10 Clash Questions for Beginners: Importing Subscriptions, Proxy Modes, Ports, and Startup

1. What do the client, core, and subscription each do?

The client provides the interface, the core handles connections and rules, and the subscription supplies configuration data. Installing a client does not mean you have usable nodes. Before you begin, check three things: the client can start the core, the core can parse the configuration, and the nodes in it are still active.

Client: Imports configurations, switches policies, sets the system proxy, and displays logs. Menu labels and how settings are saved vary between clients.
Core: Reads YAML, listens on local ports, and handles DNS, rule matching, and proxy protocols. Clash Meta continued development under the name mihomo, so not every Clash client should be assumed to use the same core.
Subscription: Usually a URL with access credentials that returns a full configuration or a set of nodes. Its format must match the import method.

When choosing a client, first check your operating system and processor architecture. Then confirm that its core supports the protocols and fields used by your subscription. If you see “unknown proxy type,” changing ports repeatedly is unlikely to help; check protocol support first. Find platform downloads on the client downloads page, and see the client selection guide for an overview of the differences.

2. How do you know a subscription imported successfully?

Importing, activating, and verifying are three separate steps. Seeing a configuration name in the list only means the client saved an entry. Make sure the downloaded content is valid, then select it as the active configuration.

Copy a subscription link for Clash or mihomo from your provider. Don’t use the URL of an account dashboard page.
Look for a URL import option on the client’s “Config” or “Profiles” page. Menu names vary by client, so follow the interface you’re using.
After importing, check the update time and any error messages. Select the configuration and make sure the core parsed it without errors.
Open the proxy policy page, select a node, then enable the system proxy and make a real request in your browser.

Some links return only a set of nodes. Use them with a compatible proxy-providers configuration; they cannot be imported directly as a complete Profile. Don’t submit a private subscription to an untrusted online service just to convert its format. Use a format supported by your provider whenever possible.

3. Is a Profile just a list of nodes? Will local edits stick?

A Profile is a switchable configuration, not necessarily just a list of nodes. A full configuration may also include listening ports, DNS, policy groups, and routing rules. Updates to a remote Profile can overwrite edits made directly to the downloaded file. Use the client’s persistent overrides, merges, or patches to keep personal settings.

The following is a configuration snippet, not a complete subscription you can import on its own. It shows that ports, mode, and logging are separate fields. Edit the relevant fields in your existing configuration; don’t add duplicate keys at the end of the file.

mixed-port: 7890
allow-lan: false
mode: rule
log-level: info

mixed-port: 7890: Accepts HTTP proxy and SOCKS proxy connections on the same port. Use the value from the configuration the client actually applies.
allow-lan: false: Keeps proxy access unavailable to devices on your local network—a sensible starting point for local use only.
mode: rule: Routes traffic according to rules; it does not automatically pick the fastest node.
log-level: info: Keeps routine runtime information. There’s no need to leave more verbose debug logging enabled after troubleshooting.

Name configurations by purpose, such as “Daily subscription” and “Temporary test.” After switching, check the active configuration name and selected policy group. Before copying a local configuration, check whether it contains node passwords. Keep backups secure, too.

4. Which should you use: Rule, Global, or Direct mode?

Use Rule mode for everyday use, Global mode briefly to isolate routing issues, and Direct mode when traffic must bypass the proxy. The mode changes how connections are routed; it won’t fix an incorrect password, an inactive node, or an unreachable proxy server.

Mode	What it does	What to check
`rule`	Matches outbound policies in rule order	The matching rule and the policy group’s current selection
`global`	Uses the global policy for ordinary connections	The currently selected `GLOBAL` outbound
`direct`	Routes ordinary connections directly	Whether the target is reachable directly from your local network

This rule snippet demonstrates matching order only. It assumes an existing proxy-groups section defines a policy group named “Proxy.” example.com is a placeholder domain for illustrating rule syntax, not a connectivity test target.

mode: rule
rules:
  - DOMAIN-SUFFIX,example.com,DIRECT
  - MATCH,Proxy

Rules are generally evaluated from top to bottom, with MATCH at the end catching connections that didn’t match earlier rules. Put the catch-all rule first and the rules below it won’t take effect. Another common misconception is that Rule mode sends everything through a proxy: a rule can select DIRECT, and a policy group may itself be set to direct.

5. Why don’t terminal apps use the proxy when the system proxy is on?

The system proxy doesn’t force all network traffic through a proxy. It provides a proxy address to apps that honor system settings. Some command-line tools, games, and apps with their own networking stacks won’t use it automatically. Browser extensions and custom settings can also override the system proxy.

Use an explicit proxy to distinguish core issues from app settings

Assuming the active mixed port is 7890, you can make a request in Windows PowerShell with the built-in curl.exe. Specifying the executable avoids environments where curl is interpreted as a different command.

curl.exe --proxy http://127.0.0.1:7890 --connect-timeout 10 --max-time 20 https://example.com/

This command checks the proxy request path through the specified port. It connects to an example site and can’t, by itself, confirm your exit region or access to every website. If an explicit proxy works but a tool’s normal request doesn’t, check the tool’s own proxy settings before changing your subscription.

Set environment variables for the current terminal only, if needed

$env:http_proxy = "http://127.0.0.1:7890"
$env:https_proxy = "http://127.0.0.1:7890"

These PowerShell settings apply only to the current process and any child processes started afterward, and the tool must support the variables. The https_proxy value uses http:// to specify the local HTTP proxy protocol; it does not mean the destination HTTPS site will use plaintext. To clear the variables, run Remove-Item Env:http_proxy, Env:https_proxy -ErrorAction SilentlyContinue.

