Clash FAQ — Troubleshooting Installation, Connection, and Subscription Issues

Go to "System Settings → Privacy & Security," find the blocked app near the bottom, and click "Open Anyway." This is macOS's standard warning for apps not signed through the App Store — Clash-related clients are all open source, and this message doesn't mean the software is unsafe.

Some security software misidentifies the virtual network adapter driver or an unsigned .exe as a risk. Add the Clash client's install directory to your security software's trusted list or allowlist, then reinstall. If it's still blocked, you can temporarily disable real-time protection to finish the install, then turn it back on afterward.

First, make sure the installer matches your system architecture (e.g. Apple Silicon needs the arm64 build, not Intel). Next, check whether an instance is already running in the background (find and end the process in Task Manager / Activity Monitor, then reopen). If the log mentions a port already in use, change the listening port in your config file.

Yes, it's safe to install. This is Google Play Protect's default warning for APKs not sourced from the Play Store, and it has nothing to do with whether the software itself is safe. Once you've confirmed the download source is trustworthy, tap "Install anyway." You can keep Play Protect enabled afterward for routine scanning.

This is usually because the binary lacks execute permission — run chmod +x ./mihomo to fix it and try again. If the error is about binding to a port below 1024 (like 80/443), you'll need to run it with sudo, or change the port in your config to something above 1024.

First, check whether the current node is working: run a latency test in the proxy group, and switch nodes if it times out or fails. Next, confirm that system proxy or TUN mode is actually turned on. Finally, check whether your firewall or security software is blocking Clash's network requests.

A timeout usually means the node is currently unavailable, or the test URL itself is being blocked. Try switching the latency test URL first (Google's test endpoints are unreliable in some regions), or switch to a different node. If every node times out, check whether your subscription has expired or whether your own network connection is working.

This is normal behavior for rule-based routing — different domains can be matched to different actions (proxy / direct / block). If a site fails to load under a direct-connect rule, add a separate proxy rule for that domain in your rules list, placed before the catch-all rule.

First, run a latency test across multiple nodes in the proxy group and pick a faster, more stable one. Make sure you're not accidentally running unnecessary multi-hop proxies or global mode at the same time. If you're using TUN mode, try switching the network stack (gVisor / System) to see if it makes a noticeable difference.

TUN mode needs to create a virtual network adapter, which usually requires admin/root privileges on desktop, or a system-authorized network extension. On mobile, you'll see a VPN authorization prompt that needs manual approval. If you still can't get online after enabling it, switch back to system proxy mode to check whether the issue is TUN-specific.

System proxy mode is simple to set up and works with most browsers and everyday apps. TUN mode takes over almost all network traffic and offers better compatibility (useful for games and apps that ignore system proxy settings), but it's a bit more complex to configure. For everyday use, start with system proxy mode, and switch to TUN mode only if a specific app won't route through the proxy. See the TUN mode section of the advanced guide for a more detailed comparison.

First make sure the subscription URL was copied in full with no extra spaces. Then check whether your current network can reach that URL directly — if the subscription URL itself requires a proxy to access, connect to any working node first, then update the subscription, or try again on a different network.

Check whether the account tied to your subscription URL is still active and hasn't run out of data. Some subscriptions return encrypted content that requires client support for that specific format. You can also try opening the subscription URL directly in a browser to see if it returns valid content.

Common causes include an expired subscription or exhausted data allowance, temporary maintenance on the provider's nodes, a problem with your own network, or a blocked test URL causing a false reading. Try testing your own network in a browser first, then contact your proxy provider to confirm your account status.

Most clients let you set an auto-update interval, typically every 12–24 hours, to avoid connection failures from outdated node info. You can also trigger a manual update whenever nodes start behaving oddly.

Most clients let you add multiple subscription profiles, but usually only one profile can be active at a time as the current source of rules and nodes. If you need to merge nodes from multiple subscriptions, use a client that supports "subscription merging" or a Proxy Provider feature.

Check whether the rule is positioned after another rule that's already catching the same traffic — rules match top to bottom and stop at the first hit. Also confirm the client has actually reloaded the updated config file (some clients need you to manually click "Reload Config" or restart for changes to apply).

On desktop (Windows/macOS/Linux) you can use a PROCESS-NAME rule to match by process name, e.g. PROCESS-NAME,chrome.exe,PROXY. Mobile platforms generally don't support process-level rules, so you'll need to achieve this indirectly with domain or IP rules.

Most clients support hot reload — just click "Reload" in the settings or config page, no need to restart the whole client. If nothing changes after reloading, try a full restart to troubleshoot further. For field definitions, check the Config Docs Center.

A node is the most basic connection unit. A proxy group bundles several nodes together with a selection method (manual / auto latency test / failover, etc.). A rule decides which proxy group handles a given type of traffic. Together, these three layers form the complete routing logic — see the config file structure guide for details.

We don't recommend it. A subscription link is usually tied to your account identity and data allowance, so sharing it means sharing your data usage and risking exposure of your account info. It's best to use it only across your own devices.

The Clash client and mihomo core are open source, with publicly auditable code, and don't upload user data on their own. That said, your traffic ultimately passes through whichever proxy node you choose — the privacy policy of that node's provider is what really determines whether your data gets logged, so choose a trustworthy proxy provider.

Clash itself is just a general-purpose network routing tool — it doesn't provide or bundle any proxy node resources. Users are responsible for understanding and complying with the laws and regulations of their region, and should use it only for lawful purposes.