Clash System Proxy Not Working? Troubleshoot Browser and Terminal Separately

1. Check the port, then distinguish system proxy from VPN routing

Open the client’s Settings and look for Port, Inbound, or Mixed Port. Note the actual value, then check that the core is running. Menu names vary by client, so don’t copy a port from a guide straight into your system settings. This article uses 127.0.0.1:7890 as an example; use it as-is only if your HTTP or mixed port is actually 7890.

A system proxy is an address that applications can choose to use; it doesn’t force all network traffic through a proxy. Browsers usually read this setting, while command-line tools vary. “Terminals rely on environment variables” in the summary refers to a common place to start troubleshooting. Strictly speaking, programs such as curl, Git, and package managers make the requests, and may also read command-line options or their own configuration files.

2. Send an explicit proxy request to pinpoint the failing layer

Don’t keep switching nodes yet. Open a terminal and use curl’s explicit proxy option to bypass the question of whether an application reads the system proxy setting. The address below is a test destination, not a speed-test node. Focus on whether the request reaches the client and where it fails.

macOS or Linux

curl -v --connect-timeout 10 --max-time 20 \
  --noproxy "" \
  --proxy http://127.0.0.1:7890 \
  https://example.com/

Windows PowerShell

curl.exe -v --connect-timeout 10 --max-time 20 --noproxy "" --proxy http://127.0.0.1:7890 https://example.com/

On Windows, use curl.exe to avoid the curl alias in Windows PowerShell 5.1, which runs a different command. The 10-second connection timeout and 20-second overall limit simply prevent the test from waiting indefinitely; they are not performance benchmarks. --noproxy "" clears the bypass list for this request.

• Local connection refused: First check that the core is running, the port is correct, and the port supports the proxy protocol you’re using.
• HTTP 407 returned: The local proxy requires authentication. Provide the credentials configured for it, and don’t post passwords in public logs.
• CONNECT succeeds: The HTTP proxy accepted the tunnel request, but the subsequent TLS handshake or destination response may still fail.
• The destination responds: The local proxy path works for this request. That doesn’t prove that every node, domain, or rule is working.

Also open the client’s Connections or Logs page. Check the requested domain, matched rule, policy group, and final outbound. If the request shows DIRECT, it may have reached the core and been routed directly by a rule. That’s different from the system proxy not working.

3. Browser can’t connect? Check system settings, extensions, and browser-specific settings

Chrome and Edge: check the system proxy, then disable proxy extensions

1. In Windows 11, open Settings → Network & internet → Proxy and check the address and port under Manual proxy setup. If the client manages an automatic configuration script, check its source as well.
2. On macOS, go to System Settings → Network → your current connection → Details → Proxies. Check that Web Proxy, Secure Web Proxy, or Automatic Proxy Configuration matches the client’s setup.
3. In Chrome, open Settings → System and select your computer’s proxy settings. In Edge, the equivalent option is usually under System and performance. You can also use the operating system paths above.
4. Open the extensions page and temporarily disable every extension that can change proxy settings. Then revisit the same test address. Note the extensions’ original modes so you can restore them afterward if needed.

A proxy extension may use a different fixed port or use PAC to send certain domains direct. PAC is an automatic configuration script that selects a proxy based on the URL. If the browser says its settings are managed by your organization, check browser policies or contact your administrator. Don’t try to override organizational settings by repeatedly toggling the client.

Firefox: choose a specific proxy source

Go to Settings → General → Network Settings → Settings. To follow the operating system, select Use system proxy settings. To test independently, select Manual proxy configuration, enter the actual HTTP proxy address and port, and check whether the proxy is also used for HTTPS. Don’t select No proxy while changing only the system proxy.

If you use SOCKS v5, the proxy field and port must match a SOCKS or mixed inbound. To resolve domain names through the proxy, check Firefox’s Proxy DNS when using SOCKS v5 option. Secure DNS, caching, and proxy type can all affect name resolution; Secure DNS being enabled in the browser doesn’t prove that Clash DNS is broken.

4. Terminal bypassing the proxy? Set environment variables for the program making the request

If an explicit proxy test succeeds but a regular terminal request fails, check whether the program reads proxy settings. Environment variables are passed to the current process and any child processes it starts; setting them in one window won’t update another window that’s already open. Start with a session-only test instead of editing a startup file.

