10 Clash Questions for Beginners: Mixed Ports, Proxy Modes, Subscriptions, and Rules

1. What’s the difference between a Clash client and a core?

The client provides the interface, subscription management, system proxy controls, and status display. The core reads the configuration, matches rules, resolves domains, and establishes connections. Installing a client doesn’t mean you already have a working proxy node. To connect, you still need a valid configuration, a reachable node, and the right way to route traffic into the core.

Clash Meta continued development under the name mihomo. Support for protocols, DNS fields, and rule types varies between cores. “Supports Clash configs” doesn’t mean every configuration will work as-is. If importing a config reports “unknown proxy type” or “unsupported field,” check the core first instead of repeatedly changing the node password.

• Where to check: Open the client’s “Settings” → “About” or “Core” page. Note the client version and core version separately.
• Where to start troubleshooting: Open “Logs” and look for the core name at startup, the configuration load result, and any error fields.
• How to choose: First check which protocols and core your provider requires, then use the client comparison to find a suitable app.

2. What is a mixed port, and where do I enter 7890?

mixed-port is the local proxy listening port. The same port accepts both HTTP and SOCKS proxy requests. 7890 is a common example, not a fixed standard or a remote node port. Check the actual value in the client’s “Settings” → “Ports”; some clients put it under “Core Settings.”

The snippet below configures a local listener; it is not a complete configuration with nodes. For local use only, bind to the loopback address and keep LAN access disabled.

mixed-port: 7890
allow-lan: false
bind-address: '127.0.0.1'
mode: rule

If the logs show address already in use, another process is usually using that port. Quit any duplicate client instances, then check which process has the port open. If you need to change it to 7891, update the app’s manual proxy address too. Changing the port in the client while leaving the app on the old value will result in a connection refused error.

3. How do Rule, Global, and Direct modes differ?

These three modes determine how the core handles outbound traffic once it receives it. They don’t make every app send traffic through the core automatically. Switching to Global mode won’t make a terminal that ignores the system proxy use a proxy.

• Rule mode: Uses the rules in your configuration to choose a direct connection, reject the request, or route it through a proxy group. This is the best mode to start with for everyday use.
• Global mode: Sends regular connections that reach the core to the selected global proxy. Check the choice under “Proxies” → “GLOBAL”—the mode toggle alone doesn’t tell you which proxy is selected.
• Direct mode: Connections that reach the core usually go out directly, without using a remote proxy node.

Where to find it: Open “Proxies” or “Overview” → “Outbound Mode.” Start with “Rule,” then choose an available node in the relevant proxy group. Cores may handle DNS or routing separately, so Global mode does not guarantee that all system traffic uses a single node.

When troubleshooting a website, you can briefly switch to Global mode for comparison. If it works in Global but not Rule mode, check the matched rule and proxy group. If both modes fail, check the node, DNS, and whether the traffic is reaching the core.

4. How are subscription links, configuration files, and nodes related?

A node is a set of parameters for a remote outbound connection, including the server address, port, protocol, and authentication details. A configuration file can contain nodes, proxy groups, rules, and DNS settings. A subscription link is the address used to retrieve this content. It may return a complete YAML configuration or just a list of nodes.

Choose an import method based on what you have

1. Get a subscription URL compatible with your client, then open “Config” → “New” → “Import from URL.” Paste the link and download the config.
2. If you have a local YAML file, use “Config” → “Import from File.” Don’t paste the file contents into the URL field.
3. After downloading, select the configuration and make sure it’s marked as active. Then check “Proxies” for the expected proxy groups.

Some clients let you import a link for a single node, but that doesn’t mean the link includes traffic-routing rules. If it only contains a node, you may still need a client configuration template to provide proxy groups and rules. If the import succeeds but no proxy groups appear, first check what kind of content was imported.

