Clash FAQ and Diagnostic Checklist

First, open the subscription URL in a browser and make sure it is reachable. Check that copying it did not add spaces, line breaks, or extra punctuation. Then verify whether the client expects a subscription URL, a YAML configuration, or a single-node URI. If the URL returns a login page, error page, or ordinary webpage, parsing will fail; request a Clash- or Mihomo-compatible subscription format from the provider.

First determine whether the URL has expired, the network request failed, or the configuration could not be parsed. Check the subscription expiry, access permissions, and system clock, then review the update log for the HTTP status or parser message. If the old configuration still works, keep it rather than deleting it immediately. Replace it only after confirming the new URL, and check whether policy-group names have changed.

YAML is sensitive to indentation, colons, and list markers. Start with the line number in the log, then check for mixed tabs, missing spaces after keys, and special characters that were not escaped correctly. If the error comes from a manual override, disable the override and load the original subscription first. Once the original loads, restore changes section by section to identify the offending entry.

TUN creates a virtual network interface and changes system routes, so it requires more privileges than a standard system proxy. On Windows, restart the client as an administrator and confirm that its service component is installed. On macOS, approve the network extension or helper service. On Linux, check root privileges, CAP_NET_ADMIN, the TUN device, and firewall rules. Fully quit and restart the client after making changes.

First make sure the client is running and that no other program has taken its local listening port. Then verify the proxy address and port in the system network settings. Some browsers use their own proxy settings, and some apps ignore the system proxy completely. Test first with a browser that follows system proxy settings; if only one app is affected, check its in-app proxy settings, TUN mode, or network restrictions.

Global mode affects only connections that reach Clash listening ports or fall within TUN capture scope; it does not automatically capture every connection on the system. Apps that ignore system proxy settings, standalone VPNs, LAN traffic, and some system services may bypass the client. Confirm the traffic entry point first, then check the node selected by the global policy group rather than relying on the mode label alone.

Rules are matched from top to bottom, and later entries are usually skipped after a match. Place custom rules before broad rules that could match first, and point them to a policy group that actually exists in the configuration. When using client overrides, also confirm that the override runs after the subscription update. After saving, inspect the generated configuration and connection logs instead of only the original text in the editor.

First confirm that the current configuration actually references the relevant rule set or database. Then check the download path, update time, and loading log. Updated files usually require a configuration reload or core restart, and existing connections may continue using their previous match results. For DNS rule problems, clear system and browser caches and confirm that Clash is handling the domain lookup requests.

Switch to other nodes in the same subscription to determine whether only one endpoint is affected. Then check the node address, port, protocol parameters, TLS server name, and system clock. A failed latency test does not necessarily mean the actual connection fails; use connection logs and real access results together. If timeouts occur only on a particular network, test UDP, IPv6, or DNS conditions on another network.

Switch to direct mode first to confirm that the underlying network works. Then check whether the subscription updates, the system clock is accurate, and the client port is available. Disable potentially conflicting VPNs, proxy tools, or security-software network modules, and review the core startup log. If the configuration will not load, fix it first. If it loads normally but every connection fails, test DNS, IPv4, IPv6, and other networks separately.

Some UWP apps are affected by local loopback restrictions and cannot directly reach a proxy port that Clash listens on locally. First confirm that a regular desktop browser can connect through the proxy. Then use the client’s UWP loopback tool or Windows CheckNetIsolation mechanism to allow loopback access for the target app. Fully close and restart the app, then check the connection log.

Changing networks can alter the gateway, DNS, interface index, and IP address, invalidating old connections and routes. Pause and re-enable the system proxy or TUN, and reload the configuration if needed. If connectivity does not return, restart the core and check whether the virtual adapter retained stale routes. If this happens often, update the client and core and avoid running multiple network-management tools that modify routes at the same time.