Ten Clash Questions for Beginners: Subscriptions, Proxy Modes, and Node Selection Explained

1. Why are there no usable nodes after installing Clash?

The Clash client reads configuration, applies proxy rules, and forwards connections. Installation packages usually do not include usable proxy nodes. If the proxy list is empty after first launch, or the interface says “No profile selected,” the installation usually worked; you simply have not imported a configuration file or subscription URL yet.

Where does the subscription URL come from?

A subscription URL is generated by your proxy service provider. It is usually available in the provider’s dashboard under “Subscription,” “One-click subscription,” or “Clash configuration.” The Clash project, the Clash Meta (mihomo) core, and graphical clients do not provide server accounts or generate connectable nodes automatically.

• Prefer a subscription format explicitly labeled Clash, Clash Meta, or YAML.
• When copying the link, make sure it starts with https:// so you do not mistake a webpage URL for a subscription URL.
• Subscription URLs usually contain access credentials. Do not post them in screenshots, forums, or public code repositories.
• If the provider changes domains or resets the subscription, the old URL may return 404, 403, or an empty configuration.

2. How do you import a subscription URL, and where are configuration files stored?

A common desktop path is “Profiles” → “New Profile” → “Import from URL.” Paste the subscription URL and download it. Some clients use “Configuration” → “New Configuration” → “Import from URL.” After importing, click the profile to make it active; downloading it without selecting it may leave the core using the old file.

URL imports vs. local YAML files

A minimal configuration needs at least a listening port, proxy definitions, proxy groups, and rules. Supported fields vary between cores, so do not treat JSON exported by another client as Clash YAML. The snippet below shows only a common structure; node parameters must come from your actual service configuration.

mixed-port: 7890
mode: rule
allow-lan: false
log-level: info

proxy-groups:
  - name: PROXY
    type: select
    proxies:
      - DIRECT

rules:
  - MATCH,PROXY

If importing produces a YAML parsing error, check indentation first. YAML generally uses spaces for nesting and does not allow Tabs as a substitute. Keep a space after each colon, and align list-item hyphens at the same level.

3. Which mode should you use: Rule, Global, or Direct?

Clash commonly offers three modes: Rule, Global, and Direct. For everyday use, beginners should start with Rule mode. It matches target domains or IP addresses against rules from top to bottom and sends each connection to the specified proxy group; if nothing matches, the final MATCH rule usually determines the route.

A quick way to troubleshoot

1. Start in Rule mode and visit the target site. Check the policy name shown in the connection list.
2. If it fails, temporarily switch to Global mode and choose a node that has passed a latency test.
3. If Global mode works, the node is probably usable; continue checking rule matching or DNS.
4. If Global mode also fails, check the node status, system time, firewall, and network environment.

4. Why does the browser still not work when the system proxy is enabled?

“Start the core” and “Enable system proxy” are separate actions. Once started, the core listens on a local port such as the mixed port 127.0.0.1:7890. The system proxy then directs applications that follow the operating system’s proxy settings to that port. If you start only the core without enabling the system proxy, the browser will usually connect directly.

Check these four places in order

1. Open “Settings” → “Core Settings” and confirm that the core is running.
2. Open “Settings” → “Parameters” and confirm that Mixed Port is 7890 and not reported as occupied.
3. Return to the home page, enable “System Proxy,” and check that the operating system proxy address is 127.0.0.1 with the same port.
4. Disable any standalone proxy extension in the browser so an old port in the extension does not override the system settings.

You can verify that the local port is listening from a terminal. On Windows, run netstat -ano | findstr :7890; on macOS or Linux, run lsof -iTCP:7890 -sTCP:LISTEN. No output means the core is not listening successfully. If the process is not the current Clash client, another application may be using the port.

Applications such as Firefox can use their own proxy settings. If an app is set to “No proxy” or manually configured with another port, it will not follow the system proxy. In that case, select “Use system proxy settings” in the browser’s network settings, or enter the HTTP/SOCKS address manually with the matching port.

5. How do you switch nodes, and what are proxy groups?

On the “Proxies” page, you will usually see several proxy groups rather than a simple node list. A proxy group is a policy entry referenced by rules, such as PROXY, Streaming, or Telegram. Inside each group, you can choose a specific node, an automatic testing group, or another proxy group.

Manual and automatic selection

• select: The user chooses a node manually, and the selection is usually retained after restarting.
• url-test: Tests latency against a fixed URL and automatically selects the node with the lowest current measurement.
• fallback: Checks nodes in list order and switches to the next one when the current node becomes unavailable.
• load-balance: Distributes connections across multiple nodes according to the core’s policy; services that require stable logins may not work well with a frequently changing exit.

When switching nodes, first find the proxy group actually used by the current rule. For example, if the rule is DOMAIN-SUFFIX,example.com,PROXY, change the PROXY group rather than a similarly named group that is not referenced. Open the “Connections” page and visit the target site once to see whether the policy chain shows PROXY / node name.

6. Does a lower latency always mean a faster node?

The latency shown by a client is usually the time required for one HTTP request from your device to a test URL. It indicates reachability and basic response speed, but does not fully represent download bandwidth, peak-hour congestion, packet loss, or the route quality between the target site and the exit server.

