Clash FAQ

The client is the app you interact with to import configurations, select proxy groups and start the service. mihomo is the core that handles connections and rules. A subscription is a configuration URL provided by a service provider, usually containing nodes, proxy groups and rules. Installing the client is not enough: you also need to import a configuration compatible with its core to use the proxy. When troubleshooting, first determine whether the app fails to start, the configuration fails to load or a node cannot connect. These are different issues, not all subscription problems.

The VPN icon only indicates that the client has created a local VPN interface on Android; it does not confirm that the remote node is reachable. VpnService is Android’s system interface for receiving device network traffic, which the client then handles according to its configuration. After the icon appears, check the selected node in the proxy group and test an actual website or app. If it will not load, check the connection logs for DNS resolution, handshake or timeout errors. Reinstalling based on the icon alone is unlikely to help.

For everyday use, choose Rule mode, then select a node in the relevant proxy group. Rules determine which connections go direct and which use the proxy. Global sends connections entering the core through the global policy; you still need to select the node that policy uses. Direct sends connections entering the core straight through. These modes only affect traffic handled by the core; they do not automatically route apps the client has not captured. Temporarily switching to Global can help identify a rules issue, but switch back when testing is done.

They are related, but they are not the same switch. TUN is a virtual network interface that captures IP-layer traffic. On Android, clients typically use VpnService to let the system route traffic through them; the relevant setting may be labeled VPN, service or TUN, depending on the app. Desktop TUN setups may also require administrator access, a service component and routing changes. Do not copy permission commands from desktop tutorials onto a different platform. Check your device and follow the settings instructions for your client.

First check the provider’s device limit and simultaneous-connection rules, then make sure both clients support the protocols and fields in the subscription. Being able to import a subscription does not mean every setting will work on both platforms. Bind addresses, file paths, TUN and DNS handling may differ by system. It is usually better to share the remote subscription and keep platform-specific changes in local overrides on each device. An override is a local change applied after the configuration is updated. Avoid syncing the entire app data folder, which could overwrite system settings on the other device.

Import and select a configuration in the client before starting the proxy service. When Android displays a VPN connection request, check that the app name matches the client you installed, then allow the connection. If no prompt appears, stop other VPN apps and restart the service; a work profile or device management policy may also block authorization. After granting permission, check the connection status in Android’s VPN settings. Allowing a VPN connection does not give the node provider access to files on your phone.

Open the configuration page and find the option to import from a URL. Copy the full subscription URL again from your provider. Check for leading or trailing spaces, line breaks or punctuation added by a messaging app, and make sure you copied the subscription URL rather than a link to the account dashboard. If it still fails, check the import log: try another network if it times out; if the format is invalid, see whether the link returns a sign-in or error page. Subscription URLs often contain access credentials, so do not post the full link on public forums or in screenshots.

Check the provider’s account page for the subscription expiry date, remaining quota and whether the subscription URL has been reset. HTTP 401 or 403 errors often point to an authorization issue, but can also result from site access restrictions; do not assume the subscription has expired based on the status code alone. Copy the URL again and update manually, then confirm the client has selected the updated configuration. If the download succeeds but no nodes appear, check whether the response was an empty configuration or in the wrong format. Keep the old configuration until the new one works so you can roll back if needed.

Long-press the app icon, open App info, then find the battery or background activity settings. Set the client to Unrestricted or allow background activity. Some systems also require enabling auto-start and locking the app in the recent apps screen. Setting names vary by phone manufacturer, so follow the menus on your device. Start the service, lock the screen for a few minutes and test again. If disconnects only happen when switching between Wi-Fi and mobile data, check the network-switch logs too. Battery optimization exemptions will not fix a failing node or a broken configuration.

Turn off TUN and check the client settings to see whether service mode or its service component is installed and running. Windows may ask you to authorize an administrator action; macOS may require permission in System Settings; on Linux, follow the client documentation to configure the service or network permissions. Restart the client, then enable TUN again. Do not run untrusted software with elevated privileges indefinitely or keep stacking routing commands. If the problem persists, note the exact error and check for conflicts with virtual adapters from older VPN software.

