Frequently Asked Questions

Clash is a rule-based proxy client that routes traffic through a local proxy interface (HTTP/SOCKS5) or TUN virtual network adapter. Supports Shadowsocks, VMess, Trojan, Hysteria2, TUIC, VLESS, and more.

Unlike traditional VPNs: Clash natively supports split routing — local traffic connects directly, and everything else goes through the proxy, so your local sites and services never slow down. VPNs typically tunnel all traffic, which is slower and can break sites that expect your real local IP.

No. Clash is just the client — you need a proxy provider for server nodes. Paste your provider's subscription link into Clash and you're ready. No server configuration required.

If you're technically inclined, you can also run your own proxy on a VPS (Xray, Sing-Box, etc.) and configure a Clash subscription.

We recommend Clash Plus — free on all platforms, ready out of the box, clean UI with full features:

• Windows / macOS / Android: Clash Plus
• iOS: Clash Plus (free on App Store)
• Linux: Clash Verge Rev (AppImage / deb / rpm)

Get the latest version on our download page.

Three steps:

1. Download & install: Get Clash Plus for your platform from the download page.
2. Import subscription: Open the client, paste your provider's subscription link on the Profiles page, and wait for nodes to load.
3. Enable proxy: Turn on System Proxy, select a node, and visit google.com to test.

See our setup guide for detailed steps.

This is Windows SmartScreen warning because the installer lacks a paid Microsoft code signature. To proceed:

1. Click "More info" in the dialog
2. Click "Run anyway"

This is completely safe — Clash Plus source code is fully open and auditable. Always download from our official page, never from unknown sources.

macOS Gatekeeper blocked the unsigned app. To fix:

1. Open "System Settings → Privacy & Security"
2. At the bottom, find "Clash Plus was blocked…" and click "Open Anyway"

If you see "damaged", run this in Terminal, then try opening again:

Usually wrong APK architecture or incomplete download:

• arm64-v8a: For most phones since 2018 (recommended)
• armeabi-v7a: For older 32-bit phones
• x86_64: For x86 tablets/emulators

Re-download the correct architecture APK. Check file size after download (should be 20MB+), then reinstall.

If Clash Plus isn't showing up in your region's App Store, you can download it using a US Apple ID instead:

1. Open App Store → tap your profile icon (top right)
2. Scroll to the bottom and tap "Sign Out"
3. Sign in with a US Apple ID
4. Search "Clash Plus" and download (completely free)

After downloading, you can switch back to your original Apple ID — the installed app won't be affected.
Direct link: App Store – Clash Plus

Common causes and fixes:

• Leftover data from old version: Fully uninstall the old version (including config folders), then reinstall.
• Incompatible OS version: Requires Windows 10 1903+ / macOS 12+ / Android 6+.
• Antivirus blocking: Add Clash Plus to your whitelist, or temporarily disable antivirus to test.
• Corrupted installer: Re-download the full installer from our official page.

Troubleshooting steps:

1. Check link integrity: Ensure the link starts with https:// with no extra spaces or line breaks when copying.
2. Network prerequisite: Subscription servers are sometimes unreachable without a proxy already active. Manually add a node first, or use your provider's alternate mirror subscription link if they offer one.
3. Check account status: Log into your provider's dashboard and confirm your account is active and data quota isn't exhausted.
4. Change User-Agent: Some providers filter User-Agent. In Clash Plus settings, set UA to ClashMeta or clash.meta.

In Clash Plus (and most clients), go to Profiles, tap the settings button next to your subscription, enable "Auto Update", set the interval (12 or 24 hours recommended), and save. The client pulls the latest node list in the background automatically.

Possible causes:

• Subscription contains Base64-encoded SS/VMess links but the client expects YAML — ask your provider for a "Clash subscription link", not a generic one.
• Subscription parse failed — open the subscription link in a browser and check if the content is valid YAML.
• Expired account causes the subscription to return empty content or an error page.

Yes. Clash supports multiple subscription profiles. Import each on the Profiles page, then check the one you want to use.

To mix nodes from multiple providers in one config, use a "subscription merge" tool (Sub-Store, subconverter) to combine subscriptions into a single YAML file, then import into Clash.

YAML syntax error — usually from manual editing. To debug:

1. Paste the config into an online YAML validator (e.g. yamllint.com) to find the error line.
2. Common mistakes: using Tab for indentation (YAML requires spaces), special characters in strings without quotes.
3. If the subscription link comes directly from your provider, the error means their config is broken — contact their support.

Check in order:

1. Proxy mode: Confirm mode is "Rule", not "Direct", and wasn't accidentally switched to direct.
2. System proxy: On Windows/macOS, ensure System Proxy is enabled. Browser should use system proxy.
3. Node availability: Switch to another node, or run Speed Test and pick the lowest-latency node.
4. Browser extension conflict: Proxy extensions like SwitchyOmega may conflict with Clash — set them to system proxy mode.
5. Firewall/antivirus: Some security software blocks Clash network access — add to whitelist and retry.

Usually caused by wrong proxy mode:

• Switch from "Global" back to "Rule" — rule mode automatically routes local traffic direct.
• If still slow, check if the subscription config includes a local direct rule (GEOIP,US,DIRECT, or the equivalent for your own country).
• In Fake-IP mode, DNS goes through the proxy and may slow down local domains — set a local DNS server as your nameserver (e.g. 1.1.1.1).

Possible causes:

• Node overload: Peak hours (8–11 PM) crowd popular nodes — switch regions or use an Auto policy group.
• Subscription expired: Check data quota and expiry date.
• Unstable local network: Test your connection first (ping 8.8.8.8) to rule out local issues.
• Keepalive setting: Add keep-alive-interval: 30 in your Clash config to keep connections alive.

