Clash Setup Guide
for All Platforms

General setup: architecture, subscriptions and traffic routing

Check your device before choosing a client

Before installing, note three things: your operating system, system architecture and whether you have administrator access. Architecture determines whether an installer will run; permissions determine whether the client can install a service or create a virtual network interface. A 64-bit operating system does not necessarily mean x64: computers with ARM processors can also run 64-bit systems. In Windows, check Settings > System > About; on macOS, open About This Mac; on Linux, run the commands below. For phones, choose a package marked as compatible on the download page, and check processor support on older devices.

On devices with a graphical interface, a GUI client is usually the simplest choice. Clash Plus is our top pick on supported platforms. The client manages configuration, proxy controls and system integration; the core parses configuration, applies rules and establishes connections. They are separate components. Switching clients does not automatically migrate system permissions, background services or local overrides. The same subscription may also behave differently across clients because core features and merge behavior can vary. See our Clash client comparison for help choosing a client, and How mihomo relates to GUI clients for an overview of the core and client ecosystem.

uname -m
# x86_64 usually corresponds to x64 / AMD64
# aarch64 or arm64 usually corresponds to ARM64

Prepare a subscription or configuration file

A Clash client is a proxy tool; it cannot create working proxy nodes on its own. Before you begin, have a subscription URL you are authorized to use or a local YAML file, and make sure the service is still active. A complete config usually includes nodes, proxy groups and rules. If you only have a node list, the client may need a template to create a usable config. A format error during import does not mean all nodes are invalid. First check whether the URL returns a full config, a list of nodes, a login page or an error message. See Subscription formats and conversion for details.

Treat subscription URLs as passwords: they often contain personal credentials. Never share them in public screenshots, online converters or public repositories. Before sharing a config, check for node passwords, controller secrets and local file paths. Updating a remote subscription may overwrite direct edits, so use the client's supported override or merge options for personal changes. Before editing, export a working copy of the config and note your current proxy group selections. That makes it easier to recover if something goes wrong, without changing the same field in multiple places.

System proxy vs. TUN

A system proxy provides an endpoint for apps that follow the operating system's proxy settings. Browsers usually do, but command-line tools, games and some apps may ignore them entirely. TUN uses a virtual network interface to route traffic within its scope and requires additional permissions, routing and DNS configuration. It is not a universal fix. Start with the system proxy to verify your subscription and route, then enable TUN if your apps need it. On mobile, clients typically connect through the system VPN interface. The interface may look different, but check that you have granted the required system permission.

This snippet only documents settings. It contains no nodes and cannot be used as a complete subscription. The loopback address is accessible only from this device. To allow LAN access, plan for both firewall rules and authentication. Never expose the external controller directly to the public internet; use a controlled access method for remote management.

mixed-port: 7890
allow-lan: false
bind-address: 127.0.0.1
mode: rule
log-level: info
external-controller: 127.0.0.1:9090

Finally, check that the system clock is accurate, the device can access the local network, and other software that changes proxy or routing settings is paused. Note the original proxy settings and DNS source, especially any automatic configuration URL on a work device. These details help restore the network if it stops working after you close the client. On organization-managed devices, follow your administrator's network policies.

Windows: services and system proxy

Download, install and launch

Open the Windows downloads section. We recommend Clash Plus; Clash Verge Rev, FlClash and Clash Nyanpasu are other options. Clash for Windows is no longer maintained. Keep it for reference in older environments only after checking compatibility; it is not a good default for new devices. Check your system type under Settings > System > About, then choose the architecture listed on the download page. If there is no package for your device, don't install one just because its filename looks similar. First confirm that the operating system and client support that way of running it.

Read the system prompts during installation and place the app in a standard applications folder. On first launch, the client may need to install a background service or network component. Make sure the prompt names the client you are installing. Don't run the entire app as administrator indefinitely as a substitute for configuring its service: opening the GUI and giving the core the required permissions are separate things. If a security warning blocks the app, check its source, system requirements and signature details. Don't disable system-wide protection just to finish installing. On a work computer where services can't be installed, use only the standard proxy features your organization allows.

Import a subscription and verify your first connection

Open the client's Config or Subscription section, choose the option to import from a URL, paste the address and download it. Seeing a config name is not enough: set it as the active config, then open Proxies and check that the proxy groups have loaded. If the list is empty, review the import status and parsing errors before enabling TUN. If you have multiple subscriptions, name them by source or purpose. Make sure the newly imported config is selected; otherwise, you could edit one file while another is actually running.

