Clash FAQ & Troubleshooting Guide

Clash Verge is an actively maintained GUI client built on the mihomo core, supporting Windows, macOS, and Linux. Clash for Windows stopped receiving updates in 2023, and the Meta branch of ClashX has been archived. All three share the same config and subscription formats, so migrating from an older client is easy: just import your subscription link and existing config.yaml into Clash Verge.

mihomo is the community-maintained successor to the Clash core, formerly known as Clash Meta. It keeps the original config format while adding rule providers, enhanced Fake-IP, domain sniffing, TCP concurrency, and more. Clash Verge ships with mihomo by default, and most fields in older config files remain backward compatible, so they run without modification.

System proxy writes the proxy address into the OS network settings, which browsers and most desktop apps pick up automatically. TUN mode creates a virtual network adapter that captures all IP traffic, including UDP and command-line tools, without requiring apps to support proxies. Manual proxy means entering 127.0.0.1:7890 inside a single app, affecting only that app. Use system proxy for everyday browsing and TUN mode for gaming and command-line use.

Yes. Clash is a client application and does not provide nodes or traffic. Nodes come from a subscription service you sign up for or from your own server. Once you import the subscription link provided by your provider, you can start using it. Subscription links usually start with https://; if your provider also offers a Clash-specific link, use that format.

No, it's free. Clash Verge is an open-source project released under GPL-3.0, and the client itself is free forever. The only thing you pay for is node traffic, which is billed by your chosen provider or server host and has nothing to do with the client.

The Windows build of Clash Verge relies on the WebView2 runtime to render its interface. If it isn't preinstalled, the installer will try to download it, which can fail on restricted networks. Fix: download the WebView2 Evergreen standalone installer from Microsoft, run it, then rerun the Clash Verge installer and launch the client.

Installing the system service requires administrator rights, so click Yes on the UAC prompt. If service installation fails, the usual culprits are security software blocking it or leftover files from an older version: quit your antivirus and security tools, then rerun the installer as administrator. If you had an older version installed, uninstall it, clean the install directory, and install again.

Check three things. First, make sure the link was copied in full — chat apps often truncate long URLs. Second, open the link in a browser; it should return a page of YAML text. If you get an error page or empty content, the subscription address itself is faulty, so copy it again from your provider's dashboard. Third, confirm the link hasn't expired. If the browser opens it but the client reports a parsing error, see the subscription parse failure entry under Troubleshooting below.

Open the Settings page in the client and turn on the System Proxy toggle. The default proxy address is 127.0.0.1:7890, and browsers need no extra configuration. If the browser still can't connect, check whether another proxy app is occupying port 7890, or whether a browser proxy extension is conflicting with the system proxy — switch the extension to Use System Proxy.

The first time you enable TUN mode, macOS shows a network extension authorization prompt. Go to System Settings → Privacy & Security and allow Clash Verge to install the network extension; if Accessibility permission is also requested, grant it too. If launching the app shows "app is damaged and can't be opened", that's Gatekeeper quarantine — click Open Anyway on the Privacy & Security page, or run xattr -d com.apple.quarantine on the downloaded .app and try again.

Updating the subscription only re-fetches the config file; it doesn't switch the currently selected node. Manually pick a node again and test its latency to confirm it works. If the list truly hasn't changed, the provider may be serving cached content or the link points to an old config — delete the subscription and import it again.

The easiest way is to enable TUN mode, and command-line traffic will automatically go through the virtual adapter. You can also set environment variables in the terminal: export http_proxy=http://127.0.0.1:7890 and export https_proxy=http://127.0.0.1:7890, adjusting the port to match your client settings. For git alone, run git config --global http.proxy http://127.0.0.1:7890.

UWP apps are blocked from accessing local loopback addresses by default, so the system proxy doesn't affect them. The recommended fix is to enable TUN mode, which covers all UWP traffic at once. Alternatively, run CheckNetIsolation LoopbackExempt -a -n=PackageName as administrator to exempt a specific app; you can look up the package name with Get-AppxPackage in PowerShell. For everyday use, just stick with TUN mode.

System proxy only handles TCP, while games and some voice apps rely on UDP, so you need TUN mode. TUN captures all IP traffic at the virtual adapter layer, including UDP. If games still don't work after enabling it, make sure the node protocol has UDP support enabled — some providers ship Shadowsocks and VMess nodes with UDP off by default, so check with your provider.

Clash's default rules usually include GEOIP-based split routing: IPs in mainland China go direct and everything else goes through the proxy. If your subscription has no built-in rules, add rule providers on the Rules page, or use a subscription converter to generate a subscription with rules. Common rule syntax: DOMAIN-SUFFIX,github.com,PROXY routes GitHub through the proxy, and GEOIP,CN,DIRECT sends mainland China IPs direct.

Check in this order: 1) Is the system clock accurate? A large time skew causes TLS handshake failures. 2) Update the subscription and make sure the nodes haven't expired. 3) Test latency on the nodes in the client to rule out a single faulty node. 4) Close other proxy software to avoid port conflicts. 5) Switch protocols — if your ISP is blocking one protocol, switching may restore connectivity. 6) Confirm the computer itself has normal network access.

Common causes, in order of likelihood: 1) The proxy port is taken — the client log shows a listen failure, so change the port in settings. 2) A browser proxy extension conflicts with the system proxy — switch the extension to Use System Proxy or disable it temporarily. 3) Another app reset the system proxy — turn the toggle back on. 4) The firewall is blocking the client's inbound connections — allow the program through in firewall settings.

Windows: run the client as administrator, make sure the service mode installed successfully, and allow the relevant processes in your antivirus. macOS: check the network extension and accessibility permissions under Privacy & Security, then restart the client after granting them. Linux: confirm your user is in the required group, or run it as a systemd service. If it still fails, open the client log and diagnose from the specific error.

Check four possible causes: 1) The link is unreachable — open it in a browser and see what it returns. 2) The response isn't YAML — some providers output base64 by default, so convert it to Clash format with a subscription converter first. 3) YAML syntax errors — save the content as a .yaml file and check the indentation in an editor. 4) Incompatible fields — older subscriptions use deprecated fields, so ask your provider for a mihomo/Clash Meta format subscription.

Check the DNS config first. When using Fake-IP mode, make sure nameserver and fallback under the dns section are filled in correctly. Open the client log to see which rule the target domain matched; if it was wrongly routed to DIRECT, add it to a proxy policy group on the Rules page. If the sites that fail use QUIC, try disabling QUIC in the browser or just enable TUN mode.

This usually happens when a subscription has too many nodes, too many rule providers are enabled, or the log level is set to debug. Set the log level back to info, trim unused rule providers and old subscriptions, and lower the GEO data auto-update frequency. A very short subscription auto-update interval also causes periodic spikes — set it to 6 hours or more.