FlClash FAQ

Clash usually refers to the proxy core and its configuration ecosystem, and is also commonly used as a general term for this type of client. mihomo is a core project derived from Clash Meta that handles protocol connections, rule matching, and DNS. FlClash provides a graphical interface for managing configurations, choosing proxy policies, and adjusting how network traffic is routed. Available features depend on the version of the core in use. If a configuration field is unavailable, check both the client documentation and the core’s supported features rather than comparing software names alone.

Get your subscription link from the account page for your existing service, your organization’s network administrator, or the management console of a service you run yourself. This site provides client downloads and configuration guides, not free Clash nodes or subscription accounts. Subscription URLs often contain credentials, so anyone who obtains one may be able to view your configuration or use your account resources. Don’t share screenshots publicly, post links in group chats, or submit them to public conversion sites. Free configurations from unknown sources may also include extra rules, DNS settings, or remote resource URLs. Check their source and purpose before importing them.

FlClash is commonly released for Windows, macOS, Android, and Linux. For iPhone, choose a client that explicitly supports iOS. The iOS option listed on this site’s download page is Clash Plus, with an App Store link and the official website clashplus.io. Whether your existing subscription will work depends on the formats and protocols the client supports. Before switching clients, confirm that your provider offers a compatible format, then import it and check the policy groups. Desktop system proxy and TUN instructions do not apply directly to iOS.

You may need a format converter only when your provider offers a list of node URIs but your client requires a complete Clash configuration. Prefer a Clash- or mihomo-specific subscription from your provider, as it usually includes compatible policy groups and rules. Conversion can arrange supported fields, but it cannot add protocol support that the core does not have. Sending a subscription to a third-party converter gives it access to the link contents. If conversion is necessary, use a trusted self-hosted tool and review the resulting DNS settings, rules, and remote resources.

Copy the full subscription URL, open FlClash’s configuration page, choose Add Configuration or Import, then select Import from URL and save. Once the download finishes, select the new configuration and check the Proxy page to make sure its policy groups appear. Adding a URL to the list does not automatically activate that configuration. Next, choose a rule mode and an available outbound policy, enable System Proxy or TUN as appropriate for your system, and test a connection. Button labels may vary slightly between releases, but the order is the same: import, select the configuration, choose a policy, and enable traffic routing.

On Windows, check System type under System Information in Settings. Most Intel or AMD PCs use x64; for ARM devices, first confirm that a compatible build is available. On macOS, check About This Mac to see your chip, then choose the installer for Apple Silicon or Intel. On Android, select a build that matches your device’s processor and supported ABI. Newer phones usually use arm64, but older devices and customized systems may need separate verification. A parse error during installation can also mean the download is incomplete or your OS version is unsupported, so don’t keep switching architectures without checking first.

TUN creates a virtual network interface and changes routing, so it usually requires more privileges than System Proxy. On Windows, follow the client’s instructions to install or start the required service, and run as administrator if needed. On macOS and Linux, complete the relevant authorization or service setup; don’t reuse commands intended for another OS. On Android, approve the system VPN connection request the first time you enable TUN. Another active VPN may cause a conflict. After granting permission, restart the relevant service or client and check the logs for the specific error. Don’t disable all security protections just to troubleshoot.

First, make sure the installer came from a trusted release source and matches your chip and macOS version. Move the app to the Applications folder and try opening it. If macOS explicitly reports that the developer can’t be verified, check Privacy & Security in System Settings for an option to allow the app, following the steps for your version of macOS. A damaged app, an incompatible architecture, and a security verification warning are different issues; follow the full error message to identify which one applies. Don’t copy Terminal commands from unknown sources or leave system security features disabled. If the problem persists, note your macOS version and the exact error message.

Rule mode selects a policy for each request based on the matching order in your configuration, making it a good everyday choice. Global mode sends requests already routed through the core to the global policy. It’s useful for brief comparisons, but it does not automatically route every app’s traffic through the core. Direct mode tries to connect routed requests directly and can help determine whether an issue is related to proxy egress. After switching modes, check which node the relevant policy group has selected. Existing connections may keep using their previous route, so close the target app’s connections and retry to avoid mistaking an old connection for the result of the new mode.

System Proxy mainly affects apps that follow the operating system’s proxy settings; it does not route all traffic from your device. Check whether browser extensions, in-app proxy settings, or other clients override the system settings, then make sure FlClash is running and its listening port matches the configured value. Command-line tools, some games, and apps with their own network stack may ignore System Proxy. Configure an app-specific proxy or use TUN if needed. Check the client’s connection logs for the target process and domain rather than relying only on whether a webpage loads. Managed devices may also be subject to organizational policies.

Some Windows apps running in AppContainer are subject to local loopback restrictions and may not be able to reach the client’s local proxy port. If a regular browser works but a specific Store app doesn’t, first confirm that the app uses the local proxy, then consider a loopback exemption. If the client includes a UWP loopback tool, authorize an exemption for the target app only. If your release doesn’t include that option, follow Microsoft’s documentation to check the app package identity and steps. A loopback exemption won’t fix subscription or node issues, and it’s best not to enable it for every app.

First, distinguish DNS resolution failures from connection timeouts. Check the logs for resolution errors and compare access to other domains using the same node. Verify the DNS mode, resolver addresses, and outbound route used for DNS requests. In particular, avoid a setup where the resolver requires a proxy connection that itself depends on that resolver. With fake-ip, some apps may need targeted filtering rules. Change one setting at a time, keep a copy of the original configuration, and start a new connection to the affected destination. Changing all DNS settings, disabling IPv6, and modifying routes at once makes it hard to identify the cause.

First confirm that your local network is working. Then check your subscription provider’s account page to see whether the link was reset, the service has expired, or a provider-specific subscription URL is required. A 401 usually indicates an authentication issue; a 403 may reflect access restrictions or server policy, so check with your provider. An HTML login page is not a valid configuration. The auto-update interval only controls when requests are made; it can’t fix an invalid link. After changing the URL, run an update manually and note the status code and time when contacting your provider. Remove the full subscription URL and its credentials before sharing logs.

Pause traffic routing in the client and confirm that your local network can reach ordinary websites. Then check that the subscription is valid and the intended configuration is selected. Resume routing, verify the selected policy group and System Proxy or TUN status, then compare nodes using the same test address. A node test may time out because the test address is unreachable; that doesn’t necessarily mean all traffic is failing. Check actual requests and logs. If all nodes fail, investigate local DNS, routing, and conflicts with other VPNs first. If only one node fails, ask your provider to check its status. Avoid changing several settings at once.

Note the browser’s error type, destination domain, and certificate issuer, then check that your system date, time, and time zone are correct. Compare direct and proxied connections, and rule out captive Wi-Fi portals, unexpected DNS results, HTTPS inspection by security software, or an issue with the node’s exit. Ordinary proxy forwarding generally does not require your browser to trust an extra root certificate. Don’t install an unfamiliar certificate or bypass verification just to open a page. If only one site reports an error, its certificate may have expired. Test on a trusted network and use the specific error to narrow down the cause.

Check that the active configuration actually references GEOIP, GEOSITE, or the relevant rule set, and that you updated the data source used by that rule—not a similarly named file. Rules are matched from top to bottom. Once an earlier rule matches, later rules aren’t evaluated; updating the database doesn’t change the order. GEOIP uses the destination IP, while GEOSITE classifies domains, so they serve different purposes. After updating, reload the configuration as prompted and check match logs for a new connection. If the classification is still unexpected, review the rule and data source rather than repeatedly updating.