FREQUENTLY ASKED QUESTIONS

Clash Frequently AskedQuestions

From installation to configuration, proxy modes to troubleshooting, we've compiled the most common questions to help you get started quickly.

26 Common Questions 5 Main Categories Full Platform Coverage Continuously Updated

Basics

Learn what Clash is, what it can do, and how it compares to other tools

6 Questions

Clash is a rule-based, open-source network proxy client. Its core function is to route network requests to different proxy nodes or direct connections based on custom rules. Key differences from a traditional VPN include:

Clash
  • Rule-based splitting: Direct connection for local sites, proxy for international
  • Supports multiple protocols (Shadowsocks, V2Ray, Trojan, etc.)
  • Fully open-source with auditable code
  • Flexible node management via subscription links
Traditional VPN
  • Forces all traffic through a tunnel, often slowing down local access
  • Usually uses proprietary, opaque protocols
  • Mostly closed-source commercial software
  • Fixed nodes with low flexibility

In short, Clash is ideal for users with some technical knowledge who want fine-grained control over their network traffic. A VPN is better for non-technical users who just want a one-click connection.

The Clash core and all clients recommended on this site (Clash Verge Rev, ClashMeta for Android, etc.) are entirely free and open-source under the GPL-3.0 license. They are permanently free to download and use, with no ads or in-app purchases.

Important distinction:While the Clash tool itself is free, the proxy service (airport subscription) required to use it is a separate third-party service that usually requires a paid subscription. Clash is the tool; the airport is the service provider.

They play different roles in the proxy ecosystem:

  • Shadowsocks（SS）、V2Ray（VMess/VLESS）、TrojanAre proxy protocols, defining how data is encrypted and transmitted between the client and server.
  • ClashAre Is a proxy client

You don't need separate apps for each protocol. Install Clash, and it will automatically handle any protocol type included in your subscription link.

Think of it this way: Shadowsocks is 'Mandarin', V2Ray is 'Cantonese', and Trojan is 'English'—Clash is the polyglot translator who speaks them all.

Clash is built with Go, allowing the core to run on almost any platform. The community has developed various GUI clients for different OSs:

Windows Clash Verge Rev
macOS Clash Verge Rev
Android ClashMeta for Android
iOS Stash / Shadowrocket
Linux Clash CLI / Soft Routers

MihomoMihomo (formerly Clash Meta) is a next-generation core maintained and extended by the MetaCubeX community based on the original Clash. Since the original author stopped development in 2023, Mihomo has become the mainstream core for the community.

Key advantages of Mihomo over the original Clash:

  • Supports more modern protocols: VLESS, Hysteria2, TUIC v5, Reality, etc.
  • Enhanced DNS capabilities (DoH3, ECH, etc.)
  • Superior rule engine and rule set support
  • Active community maintenance and security updates
All clients recommended on this site (Clash Verge Rev, ClashMeta for Android) are powered by the Mihomo core by default, requiring no manual switching.

The Clash core and mainstream community clients follow the GPL-3.0 open-source license. The code is publicly hosted on GitHub, allowing developers worldwide to review, audit, and contribute.

  • No Backdoors: Transparent code means any malicious behavior would be quickly flagged by the community.
  • No Ads: Clash is a pure technical tool with no commercial incentives.
  • No Data Collection: Clash does not collect or upload any personal user information.
Verify your source:Beware of modified, non-open-source versions claiming to be 'Clash'. Always download from this site or the official GitHub repositories.

Installation

How to safely download clients and handle common installation permission issues

5 Questions

We recommend obtaining clients from these official and trusted channels:

  • Our Download Center（clashinstall.com/zh-CN/download.html) — Direct links for all platforms, accessible without a proxy
  • Official GitHub Repositories — Raw installation packages are available on each client's Releases page
Avoid downloading Clash from unknown websites, social media links, or 'cracked' versions, as these carry a high risk of containing malware.

The author of the original Clash for Windows (CFW) stopped maintenance in 2023. Here are the most recommended community successors:

Top Choice
Clash Verge Rev Windows/macOS, actively maintained with a modern UI, based on Mihomo core
Clash Nyanpasu Windows, feature-rich for advanced users
Mihomo Party Cross-platform, minimalist, and very beginner-friendly

All these alternatives are fully compatible with Clash YAML subscriptions. You can import your existing links directly without any modifications.

