10 Clash Questions for Beginners: Importing Subscriptions, Rule vs. Global Mode, and Connected but No Internet

1. What are a Clash client, core, and subscription?

The client provides the interface, the core handles connections, and the subscription supplies proxies or configuration. Installing a client only prepares the software environment; it doesn't provide proxy service. Understanding these three parts makes it easier to pinpoint problems later.

• GUI client: For example, Clash Verge Rev provides an interface for managing subscriptions, choosing policies, viewing logs, and toggling the system proxy.
• Core: For example, mihomo, also known as the Clash Meta core, handles protocol connections, rule matching, DNS, TUN, and other processing.
• Subscription: A URL provided by a service provider or someone who manages their own service. It may return a complete YAML configuration or just a list of proxies.

Clients that use the Clash name may not support the same fields or protocols. If a configuration fails to parse, note the client and core names and versions, then check the configuration requirements. Don't assume configurations are interchangeable just because both clients are called Clash.

2. Where do I get a subscription, and can I share its link?

Get your subscription URL from a service you’re authorized to use or from a configuration service you manage. The Clash client doesn't provide subscriptions; the download page and subscription management page are separate destinations.

1. Open the subscription section of your service dashboard and look for a configuration option specifically labeled Clash, Clash Meta, or mihomo.
2. Copy the entire subscription URL, including its query parameters. It may contain a token that identifies your account.
3. Check your plan status, expiration date, and remaining data before importing the subscription.

If opening a subscription URL in a browser shows a long block of text, that isn't necessarily an error; some links return the configuration directly. If it returns a login or CAPTCHA page, or 401 Unauthorized or 403 Forbidden, check your access and server-side restrictions instead of repeatedly changing local ports.

3. How do I import a subscription, and why does it say the format is invalid?

Check the subscription format before importing and activating it. In Clash Verge Rev, for example, open Subscriptions in the sidebar, paste the URL into the subscription field, and import it. Then select the subscription to make it the active configuration. Button labels may vary by version, but downloading a configuration and enabling it are separate steps.

What to check after the first import

1. After importing, check for an updated timestamp or success message; don't rely only on seeing a subscription card.
2. Open Proxies and confirm that policy groups and proxy names are visible.
3. Choose an available proxy, enable System Proxy, and test in a browser.
4. If the client reports a configuration error, check the logs for the specific field and line number.

A complete Clash YAML configuration often includes proxies, proxy-groups, and rules. It can also use proxy-providers to load proxies. A single ss:// or vmess:// link, a Base64-encoded list, and a complete configuration are different things. Whether you can import them directly depends on the client's import support.

If you see yaml: unmarshal errors, first make sure you received YAML rather than an HTML page. Then check indentation, field types, and core compatibility. YAML uses spaces for indentation; don't use tabs. If you need to convert formats, use the matching option from your service provider whenever possible. Avoid sending subscription credentials to unknown services.

4. When should I use Rule, Global, or Direct mode?

Use Rule mode for everyday traffic. Global mode is for targeted testing, not a universal fix. The mode determines how connections already reaching the core are routed; it doesn't determine whether an app's traffic reaches the core in the first place.

Rules are generally evaluated in order, and the fallback MATCH rule should go last. This is only a rule snippet, not a complete runnable configuration. In a complete configuration, PROXY must be defined as an available policy group or proxy name.

mode: rule
rules:
  - DOMAIN-SUFFIX,example.com,DIRECT
  - GEOIP,CN,DIRECT
  - MATCH,PROXY

If a site works in Global mode but not Rule mode, check which rule and policy matched the connection. Don't immediately delete all your rules, and don't assume Global mode routes every app on your computer through the proxy.

5. What's the difference between System Proxy and TUN mode?

System Proxy works mainly with apps that follow the system proxy settings; TUN routes traffic that matches its routing rules through a virtual network interface. Start with System Proxy to test your browser, then decide whether you need TUN.

• System Proxy: Usually points the system's HTTP/HTTPS proxy settings to a local listening port. Browsers generally follow these settings, but some games, command-line tools, and apps with their own networking stack may not.
• TUN: Requires appropriate system permissions and routing settings. It can handle more connections that don't follow the system proxy, but enabling it doesn't guarantee that all traffic will use the proxy route.
• Mobile: Android clients generally route traffic through the system VPN interface. This isn't the same as the desktop System Proxy setting.

In Clash Verge Rev, first check that System Proxy is enabled, then enable TUN mode if needed. If the app asks you to install a service or grant permission, follow the requirements for your version. Other VPNs, virtual network adapters, and security software can cause routing or DNS conflicts. For testing, use only one traffic-capture method at a time.

TUN won't fix a dead proxy or turn an invalid subscription into a valid configuration. If enabling it cuts off your connection, turn TUN off and test with System Proxy, then check permissions, routes, and DNS logs. Don't change proxies, DNS, and TUN all at once, or it'll be difficult to tell what changed the result.

6. How do I choose a policy group, and why can a low-latency proxy still fail?

Check the policy group's available options before looking at latency results. A manual select group behaves differently from an automatic url-test group. With the former, you choose the route; with the latter, the client selects one based on its test settings.

Check these three things

1. Which policy group did the current site match, and is it the group you're viewing?
2. Does the group ultimately select a proxy, another policy group, DIRECT, or REJECT?
3. Record whether the proxy test succeeded and whether the actual website connection worked; they're separate results.