Bash or Zsh: set HTTP proxy variables first

export http_proxy="http://127.0.0.1:7890"
export https_proxy="http://127.0.0.1:7890"
export no_proxy="localhost,127.0.0.1,::1"

curl -v --connect-timeout 10 --max-time 20 https://example.com/

Using http:// for the https_proxy value isn’t a mistake. It describes the protocol used to connect to the local proxy; HTTPS destinations are usually reached through an HTTP CONNECT tunnel. Don’t change the local proxy address to https://127.0.0.1:7890 just because the destination uses HTTPS.

curl uses lowercase http_proxy for HTTP proxies; other tools may handle variable names differently. no_proxy is a bypass list: if it includes the test domain, the program may connect directly. Check for conflicts between uppercase and lowercase variables, and don’t expose variables containing credentials.

PowerShell: variables apply only to the current session

$env:http_proxy = "http://127.0.0.1:7890"
$env:https_proxy = "http://127.0.0.1:7890"
$env:no_proxy = "localhost,127.0.0.1,::1"

curl.exe -v --connect-timeout 10 --max-time 20 https://example.com/

Not every PowerShell command or application reads these variables the same way curl does. If curl works but another tool fails, check that tool’s proxy documentation rather than changing system-wide network settings. Variables may also be cleared when using sudo, so check what configuration the elevated process actually receives.

SOCKS and application-specific settings

If a SOCKS or mixed inbound is actually listening locally, use the one-off request below to compare DNS resolution paths. socks5h sends domain resolution to the proxy; plain socks5 usually resolves domains locally first. Replace 7890 with your actual port.

curl -v --noproxy "" --proxy socks5h://127.0.0.1:7890 \
  --connect-timeout 10 --max-time 20 https://example.com/

Some tools use ALL_PROXY as a general proxy variable, but support and precedence aren’t consistent across the system. Git may also have http.proxy configured, and npm has its own proxy settings. Check where the settings come from before layering environment variables over old configuration.

git config --show-origin --get-regexp '.*proxy.*'
npm config get proxy
npm config get https-proxy

5. When to switch to TUN mode

Consider TUN mode if you need to route traffic from multiple applications that ignore the system proxy, or from apps with no proxy settings. TUN is a virtual network interface that cores such as mihomo can use to receive IP traffic. It addresses how traffic enters the proxy; it won’t fix an expired subscription, a bad node, certificate problems, or unsuitable routing rules.

1. First confirm that the node path works with an explicit HTTP or SOCKS request. Then enable TUN mode or the virtual network adapter in the client.
2. Install or start the system service and grant the required permissions as prompted by the client. Windows, macOS, and Linux handle permissions differently, so don’t follow instructions intended for another platform.
3. Temporarily turn off other VPNs or virtual networking tools to avoid competing default routes. On managed devices, follow your organization’s requirements first.
4. During testing, remove the browser’s manual proxy settings and terminal proxy variables to make it easier to tell whether explicit proxy settings or TUN is handling the traffic.
5. Send the request again and check the client’s connection log and matched rule. Then verify that your local network, printers, and company intranet are still accessible.

Android usually handles this kind of traffic routing through its VPN service; don’t follow desktop instructions for installing a virtual network adapter driver. Also check whether per-app proxy settings exclude the target app. Other VPNs in the same Android user profile or work profile may affect the connection too.

6. Wrap up based on the test results and keep reproducible settings

When troubleshooting is done, clear temporary variables. If proxy settings were already present before testing, restore their original values instead of removing them. The commands below apply only if these variables were not set beforehand. To make settings persistent, update your shell startup file or the system environment variables separately.

# Bash / Zsh: clear temporary proxy settings from this session
unset http_proxy https_proxy all_proxy no_proxy
unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY

# PowerShell: clear temporary proxy settings from this session
Remove-Item Env:http_proxy, Env:https_proxy, Env:all_proxy, Env:no_proxy -ErrorAction SilentlyContinue

Record four details: the actual inbound port, the browser’s proxy source, the terminal program’s proxy settings, and the outbound selected for the request. Once these are clear, you can pick up at the right layer next time the system proxy is on but not working, instead of conflating browser, terminal, and node issues. Before sharing logs, redact subscription links, credentials, and personal browsing activity.