Clash Beginner’s Guide: 10 FAQs on Subscriptions, Proxy Modes & System Proxy

1. What are Clash, a client, and mihomo?

First, distinguish the three components: the client provides the interface, the core handles network connections, and a subscription supplies nodes or configuration. Installing a client does not give you working proxy nodes. After importing a subscription, you still need to activate the configuration, select a policy, and route application traffic through it.

The original Clash core and mihomo are separate projects, and the original core is no longer actively maintained. mihomo evolved from Clash Meta, retains many familiar Clash configuration conventions, and adds protocol and configuration capabilities. Older cores may not understand configurations written for mihomo. Even if both files use the .yaml extension, that does not mean they are compatible.

• Choose a client: Select an installer for your operating system and processor architecture, then check the client comparison to confirm which core it uses.
• Check the configuration: Ask your provider whether to use the Clash or Clash Meta/mihomo format.
• Check the error: If you see “unsupported proxy type,” check the core’s capabilities first instead of repeatedly downloading the same subscription.

Client settings menus vary. In this guide, general features are called “Subscriptions,” “System Proxy,” and “Connection Log”; operating-system steps include their exact paths. The examples use port 7890; check the listening port shown in your client before using it.

2. Where do I enter a subscription link, and how can I tell if it imported successfully?

Enter the subscription link in the client’s remote subscription import option—not in a browser’s proxy server field or a node’s server address field. Remote subscriptions usually return a YAML configuration. If your provider offers multiple formats, copy the link for your client.

1. Copy the complete link from your provider’s subscription page, keeping all query parameters. Make sure you don’t add spaces or line breaks when copying it.
2. Open the client’s subscription manager, choose remote import, paste the link, and start the download.
3. When the download finishes, select or activate the configuration. Seeing it in the list does not necessarily mean the core is using it.
4. Open the proxies or policy groups page. Confirm that nodes and groups are listed, then check the logs for configuration loading errors.

If you have a local YAML file, use the client’s local configuration import option. If no nodes appear after import, check whether the downloaded content is actually a login page, an error message, or an empty file. Don’t assume every URL that opens in a browser is a subscription link.

3. Which mode should I use: Rule, Global, or Direct?

For everyday use, choose Rule. It uses rules to route each connection directly, through a proxy group, or according to another action. Use Global to temporarily test the proxy path; Direct sends connections that reach the core straight to their destinations. These modes only control traffic that has already entered the core—they do not automatically capture traffic from every app.

After switching to Global, check what GLOBAL is currently set to. It may select another policy group or DIRECT; switching modes does not guarantee that traffic will use a remote node. Switch back to Rule when you finish troubleshooting so connections that should go direct aren’t sent through a remote proxy indefinitely.

This is a rules snippet, not a standalone configuration. Proxy is an example policy group name. Replace it with a group that exists in your configuration, or define the group first:

mode: rule
rules:
  - DOMAIN-SUFFIX,example.com,Proxy
  - GEOIP,CN,DIRECT
  - MATCH,Proxy

MATCH is a catch-all rule and usually belongs at the end. If it appears earlier, later rules will never be matched. GEOIP rules also depend on the required geolocation data files being available; valid YAML syntax alone is not enough.

4. Why isn’t an app using the proxy when System Proxy is enabled?

System Proxy provides a proxy endpoint for apps that honor the system proxy settings; it does not force all traffic through the proxy. Some browsers use their own proxy settings, some command-line tools only read environment variables, and games and other apps may connect directly.

Check the listener, then check your system settings

1. Make sure the core is running, then find the HTTP or mixed port. mixed-port accepts both HTTP and SOCKS proxy connections on the same port.
2. Apps on the same device should connect to 127.0.0.1 and the actual listening port. Don’t enter your subscription domain as the system proxy server.
3. In Windows 11, check the address and port under Settings → Network & internet → Proxy → Manual proxy setup.
4. On macOS, check the HTTP and HTTPS proxy settings under System Settings → Network → your current network service → Details → Proxies.

Use the command below to specify the proxy explicitly, eliminating the question of whether the program reads system settings. In Windows PowerShell, use curl.exe to avoid interference from an older alias with the same name; on other systems, use curl.

curl.exe -I --proxy http://127.0.0.1:7890 --connect-timeout 10 https://example.com

If the log reports that it cannot connect to 127.0.0.1:7890, check the port and core process first. If a proxy connection is established but the request still fails, check the node, rules, and DNS. Getting a web response only confirms that the request reached the local proxy endpoint; it does not prove that a remote node was used.

5. Should I enable System Proxy and TUN mode together?

There’s no need to enable both from the start just to “cover everything.” System Proxy works well for browsers and other apps that honor proxy settings. TUN routes traffic through a virtual network interface, which can help with apps that ignore system proxy settings, but requires extra configuration for permissions, routing, and DNS.

• Start with a browser: Test the configuration, node, and rules using System Proxy first. Then decide whether you need TUN.
• The app ignores proxy settings: Confirm that your client supports TUN, then install its service or grant the required permissions as instructed.
• Another VPN is running: Temporarily pause other software that manages routes, then test each one separately to avoid conflicts over default routes and DNS.

In mihomo, tun.enable controls TUN, auto-route configures automatic routing, and dns-hijack captures matching DNS traffic. These settings don’t guarantee that all traffic will be captured. The result depends on the platform, permissions, excluded routes, and whether apps use their own encrypted DNS.