Windows Defender SmartScreen flags open-source software that isn't Microsoft-certified. This is normal, and Clash is safe. To proceed:

  1. When the 'Windows protected your PC' prompt appears, click 'More info'
  2. Click the 'Run anyway' button that appears
  3. Proceed with the standard installation steps
If downloaded from this site or GitHub, it is safe to run. SmartScreen warnings occur because open-source projects often skip expensive Microsoft code-signing certificates.

macOS Gatekeeper blocks apps not notarized by Apple. To allow it:

  1. Open 'System Settings' (or 'System Preferences' on older versions)
  2. Go to the 'Privacy & Security' tab
  3. Scroll down to find the blocked Clash application
  4. Click 'Open Anyway' and enter your admin password
This is only required once per client. The warning appears because open-source projects typically don't pay for Apple developer notarization.

Due to regional App Store restrictions, proxy apps are not available on some accounts. You will need a US Apple ID to purchase and download one of the following from the App Store:

Top Choice
Stash Approx. $3.99, feature-complete with full Clash YAML support
Shadowrocket Approx. $2.99; most popular, widely compatible, and easy to use
Quantumult X Approx. $7.99; best for advanced users with powerful scripting capabilities

Simply import your airport's Clash YAML subscription link after purchase. See detailed steps in our iOS Config Guide。

Subscriptions

How to import subscriptions, manage nodes, and handle configuration issues

5 Questions

Taking Clash Verge Rev (Windows / macOS) as an example:

  1. Open the client and click 'Profiles
  2. Click 'New' at the top or use the input field
  3. Paste the Subscription URL
  4. Click Confirm', and wait for node data to sync (usually 3–10 seconds)
  5. Once synced, double-click the profile to set it as the active configuration
We recommend enabling 'Auto Update' and setting it to 12–24 hours to ensure your nodes are always current.

For other platforms, please refer to our Config Tutorial page。

Common causes and solutions:

  • Expired Link → Log into your airport dashboard to get a new link
  • Network Connection Issue → Temporarily use a mobile hotspot or Wi-Fi to retry the download
  • Incorrect Format → Change 'Subscription Type' to 'Clash' or 'Mihomo' in your airport dashboard
  • Outdated Client → Update to the latest version and try again
  • Extra Spaces or Characters → Re-copy the link and ensure it's pasted correctly

Clash uses the YAML format to define nodes, rules, and policies. Core sections include:

  • proxies: List of proxy nodes (server, port, protocol, etc.)
  • proxy-groups: Node grouping strategies (auto-select, load balance, manual, etc.)
  • rules: Traffic rules (defining which domains use proxy or direct)
  • dns: DNS settings (Fake-IP recommended to prevent leaks)
Most users do NOT need to manually write these files, as airport links generate them automatically. For custom setups, see our Advanced Config docs。

To set up auto-updates in Clash Verge Rev:

  1. Go to the 'Profiles' page
  2. Right-click your profile and select 'Edit'
  3. Set the interval in the 'Auto Update' field (in minutes)
  4. Recommended setting: 720–1440 minutes (12–24 hours)
Updating too frequently (e.g., every minute) is unnecessary and strains the server. 12–24 hours is ideal for node stability.

Clash is a proxy client tool; it does not include nodes. You must obtain them via:

Highly Recommended
Purchase Airport Service Stable and reliable with technical support and standard links; usually costs a small monthly fee
Self-built Server Deploy Shadowsocks/VMess on an overseas VPS (for technical users)
Free Public Nodes Unreliable sources with slow speeds, poor stability, and privacy risks; not recommended

Proxy Modes

Rule Mode vs. Global Mode vs. TUN Mode: Use Cases

5 Questions
Mode
Traffic Handling
Scenario
Recommendation
Rule Mode
Splits traffic by rules: Proxy for overseas, Direct for domestic
Daily browsing; maintains local speeds while bypassing firewalls
Daily Choice
Global Mode
All traffic passes through the proxy node
Temporary testing or when all traffic requires a proxy
Use as Needed
Direct Mode
All traffic connects directly; no proxy used
Disable proxy temporarily for network troubleshooting
Use as Needed

For most daily scenarios, choose 'Rule Mode'. It automatically handles proxying for international sites while keeping domestic traffic fast.

TUN Mode creates a virtual NIC to capture all outgoing traffic at the system level, including apps that ignore standard system proxy settings.

System Proxy
  • Proxies via HTTP/SOCKS protocols
  • Covers browsers and most applications
  • No special permissions needed; instant on
  • CLI tools and games often bypass it
TUN Mode
  • Virtual NIC captures all traffic
  • Covers games, terminal, system updates, etc.
  • Requires Administrator/Root privileges
  • Slightly higher resource usage
We recommend using System Proxy for daily tasks. Only enable TUN Mode if you need to proxy games, terminal tools, or apps that don't support system proxy.