Find the client’s override, rule editor or extended configuration settings. Put persistent rules in a local override so subscription updates do not replace them. Rules are usually matched from top to bottom, and the first match determines where traffic goes. Place specific domain rules before broader rules and the final catch-all rule. Reload the configuration and check the connection log to see which rule matched. The policy group named in a rule must match the configuration exactly. A typo can prevent the configuration from loading; the client will not automatically switch to the nearest node.

Open the client’s connections page, then make the target app send a new request. Check the domain, matched rule and final policy. Existing long-lived connections may keep using their previous route, so after changing nodes, close and reopen the target app. On Android, if per-app proxying is enabled, confirm the app is included. A node speed test only checks a specific probe address; it does not prove the target app’s server is reachable. Test with a page you actually use and match the request time to the log timestamp.

Add the same remote subscription on both devices, then create a local override on each and note which DNS, rules and platform settings need to be preserved. Update the subscription manually, check that the override is still enabled, then reload the configuration. Clients may merge fields differently, so check whether rules are appended, placed first or replaced. Before migrating, export any local settings you need and save your proxy group selections. Avoid using file-sync tools to overwrite a configuration file while it is running; the client could load it before the write is complete.

In Android’s VPN settings, open the settings for the current client and check these two options. Always-on VPN tells Android to maintain or restore the VPN service. Block connections without VPN prevents network traffic from bypassing it, which can leave the whole device offline if the service fails. First confirm the client supports these behaviors, then test after restarting and switching networks before enabling them. If the device loses connectivity, return to this page and turn off the blocking option, then check the configuration and per-app coverage.

Start by identifying which layer has the problem. If the node list is outdated or the provider changed its URL, update the subscription. If the configuration reports an unsupported protocol or field, check whether the client or core needs updating. There is no need to change everything at once during normal use. Before updating the client, save your local overrides and important settings. Afterward, test the existing configuration first. Changing the client, subscription, DNS and mode all at once makes it hard to find the cause of a failure. Change one thing at a time and note how connections behave before and after.

Stop the proxy service and confirm your device can reach regular websites without it. Then check the subscription’s expiry, quota and node list. Make sure the system date and time are set to update automatically, and look in the logs for DNS resolution failures, connection timeouts or handshake errors. Test another node on a different network, then open the target website itself. If only the speed test fails while websites load, the probe address may be unreachable. Do not start by reinstalling the client: that can erase useful settings and will not fix a remote node outage.

First confirm that the client is listening on its local proxy port. Then check that the proxy address and port in Windows Settings under Network & internet match. Browser extensions, custom proxy settings and some work policies can override the system proxy. Disable the relevant extensions or configure the browser to use system settings, then reopen it. Check whether the request appears in the client’s connection log. If there is no entry, check how traffic is reaching the client; if there is an entry but access fails, investigate the policy, node and DNS. Repeatedly toggling the system proxy will not help.

Many command-line tools do not automatically use the desktop system proxy. Check which proxy options or environment variables the tool supports, then enter the address, port and protocol the client is actually listening on. HTTP and SOCKS proxies use different protocols; changing only the port is not enough. Some programs also need ALL_PROXY; check the tool’s documentation. Test in a new terminal and check the connection log. If several programs need to be routed, consider TUN. Do not share environment variable output containing credentials or screenshots of the full terminal.

Check the logs to see whether the unresolved name belongs to the target site or the node server, then confirm the configured DNS upstream is reachable on your current network. An encrypted DNS server’s address may itself need to be resolved first, so switching to another equally unreachable address will not help. Android Private DNS, secure DNS in the browser and the client’s DNS can use different resolution paths. Change one setting at a time when testing. If you use fake-ip mode, check that the client is handling DNS traffic correctly rather than just clearing the browser cache.

First confirm that the affected app runs in a restricted app container, and check whether a desktop browser can access the internet through the same proxy. Some UWP apps cannot access local loopback addresses such as 127.0.0.1 by default, so they cannot connect to the client’s local proxy port. If the client provides a UWP loopback utility, add an exemption for the target app as needed and grant permission when prompted. Otherwise, consult Microsoft’s CheckNetIsolation documentation. Only change settings for the apps that need them, then restart the target app and check the connection log.