The 10 Most Common Questions During Your First Week with Clash: From Importing Subscriptions to Enabling the System Proxy

1. Choosing a Client: How Clash, Clash Meta, and mihomo Are Related

Question 1: Which Clash Client Should You Download?

The short answer: choose a maintained, graphical client for your operating system, then confirm that its core supports the protocols used by your subscription. For beginners on Windows and macOS, choose a desktop client that can manage profiles, the system proxy, and TUN mode. On Android, choose one with profile import and per-app routing. You do not need multiple clients for your first setup; running two proxy applications on the same device can cause port conflicts.

“Clash” may refer to the original Clash core or, more broadly, to clients that use the Clash configuration format. The original project is no longer maintained, and many current clients use the mihomo core. mihomo was previously known as Clash Meta; it retains Clash YAML structure while extending support for protocols, rule providers, DNS, and transparent proxying. When you see “Meta core” or “mihomo core,” treat them as names from different periods of the same technical lineage.

• Need only basic web proxying: a graphical client, Rule mode, and the system proxy cover most use cases.
• Need game launchers, command-line tools, or store apps: choose a client that supports TUN mode.
• Need to import an existing YAML file: confirm that the client supports local configuration files, not just subscription URLs.
• Different device architectures: Windows commonly offers x64 and arm64 builds; choose arm64 for Apple Silicon Macs and x64 for Intel Macs.

2. Where Subscription URLs Come From and How to Import Them Correctly

Question 2: Why Are There No Proxies After Installing the Client?

A Clash client generally reads configuration, applies rules, and forwards connections; it does not automatically generate usable proxy nodes. Node information comes from your own service configuration, an organization’s configuration, or a subscription URL issued by a network service provider. A subscription URL is usually a dedicated HTTPS URL that may contain an access token. Treat it like account credentials and never publish it in screenshots, forums, or public code repositories.

A typical import path is “Profiles” → “New Profile” → “URL.” Some clients use “Configuration” → “New Configuration” → “Import from URL.” Paste the subscription URL, download it, and then make the new profile active. Seeing a profile in the list does not mean it is enabled; confirm that it is marked “Current,” “Selected,” or otherwise highlighted.

1. Copy the complete subscription URL and check that it begins with https://.
2. Open the client’s “Profiles” or “Configuration” page.
3. Choose “Import from URL,” paste the address, and download it.
4. Select the newly downloaded profile and wait for proxy groups and nodes to appear.
5. Open “Proxies” and select a node in the target policy group.
6. Return to the home screen, enable the “System Proxy,” and test access in a browser.

Question 3: What to Do When a Subscription Import or Update Fails

First distinguish between “the URL cannot be downloaded” and “the download cannot be parsed.” The former usually appears as a timeout or HTTP 401, 403, or 404 error; the latter may show a YAML parse error, an invalid field type, or configuration validation failure. A 401 or 403 usually indicates an expired token, a changed account status, or a server-side restriction. A 404 may mean the URL has changed. For parse errors, check that the subscription returns a configuration format recognized by Clash or mihomo.

During the first import, do not enable automatic updates, profile overrides, and script processing at the same time. First confirm that the raw profile loads, then add features one by one. If opening the subscription URL directly in a browser returns a login page or an HTML error page, the client cannot parse it as YAML either. If the URL is valid but the client still reports an error, temporarily set the log level to debug under “Settings” → “Logs,” reproduce the issue once, and inspect the failing stage. Change it back to info after troubleshooting.

3. Choosing Between Rule, Global, and Direct Modes

Question 4: What Is the Difference Between Rule, Global, and Direct?

Rule mode matches domains, IPs, processes, or rule providers against the configured rules, then sends each connection to the assigned policy group. It is suitable for everyday use and is the default mode for most subscription profiles. Sites in mainland China can connect directly, targets that require a proxy go through a proxy policy, and local network addresses usually remain direct.

Global mode sends most connections to the policy group named GLOBAL. It is useful for temporarily checking whether a node can establish a connection. It does not mean that every connection necessarily leaves the local network; LAN addresses, reserved addresses, and the client’s own connections may still be handled by core rules. Using Global mode long term bypasses the traffic-routing logic designed into the subscription.

Direct mode connects to the destination directly without using a proxy node. It is useful for checking whether a problem is caused by the proxy path and for temporarily disabling forwarding. Direct does not exit the client; if the system proxy still points to a local port, traffic still reaches the client first and is then sent directly.