For an initial test, select Rule mode, choose a proxy in the group that needs one, and turn on the system proxy. In Windows, go to Settings > Network & Internet > Proxy and check that the manual proxy address and port match the client listener. A common local address is 127.0.0.1, and a common port is 7890, but use the values shown in your client. If your browser has its own proxy extension, disable it or make sure it isn't overriding the system settings. Otherwise, the test won't tell you whether the system proxy is working.

You can specify the proxy explicitly in PowerShell to compare results without relying on browser settings. This command tests only the local HTTP proxy endpoint. Receiving an HTTP response from the target means the request completed at least one round trip; the status code may not indicate a successful page. Don't use this one command to conclude that every app and UDP connection is working.

curl.exe --proxy http://127.0.0.1:7890 -I https://example.com

TUN permissions, adapters and routing

Once the system proxy works, enable TUN if your target app doesn't follow proxy settings. First-time setup may require a service component and elevated permissions; follow the client prompts to install it, then confirm the service is running. After turning on TUN, check the connections page for requests from the target app instead of relying on the toggle's color. A virtual adapter does not guarantee correct routing, and a running core does not guarantee DNS is being handled. Check each layer separately.

If LAN devices, printers or work resources become unreachable after enabling TUN, turn it off and compare. If access returns, check the client's LAN bypass, route exclusions and the address ranges used by your organization's VPN. Some clients manage private network routes automatically, but those routes can still conflict with an existing gateway. Don't copy a large set of fixed exclusions blindly, especially if you need remote access to private addresses. Choose exclusions based on how the network is actually used.

Port conflicts and restoring settings after exit

If you see an “address already in use” error, check whether another client, an old core process or a development proxy is using the port. Run the command below to list listeners, then use Task Manager to identify the process by its ID. Don't end a system process just because you see its ID. If you switch to a new port, update browser extensions, terminal environment variables and other devices too. Changing the port in the client does not update external settings automatically.

Get-NetTCPConnection -State Listen -LocalPort 7890 |
  Select-Object LocalAddress, LocalPort, OwningProcess

Keep startup options separate: launching the GUI, starting the core service, enabling a config automatically and restoring the system proxy are different settings. Restart once after configuring them, then check that the config is enabled and the port is listening after login. If problems start only after waking from sleep, check network changes and service status first. Don't repeatedly download the config and risk hiding a background recovery issue.

macOS: processor architecture, network services and permissions

Choose the right package for Apple Silicon or Intel

Check the processor or chip under Apple menu > About This Mac. Apple Silicon usually means ARM64; Intel means x64. Open the macOS downloads section. Clash Plus is our top pick; Clash Verge Rev and FlClash are alternatives. ClashX Meta is no longer maintained, so check system compatibility before using this archived client. Choose a package for your native architecture where possible. Compatibility mode does not guarantee that its background services, network components or update process are suited to your device.

If the installer is a disk image, open it, drag the app to Applications and launch it from there. Avoid running the app from a mounted image long-term, as this can cause issues with its path, login items and updates. If macOS says the app can't be opened, first check its source, system requirements and the full error message, then follow the options provided by the system. Don't run bulk security-attribute removal commands found online, and don't broadly change permissions across the entire app folder.

Import a config and check the active network service

Import a URL or local file from the client's config page, download it and enable the config. On the Proxies page, confirm that the proxy groups and rules are present, then choose a proxy manually. Turn on the system proxy, then open System Settings > Network and select your current Wi-Fi or Ethernet connection. Check its proxy settings under Details. macOS usually saves proxy settings per network service: setting them for Wi-Fi does not mean they will carry over to Ethernet.

If your device is connected to both Ethernet and Wi-Fi, check which route is currently the default and review the network service order. Testing with one clear network path makes issues easier to isolate. If the browser works but the terminal doesn't, try an explicit proxy command before changing system DNS. Whether a terminal tool reads the system proxy depends on the tool; some require their own options or environment variables. That doesn't prove the system proxy is broken.

scutil --proxy
curl --proxy http://127.0.0.1:7890 -I https://example.com

Use scutil --proxy to view the current proxy settings, especially whether they are enabled and which address and port they use. The command output does not prove the remote route is working. A browser's PAC file, extension or work profile may also override the route. Compare a regular browser window with an explicit proxy request to distinguish browser settings from the client endpoint, rather than repeatedly toggling the same settings.