5. How often should subscriptions update, and will updates overwrite manual changes?

Updating a subscription fetches the configuration again; it doesn’t upgrade the client or test node speeds. How often to update depends on how frequently your provider makes changes. You can start with every 24 hours, or use a different interval if your provider specifies one. Repeatedly clicking Update usually won’t fix an expired link or an incompatible format.

Where to find it: “Config” → the current subscription’s menu → “Update” or “Edit” → “Update interval.” Check the units: if the field expects seconds, enter 86400 for 24 hours; if it expects minutes, enter 1440. Some clients don’t run scheduled tasks while closed, which doesn’t mean the server has stopped updating.

• When to update manually: Your provider announces a change, nodes are failing broadly, or the configuration is clearly out of date.
• What may be overwritten: Rules, node names, and DNS settings edited directly in the downloaded configuration.
• How to keep custom settings: Use the client’s supported override, merge, or extension features where possible, and save a copy before making changes.

“Update successful” only means the download and load process completed. It doesn’t mean every node can connect. If the download fails, check the HTTP status and parsing details in the logs first: 401 or 403 may indicate an access or permissions issue, 404 may mean the URL is no longer valid, and a parsing error means you should check whether the response is actually a configuration.

6. How do rules match, and why does their order matter?

Standard rule lists are evaluated from top to bottom. When a rule matches, its specified outbound is used. Put more specific exceptions first and the catch-all rule last. The examples below use reserved example domains and don’t rely on proxy group names from any real subscription.

rules:
  - DOMAIN,login.example.com,DIRECT
  - DOMAIN-SUFFIX,example.com,DIRECT
  - GEOIP,CN,DIRECT
  - MATCH,DIRECT

DOMAIN matches an exact domain; DOMAIN-SUFFIX matches that domain and its subdomains; GEOIP,CN matches based on the destination IP’s location in a geolocation database; MATCH is the catch-all rule. All the examples above use direct connections and only illustrate rule order. To route traffic through a proxy group, replace the outbound with a group name that exists in your configuration, matching it exactly.

Where to find it: Find the request under “Connections” and check the matched rule, rule payload, and outbound chain. Some clients require you to expand the details. If the interface doesn’t show the matched rule, temporarily select a more detailed level under “Settings” → “Log Level,” reproduce the issue once, then restore the previous setting to avoid logging too much connection data.

Domain rules depend on the core being able to identify the domain. Results may differ from what the rule text alone suggests if an app connects directly to an IP address, DNS interception works differently, or an existing connection is still open. After changing a rule, establish a new connection to verify it.

7. What’s the difference between a system proxy and TUN mode?

A system proxy sets the local proxy address in your operating system’s proxy settings. It works for browsers and apps that honor those settings. TUN mode routes traffic through a virtual network interface and can cover some apps that ignore the system proxy, but results still depend on routing, exclusions, permissions, and platform-specific implementation.

Getting started on desktop

1. First, turn on “System Proxy” in the client’s “Settings” or tray menu, then confirm that your browser can connect.
2. If the target app still doesn’t appear under “Connections,” check whether it has its own proxy settings.
3. If you need to route more traffic, install the required service or grant the necessary permissions as instructed by the client, then turn on “TUN Mode.”

On Windows, this often requires administrator privileges or service mode. On macOS, you may need to approve system permissions. Android and iOS clients typically route traffic through the system VPN interface, so desktop system proxy steps don’t apply. Running another VPN, virtual network adapter tool, or traffic-routing app at the same time may cause routing conflicts.

When you’re new to this, avoid changing TUN, DNS, and rules all at once. Change one setting at a time and note the difference with it on and off. If the network stops working after enabling TUN, turn TUN off to restore connectivity, then check permissions, routing conflicts, and DNS interception one by one.

8. Why does my browser work while the terminal can’t connect?

Many command-line tools don’t use the desktop system proxy. They may read environment variables such as http_proxy and https_proxy, or only recognize their own proxy options. A working browser only proves that the browser’s current route works; it doesn’t mean the terminal is using the same route.

