Clash Downloads
and FAQs

First, confirm that the subscription updated successfully, then check that the configuration is selected. Add the URL provided by your service on the client's Configuration or Subscription page, update it, and check whether proxies and proxy groups appear. A URL opening in your browser doesn't mean its response is a compatible Clash configuration: a login page, expiration notice, or plain-text error isn't valid YAML. If the update fails, check the status code and logs before changing DNS. Subscription URLs often contain personal access credentials. Redact the full URL before sharing screenshots or asking for help; public examples should include only the domain and parameter names.

Also distinguish a successful import from a working proxy: import success means the client accepted the content, while a working route can only be confirmed by making a connection. After switching configurations, check that the proxy group still selects the intended route. Local edits may also be overwritten at the next subscription update.

For everyday use, start with Rule mode to route requests according to your configuration. Switch to Global temporarily to check whether a rule is causing the issue. Global mode doesn't make the connection itself faster, and you still need to choose a proxy for GLOBAL. Direct mode sends requests entering the core directly, which is useful for checking whether your local network works. These modes change the route taken by traffic that reaches the core; they don't automatically capture every app. Apps that ignore the system proxy need their own proxy settings or, where appropriate, TUN. Switching modes alone won't fix that.

mode: rule

mode: global

mode: direct

You can change the port, but first check whether the process using it is an old instance. Running multiple proxy clients on the same device is a common cause of listener conflicts; closing an unused instance is often clearer than changing settings at random. If you do need a different port, set mixed-port to an unused value, reload the configuration, and confirm the logs show the new listening address. Then update the system proxy and app proxy ports, or your browser may keep using the old address. allow-lan controls access from your local network; it doesn't resolve a conflict on this device. If you only use Clash locally, leaving it set to false helps limit access.

mixed-port: 7891
allow-lan: false
mode: rule

First determine whether DNS resolution is failing or the connection is failing after resolution. Check dns.enable, which fields your current core supports, and whether the app actually uses this DNS path. With fake-ip, returning a mapped address is normal; an address that doesn't look like a public IP isn't proof of a configuration error. nameserver specifies upstream resolvers. fallback isn't a simple switch that retries every request with a backup resolver; its behavior depends on filters and the core. A browser's built-in encrypted DNS may also bypass the expected route. During troubleshooting, change one variable at a time and compare the logs before and after each change. That's more useful than replacing every resolver at once.

This is only an example of the field structure: the local DNS listener uses a loopback address, which doesn't mean the system is automatically using it. Check how the client handles traffic to determine whether DNS hijacking is needed and how it works with TUN. After updating the configuration, remember that apps and the system may cache DNS results.

dns:
  enable: true
  listen: 127.0.0.1:1053
  enhanced-mode: fake-ip
  nameserver:
    - 223.5.5.5

First confirm that Rule mode is active, then start at the top of the rule list. Matching stops at the first match, so a broad rule earlier in the list may already be handling the request. MATCH is typically a catch-all; placing it too early prevents later rules from being reached. The policy name at the end of a rule must exactly match a proxy or proxy group in your configuration. PROXY here is just an example name, not a built-in policy available in every configuration. Open the connection details and check the requested domain, matched rule, and final outbound route instead of guessing from what a webpage displays. Also note that existing connections may keep using the old route; send a new request after making changes.

rules:
  - DOMAIN-SUFFIX,google.com,PROXY
  - GEOIP,CN,DIRECT
  - MATCH,PROXY

“Connected” usually means the local service or network routing has started; it doesn't mean the remote proxy is reachable. Turn off the proxy first and check that your local network can reach ordinary websites. Then check startup logs for configuration parsing, port binding, or permission errors. Open a target site and see whether a request appears in the connection list. If there's no entry, check the system proxy or TUN; if there is an entry but it times out, check the selected proxy group, DNS, and remote connection. Clash node speed tests measure the response from a specific test endpoint; low latency doesn't mean every website will work. If the app crashes, save the error logs before checking the configuration, core files, and system runtime. Don't immediately erase the entire data directory.

When reporting an issue, include your OS, client name, core details, steps to reproduce, and a few log lines from before and after the error. Hide subscription credentials and server authentication details, but keep field names and the exact error text. A screenshot that only says “can't connect” usually isn't enough to identify the failing layer.