FAQ

Clash
Frequently Asked Questions

From download and installation to subscription import, proxy modes, node optimization, and error fixes—30+ common questions answered.

Installation Issues Subscription Config Proxy Modes
30+ Issue Coverage
6 Issue Categories
5 Supported Platforms
Continuous Updates & Maintenance

Download & Install

Common questions regarding client selection, installers, and the installation process across platforms.

Windows

(Recommended) or FlClash. Supports Windows 10/11 x64 and ARM64 with built-in Mihomo core. Advanced users can also choose Clash Nyanpasu.Clash Verge Rev (Recommended) or FlClash. Supports Windows 10/11 x64 and ARM64 with built-in Mihomo core. Advanced users can also choose Clash Nyanpasu.

macOS

(Recommended) or FlClash. Supports Windows 10/11 x64 and ARM64 with built-in Mihomo core. Advanced users can also choose Clash Nyanpasu.Clash Verge Rev, with native support for Apple Silicon (M1/M2/M3/M4) and Intel architectures. FlClash and ClashX Meta are alternatives.

Android

(Recommended) or FlClash. Supports Windows 10/11 x64 and ARM64 with built-in Mihomo core. Advanced users can also choose Clash Nyanpasu.ClashMeta for Android (Recommended). Supports Android 5.0+; install APK directly without Google Play. FlClash is a lightweight alternative.

iOS / iPadOS

(Recommended) or FlClash. Supports Windows 10/11 x64 and ARM64 with built-in Mihomo core. Advanced users can also choose Clash Nyanpasu.Stash (most feature-complete, supports VLESS Reality) or Shadowrocket (easiest to use, best for beginners). Both require a US Apple ID for purchase.

Linux

, use with the MetaCubeXD Web dashboard.Clash Verge Rev (deb/rpm). Server users should install the Mihomo Core directly and use it with the MetaCubeXD Web dashboard.

Download directly; all installers are hosted on this site for fast access without a proxy or GitHub.Download Page directly; all installers are hosted on this site for fast access without a proxy or GitHub.
If you already have a proxy tool, downloading from GitHub Releases is also fine, but not required. This site (clashchinasite.com) hosts installers for all platforms locally. Download from Download Page for high-speed access without needing a proxy or visiting GitHub.

If you already have a proxy tool, downloading from GitHub Releases is also fine, but not required.
Clash clients are often flagged as false positives because they intercept network traffic. This is normal and not a real threat. Fix:

1. Windows Defender: Go to 'Windows Security → Virus & threat protection → Protection history', find the blocked file, and click 'Allow'.
2. : Add the installation directory to its 'Trusted List' or 'Whitelist'.: Add the installation directory to its 'Trusted List' or 'Whitelist'.
3. : Temporarily pause real-time protection, complete the install, then add the directory to the exclusion list.: Temporarily pause real-time protection, complete the install, then add the directory to the exclusion list.

We recommend downloading only from this site or official GitHub Releases to avoid third-party links from unknown sources.
This is triggered by the macOS Gatekeeper security mechanism and does not reflect the actual safety of the software. Two solutions:

, find the blocked app prompt at the bottom, and click 'Open Anyway'.x64 Version, and click 'Open Anyway' at the bottom of the page. Or run in terminal:, find the blocked app prompt at the bottom, and click 'Open Anyway'.

Run the following command in terminal to remove the quarantine flag: Run the following command in terminal to remove the quarantine flag:
bash 
sudo xattr -rd com.apple.quarantine /Applications/Clash\ Verge.app
After execution, simply double-click to open without further authorization.
Since the APK is not from Google Play, you need to manually authorize installation. Paths vary by brand:

  • : Settings → Privacy protection → Special permissions → Install unknown apps → find downloader (e.g., browser) → Enable: Settings → Privacy protection → Special permissions → Install unknown apps → find downloader (e.g., browser) → Enable
  • OPPO / OnePlus / Realme: Settings → Additional Settings → Security → Unknown Sources
  • vivo / iQOO: Settings → Security → Install unknown apps
  • : Settings → Biometrics and security → Install unknown apps: Settings → Biometrics and security → Install unknown apps
  • Stock Android: Settings → Apps → Special App Access → Install Unknown Apps : Settings → Apps → Special app access → Install unknown apps

After authorizing, tap the APK file to install. You can disable the permission after installation.
If unsure, download For a smaller file size: , and the system will automatically match the best installer for your device.

