Clash Troubleshooting

The client provides an interface for importing configurations, switching modes and viewing logs. The kernel handles connections, matches rules and forwards traffic. A subscription usually provides proxy resources or a complete configuration. Installing a client does not configure it automatically: you still need to import a working configuration, and updating the client does not update your subscription. When troubleshooting, first identify whether the issue is with the interface, the kernel or the remote resource instead of assuming the client version is at fault.

Rule mode routes connections according to the rule list and works well for everyday split routing. Global mode sends connections that reach the kernel through the global policy group, making it useful for short diagnostic tests. Direct mode sends those connections straight to their destinations. Global mode does not automatically capture all device traffic: apps still need to route through the system proxy or TUN to reach the kernel. Switch back to Rule mode after testing to avoid changing how other apps connect.

The system proxy makes a proxy address available to apps, but each app decides whether to use it based on its networking implementation. Browsers usually honor system settings; some games, command-line tools and apps with their own network stack do not. First check the client’s Connections page to see whether the request appears, then check whether the app supports a separately configured HTTP or SOCKS proxy. Consider TUN if you need to capture more traffic; repeatedly switching to Global mode is not a substitute.

Both can be used to import a configuration, but they are maintained differently. A remote subscription can be fetched again according to the client’s settings, while a local file usually reflects only the version saved and does not update when the remote source changes. A list of proxy nodes is not necessarily a complete Clash configuration, so check the format provided by your service before importing it. For conversions, prefer a trusted local tool: subscription URLs may contain access credentials, so do not submit them to unfamiliar conversion services.

Common modes and basic rule fields have carried over, but protocols, rule types and DNS options are not fully compatible. mihomo continues the development of Clash Meta and includes more extensions that older kernels may not recognize. If a configuration fails to parse, check the field named in the logs and consult the kernel documentation. Use a compatible configuration format or client rather than simply deleting the field that caused the error.

After importing a subscription on the Configurations page, select it and confirm that the kernel loads successfully with no parsing errors in the logs. Then switch to Rule mode and choose an available policy in the relevant group. On desktop, enable the system proxy and test with a browser; on mobile, approve the VPN connection prompt. Finally, check the connection log for the matched rule and outbound policy to confirm that requests are reaching the kernel. Set up automatic updates or TUN only after that works.

Check the logs first to distinguish a permissions issue from a virtual adapter creation or route configuration failure. Windows desktop clients usually need service mode installed and running, or must be launched as an administrator as instructed by the project. macOS and Linux also have their own privilege requirements. Then check whether another VPN is using the network stack. Do not delete adapters or change multiple routes at once. Turn off TUN first to restore basic connectivity, then test one change at a time.

First check whether two clients are running or an old kernel process is still active. If another service is using the port, choose an unused local port in the client settings, apply the change, then toggle the system proxy off and on again. Update the port in any browsers, terminals or other apps where you configured a proxy manually. Don’t edit only the YAML while overlooking client overrides; verify the active configuration and the port the kernel is actually listening on.

Some Windows apps isolated with AppContainer cannot access a local loopback proxy by default. First confirm that a regular browser can connect through the same proxy. Then use the client’s UWP loopback tool to enable loopback exemptions for apps that need them; this may require administrator access. Not every Microsoft Store app is affected. If exemptions do not help, check the app’s proxy support, DNS settings and connection logs.

Importing a configuration only saves the resource. You also need to start the connection in the client and accept the system’s VPN permission prompt. Check that no other VPN is running, then make sure the imported configuration is selected and loads successfully. On Android, check battery optimization and background activity restrictions if the connection keeps dropping. On iOS, check the connection status in VPN settings. Closing the client window does not necessarily stop the VPN; check the system and client status.

No. Auto-update on the client’s configuration page usually downloads the entire remote configuration again, using the time unit shown in the client. The interval in proxy-providers is usually measured in seconds and controls how often the kernel fetches the corresponding proxy collection. Rule providers may have their own update interval too. First decide whether you need to update the full configuration, proxy collection or rule resources, then change the relevant setting. Don’t copy a number of minutes from the interface directly into a kernel field.

If you edit a file generated by a remote subscription, the next update may overwrite your changes. For rules you need to keep, use the client’s supported override, merge or scripting mechanism, and check where the rules are inserted. Rules are evaluated in order, so adding one after a catch-all rule often has no effect. Back up the configuration before editing. After an update, check the active configuration—not just the editor—and use connection logs to confirm that the new rule matched.

Open the client’s Connections page and revisit the site. Find the new connection by domain or process, then check its rule type, policy group and final outbound. Browser cache or an existing persistent connection can hide a rule change temporarily; close the relevant connections and try again. Websites often use multiple domains, so don’t check only the main domain in the address bar. If no connection appears, first check whether the system proxy or TUN is capturing traffic from the app.

Enable Allow LAN only on a trusted local network. Check the listening address and inbound firewall rules, then configure other devices with the LAN address of the device running the client and the proxy port. Don’t use 127.0.0.1—it points to each device itself. Open only the proxy ports you need and do not expose the controller API. Disable LAN access on public networks. If authentication is needed, configure access restrictions using the method supported by the kernel.

Usually not. First make sure the device has a working network connection, then toggle the system proxy or TUN off and on to let the client restore traffic capture. If old connections are still stuck, disconnect and retry. Switching Wi-Fi networks can change the gateway, DNS and available routes, so parsing or connection errors in the logs are more useful than reimporting. Update or reimport the subscription only if the remote configuration has changed, expired or stopped loading correctly.

First check that the subscription URL was copied in full, the account is active and the client supports the subscription format. Then review the update log: 401 or 403 usually indicate an authorization issue or server-side access restriction; for 404, check the URL; for timeouts, check the current network and the route used for the update request. If the client lets you update through a proxy, try both ways for comparison. Avoid repeated rapid refreshes. When contacting the provider, hide subscription credentials and share only the status code and a brief error summary.

Not necessarily. A failed latency test only means that the test request did not complete within the time limit. The cause could be the test URL, DNS, protocol support or the current route. Compare other policies in the same configuration, then check actual web requests and kernel logs. If only one outbound fails, try another and contact the provider. If all outbounds fail, check your local network, system clock and kernel status. Don’t delete the subscription based on a test result alone.

First check that the kernel is listening on the configured port, then confirm that the operating system proxy uses the same address and port. Temporarily disable browser extensions and other proxy clients that might change proxy settings, then watch the Connections page. If no request appears, check how the app’s traffic is being captured. If a request appears but fails, check the matched policy, DNS result and outbound error. If the network breaks after you exit the client, check whether the system is still pointed at a proxy port that is no longer active.

Start by defining what you expect: a split-routing configuration may intentionally use local DNS for some domains, so seeing a local resolver does not automatically mean there is a problem. Check the actual path using kernel DNS logs, system resolver settings and your browser’s Secure DNS settings. In Fake-IP mode, device discovery and some specialized apps may not work; follow the documentation to add filters for affected domains. After changing settings, clear system and browser DNS caches and reconnect. Avoid changing multiple DNS options at once.

Note the client name, kernel version, operating system, proxy mode and reproducible steps, then capture relevant logs from before and after the issue. Include status codes, error fields and connection stages to help distinguish configuration parsing, DNS and forwarding problems. Before sharing, redact subscription URLs, credentials, controller API keys and private domains or addresses. Never post the full configuration publicly. Restore the normal log level when troubleshooting is complete to avoid collecting unnecessary connection data over time.