Clash FAQ

Clash usually refers to the proxy engine and its configuration ecosystem. mihomo is an engine that evolved from Clash Meta, handling protocol connections, rule matching, and traffic forwarding. Mac GUI clients add a menu bar, subscription management, and system proxy controls around the engine. Even when two clients both use mihomo, their settings, helper services, and engine update schedules may differ. When troubleshooting, note the client name and version as well as the engine version—“Clash” alone isn’t specific enough. Whether an older config will still work depends on its individual fields; similar-looking interfaces don’t guarantee identical feature support.

A client provides tools for running a configuration; installing it doesn’t automatically give you a working remote proxy. A subscription from a service provider typically supplies nodes, proxy groups, and rules. You can also import a local config you maintain yourself. Before importing, make sure it’s compatible with Clash or mihomo, and check its expiry and device limits. A subscription URL may contain account credentials, so treat it like a password—never post it on public forums, include it in screenshots, or paste it into online converters. If you don’t have a config yet, you can finish installing the client first. Repeatedly turning on the system proxy won’t supply missing connection details.

For everyday use, start with Rule mode, which routes traffic according to the rules in your config. Global mode sends connections to the global proxy group, but you still need to select a working outbound in that group—and it doesn’t guarantee that every app’s traffic will be captured. Direct mode sends captured connections straight to their destinations; it doesn’t turn off the system proxy or quit the client. If one site behaves unexpectedly, briefly switch modes to compare, then return to Rule mode and identify the matching rule. Capturing an app’s traffic and choosing its outbound are separate tasks: capture depends on an entry point such as the system proxy, app settings, or TUN.

A standard HTTPS connection is encrypted between the app and the destination website; ordinary proxy forwarding doesn’t require installing a root certificate. A proxy provider may still see metadata such as connection times, destination addresses, and traffic volume, so review how the provider handles data. If a tool asks you to install a certificate and enable HTTPS decryption, assess its purpose and scope of trust separately. Client logs may also include domains, connection errors, and config paths. Before sharing diagnostics, redact subscription URLs, credentials, and personal information. Using a proxy doesn’t make all activity untraceable.

Open About This Mac from the Apple menu. If it shows an Apple M-series chip, choose the arm64 or Apple silicon build; if it shows an Intel processor, choose the x64 or x86_64 build. If a Universal build is available, follow the client’s installation instructions. Apple silicon Macs may need Rosetta to run an Intel build, but choosing the native architecture avoids an extra compatibility layer. Also check the client’s minimum macOS version: matching the architecture doesn’t guarantee your OS is supported. See the installer page for the exact download options; don’t rely on your MacBook’s appearance or purchase year.

First, identify the exact warning and check the installer’s source, CPU architecture, and system requirements. Move the app to Applications and try opening it. If macOS blocks it, check System Settings > Privacy & Security for an Open Anyway option, and use it only if you’ve verified the app’s source. A “damaged” warning can also mean an incomplete download, a signing issue, or an incompatible version; download it again and check the release notes. Don’t disable macOS security globally or paste commands from an unknown source just to launch an app. If macOS warns that the app contains malware, stop and verify its source.

In the client’s Subscription or Config page, choose Import from URL, paste the full address from your provider, and save. Wait for the download and parsing to finish. Then explicitly select that config as the active one. Check that its proxy groups appear on the Proxies page, and choose an outbound in any group that requires manual selection. Seeing a subscription entry in the list only confirms that it was saved—not that it downloaded successfully or is active. If import fails, check the HTTP status and parsing error to distinguish an unreachable URL from an incompatible format. Don’t use your account login page URL as a subscription URL; import local files through the file import option.

TUN creates a virtual network interface and adjusts routes. Mac clients typically use a privileged helper service for these operations, so macOS may prompt for administrator authorization. Follow the client’s settings to install or repair the helper, then enable TUN and check the engine logs for successful interface creation. Canceling the prompt, a stopped helper, or a version mismatch between the helper and client can cause the toggle to switch off immediately. Try temporarily closing other VPNs or tunnel tools, but don’t delete system network settings indiscriminately. If your organization manages the device and you don’t have permission, contact your administrator. For apps that support it, the system proxy can be a temporary alternative.