A displayed 80 ms only means that a particular test request got a response. It doesn't mean every site is reachable or indicate download speed. The test URL, request timeout, proxy exit, and restrictions at the destination site can all affect the result. A timeout also doesn't prove that a proxy is permanently dead; rule out local network and test URL issues too.

If just one site fails, keep the mode unchanged and switch to one other proxy for comparison. If every proxy fails, check your rules and DNS. If only one proxy fails, focus on that proxy or its exit route; there's no need to reinstall the client first.

7. Connected, but can't open websites? What should I check first?

“The core is running” doesn't mean “the browser request went through.” Check the traffic entry point, rules, proxy, and DNS in that order. This is usually more effective than repeatedly restarting the client.

1. Test a direct connection: Turn off System Proxy and TUN, then check that your regular internet connection works. If direct access fails too, troubleshoot Wi-Fi, your gateway, or the system network first.
2. Check the entry point: Turn System Proxy back on, then open a test page in one browser while checking Connections or Logs. If no new entry appears, check the browser's own proxy settings, proxy extensions, and the system proxy port.
3. Check the route: In the connection details, confirm the matched rule, policy group, and final proxy. If the connection matched REJECT by mistake, fix the rule rather than changing DNS.
4. Switch proxies: Keep the test URL the same, change just one proxy, and see whether the result changes.
5. Note the exact error: Record the destination address associated with connection refused, i/o timeout, or a name resolution failure. “It doesn't open” isn't enough detail to troubleshoot.

If your browser reports a certificate error, check the system date, time, and time zone first. Don't disable certificate verification. HTTPS inspection on corporate networks, certificates from traffic-capture tools, and name resolution errors should be investigated separately. See the Help Center for more troubleshooting steps.

8. How do DNS and Fake-IP relate to sites that won't load?

DNS resolves domain names, while proxy rules determine the route connections take. They affect each other, but one can't replace the other. In mihomo's fake-ip mode, domains are assigned virtual IPs, and the core maps connections back to their original domain names.

For example, if the configuration uses 198.18.0.1/16 as its Fake-IP address pool, seeing an address in that range doesn't necessarily indicate a problem. But an app may try to use a cached virtual IP after the client exits, or traffic may bypass the routing path, causing connections to fail despite successful DNS resolution.

• Look in the logs for messages such as DNS resolve failed or no such host, and identify the domain that failed.
• Check the browser's Secure DNS setting and any app's built-in DoH; these can change the expected DNS resolution path.
• Rule out other VPNs, encrypted system DNS, and local network DNS settings. Change one thing at a time.
• After changing DNS, retry the app and clear the relevant cache if needed. On Windows, run ipconfig /flushdns in Command Prompt, but note that your browser may have its own cache.

Don't blame every DNS problem on Fake-IP, and don't copy an entire DNS configuration from an unknown source. First check the subscription's existing dns settings and any client overrides, then make changes one at a time using the Advanced Configuration guide.

9. What are ports 7890 and 7897, and how do I fix a conflict?

A port is an entry point for a service on your device, not a proxy route number. Configurations may use 7890 or 7897, but there isn't one standard port shared by every Clash client. Use the value shown in the active configuration and client settings.

mixed-port: 7890
allow-lan: false

mixed-port provides a shared listening port for HTTP and SOCKS. This example only explains the field; it doesn't include proxies, policy groups, or rules. If another program is already using 7890, the logs may show bind: address already in use. Stop the other program or change the listening port to an unused value, then update your system proxy and app proxy settings to match.

Test the local proxy explicitly

If the HTTP proxy is actually listening at 127.0.0.1:7890, you can test it with the command below. On Windows, use curl.exe to avoid PowerShell interpreting curl as a different command. On macOS and Linux, use curl.

curl.exe -I --proxy http://127.0.0.1:7890 --connect-timeout 10 https://example.com

If the connection to the local port fails immediately, check that the port is listening and the configured value is correct. If the request appears in the logs and then times out, troubleshoot the connection beyond the local port. Don't enable allow-lan: true just to fix your local browser. Sharing with devices on your LAN requires separate configuration for the listen address, firewall, access controls, and authentication.

10. Will subscription updates overwrite my changes, and what should I do before quitting?

Direct edits to a downloaded subscription configuration may be lost the next time it updates. For rules, DNS, or port changes you need to keep, use an override, merge, or script mechanism supported by your client, then verify the final generated configuration.

• Before making changes: Note the client and core versions, and back up your local rules, overrides, and any settings you need. Backups may also contain subscription credentials, so store them securely.
• After updating: Confirm the configuration is still selected, your policy group choices are intact, and your new rules are actually being matched. Don't just check the subscription's update timestamp.
• When switching clients: Check your ports, System Proxy, TUN, DNS, and startup settings again. Don't copy the old app's entire data directory.
• Before quitting: Turn off System Proxy, then exit normally. If you're using TUN, make sure traffic capture has stopped. If your browser loses its connection after an unexpected exit, check for a proxy setting still pointing to your local device.

On Windows 11, check the manual proxy settings under Settings → Network & internet → Proxy. On macOS, check System Settings → Network → select your current network service → Details → Proxies. Disable a setting only if you've confirmed it was left behind by a client that's no longer running. Don't remove a proxy managed by your workplace.

For your first setup, get one path working: import a valid subscription, activate it, choose a proxy, enable System Proxy, and test in a browser. Once that's stable, move on to TUN, custom rules, and DNS. For the full walkthrough, see Importing a Subscription and Basic Setup. Look up configuration fields in the Glossary.