In Rule Mode, local traffic should be direct and fast. If it feels slow, check these causes:

  • DNS Latency → Enable 'Fake-IP' in your client DNS settings or use a local DNS like 1.1.1.1
  • Misconfigured Rules → Check logs to see if local domains are accidentally hitting proxy rules
  • Outdated Rule Sets → Update your profile to fetch the latest rules
  • Resource Constraints → Check your device CPU/RAM usage; older devices may struggle with heavy rule matching

There are several methods:

  • Enable TUN Mode(Recommended) — Manages all traffic at the system level; covers games and terminal tools without additional configuration.
  • Manually Set Terminal Proxy — set environment variables in your terminal:
    export https_proxy=http://127.0.0.1:7890 http_proxy=http://127.0.0.1:7890
  • For git — run:
    git config --global http.proxy http://127.0.0.1:7890
Port7890 is the default Mixed Port for Clash, which can be viewed or modified in the client 'Settings'.

A DNS leak occurs when your DNS queries bypass the proxy and are sent directly to your ISP or local DNS servers, potentially exposing your browsing history.

The best way to prevent DNS leaks in Clash is by enabling Fake-IP Mode：

  • Fake-IP assigns a virtual internal IP to each domain, ensuring all DNS resolution is handled by the Clash core.
  • Prevents ISPs from monitoring or polluting your DNS queries.
  • Speeds up initial connections by skipping the wait for real DNS resolution.
Most airport profiles have Fake-IP enabled by default. You can check this in your client's 'DNS Settings' enhanced-mode: fake-iptab.

Troubleshooting

Troubleshooting failed connections, timeouts, and network drops

5 Questions

Follow these steps to troubleshoot:

  • Confirm profile is active → The profile in use should be highlighted on the 'Profiles' page.
  • Check Proxy Mode → Ensure you are on 'Rule' or 'Global' mode, not 'Direct'.
  • Test node latency → Run a latency test on the 'Proxies' page to ensure you have connectable nodes (showing ms values, not 'Timeout').
  • Verify System Proxy is on → Confirm the proxy is set in your Windows/macOS network settings, or enable TUN Mode.
  • Check for firewall blocking → Ensure Clash is allowed in Windows Firewall and any antivirus whitelists.
  • Try a different node or provider → If all nodes time out, the provider might be down; contact their support.

Total node timeout is usually caused by:

  • Outdated profile/nodes → Manually refresh (right-click profile → Update) to fetch the latest node data.
  • Provider maintenance → Check the provider's website or Telegram group for downtime notices.
  • Protocol blocking by ISP → Try switching protocols (e.g., from SS to Trojan or Hysteria2).
  • Local network issues → Test with a mobile hotspot or different Wi-Fi to rule out local interference.
  • Antivirus/Firewall interference → Temporarily disable your firewall to test, then add Clash to the whitelist.
If a provider is consistently unstable, we recommend switching to a more reliable service.

For Windows users:

  1. Open Task Manager and force close the Clash process
  2. Go to 'Control Panel → Network and Internet → Network Connections'
  3. Find the virtual NIC created by Clash (often named 'Clash' or 'TAP'), right-click and Disable
  4. it. Restart Clash and ensure internet is back before trying TUN again.

For macOS users:

  1. Go to 'System Settings → Network'
  2. Find and remove the network interface created by Clash
  3. Restart Clash; you'll need to enter your admin password to re-enable TUN
If the problem persists, reinstall the client, selecting the option to clear all old configs. Avoid running multiple proxy tools at once to prevent conflicts.

Clash performs low-level network operations (especially in TUN Mode), which some antivirus tools misidentify as suspicious. Steps to fix:

  1. Ensure you downloaded from this site or the official GitHub to rule out actual malware
  2. Add the Clash installation directory (e.g., C:\Users\YourUsername\AppData\Roaming\clash-verge) to your antivirus Trust List or Exclusions
  3. Allow both inbound and outbound access for Clash in Windows Firewall
  4. If the installer was deleted, disable real-time protection, reinstall, add the exclusion, and then re-enable protection

This happens when Clash modifies system proxy settings but fails to revert them on exit, leaving the system trying to connect via a non-existent proxy.

Quick Fix:

  • WindowsWindows: Go to 'Settings → Network & Internet → Proxy' and turn off 'Use a proxy server'
  • macOSmacOS: Go to 'System Settings → Network → Advanced → Proxies' and uncheck all proxy options
  • Permanent Fix: Update Clash to the latest version, which handles system proxy cleanup more reliably
NEXT STEPS

Still have questions?

Check our visual configuration guides or visit the Download Center for the latest client. Updating often resolves most common issues automatically.

  View Config Guide   Download Latest Client   Feedback on GitHub