination connection issues.
What should you do if the system proxy is enabled but the browser still cannot connect?
First confirm that the client core is running and that the system proxy port matches mixed-port in the configuration. Then check whether the browser uses a separate proxy extension, enterprise policy, or manual proxy setting, any of which can override the system proxy. Quit other proxy software, toggle the system proxy off and on again, visit a test page, and watch the Clash connection log. If no requests reach the client, continue by checking the system proxy address and the local firewall.
How should you troubleshoot a timeout when node tests pass but browsing fails?
Switch to another node in the same policy group to determine whether the problem affects one node or all nodes. A single-node timeout is usually related to the remote service, transport parameters, or route. If every node times out, check whether the subscription has expired, whether the local network restricts connections, whether the system clock is accurate, and whether DNS works. dial tcp timeout in the logs indicates a connection establishment timeout. If DNS errors appear at the same time, fix name resolution before evaluating the node.
How can you handle UWP loopback when Windows Store apps cannot use the proxy?
Some UWP apps are restricted by Windows network isolation and cannot directly access the local loopback address, so a system proxy pointing to 127.0.0.1 may not work. Use the UWP loopback tool provided by the client to enable Loopback Exempt for the Store apps that need network access. Fully quit and reopen the target app afterward. Select only apps that genuinely need the proxy; do not broadly exempt system components.
What should you do if Clash fails to start because a port is already in use?
A port conflict usually means another Clash instance, proxy tool, or background service is listening on the same port. Fully quit related programs, then identify the process using Task Manager or system networking tools. If the port cannot be freed, change mixed-port to an unused port and update the system proxy settings to use it as well. If the client still exits immediately, check the configuration syntax, core file path, and log messages such as bind and address already in use.