Some apps ignore system proxy (game clients, UWP apps, download tools). Solutions:

• Enable TUN mode: Creates a virtual network adapter at the system level to capture all TCP/UDP traffic, bypassing app-level proxy limits.
• Windows UWP: Clash for Windows (legacy) has a built-in UWP loopback fix; Clash Plus TUN mode also resolves this.
• TUN mode requires admin privileges on Windows/macOS and VPN permission on Android/iOS (grant when prompted).

Enable "Allow LAN" in Clash settings, then set HTTP proxy on other devices to this computer's LAN IP and Clash's listen port (default 7890).

Example: if Clash PC IP is 192.168.1.100, set phone Wi-Fi HTTP proxy to server 192.168.1.100, port 7890.

TUN (Tunnel) mode creates a virtual network adapter at the kernel level to capture all TCP/UDP traffic at the network layer, bypassing app-level proxy restrictions.

When to enable TUN:

• Game clients (Steam, Epic, etc.) not using proxy
• Windows UWP apps not using proxy
• System components (e.g. Windows Update) need proxy
• macOS/Linux terminal commands need proxy

TUN uses more system resources. System Proxy is enough for daily use — enable TUN only when needed.

Fake-IP is a DNS handling method: Clash returns a fake local IP (e.g. 198.18.x.x) for each domain, then resolves the real IP when the connection arrives. Reduces DNS latency and avoids DNS pollution.

Note in Fake-IP mode:

• Local network discovery (Bonjour, mDNS) may fail — configure fake-ip-filter to exclude those domains.
• Some DRM content or network verification may fail — use filter whitelist to fix.

Add custom rules in the config's rules section (before other rules). Examples:

Rules match top to bottom — first match wins. Supports DOMAIN, DOMAIN-SUFFIX, DOMAIN-KEYWORD, IP-CIDR, GEOIP, and more.

Change these ports in the config file or client settings page.

Recommended approach:

1. Use Auto policy group: Most subscriptions include an Auto group that picks the lowest-latency node and switches periodically.
2. Manual speed test: On the Proxy page, click Speed Test to batch-test all nodes — pick nodes under 50ms.
3. Consider region: US services → US nodes, Japanese games → Japan nodes. Closer is usually more stable.
4. Protocol choice: At similar latency, Hysteria2 > TUIC > VMess/VLESS XTLS > plain VMess — newer protocols are usually faster.

Low latency (ping) doesn't mean high bandwidth. Factors affecting real speed:

• Node bandwidth cap: Providers may rate-limit per node/user — try nodes with lower load multipliers.
• Peak hour congestion: Heavy traffic 8–11 PM — test during off-peak hours.
• Local network bottleneck: Run a speed test (e.g. fast.com) to rule out ISP issues.
• Protocol overhead: Try more efficient protocols (Hysteria2, TUIC).

Normally Clash uses very little (< 1% CPU, < 100MB RAM). If usage is high:

• Check if log level is unnecessarily verbose — change to warning or error.
• Large rule sets (tens of thousands of rules) increase memory — use GeoData instead of per-IP rules.
• TUN mode uses more resources than system proxy — disable when not needed.
• Update to the latest version — newer releases usually include performance improvements.

Visit dnsleaktest.com to test. If results show your ISP's DNS servers (instead of your node's location), you have a DNS leak.

Fix: Enable the DNS module in Clash config with enhanced-mode: fake-ip or redir-host, and configure remote DNS in nameserver (e.g. tls://8.8.8.8).

No. Clash Plus is fully open source — code is publicly auditable on GitHub with no data collection or telemetry. Your traffic only passes through nodes you configure (your provider). Clash Plus itself never touches your data.

Tip: Always download from official channels. Avoid unknown "cracked" or "optimized" versions — they may contain backdoors.

Strongly not recommended. Subscription links contain your account credentials. If shared:

• Others can use your node quota, exhausting your data early.
• Providers may ban your account for multi-device sharing detection.
• You can't trace what others do with your account.

For family sharing, buy a multi-device plan from your provider — each person gets their own subscription link.

When accessing via proxy nodes, sites see the node's server IP, not your real IP. Exceptions to watch for:

• Traffic in Direct mode or ruled as direct — sites see your real IP.
• WebRTC can leak local IP in some browsers — install a WebRTC leak protection extension.
• DNS leaks let DNS providers log your queries (see DNS leak section above).

Two methods:

1. Manual import: Open Clash Plus → Profiles (bottom) → "+" (top right) → "Import from URL" → paste subscription link → confirm.
2. One-click import: Open your provider's one-click import link in Safari — iOS will jump to Clash Plus and fill in the URL automatically.

Troubleshooting steps:

1. Switch to a lower-latency node on the Proxy page and retry.
2. Verify subscription is valid Clash YAML format (not raw SS/VMess links).
3. Go to Settings → General → VPN & Device Management, delete old VPN configs, then reconnect in Clash Plus.
4. Restart your phone and retry.

iOS suspends background VPN processes after a while. Solutions:

1. In Clash Plus Settings, enable "On Demand" — system-level VPN rules that auto-trigger on network connect, unaffected by process management.
2. In iOS Settings → General → VPN & Device Management, find Clash Plus VPN config and enable "Connect On Demand".

In Clash Plus Settings, enable "iCloud Sync" — configs and subscriptions sync to iCloud Drive. All devices on the same Apple ID (iPhone, iPad) share the same config.

Clash Plus has a built-in traffic stats panel — real-time speed, daily usage, node latency, and more. Detailed per-app analysis is limited on iOS due to system restrictions. For advanced traffic analytics, Stash is a paid but feature-complete option.