6. Port 7890 is already in use. What should you change?

Identify the process using the port before deciding whether to close a duplicate process or change the listening port. A log entry like address already in use usually means the core couldn’t bind to the specified address and port. It doesn’t mean a remote node timed out.

On Windows, find local listening ports and their process IDs:

Get-NetTCPConnection -LocalPort 7890 -State Listen |
  Select-Object LocalAddress, LocalPort, OwningProcess

Once you have the OwningProcess number, check the PID under “Details” in Task Manager, or look it up with Get-Process -Id followed by the number. Don’t terminate an unknown process based on its port alone. Common culprits include another proxy client or a leftover core process from the same client.

If another client is using the port, close the one you don’t need normally, then restart the active core.
To use a different port, change the active mixed-port from 7890 to an available port, such as 7891.
Update the system proxy, terminal environment variables, and any app-specific proxy settings so they don’t keep pointing to the old port.

A client may override the port in YAML through its interface. After changing it, confirm the effective value in the runtime log or listening-port list. The proxy listening port is not the same as the controller port: external-controller is for the management API and does not belong in a browser’s proxy port field.

7. Do timed-out nodes mean the subscription has expired?

Not necessarily. A timeout only means a particular test didn’t finish within the allotted time. The test URL, DNS, local network, node protocol, and server status can all affect the result. A latency test isn’t a bandwidth test, and a lower latency doesn’t guarantee faster downloads.

All nodes time out: Check your local connection, whether the subscription updated successfully, and whether the core is running. Then check whether your provider is experiencing a wider outage.
Only one node times out: Compare it with other nodes from the same subscription. First check that node’s address, port, and server status.
The test fails but websites work: Check whether the latency test target is reachable through that node. A failed probe to one address doesn’t mean all connections are failing.
The test succeeds but websites won’t load: Check which rule, policy group, and node the website request actually uses. The node selected for testing may not be the outbound used for the website.

When troubleshooting, keep four details: the time it happened, the target domain, the error type, and the selected policy. connection refused usually means the connection was rejected; i/o timeout means a related read or write operation timed out. Neither message alone proves that an account has expired.

8. Should you enable DNS and TUN mode right away?

Verify a standard proxy connection first, then add TUN if your apps need it. Check DNS alongside the traffic interception method. TUN uses a virtual network interface to capture traffic, which can help with apps that ignore the system proxy. Its coverage depends on the operating system, routes, and exclusions; enabling it doesn’t mean all traffic will exit through a proxy node.

Start with the symptoms when troubleshooting DNS

If the log reports a domain resolution failure, determine whether it’s the node server’s domain or the destination website’s domain. The former may prevent the proxy connection from being established at all; the latter concerns how the destination request is resolved. Don’t replace your existing setup with a full DNS configuration copied from elsewhere—you could change the DNS servers, resolution mode, and routing behavior all at once.

Check these three things before enabling TUN

Make sure the core and client support TUN on your operating system and have the required permissions. Some desktop clients need service mode or administrator approval.
Confirm that a standard explicit proxy request works, so you don’t troubleshoot an invalid node and a virtual network adapter at the same time.
Make sure no other VPN, virtual network adapter, or proxy tool is also taking over the default route. After enabling TUN, check the connection logs and confirm the system network still works.

9. Why do I still have to connect manually after enabling startup?

Starting the client after login, starting the core, restoring a configuration, and enabling the proxy are separate steps. Some clients restore only the window or tray process and don’t re-enable the system proxy. Service mode also doesn’t necessarily launch the graphical interface when a user signs in.

On Windows 11, check the client’s startup entry under “Settings” → “Apps” → “Startup,” or view its status under “Task Manager” → “Startup apps.” Whether the client also has options like “Start core” or “Restore previous state” depends on the product. Don’t assume another client’s menu path applies.

After restarting and signing in, check that the client is running in the system tray and that the core is active.
Confirm the expected Profile is still active and that each policy group has restored the right node.
Check that the system proxy points to a port that’s listening, not an old value from before you changed it.
If you rely on TUN, also confirm that its service permissions and virtual network adapter are ready.

Test with a full restart, not just by closing and reopening the window. If the network comes up later than the login process, a failed subscription update on startup doesn’t necessarily mean you need to reinstall. Update it manually once you’re online and check the logs to narrow down the cause.

10. How should you manage Clash in the first week and recover from problems?

Keep a working configuration, change one category of settings at a time, and retest with the same request. Changing DNS, mode, TUN, and nodes all at once removes your basis for comparison. Even if the connection comes back, you won’t know which change fixed it.

Record a baseline: Note the client name, core version, active Profile, listening port, and proxy mode. Find the version in the client’s About page or core information; don’t rely on the installer’s filename.
Manage updates: Set the subscription update interval recommended by your provider. If an update fails, check your network and the response content first instead of retrying repeatedly.
Make changes step by step: Change the node, then retest the same request. If you need to adjust a rule, change just one and confirm in the connection log that it matches.
Keep a recovery option: Back up the configuration before editing it. After switching back to a working Profile, check whether the client is still applying global overrides.
Exit cleanly: Turn off the system proxy before quitting the client. If you use TUN, make sure traffic interception has stopped too, so apps don’t keep trying to connect to a local port that’s no longer listening.

If your browser can’t connect after you quit, check the manual proxy under “Settings” → “Network & Internet” → “Proxy” on Windows 11. On macOS, check “System Settings” → “Network” → your current network service → “Details” → “Proxies.” Don’t change managed settings on a device controlled by your organization. If command-line tools still have problems, check for leftover proxy environment variables in the terminal.

The first-week checklist is straightforward: the configuration activates, an explicit proxy request succeeds, apps use the intended route, settings are restored after a restart, and direct internet access works after quitting. For a field-by-field YAML reference, see Config Basics. For installation and import steps, see Getting Started.