Clash Beginner FAQ: Modes, Ports, Subscriptions & Common Errors

Picking the wrong mode cuts your proxy performance in half

Nearly every new user gets stuck right after installing the client, wondering which mode to pick. Choosing the wrong mode doesn't throw an error — it just quietly degrades things: slower speeds, or some sites refusing to load, which makes the issue harder to track down later.

1. What's the actual difference between rule mode and global mode?

In rule mode, the client checks each request's destination against the rule set in the config: traffic matching a "direct" keyword (domestic banking sites, local LAN addresses, etc.) goes straight out through the local network, while traffic matching a "proxy" keyword gets forwarded to a node. Global mode skips that matching step entirely — every bit of traffic gets pushed through the proxy node regardless of whether the destination is local or overseas. For everyday use, rule mode is the better choice: local services get lower latency over the direct connection and don't eat into your node's traffic quota. Switch to global mode only temporarily, to verify a case where the rule set clearly misjudged something that should have gone through the proxy.

2. What is TUN mode, and isn't normal mode enough?

Normal mode (system proxy / HTTP proxy) only handles traffic from apps that explicitly use the configured proxy — browsers and most chat apps are covered, but some apps that talk directly to the OS network stack (games, certain background services) bypass this layer entirely. TUN mode creates a virtual network adapter at the system level, routing all of the device's traffic through that adapter before handing it to the proxy core. Coverage is far more complete, but it requires extra authorization (a VPN permission prompt on Android). Stick with normal mode day to day, and only turn on TUN mode when a specific app just won't route through the proxy.

Ports, subscriptions, and update cycles

These questions sound basic, but they're exactly the background details people forget when troubleshooting later — getting them straight up front saves a lot of back-and-forth.

3. What's port 7890 in the interface for?

7890 is the local mixed-proxy port the client opens by default (it supports both HTTP and SOCKS5). Browser extensions, command-line tools, and any other software without built-in proxy support can be manually pointed to 127.0.0.1:7890 to route through it. Once the system proxy switch is on in the client, system-level traffic is already routed automatically — this port mainly exists for cases where you need to configure a proxy address by hand, and you can otherwise ignore it.

4. How often should a subscription link be updated?

Subscription content is maintained by the provider, and update frequency varies by service. The common approach is to set an auto-update interval in the client (say, pulling every 12 or 24 hours) so node changes sync automatically without any manual work. If you need to verify a change right away, look for an "Update Subscription" or "Refresh" button in the client to trigger it manually instead of waiting for the next cycle.

5. The node list is empty after importing a subscription link — is the link dead?

Don't assume the link is dead just yet. Three common causes: a stray space or missing character got added when the link was copied; the link is a generic share format rather than a direct config URL Clash can read natively, requiring a format conversion by the client; or the provider has actually paused or expired the subscription on their end. Try opening the link directly in a browser first — if it returns a block of config text, the link itself is fine, and re-pasting it usually resolves most cases.

How to read nodes and latency

6. For the latency numbers in the node list, is lower always better?

Yes — the latency figure is usually in milliseconds and represents the round-trip time for a speed-test request to that node, so a lower number means the connection establishes faster. But latency only reflects "how fast it connects," not actual download or streaming speed. A node with 200ms latency but plenty of bandwidth can outperform one with 80ms latency but a congested line in real use. When picking nodes, filter out the obviously high-latency ones first, then narrow down the rest based on actual usage experience.

7. What if every node shows a timeout or a failed speed test?

First confirm the device's own network connection is working (can you load a regular local webpage). If the network is fine, it's most likely that the subscription's nodes have expired in bulk or the provider's lines are temporarily unstable. Try manually refreshing the subscription to pull the latest node list — if everything still times out afterward, it's almost certainly an issue on the provider's side, not a client setting.

Can't connect to the proxy? Check these steps first

Having a fixed troubleshooting order keeps you from randomly poking at settings. Work through the steps below in order and you'll usually land on the actual issue.

8. Nothing happens after turning on the proxy toggle — what to check first?

Step one: check whether the connection status icon on the main screen shows "Connected." If it hasn't connected successfully, nothing else matters yet. Step two: confirm at least one node in the currently selected node group is usable, not all grayed out or flagged red. Step three: check system settings to confirm proxy (or VPN) permission is actually granted to this client — some OS updates reset permissions and require re-authorization. If it still doesn't work after all three, then look into the nodes or the subscription itself.

9. One specific app won't open, but the browser works fine — why?

Most likely this app uses a lower-level network path that bypasses the system proxy settings entirely, which normal proxy mode can't reach. Try enabling TUN mode (or the equivalent "enhanced mode" option in the client) so all traffic routes through the virtual adapter, and see if the app recovers. If it still doesn't work with TUN mode on, check whether the rule set has mistakenly classified this app's domains as direct.

10. How do I confirm traffic is actually going through the proxy, and it's not just wishful thinking?

The most direct way is to open a page that shows your access IP in the browser. Note the IP and region shown with the proxy off, then turn the proxy on and refresh the page — if the IP and region change, traffic is genuinely routing through the proxy node. If the client has a real-time traffic chart, you can also watch it for corresponding activity while browsing, which gives you double confirmation.

These ten questions cover the trickiest points from installation through everyday use. Work through this checklist first — most connection issues get resolved in a single pass. For a deeper look at node speed testing and verifying that the proxy is actually active, check out the dedicated first-connection walkthrough article.