1. For everyday use, choose “Mode” → “Rule.”
2. Open “Proxies” → the target policy group, then select a node that passes the latency test.
3. When a website behaves unexpectedly, temporarily switch to Global mode for comparison.
4. If Global works but Rule fails, focus on the matched rule and policy-group selection.
5. If Global also fails, check the node, network, port, and DNS.

How to Confirm Which Rule Matched a Connection

Open “Connections,” revisit the target website, and filter by domain. Records usually show the destination host, destination port, upload and download totals, matched rule, and actual policy chain. For example, if a record shows DOMAIN-SUFFIX matching Proxy, and Proxy currently selects a node, you can confirm the routing path. If it shows MATCH → DIRECT, the final fallback rule sent the connection directly.

4. The System Proxy Is Enabled, but Why Is the Browser Still Not Working?

Question 5: What Does the System Proxy Switch Actually Do?

The system proxy switch usually writes the operating system’s HTTP and HTTPS proxy address as 127.0.0.1 plus a local port. For example, with mixed-port: 7890, the system proxy points to 127.0.0.1:7890. Whether an application follows this setting is up to the application. Mainstream browsers usually read the system proxy, while some games, terminal programs, store apps, and software with its own network stack may ignore it.

Check the following in order to avoid masking the real cause by repeatedly switching nodes:

1. On the client home screen, confirm that the core is running, not merely that the interface has opened.
2. Open “Settings” → “Port Settings” and note the actual Mixed Port value.
3. Confirm that the system proxy address matches this port, for example 127.0.0.1:7890.
4. Open “Connections,” then refresh the browser and check whether a new connection appears.
5. If connections appear but access fails, check the matched rule, node, and DNS.
6. If no connection appears at all, check browser proxy extensions, system-proxy overrides, and the application’s own settings.

A proxy extension installed in the browser may override the system proxy. During troubleshooting, set the extension to “Use system proxy” or disable it temporarily. Command-line tools may also read environment variables. In Windows PowerShell, check HTTP_PROXY and HTTPS_PROXY; in a macOS or Linux terminal, run env | grep -i proxy. An old variable that still points to another port can make the browser work while the terminal fails.

Question 6: When Should You Enable TUN Mode?

TUN mode receives more system traffic through a virtual network interface. It is useful for applications that ignore the system proxy, UDP traffic, some game launchers, and command-line programs that need unified routing. It is not a “speed boost” switch. If you only use a browser and ordinary desktop apps, the system proxy is usually easier to maintain. Enable TUN when you have confirmed that the target application does not read the system proxy.

A common path is “Settings” → “Network Settings” → “TUN Mode.” The first activation may require administrator permission and installation of a virtual network component. After enabling it, confirm that the client reports TUN as running, and make sure another VPN, virtual network adapter tool, or old client is not competing for routes. If activation fails on Windows, fully exit the client and launch it once as administrator to complete service installation. Whether administrator permission is needed afterward depends on the client’s service implementation.

5. How to Check Timeouts, Port Conflicts, and DNS Problems

Question 7: Does a Timeout in the Latency Test Mean the Node Is Unusable?

Not necessarily. A latency test usually requests the test URL specified by the profile with a fixed timeout. An unreachable test address, a node that cannot access the target, failed DNS resolution, or packet loss on the local network can all produce a Timeout. Perform at least three cross-checks: update the profile, try two nodes in different regions, and use a browser to access a target that clearly supports HTTPS.

Latency is not download speed. A result of 80 ms only means that the test request completed in about 80 milliseconds at that moment; it says nothing about sustained throughput. Results of 85 ms, 92 ms, and 410 ms across three tests indicate substantial jitter. In video and normal web browsing, a stable 140 ms node may be more usable than a supposedly low-latency node that frequently jumps to 400 ms.

• All nodes time out: first check the subscription status, local network, DNS, and client logs.
• Only one node times out: switch to another node in the same group and test again later.
• Latency tests pass but webpages fail: check rule matches, browser proxy settings, and restrictions on the destination site.
• TCP pages work but games fail: check whether the client handles UDP and whether the TUN configuration is active.

