Clash for Windows FAQ and Troubleshooting

An installed copy of Clash for Windows can usually still load existing configurations and proxy traffic, but the discontinued project will not receive further feature updates or bug fixes. If it remains stable in your environment, keep a backup of your configuration and continue using it. For compatibility issues with newer systems, core updates, or TUN support, consider maintained graphical clients such as Clash Plus, Clash Verge Rev, and FlClash. Migration usually only requires importing the subscription again; do not overwrite the original configuration directory.

Rule mode evaluates the rules in the configuration in order and sends different domains or IP addresses to their assigned policy groups, making it the usual choice for everyday use. Global mode sends most proxyable traffic through the GLOBAL policy and is useful for checking whether rules are causing access problems. Direct mode bypasses the proxy and is useful for restoring local connectivity or running comparison tests. Switching modes does not change the subscription, but it immediately changes the traffic route. Switch back to the original mode after troubleshooting.

A subscription URL is the source used to update configuration content, and the client retrieves a YAML configuration from it. A configuration can contain more than nodes, including policy groups, routing rules, DNS settings, and port settings; nodes are only the part that connects to proxy servers. Updating a subscription refreshes the local configuration with remote content, so manual changes may be overwritten. For local rules that must persist, use the client’s override feature or maintain a separate local configuration.

For a clear graphical interface and commonly used configuration controls, start by reviewing Clash Plus. If you need broader Mihomo features and rule management, compare Clash Verge Rev. For users working across multiple desktop platforms, FlClash is another option. The original Clash for Windows is best suited to users who already know its interface and need to retain an older configuration. Before choosing, verify the system architecture and package type, then open the corresponding client entry from the downloads page.

First, paste the subscription URL into a browser to check whether it opens, and make sure the copied address contains no spaces, line breaks, or trailing punctuation. If the browser cannot open it either, check whether the subscription has expired, the traffic quota is exhausted, or the server is temporarily unavailable. If it opens in the browser but fails in the client, disable the system proxy and try again, or change the proxy method used for subscription updates in the client. Do not confuse a subscription webpage, user-center URL, and actual configuration subscription URL.

First, verify that the active configuration is the one just updated rather than another older entry in the list. Then check whether the policy groups contain selectable items and whether the configuration includes proxies or proxy-providers. Some subscriptions return a webpage, login page, or error message; the client may finish downloading it without being able to parse any nodes. Delete the invalid configuration and import it again. If it relies on a remote provider, update the provider manually and check the logs for download or parsing errors.

First, confirm that the Clash core is running and that no other program is using the HTTP or mixed port. Then open the Windows proxy settings and verify that the manual proxy points to the local address and port shown by the client. Some browsers, download tools, and development applications use their own proxy settings instead of the system proxy; select the system proxy in the application or enter the address manually. If a proxy extension is enabled, make sure it is not taking over requests alongside the system proxy.

Windows UWP apps may not be able to access a local proxy port by default, so a working browser does not mean Store apps can connect. Run the client’s UWP Loopback tool as administrator, select the apps that need proxy access, save the changes, and restart those apps. Do not select every system component at once, as this can make troubleshooting harder. If access breaks again after an app update, repeat the loopback authorization and verify that the system proxy port has not changed.

A latency test usually only verifies that a connection can be established to a specific address; it does not prove that the target website is reachable. Switch to another node in the policy group, then test both Rule and Global mode. If Global mode works, the problem is likely related to rule matching or policy-group selection. If every node times out, check the local network, subscription status, system time, and client logs. The log messages timeout, connection refused, and TLS errors indicate different problems: a link timeout, a rejected port, and a handshake failure.

TUN mode creates a virtual network interface, changes routes, and handles traffic from applications that do not read the system proxy. These operations require more than standard user privileges. On Windows, follow the client’s instructions to install the required service or run the first setup as administrator, then confirm that the virtual adapter and related service load correctly. If the permission prompt is canceled, the TUN switch may appear to have been enabled even though the interface was never created. Organization-managed computers may also restrict driver or service installation, which requires an administrator to resolve.

Before and after connecting through the proxy, use a DNS leak test page to see whether the resolver servers change, then check the client logs to confirm that domain requests enter Clash DNS. In the configuration, verify that dns is enabled, that nameserver and fallback match the current network, and whether enhanced-mode uses fake-ip or redir-host. With TUN enabled, also confirm that DNS hijacking rules are active. After making changes, clear the system DNS cache, restart the browser, and test again so old cached results do not affect the diagnosis.

Enable Allow LAN in the client and make sure the listen address is not limited to 127.0.0.1. Find the IPv4 address of the computer running Clash on the local network, then enter that address and Clash’s HTTP or mixed port in the Wi-Fi proxy settings on the other device. The host firewall must allow the relevant application and port on private networks. Keep both devices on the same trusted LAN while sharing access, and disable LAN access when finished.

Port conflicts are commonly caused by another Clash instance, an old core process, a proxy tool, or a development service. Exit the related programs completely and confirm in Task Manager that no core process remains. If the conflict persists, use the system’s network commands to identify the process ID using the port, then decide whether to stop it or change Clash’s mixed-port, port, or socks-port. After changing a port, update the system proxy and any applications configured manually; otherwise the core may run while requests cannot reach it.

YAML is highly sensitive to indentation, colons, and list markers. Start with the line number in the error message, then inspect upward at the same indentation level. Use spaces consistently and do not mix in tabs. Keep a space after the colon following a key, and quote text containing special characters when necessary. Rules must retain list syntax, and policy-group references must exactly match existing node or group names. Keep a working copy before editing, run a configuration check afterward, and only then reload the core.

First disable TUN mode and exit the client to see whether basic connectivity returns. If it does not, disable and re-enable the physical network adapter, and check for a leftover manual proxy in the system. Before enabling TUN again, confirm that the virtual adapter, service mode, DNS hijacking, and routing settings have loaded correctly. Temporarily disable other VPN or virtual-adapter software for comparison. If the issue occurs only on one network, try another TUN network stack or adjust the MTU, changing and recording only one setting at a time.

This usually happens because the system proxy was not restored when the client exited, or because the TUN service and routes remain active. Open Windows Network & Internet settings, disable the manual proxy, and check for an automatic configuration script. Then confirm that Clash, its core, and related service processes have stopped. If TUN was enabled, reopen the client, disable TUN normally, and exit again. Finally, clear the DNS cache and restart the network adapter. If access still does not return, restart the system rather than deleting unknown network drivers.