For a smaller file size:
  • Mainstream Android phones released after 2016: Choose ARM64-v8a
  • Models from 2015 or earlier or low-end devices: Choose ARMv7（armeabi-v7a）

You can check your CPU architecture in 'Settings → About Phone → Processor Information' or via apps like CPU-Z.

Subscription & Config

Common questions about subscription formats, import methods, and auto-update settings.

Usage: Buy a plan from a provider → Copy the 'Clash Subscription Link' from their dashboard → Paste it into 'Subscription Management' in your client → Update → Done. is a URL provided by your provider that contains node configuration info. Paste it into your Clash client, and it will download the node list automatically—no manual configuration required.。

Usage: Buy a plan from a provider → Copy the 'Clash Subscription Link' from their dashboard → Paste it into 'Subscription Management' in your client → Update → Done.

subscription link, not V2Ray JSON, SS Base64, etc., or it will show a format error after import.Clash (YAML) format subscription link, not V2Ray JSON, SS Base64, etc., or it will show a format error after import.
Please troubleshoot in the following order:

  1. : Confirm with your provider that you have a Clash/YAML link, not V2Ray, SS, or Trojan.: Confirm with your provider that you have a Clash/YAML link, not V2Ray, SS, or Trojan.
  2. : Some provider servers are overseas and inaccessible without a proxy. Try enabling a proxy by other means first, or ask your provider for a local mirror address.: Some provider servers are overseas and inaccessible without a proxy. Try enabling a proxy by other means first, or ask your provider for a local mirror address.
  3. : Old links expire after plan changes or expiration. Re-copy the latest link from your provider's dashboard.: Old links expire after plan changes or expiration. Re-copy the latest link from your provider's dashboard.
  4. : Update your client to the latest version and try again. : Upgrade your client; older versions may fail to parse newer subscription formats.
  5. : Ensure the link is pasted completely without extra spaces or missing characters.: Ensure the link is pasted completely without extra spaces or missing characters.
Client settings:

Clash Verge Rev（Windows / macOS / Linux） → Save.1440 minutes (24 hours) → Save.

ClashMeta for Android: Long press profile → 'Edit' → enable 'Auto Update' → set frequency (recommend 24 hours).

Stash（iOS）: Go to 'Config' → Profile Details → enable 'Auto Update' → set interval.

Shadowrocket（iOS）: Long press subscription → 'Edit' → 'Update Interval' → set frequency.

We recommend setting it to auto-update every 12-24 hours. It will update in the background while online, ensuring node info is always current.
Device limits are determined by You can import the same subscription on multiple devices, but exceeding the provider's simultaneous online limit will cause disconnections or speed throttling. Check your plan's terms for details. by the provider, not the Clash client. Limits vary by airport, typically allowing 2 to 5 devices online simultaneously.

You can import the same subscription on multiple devices, but exceeding the provider's simultaneous online limit will cause disconnections or speed throttling. Check your plan's terms for details.
Usage: Buy a plan from a provider → Copy the 'Clash Subscription Link' from their dashboard → Paste it into 'Subscription Management' in your client → Update → Done. is a URL that returns the latest YAML configuration when accessed, allowing for remote updates.

Average users just need the subscription link. Power users can manually edit YAML files to customize rules or use tools like Sub-Store for further processing. is the local file (.yaml or .yml) that the Clash core actually reads, containing nodes, rules, and DNS info. The client saves the downloaded content from the subscription link as this local file.

Average users just need the subscription link. Power users can manually edit YAML files to customize rules or use tools like Sub-Store for further processing.

