Clash FAQ and Troubleshooting

Open the subscription URL in a browser first and confirm that it returns text or downloads a configuration file. An expired link, authorization error, or blank response means the URL must be renewed with the subscription provider. If the browser works but the client fails, check the system clock, the client's proxy update settings, and the HTTP status code in the logs. You can also temporarily disable the system proxy and retry to prevent the broken configuration from proxying its own update request.

Start at the reported line and check indentation, spaces after colons, list hyphens, and matching quotes. YAML does not accept tab indentation, and each nesting level must use a consistent number of spaces. If the reported location looks correct, inspect the preceding line for a missing colon or bracket. Remove recently added dns, proxy-groups, or rules sections one at a time until the configuration loads, then narrow the issue down to the specific field.

Windows usually requires administrator privileges to install or start service mode. On macOS, allow the network extension or helper component when prompted by the system. On Linux, the core process needs permission to create a TUN device and modify routes. After granting access, fully quit and relaunch the client. If it still fails, check whether another VPN, virtual network adapter tool, or security application is using the relevant network components.

First confirm that the installer matches your processor architecture; Apple Silicon devices should preferably use an ARM build. If macOS blocks the launch, open System Settings > Privacy & Security, find the recently blocked app, and allow it manually. If enabling TUN triggers a network-extension prompt, grant permission in the same area. Reopen the client afterward, and avoid keeping helper components from multiple versions installed at once.

Switch to Global mode and select that node explicitly to rule out another policy being chosen by the rules. Then check the device clock, whether the network can reach the node server, whether all protocol parameters are present, and whether the logs show a connection timeout, TLS error, or authentication failure. If every node in the same subscription times out, test another network and inspect the firewall. If only one node fails, refresh the subscription or replace the node.

Fake-IP returns reserved addresses and lets the core maintain domain mappings, so apps that rely on LAN discovery, specific game platforms, or local device hostnames may be incompatible. Check the logs to identify the failing domains, then add only the necessary domains to fake-ip-filter instead of using an overly broad wildcard. If many apps fail, also check whether the core controls DNS, whether nameserver entries are available, and whether another DNS tool is running alongside it.

Quit any leftover processes and relaunch the client, then inspect the final entries in its log directory. Common causes include an occupied proxy port, an invalid YAML file, insufficient permissions for a service component, or an old core process that did not exit. Temporarily switch to a known-good basic configuration to test the startup path. If it works, restore DNS, nodes, policy groups, and rules section by section until the failing part is identified.

Confirm that the subscription response actually contains node definitions rather than a login page, error message, or empty configuration. If nodes exist but policy groups are empty, check that proxy-groups is defined and that the node names referenced by each group exactly match those under proxies. If the problem appeared after subscription conversion or overrides, temporarily disable the conversion rules and import again. Log messages about missing proxies, empty policy groups, or field type errors can point directly to the affected configuration section.