Clash FAQ

After installing the client and importing a subscription, turn on the "System Proxy" switch in the client settings. The client writes 127.0.0.1:7890 (the default mixed port) into Windows' system proxy settings, and apps that follow the system proxy — browsers, for instance — start working through it automatically. Some apps don't read the system proxy (many command-line tools and games included); enable TUN mode if you need to cover those as well. See this site's Setup Guide for the full step-by-step walkthrough.

This is macOS Gatekeeper's default block on unnotarized apps, not a sign that the installer itself is broken. Go to "System Settings → Privacy & Security," find the blocked app near the bottom of the page, and click "Open Anyway." If it still reports the app as damaged, run xattr -cr /Applications/ClientName.app in Terminal to clear the quarantine attribute and try opening it again — adjust the path to match where it's actually installed. You'll still be asked to confirm once on first launch afterward; that's normal.

Copy the full URL your subscription provider gave you, choose "Import from URL" on the client's "Profiles" or "Subscription" page, paste it, and confirm — the client will download and parse the config. A successful import shows a new entry in the profile list and node groups with a node list on the proxy page. If the list is empty or an error appears, first check whether the chat app that sent you the link truncated it or added extra spaces. Some clients also support importing via QR code or from a local YAML file.

TUN mode has to create a virtual network adapter, which requires system-level permissions. On Windows, run the client as administrator, or install the system service component as prompted; on macOS, the first time you enable it, you'll be asked for your login password; on Linux, grant the core binary the CAP_NET_ADMIN capability or run it as root. Restart the client after authorizing, then turn on the TUN switch. If the service install keeps failing, check whether security software is blocking the driver installation.

Yes, you should allow it. The Android client takes over device traffic through the system's VpnService interface, and tapping connect for the first time triggers a system dialog asking to set up a VPN connection — you need to tap "OK" for the local virtual tunnel to be established. That tunnel only connects to the client running on your own device; the client decides whether each piece of traffic goes direct or through a node based on your rules, and it isn't connecting to some remote VPN server. If you tap "Deny" by mistake, tapping the connect button again will bring the prompt back.

Start by opening the subscription link directly in a browser to confirm it returns real content and not an expiration notice. Then check, in order: whether the link is complete and untruncated, whether your system clock is accurate, and whether the subscription URL itself needs a proxy to reach (try switching to direct mode temporarily and updating, or the other way around). If the link opens fine but the client reports a parse error, the returned format is usually incompatible — contact the subscription provider to confirm they offer a Clash-format subscription. This site's blog has an item-by-item checklist you can follow.

Confirm five things in order: your local network works fine (you can get online with the proxy off); the subscription hasn't expired and its data allowance isn't exhausted; the client's latency-test URL is itself reachable; you've manually updated the subscription once to get the latest node addresses; and switching to global mode with a single node picked manually rules out a rule misconfiguration. If a few nodes work while most time out, it's usually a server-side issue that the subscription provider needs to fix — it isn't something the client can solve.

First check whether the browser has a proxy extension installed — its settings can override the system proxy. Next, confirm the port the system proxy points to matches the client's listening port (7890 by default); a common cause is the client's port having changed without the system setting following along. Some browsers need a restart before they pick up a new proxy setting. Also note that Firefox uses its own independent proxy configuration by default, so you'll need to switch it to "Use system proxy settings" in its network settings.

By default, Windows blocks UWP apps from connecting to the local loopback address, so even when the system proxy points to 127.0.0.1, their requests get isolated and dropped. Two fixes: use the client's built-in "UWP loopback exemption" tool (offered by some clients) and check the target app to allow it through; or switch to TUN mode, which takes over traffic at the network layer and sidesteps the loopback restriction entirely. Restart the target app after making the change to verify.

That means another process is already listening on the same port — often because two proxy clients are running at once, or a previous process was left over after exiting. On Windows, use netstat -ano to find the PID holding the port, then end that process in Task Manager; on macOS and Linux, use lsof -i:7890 to locate it. Restart the client once the conflicting process is closed; if you need both programs to coexist, switch to a different port in the client settings and restart to apply it. See this site's blog article for the full command walkthrough on all three platforms.

Not necessarily. There are three common causes: the system clock is off by enough to break certificate validity checks; the current node or network path is malfunctioning and returning a hijacked page instead of the real site; or a packet-capture tool's root certificate is installed and its decryption feature is still active. Check in this order: calibrate the system clock first, then switch nodes and retest, and finally check whether any MITM-style tool is running in the background. Don't click through the warning page until you've identified the cause.