Proxy Modes

Differences between Rule, Global, and TUN modes, and common proxy issues.

Recommended for daily use
Rule Mode

Diverts traffic automatically based on rules: local sites go direct, overseas go through proxy. Best for most users as it's fast and saves provider data.

: All traffic goes through the proxy.

Forces all traffic through a proxy node, including local sites. Best for: testing nodes, accessing corporate intranets, or when a site is inaccessible in Rule mode. Consumes more provider data.

: Disable proxy temporarily.

Disables all proxying; traffic goes direct, same as not using a proxy. Best for temporary needs like online banking or local payments requiring your real IP.

System Proxy Mode Recommendation for daily use: Use
Coverage Apps supporting HTTP/SOCKS5 proxy All system traffic (virtual network card)
Terminal / CLI ❌ Usually does not go through proxy ✅ Automatically proxied
Game Clients ❌ Usually does not go through proxy ✅ Automatically proxied
Privileges No admin privileges needed Requires admin / root privileges
Recommended For Daily browsing, browser proxy Gaming acceleration, terminal proxy, global takeover

: Rule mode + System Proxy.: Rule mode + System Proxy.
: Enable TUN in 'Settings → TUN Mode' (requires admin password). : Enable TUN in 'Settings → TUN Mode' (admin password required).
This is a normal limitation of System Proxy mode—games and apps like Steam often don't support HTTP/SOCKS5 proxy protocols and won't auto-proxy.

Note: TUN mode requires administrator / root privileges; a system prompt will appear for authorization.
  • Clash Verge Rev: 'Settings' → 'TUN Mode' → Enable → Authorize with admin password
  • ClashMeta for Android: Already handles all traffic via VPN mode; no extra setup needed
  • Stash / Shadowrocket（iOS）: VPN mode handles all app traffic by default

After enabling TUN mode, all traffic from games, Steam, and terminals will pass through Clash, achieving a true global proxy.
Clash Rule mode inherently supports fine-tuning, but 'per-app/process' split tunneling needs extra config:

Add process name rules to the
Add process name rules to the rules section of your YAML file, for example:
yaml 
rules:
  - PROCESS-NAME,steam.exe,PROXY
  - PROCESS-NAME,LeagueClient.exe,PROXY
After enabling TUN mode, add apps that need a direct connection to the 'Excluded Processes' list in the TUN settings; other apps will default to proxying.
After enabling TUN mode, add apps that need a direct connection to the 'Excluded Processes' list in the TUN settings; other apps will default to proxying.

For most users, Rule Mode (Local Direct + Overseas Proxy) + System Proxy already meets daily needs without extra configuration.
When accessing overseas websites, traffic must be relayed through a proxy server, so a certain increase in latency is normal. Optimization suggestions:

  1. : Click the speed test icon in the proxy panel and select a node with latency < 150ms.: Click the speed test icon in the proxy panel and select a node with latency < 150ms.
  2. : Local websites go direct without passing through the proxy, so speed is unaffected.: Local websites go direct without passing through the proxy, so speed is unaffected.
  3. : Nodes in Hong Kong, Taiwan, and Singapore usually have lower latency than those in Europe or the US.: Nodes in Hong Kong, Taiwan, and Singapore usually have lower latency than those in Europe or the US.
  4. : In high packet loss networks, Hysteria2 (UDP-based) is much faster than TCP-based protocols.: In high packet loss networks, Hysteria2 (UDP-based) is much faster than TCP-based protocols.
  5. : Nodes that are expired or overloaded will see significant speed drops.: Nodes that are expired or overloaded will see significant speed drops.

Nodes & Connection

Common questions about node testing, latency optimization, protocol selection, and streaming unlock.