6. Why won’t a website load even though the node shows a latency value?

A latency test usually measures how long the client takes to request a test URL through a node. It is not the same as an ICMP ping, and it doesn’t mean every destination is reachable. Access to the test URL does not guarantee access to video services, login pages, or region-restricted sites.

Check each step in the connection path

1. Check the selected policy: Which group did the request match? Manual groups, automatic latency-test groups, and failover groups choose routes differently.
2. Test a new request: Reconnect after switching nodes. Existing TCP connections may keep using the previous route, and cached pages can also skew the result.
3. Compare destinations: Test a regular HTTPS site, then the site that’s actually failing. This helps distinguish an unavailable node from a restriction affecting one service.
4. Check where the error occurs: DNS resolution failures, node connection timeouts, and TLS errors from the destination are different problems—not all signs of a “slow node.”

If only certain sites fail, check which rule matched each request. In Rule mode, traffic may be routed to DIRECT or to a different policy group. Don’t focus only on the currently selected node in the node list; the connection log shows the route for each request.

7. Should I change DNS first when a subscription update fails?

Read the error before changing anything. An update can fail during DNS resolution, the TCP connection, the TLS handshake, the HTTP response, or YAML parsing. Only DNS resolution errors point directly to DNS; changing DNS won’t fix an HTTP status code or invalid configuration syntax.

Some clients let you choose whether subscription updates use a proxy; others use a separate downloader. Being able to open a site in your browser doesn’t mean the updater uses the same route. Check your client’s documentation for how downloads work instead of assuming that enabling System Proxy covers all background updates.

Keep the last working configuration before trying an update. Don’t delete your only working configuration if the subscription is unreachable, and don’t disable certificate verification just to clear a TLS error. If you see a certificate time error, check your system date, time zone, and network environment first.

8. What are DNS, Fake-IP, and “DNS leaks”?

DNS resolves domain names to addresses. In mihomo’s Fake-IP mode, a domain is assigned a mapped address, which is then used to handle subsequent connections. A common configuration uses 198.18.0.0/16. Seeing an address in this range doesn’t automatically mean the node is broken or the domain was resolved incorrectly.

A DNS leak concerns whether queries take an unexpected resolution path. The location of a resolver shown on a test page may not match the location of your browser’s proxy node. Remote resolvers, caches, and your provider’s network egress can all affect the result. A single location label is not enough to prove or rule out a leak.

• First check whether system DNS requests enter the core, then review the core’s nameserver and domain-specific nameserver-policy settings.
• A browser’s Secure DNS/DoH may use a separate connection. Check its actual route instead of changing only system DNS.
• Some local network services and apps don’t work well with Fake-IP. If needed, configure fake-ip-filter; don’t exclude every domain by default.

If you’re new to Clash, start with DNS settings from a trusted source that match your current core, then make changes to address specific issues. DNS fields depend on one another, and blindly combining snippets from different guides can create upstream resolution loops. See Advanced configuration and the mihomo DNS documentation for field descriptions.

9. How can I tell which rule a website actually uses?

Find the request on your client’s Connections page and check its destination domain, matched rule, and policy chain. The interface may use different names, but the key is to match each request to its routing result—not to infer how every app is routed from an external IP lookup page.

1. Pause unrelated downloads to reduce background connection noise.
2. Open the connection log, then revisit the target page in your browser.
3. Filter by domain or process to check the target connection’s rule and final policy.
4. After changing a rule, reload the configuration and test again with a new connection.

If you need to add a temporary domain rule, place it before any broader rule that could match first. The snippet below routes example.com and its subdomains directly. It illustrates the syntax only; it is not a complete configuration and won’t affect unrelated domains:

rules:
  - DOMAIN-SUFFIX,example.com,DIRECT
  - MATCH,Proxy

Proxy must still match an existing policy group. A remote subscription update may overwrite manual edits. For lasting customizations, use the client’s override, merge, or scripting feature, and check the effective generated configuration. Merge order varies by client, so don’t assume the snippet shown in an editor reflects the final rules.

10. How do I restore my internet connection if it drops after I quit the client?

A common cause is that the local proxy process has stopped while the system still points to its listening address. Apps then try to connect to 127.0.0.1:7890 and get no response. Restore the network entry point first, then troubleshoot the configuration—you don’t need to reinstall the client right away.

Restore access in order, starting with the simplest steps

1. If the client is still open, turn off System Proxy and TUN, then quit normally.
2. In Windows 11, go to Settings → Network & internet → Proxy and turn off any manual proxy you no longer use. If the proxy is managed by your organization, check with your administrator first.
3. On macOS, go to Details → Proxies for your current network service and turn off any proxy settings that no longer work.
4. If only terminal commands fail, check environment variables such as HTTP_PROXY, HTTPS_PROXY, and ALL_PROXY, along with the tool’s own proxy settings.
5. If your connection still doesn’t work after TUN exits unexpectedly, restart the client and shut TUN down normally. If necessary, restart your system to rebuild network interfaces and routes.

In the current Linux or macOS shell, start by checking proxy environment variables. The command below only reads and filters them; it won’t change system settings. Variable values may contain account details, so redact them before sharing the output:

env | grep -iE '^(http|https|all|no)_proxy='

Don’t start by resetting network settings or clearing all firewall rules. This may affect other VPNs, virtual machines, or corporate networks. Once you’re back online, check each step in order: the configuration is active → the core is listening → the app is connected → the correct rule is being applied. This usually helps pinpoint the problem.