Where to find it: First confirm the actual mixed port under the client’s “Settings” → “Ports,” then try an explicit proxy request from a terminal. Assuming the listener is at 127.0.0.1:7890:

# macOS / Linux
curl --proxy http://127.0.0.1:7890 --connect-timeout 10 --head https://example.com

# Windows PowerShell
curl.exe --proxy http://127.0.0.1:7890 --connect-timeout 10 --head https://example.com

On Windows, use curl.exe to avoid PowerShell environments that interpret curl as a different command. If you get an HTTP response from the target site, the request received a response. If the connection to the local port fails, first check that the client is running and the port matches.

To set variables for your current macOS or Linux shell, use the temporary settings below. HTTPS destinations can still be accessed through an HTTP proxy using the CONNECT tunnel, so the proxy address here uses http://.

export http_proxy=http://127.0.0.1:7890
export https_proxy=http://127.0.0.1:7890

# Clear the current shell settings when you’re done troubleshooting
unset http_proxy https_proxy

These variables only affect programs that support them and inherit the relevant process environment. If they’re set but traffic still goes direct, check the program’s own settings and no_proxy exceptions. Don’t treat Global mode as a substitute for configuring a proxy in the terminal.

9. Why is my download slow when the node has low latency?

The latency shown in a client usually comes from a connection or HTTP probe; the exact method depends on the client and configuration. It isn’t download bandwidth, and may not be an ICMP ping. A node showing 40 ms can still be slow during sustained transfers because of network congestion, server bandwidth limits, or the destination site’s policies.

Where to find it: Run a latency test in “Proxies” → the target proxy group, and note the test URL, time, and timeout settings. After switching nodes, stop the old download and start a new connection. Existing TCP connections usually won’t switch over immediately when you change proxy groups.

• Compare latency: Use the same test URL and run it three times in a row. Don’t judge stability from a single result.
• Compare throughput: Use the same download source and file, then check the sustained speed over about 30 seconds. Also confirm the selected outbound under “Connections.”
• Convert units: 8 Mbps is about 1 MB/s in theory, before protocol overhead. Don’t compare the two units directly.

For example, a reading of 50 ms describes only that probe result; it doesn’t mean the node can reach 50 MB/s. If only one site is slow, check its connection and routing rules first. If all nodes are slow, compare your local network, other devices, and different times of day. These figures illustrate how to interpret results; they aren’t a performance guarantee for any node.

10. Still can’t connect after importing? Check these first

Troubleshoot in this order: configuration loaded → local listener → traffic reaches the core → rules select an outbound → remote connection. Find the first failing step; it’s usually easier to reproduce than changing the subscription, port, and DNS all at once.

1. Check the configuration: Under “Config,” make sure the correct item is selected and the logs show no YAML parsing errors. YAML uses spaces for indentation; align fields at the same level and don’t use tabs.
2. Check the listener: Verify the port under “Settings,” then make one request using an explicit proxy command to rule out stale processes and port conflicts.
3. Check how traffic gets in: Open “Connections” and revisit the target. If no new connection appears, check the system proxy, the app’s own proxy settings, or TUN routing.
4. Check the rules: If a connection appears, expand its details and confirm that it matched the expected rule and selected an available proxy group.
5. Check the error: For name resolution failures, check DNS first. For connection timeouts, check whether the node is reachable. For authentication failures, check your credentials or subscription status.
6. Check before restoring settings: Turn off the system proxy before temporarily quitting the client. Disable it through the client only; don’t accidentally remove company settings required for your work network.

When asking for help, include your operating system, client and core versions, when the issue occurred, the app that failed, and redacted logs. “Browser works, terminal fails” or “an explicit proxy request can’t connect to the local port” is more useful than just “no internet.” For platform permissions and installation steps, see the installation guide. For concepts and common settings, see the FAQ.