  1. : Nodes that are expired or overloaded will see significant speed drops.: Click 'Update Subscription'. Old nodes may be offline, and new nodes usually have lower latency.
  2. : Long-press or right-click a node group, select 'Test All', and pick a green node with latency < 150ms.: Long-press or right-click a node group, select 'Test All', and pick a green node with latency < 150ms.
  3. : Ensure your local network is fine. ISPs sometimes QoS certain ports; try switching Wi-Fi or cellular data.: Try switching between Wi-Fi and cellular data. ISPs sometimes throttle specific ports.
  4. : If your provider offers multiple protocols (Shadowsocks, VMess, Trojan, Hysteria2), try Hysteria2 or other UDP-based protocols for better performance in high packet loss environments. : If your provider offers multiple protocols, prioritize Hysteria2 (UDP-based, strong anti-packet loss performance) in high loss environments.
  5. : In Global mode, all traffic goes through the proxy, including local sites. We recommend switching back to Rule mode.: In Global mode, all traffic goes through the proxy, including local sites. We recommend switching back to Rule mode.
In-app speed tests only reflect ICMP/TCP handshake latency, not actual download speed. Node availability is best determined by whether you can actually access the target website.
stopped maintenance in November 2023 and no longer provides updates. stopped maintenance in November 2023 and no longer provides updates.

is an actively maintained community fork that adds several features over the original: is an actively maintained community fork that adds several features over the original:
  • Next-gen protocol support: VLESS Reality、Hysteria 2、TUIC、AmneziaWG
  • Better DNS resolution and anti-leak mechanisms.
  • Enhanced rule matching engine and Provider support.
  • Continuous security fixes and feature iterations.

Recommended clients (Clash Verge Rev, ClashMeta for Android, etc.) come with the Mihomo core built-in. Average users don't need to distinguish—simply use these clients to get full Mihomo features. Recommended clients (Clash Verge Rev, ClashMeta for Android, etc.) come with the Mihomo core built-in. Average users don't need to distinguish—simply use these clients to get full Mihomo features.
These are proxy protocols that define how data is transferred between your client and the proxy server:

  • Shadowsocks（SS）: A lightweight, classic protocol using TCP. Best compatibility, supported by most providers.
  • VMess / VLESS: Part of the V2Ray family. VLESS is a streamlined version that uses Reality masking to bypass strict censorship.
  • Trojan: Masks traffic as HTTPS for strong anti-blocking capabilities.
  • Hysteria2: Based on UDP + QUIC. Far exceeds TCP speeds in high-loss or throttled environments. Great for gaming and streaming.
  • VLESS Reality: Masquerades by borrowing a real website's TLS certificate. Currently the strongest protocol against active probing.

Average users don't need to understand the underlying principles—just pick the node with the lowest latency and let the provider handle protocol optimization.
Streaming unlock depends on the and is not related to the Clash client itself: and is not related to the Clash client itself:

  1. : Providers often mark specific nodes for 'Netflix Unlock' or 'Disney+ Unlock'. Look for these labels in the node list.: Providers often mark specific nodes for 'Netflix Unlock' or 'Disney+ Unlock'. Look for these labels in the node list.
  2. : Netflix libraries vary by region; US content is the most extensive, while some Japanese shows require a Japanese node.: Netflix libraries vary by region; US content is the most extensive, while some Japanese shows require a Japanese node.
  3. : Ensure streaming traffic is proxied, not direct.: Ensure streaming traffic is proxied, not direct.
  4. to confirm accessible regional content.: You can visit netflix.com to confirm accessible regional content.

If your current provider does not support streaming unlock, you need to switch to one that does. This is a service capability of the provider, not an issue with Clash.

Common Errors

Common troubleshooting for connection failures, proxy not taking effect, and system compatibility.