How to read common test results

• 50–120 ms: Interaction is usually responsive, but verify it with the sites you actually use.
• 120–250 ms: Normal webpages should work, though seeking in video and real-time communication may feel noticeably delayed.
• Over 500 ms: Congestion, routing detours, or packet loss may be present. Try another node and test again.
• Timeout: The test URL did not respond before the timeout. This does not necessarily mean every destination is unreachable, but it should be treated as a warning sign.

Repeated latency tests can also produce fluctuating results. A safer approach is to test twice 10–20 seconds apart, then verify with an actual download or video stream. For a distant node, a stable 150 ms connection with no packet loss may feel better than an 80 ms connection that constantly fluctuates.

7. What if the node connects but the website reports a DNS failure?

A successful node connection only means that a connection to the proxy server could be established; DNS resolution can still fail. Common signs include no such host in the logs, a browser message saying the server cannot be found, or an IP address that works while the domain does not. Check whether Clash DNS is enabled, whether the nameserver is reachable, and whether another DNS tool is also handling requests on the system.

Common DNS enhancement modes in Clash Meta include fake-ip and redir-host. Fake-IP first returns a mapped address to the application, while the core retains the domain information and applies rules. This is generally better suited to TUN and precise domain-based routing. If certain LAN devices, games, or special resolution flows are incompatible, exclude the relevant domains with fake-ip-filter.

dns:
  enable: true
  listen: 0.0.0.0:1053
  enhanced-mode: fake-ip
  nameserver:
    - 223.5.5.5
  fallback:
    - tls://1.1.1.1:853
  fake-ip-filter:
    - "*.lan"
    - "localhost.ptlogin2.qq.com"

8. What is the difference between system proxy and TUN mode?

A system proxy works well for applications that read HTTP or SOCKS proxy settings, including most browsers and desktop software. Some games, command-line programs, store apps, and UDP-based applications ignore the system proxy; that is when TUN mode may be useful. TUN creates a virtual network interface that lets the core handle a broader range of TCP and UDP traffic.

Beginners should establish a basic connection through the system proxy before enabling TUN. On Windows, the first activation may require installing a virtual network adapter service and granting administrator permissions. Android and iOS display a system VPN authorization prompt, and normally only one app can occupy the VPN interface at a time. If another VPN is running, Clash TUN or the mobile VPN service may fail to start.

9. Will a subscription update overwrite manual selections and custom rules?

Updating a subscription usually downloads the remote configuration again. Rules, DNS settings, or proxy groups written directly into the generated subscription file may be overwritten by the new content, so they are not suitable for long-term manual edits. If the client provides “Override,” “Mixin,” “Extended Configuration,” or “Configuration Preprocessing,” put fixed local settings in the appropriate entry and let the client merge them after each update.

Recommended update workflow

1. On the “Profiles” page, note the name of the active profile and its last update time.
2. After updating, run a configuration check before deleting the old profile.
3. Confirm that proxy groups, node counts, DNS, and rules have all loaded.
4. Test one direct destination and one proxied destination, then check the matched policy on the Connections page.
5. If the update fails, switch back to the last working profile and inspect the subscription response.

Whether a manually selected node is retained depends on the client’s persistence mechanism and whether the proxy group name has changed. If the provider renames PROXY, the old selection cannot map to the new group and may fall back to the first item. Avoid setting automatic updates too frequently; node subscriptions commonly refresh every 6 or 24 hours, and updating every minute offers no practical benefit.

10. What order should you follow for first-time troubleshooting?

Clash connection problems commonly involve configuration, the core, ports, nodes, rules, DNS, and system integration. Following a fixed order is more effective than repeatedly reinstalling the client. After each step, check the logs and Connections page; do not change the subscription, mode, DNS, and client version all at once.

A 10-minute basic troubleshooting checklist

1. Check the system time: The date, time zone, and minute should be accurate; clock drift can affect TLS connections.
2. Check the configuration: The active profile is selected, syntax validation passes, and no proxy groups are missing.
3. Check the core: The logs show a listening port, and the core does not exit immediately after starting.
4. Check the port: 7890, or the current mixed-port, is not occupied by another program.
5. Check the nodes: Run a latency test and manually switch between at least two different nodes.
6. Try Global mode: Use it to distinguish rule issues from node issues, then restore Rule mode after testing.
7. Check the system proxy: The address is 127.0.0.1, and the port matches the client.
8. Check DNS: Look for timeouts, resolution failures, or query loops in the logs.
9. Temporarily disable TUN: Verify the standard system proxy first to rule out virtual adapter and routing conflicts.
10. Read the full log message: Record the time, target domain, policy name, and specific error instead of simply writing “Connection failed.”

In the logs, connection refused usually means the destination port explicitly rejected the connection. i/o timeout or dial tcp timeout more often indicates an unreachable network, a congested node, or firewall filtering. no such host points first to DNS. After seeing an error, determine whether it occurred at the local listener, the proxy node, or the final destination to narrow the investigation.