Make sure the engine is running, the active config is valid, and the system proxy address and port match the values the client is actually listening on. Then open Network in System Settings and check the proxy settings for the Wi-Fi or Ethernet service currently in use; settings for a previous network service may not apply after you switch networks. Browser extensions, in-app proxy settings, and other VPNs can also change the connection route. Open the client’s Connections page, refresh a test site, and check whether a connection appears and which outbound it uses. If no connection appears, check how traffic is being captured. If it appears but uses Direct, review the rules and bypass list rather than repeatedly toggling the system proxy.

Many command-line tools don’t read the macOS system proxy; they use their own settings or proxy environment variables. Check the client’s actual HTTP or mixed-port listener, then configure each tool according to its documentation—for example, pass a proxy option to curl for a single command or set Git’s own proxy options. Consider TUN if you need to capture more apps that ignore the system proxy. Check for stale HTTP_PROXY, HTTPS_PROXY, and ALL_PROXY variables that may still point to a closed client or old port. After changing variables, make sure the current Terminal session has picked up the changes. Avoid changing several proxy entry points at once, or it’ll be hard to tell what fixed the issue.

Find the request on the Connections page and check its actual domain, matched rule, and final outbound. Rules are generally evaluated in order, so a broad rule earlier in the list may take precedence over a more specific one later. A proxy group may also refer to another group, so follow the group chain to find the final selection. To change the route for a single domain, prefer the client’s override or rule extension feature and follow its instructions for rule insertion order. Direct edits to a downloaded subscription file may be overwritten the next time it updates. Make sure the rule refers to an existing proxy group. After editing, reload the config and start a new connection; existing connections usually won’t switch immediately.

This is a Windows app container issue, not a macOS permissions setting. Some UWP apps running in app containers can’t access the local loopback address by default. Desktop proxies usually listen locally, so a working browser doesn’t mean those apps can connect too. Try the loopback exemption tool provided by your Windows client, allow the relevant apps to access the local proxy, and follow any administrator authorization prompts. If supported, you can also consider using TUN to capture traffic, but check the app’s own behavior and other firewall restrictions. Don’t look for a similarly named setting on your Mac, or work around the issue by leaving the entire firewall disabled.

First, check your provider account for the subscription’s expiry, traffic status, and whether its URL has been reset. A 401 usually indicates an authentication issue; a 403 may reflect access rules or account restrictions; and a 404 may mean the link has changed. Check your provider’s guidance for the specific cause. If the client receives a login or verification page instead of a config, parsing will fail. Confirm the full URL before updating, then try the client’s direct or proxied download option so subscription access doesn’t depend on a connection that has already stopped working. Keep your existing working config; don’t clear all subscriptions first. When contacting your provider, include the status code and time, but never share the full URL publicly.

Turn off the proxy first and confirm your basic internet connection works. Then determine whether the issue affects one outbound or all of them. If only one times out, try another outbound in the same group and check whether that service is undergoing maintenance. If all time out, check the subscription status, system clock, whether the engine supports the configured protocol, and logs for DNS, handshake, or authentication errors. A connectivity test can also time out because its test address is unavailable or its timeout threshold is too short. Don’t conclude that a node is down based on the test alone; check whether real websites load. If switching networks fixes the issue, the network path may be a factor. Change one thing at a time and record the result.

Check the logs for DNS resolution failures, DNS request timeouts, or routing loops. Then verify that the configured DNS servers, TUN DNS hijacking, and routing settings work together. Browser Secure DNS, other VPNs, and custom system DNS settings can send apps through different resolution paths. macOS diagnostic tools and apps don’t always use the same path, so one command’s result may not reflect every app. If you use fake-ip, make sure those addresses are being captured correctly, and add exceptions for incompatible local network services as described in your config. Compare against a known-working config first; don’t change DNS, rules, and every node at the same time.

If the client still opens, turn off the system proxy and TUN before quitting normally, then check whether the connection recovers. If the app has already crashed, open Network in System Settings, select the active network service, and check its proxy settings under Details for any leftover address pointing to your Mac. Disable entries you’ve confirmed belong to the client, then apply the changes. Also check other VPNs, proxy environment variables in Terminal, and any DNS settings you added manually. On managed devices, a proxy may be set by your organization and shouldn’t be removed. If TUN routes or the helper service weren’t cleaned up properly, save your work and restart your Mac, then test your basic connection without the proxy.