Troubleshoot in these steps:

  1. : Find 'System Proxy' in the top toolbar or settings and ensure it's toggled on.: Find 'System Proxy' in the top toolbar or settings and ensure it's toggled on.
  2. : Go to the 'Subscription' page and ensure one is marked as 'In Use'; if not, right-click and select 'Use'.: Go to the 'Subscription' page and ensure one is marked as 'In Use'; if not, right-click and select 'Use'.
  3. : In the 'Proxy' page, ensure a specific node is selected in the policy group, not 'DIRECT'.: In the 'Proxy' page, ensure a specific node is selected in the policy group, not 'DIRECT'.
  4. : Clash uses 7890 (HTTP) and 7891 (SOCKS5) by default. If occupied by other programs, proxying will fail. You can change ports in settings.: Clash uses 7890 (HTTP) and 7891 (SOCKS5) by default. If occupied by other programs, proxying will fail. You can change ports in settings.
  5. : Quit completely and restart. Some system proxy settings require a restart to take effect.: Quit completely and restart. Some system proxy settings require a restart to take effect.
  6. : Some extensions (like SwitchyOmega) may conflict with system proxying; temporarily disable them to test.: Some extensions (like SwitchyOmega) may conflict with system proxying; temporarily disable them to test.
TUN mode requires creating a virtual network card, which needs admin privileges:

Windows：
  • Right-click the Clash Verge Rev icon → 'Run as Administrator', then enable TUN mode.
  • Alternatively, click enable in 'Settings → TUN Mode' and select 'Yes' in the UAC prompt.
macOS：
  • Enter your Mac login password in the prompt to authorize.
  • If no window appears, go to 'System Settings → Privacy & Security → Network Extensions' and confirm Clash is authorized.
Linux：
  • start the client:sudo start the client:sudo clash-verge
This means the browser is trying to connect via a proxy that is unavailable:

  1. : Reopen Clash, or manually disable proxy settings in 'System Settings → Network → Proxy'.: Reopen Clash, or manually disable proxy settings in 'System Settings → Network → Proxy'.
  2. : Fully quit and run as administrator.: Fully quit and run as administrator.
  3. : Check if port 7890 is occupied; change the listening port in settings and restart.: Check if port 7890 is occupied; change the listening port in settings and restart.
  4. : Add inbound/outbound rule exceptions for Clash in the Windows Firewall.: Add inbound/outbound rule exceptions for Clash in the Windows Firewall.
This happens when the system proxy settings are not correctly restored upon closing. Fix:

Windows：
  1. Go to 'Settings → Network & Internet → Proxy'.
  2. Under 'Manual proxy setup', toggle 'Use a proxy server' to Off.
macOS：
  1. 'System Settings → Network → [Current Network] → Proxy'.
  2. Uncheck 'Web Proxy (HTTP)' and 'Secure Web Proxy (HTTPS)'.

Enable 'Auto-close system proxy on exit' in Clash Verge Rev settings to ensure network settings are restored automatically. Enable 'Auto-close system proxy on exit' in Clash Verge Rev settings to ensure network settings are restored automatically.
Possible causes and solutions:

  1. : Go to 'Settings → Config', check the current config content for syntax errors. Temporarily switch to a blank config or another subscription.: Go to 'Settings → Config', check the current config content for syntax errors. Temporarily switch to a blank config or another subscription.
  2. : Update to the latest Mihomo core in 'Settings → Kernel'.: Update to the latest Mihomo core in 'Settings → Kernel'.
  3. : Other processes are using Clash ports; change the Mixed Port in settings and restart.: Other processes are using Clash ports; change the Mixed Port in settings and restart.
  4. : Select 'Reset to Default Config' in app settings, then re-import your subscription.: Select 'Reset to Default Config' in app settings, then re-import your subscription.
  5. : Fully uninstall and download the latest version to reinstall.: Fully uninstall and download the latest version to reinstall.

iOS Special & Advanced Usage

iOS purchase guide, Stash vs. Shadowrocket comparison, rule customization, DNS config, and more.

Due to compliance, proxy apps like Stash, Shadowrocket, and Quantumult X , so they cannot be found using a mainland China Apple ID., so they cannot be found using a mainland China Apple ID.

Solution: Register a US Apple ID
  1. , use a local address (e.g., Oregon for no sales tax in the US), and verify email to complete registration.appleid.apple.com → 'Create your Apple ID'.
  2. Choose 'United States' for the country, use a US address (Oregon has no sales tax; any city is fine).
  3. Verify email to complete registration.
  4. Open App Store → tap profile icon → scroll to bottom → 'Sign Out' → log in with the US account.
  5. Search for 'Stash' or 'Shadowrocket', buy it, and then you can switch back to your local account.