Helper services, TUN and other VPNs

TUN may require the client to install a helper service or network component. When a permission prompt appears, verify the app name and follow the client's setup process, then check that TUN is enabled. Grant only permissions needed for the feature; Full Disk Access is not a general-purpose fix. After a system upgrade, some permissions or background items may need to be confirmed again. Check system settings such as Login Items & Extensions before considering a reinstall.

Before enabling TUN, quit other VPNs and proxy clients. Pay special attention to apps that look closed in the menu bar but still have an active network extension. Two tools can modify the default route or DNS at the same time, causing traffic to take the wrong path, loop or fail only for some domains. If you need to use an organization VPN at the same time, configure routing according to its network ranges and follow your organization's requirements. Global mode in a personal client won't automatically resolve conflicts with work networks.

This is a mihomo TUN snippet to explain the fields, not a set of settings that every macOS client should paste in. A GUI client may generate these values based on the system, so use its settings first. Auto-routing and interface detection control how traffic reaches the core; accessing remote services still requires a working config and the right proxy group.

tun:
  enable: true
  stack: mixed
  auto-route: true
  auto-detect-interface: true

Sleep, network changes and restoring settings after uninstall

If websites stop working after you reopen your Mac from sleep, first check that Wi-Fi has an IP address and doesn't need an additional sign-in. Then check whether the core has recovered. If the issue starts after switching hotspots, turn off system routing, verify the direct connection works, then turn routing back on to separate network problems from proxy issues. Don't delete all your configs as soon as recovery fails; a single sleep event usually doesn't change the subscription itself.

If you enabled launch at login, check that the login item is allowed to run in the background and that the config starts after a reboot. Proxy environment variables set temporarily in the terminal usually apply only to that session. If you added them to a shell config file, they may remain after closing the GUI client. When troubleshooting, check both terminal environment variables and system proxy settings so you don't restore only one of them.

Android: VPN permissions and background operation

Choose an installer and grant permissions on first launch

In the Android downloads section, we recommend Clash Plus. Depending on the features you need, you can also choose Clash Meta for Android, FlClash or Surfboard. Check the system requirements and architecture before installing. Newer devices usually use ARM64; older ones may need an ARM or universal package. Open the downloaded file with the system installer. Allow your file manager or browser to install apps only if needed, then revoke that source permission after installation. There's no need to let every app install other apps indefinitely.

Import your subscription before connecting. Android will show a system VPN permission prompt through VpnService; approve it so the client can create a local virtual network interface. A VPN icon in the status bar only means the system tunnel is up. It doesn't confirm that the subscription's nodes or rules are working. If the permission prompt keeps appearing or the confirmation button can't be tapped, check for screen overlays, accessibility prompts or device management restrictions. Follow the system guidance instead of installing several different packages to try to bypass the prompt.

Import a subscription, select a proxy group and route apps

On the config page, add a remote config, enter the subscription URL and download it, then make it the active config. Watch for spaces or line breaks at either end; some chat apps split URLs across multiple lines. If import fails, read the full message to distinguish a network request failure, expired credentials or an unsupported format. Full YAML configs and node lists may need different handling. A URL opening in your browser does not mean it can be imported as a subscription.

After enabling the config, open the Proxies page, select Rule mode and choose an exit in the relevant proxy group, then start the VPN. Mobile VPN routing is not the same as a desktop system proxy, and you usually don't need to set a local proxy for Wi-Fi as well. If you previously set one manually, note its values and check whether it still needs to be there before testing. Avoid sending requests to an old port that's no longer listening. Start with the client's default connection method, then adjust advanced network stack settings only after it works.

Per-app proxy settings can either proxy only selected apps or bypass selected apps; these options do opposite things, so read the screen carefully. Some clients need to reconnect the VPN before applying changes to the app list. System download components, browsers, in-app web views and the main app may run as separate processes or packages. Selecting only the main app may not cover the entire sign-in or download flow. If a page loads but attachments fail, check which component is making the request before switching proxies.