Question 8: What to Do When “Port 7890 Is Already in Use” Appears

This means another process is listening on the same port. Common causes include an old client still running in the background, two instances of the same client, or another network tool using port 7890. Do not keep changing ports without checking; first identify the process using it. On Windows, run the following command in Command Prompt:

netstat -ano | findstr :7890
tasklist /fi "PID eq process ID"

On macOS and Linux, use:

lsof -nP -iTCP:7890 -sTCP:LISTEN
lsof -nP -iUDP:7890

After confirming that it is an old instance, exit the process normally and restart the current client. If another required program is using the port, open “Settings” → “Port Settings” and change Mixed Port to 7891 or another available port. Then refresh the system proxy so that it points to the new port. When editing YAML manually, the corresponding setting can be written as:

mixed-port: 7891
allow-lan: false
mode: rule
log-level: info

allow-lan: false means that the client does not provide a proxy entry point to LAN devices. If you need a phone to use the computer’s proxy, enable LAN access and configure the operating system firewall and trusted network scope; do not simply change the listening port.

Question 9: What to Do When Webpages Load but DNS Is Slow or Unreliable

The DNS module in Clash or mihomo coordinates domain resolution between rule matching and connection establishment. Common enhanced modes include fake-ip and redir-host. fake-ip first returns a reserved-address mapping, then the core restores the original domain, which improves rule-matching efficiency and is better suited to TUN routing. Some LAN devices, enterprise software, or applications that depend on real IP addresses may need to be added to fake-ip-filter.

Do not pile on large numbers of DNS servers before confirming the source of the problem. Start with two stable resolvers and watch the logs for timeouts. A basic structure looks like this; the actual configuration should still follow the requirements of the current client and subscription:

dns:
  enable: true
  ipv6: false
  enhanced-mode: fake-ip
  nameserver:
    - https://dns.alidns.com/dns-query
    - https://doh.pub/dns-query
  fake-ip-filter:
    - "*.lan"
    - "localhost.ptlogin2.qq.com"
    - "+.stun.*.*"

After changing the configuration, use “Profiles” → “Reload,” then clear the application’s own cache and test again. On Windows, run ipconfig /flushdns to clear the system DNS cache. On macOS, quit and reopen the target application. If the client logs continue to show DNS timeouts, first test whether the current network can reach the configured resolvers instead of adding more fallback servers.

6. Profile Updates, Automatic Selection, and Recovery

Question 10: Which Settings Should You Keep After the First Week?

Keep a minimal reproducible setup first: one valid subscription, one active profile, Rule mode, one confirmed working node, the correct local port, and one clearly chosen traffic-entry method—system proxy or TUN. Do not enable multiple auto-selection scripts, remote rule overrides, and experimental DNS options at the same time. Once the basic path is stable, add automatic updates, latency tests, and rule providers.

The automatic subscription-update interval should not be too short. Node information usually does not need refreshing every minute; 6, 12, or 24 hours is easier to monitor. After the client wakes and the network returns, manually update the profile once. If the update fails, do not immediately delete the currently working profile, because the old profile may still keep the connection alive. Check the HTTP status code in the logs before deciding whether to obtain a new subscription URL.

Six Details Worth Recording

• Client name, version, and system architecture, such as Windows 11 x64.
• Core name and version, such as mihomo 1.19.x.
• Current mode: Rule, Global, or Direct.
• Traffic entry point: system proxy, TUN, or a manual in-app proxy.
• Actual Mixed Port value, such as 7890 or 7891.
• The time of the failure, the log error line, and the matched policy group.

These six details are more useful than saying “it does not connect.” For example: Windows 11 x64, mihomo 1.19.x, Rule mode, system proxy, mixed-port 7890, and a browser connection matching Proxy while the log shows connection timeout. With this information, you can narrow the issue directly to the node path instead of repeatedly reinstalling the client.

A Fixed Five-Minute Troubleshooting Sequence

1. Check the core: confirm its running state and make sure the logs show no profile-loading failure.
2. Check the entry point: confirm the system proxy port or TUN status.
3. Check connections: refresh the target application and see whether Connections shows a record.
4. Check rules: confirm the matched rule, policy group, and final node.
5. Check the exit path: switch to another node and compare Global mode with Rule mode.

If Direct works but Rule fails, and Connections shows that requests entered the wrong policy group, correct the rule or policy-group selection. If both Direct and proxy access fail, return to the local network and DNS. If the browser has connection records but the target application has none, check whether the application reads the system proxy and decide whether to use TUN. Troubleshooting by entry point, rules, and exit path preserves more useful clues than deleting the profile and reinstalling.