Purchased apps are permanently valid and can still be used and updated after switching back to your local account.
Both apps have their strengths; choose based on your needs:

Most Feature-complete
Stash (approx $3.99)

Full support for Clash YAML rule syntax and Mihomo extension protocols (VLESS Reality / Hysteria2 / TUIC). Features a beautiful visual dashboard. Best for users who want the full Clash experience.

Shadowrocket (approx $2.99)

The most widely used proxy app on iOS. Minimalist operation with one-click subscription imports, very beginner-friendly. Supports common protocols, though support for new protocols may lag behind Stash.


; for full Clash rule support or new protocols → For beginners and simplicity → Shadowrocket; for full Clash rule support or new protocols → Stash。
Default configurations may risk DNS leaks (DNS queries going direct rather than through the proxy). Recommended config:

  1. : Enable in the config file or client DNS settings to prevent DNS queries from leaking your true intent.: Enable in the config file or client DNS settings to prevent DNS queries from leaking your true intent.
  2. ) Prevents ISP from monitoring DNS requests.: Use encrypted DNS servers (e.g., https://dns.cloudflare.com/dns-query) to prevent ISPs from monitoring DNS requests.
  3. : Takes over all system traffic, including DNS queries, fundamentally preventing leaks.: Takes over all system traffic, including DNS queries, fundamentally preventing leaks.

Visit browserleaks.com/dns to check for current DNS leaks.
In the rules section of your Clash YAML file, add custom rules (processed from top to bottom):the very top to add custom rules (processed from top to bottom):

yaml 
rules:
  # Custom rules — placed before existing rules
  - DOMAIN,example.com,PROXY        # force PROXY
  - DOMAIN-SUFFIX,mybank.com,DIRECT # always DIRECT
  - IP-CIDR,192.168.0.0/16,DIRECT   # LAN direct
  # ... existing rules from subscription ...
  - MATCH,PROXY
Common rule types:
  • : Exact domain matching: Exact domain matching
  • : Domain and subdomain matching: Domain and subdomain matching
  • : Matches domains containing the keyword: Matches domains containing the keyword
  • : IP address range matching: IP address range matching

In Clash Verge Rev, you can add Overrides in 'Subscription' → 'Edit' without modifying the original subscription file.
Yes, but it requires a router that supports custom firmware or has sufficient processing power:

  • plugins for transparent proxying of all home traffic.: Install the OpenClash or Mihomo (formerly Clash Meta) plugin for transparent proxying of all home traffic.
  • : Install iStoreOS, Immortalwrt, etc., then configure OpenClash or run Mihomo core directly.: Install iStoreOS, Immortalwrt, etc., then configure OpenClash or run Mihomo core directly.
  • : Usually not supported; requires flashing third-party firmware.: Usually not supported; requires flashing third-party firmware.

Router solutions are complex and best for technical users. Individual client installation on each device is easier for most.
How to view logs in different clients:

  • Clash Verge Rev: Click 'Logs' in the left menu to see real-time routing decisions (DIRECT / PROXY / REJECT) and matched rules.
  • ClashMeta for Android: Top-right '...' → 'Logs'.
  • Stash（iOS）: Bottom 'Tools' → 'Logs'.
  • Shadowrocket（iOS）: Bottom 'Tools' → 'Recent Requests'.

Logs show which node each request took and which rule it matched. It is the most effective tool to troubleshoot why a site is or isn't being proxied.

Issue still not resolved?

If the above doesn't answer your questions, visit the GitHub repo for your client to submit an Issue, or check the official Wiki for technical docs.

Clash Verge Rev Windows / macOS / Linux ClashMeta for Android Android 5.0+ Mihomo Official Wiki Core Config Docs

Ready? Download Clash Client Now

All platform installers are locally hosted. No GitHub access needed. Set up in 5 minutes.

Go to Download Page View Installation Tutorial