Battery optimization and disconnects when screen is locked

If the client works in the foreground but disconnects after the screen has been locked for a while, check background restrictions first. In the app info, allow necessary background activity and adjust battery optimization using the options provided by your system. Keep the client's foreground service notification enabled. Some manufacturers also manage auto-start, linked launches and task cleanup separately, with menu names that vary by device. Changing just one setting doesn't guarantee the app is unrestricted. See Android VPN permissions and battery optimization for more details.

A background allowlist doesn't mean you need to disable battery saving across your entire phone. Make only the minimum changes needed for the client, then test notifications, page loading and connection status with the screen locked. If battery use is still high, check whether detailed logging is running continuously, subscriptions are updating too often or an app is repeatedly retrying failed requests. See Mobile battery drain and background activity for a troubleshooting sequence. Battery use in a single test depends on signal, screen time and workload, so one observation isn't enough to judge the client.

Always-on VPN, hotspots and network changes

Android's always-on VPN and “Block connections without VPN” are system-level options. The latter can leave your device offline if the client stops or fails to start, which may look like a Wi-Fi problem. Before enabling it, make sure you need that restriction and know how to turn it off again. In most standard setups, two apps that use Android's VPN interface can't run at the same time in the same user profile. Another firewall or filtering app may also be using it.

If the connection fails when switching from Wi-Fi to mobile data, check mobile data permissions, system time and carrier connectivity before reconnecting the VPN. If public Wi-Fi requires a sign-in page, temporarily turn off VPN routing while you authenticate, if system restrictions allow. If the client reports that the config loaded but no apps appear in its connection list, check VPN permissions and per-app selection first. If requests appear but all time out, check the proxy route, DNS and underlying network.

Surfboard and mihomo-based clients do not use exactly the same config formats or expose the same features. Don't try to force the same YAML into every client. Before switching apps, check which format your subscription provides, then set up VPN permissions and the per-app list again. Treat synced configuration and system permissions separately; permissions must be confirmed again on each device.

iOS: App Store installation and VPN configuration

Install Clash Plus and check your config source

We recommend Clash Plus for iPhone and iPad. Install it from the Clash Plus page on the App Store. Find product information on the official site, clashplus.io. The iOS downloads section provides a central link. Check the system requirements shown in the App Store, then prepare your own subscription URL or config file after installation. Installing the app does not mean you have a working proxy route.

On first launch, get familiar with the config list, proxy groups, connection toggle and logs. Interface labels may vary between releases; this guide focuses on what each feature does, not the exact button names. If you import a file shared from another app, check its extension and contents to make sure it's a config file rather than a saved web page or subscription instructions. Config account details are personal credentials, so hide the full subscription URL and node authentication fields in screenshots.

Import a subscription and add a VPN configuration

In config management, choose Add from URL, paste your subscription link and download it, then enable the config. After it appears in the list, check that its proxy groups have loaded and include a selectable exit. If the returned format isn't supported, use a format provided for the client or process the config in a trusted environment. Changing the file extension to YAML does not convert its format. Keep the original source for remote configs that need regular updates; otherwise, you could mistake a static import for a config that updates automatically.

When you first start a connection, iOS may ask to add a VPN configuration and require your passcode or biometric confirmation. Once authorized, return to the client to start the tunnel, then check the current connection on the system VPN page. If iOS won't let you add the configuration, check for Screen Time, device management or organization restrictions. For managed devices, ask your administrator which options are allowed. Don't remove a management profile to use a personal proxy.

iOS routes network traffic through a system network extension; it doesn't set one desktop HTTP proxy address for every app. If the client has options such as TUN or network stack, follow the client-specific implementation. Don't copy Windows service installation or virtual adapter instructions. For your first test, leave the default network settings in place, select Rule mode and a clear proxy group exit, then open a reproducible HTTPS page in your browser.

Rules, DNS and in-app connections

If the browser works but one app fails, first check whether the app appears in the connection list. If it doesn't, check for a special network path, another VPN or app-specific restrictions. If it does, inspect the matched rule, proxy group and error type. Some apps use UDP, separate DNS resolution or cached addresses, so a working web page doesn't prove they will work. After changing rules, quit and reopen the target app. If needed, reconnect the tunnel so new requests use the updated config.

DNS determines how domain names are resolved; proxy groups determine where connections go. Both need to be configured consistently. Changing the DNS server alone won't route all traffic through a proxy, and selecting a proxy exit won't fix an unreachable DNS resolver. For a single failing domain, note the domain, resolution result and matched rule, then make one small change at a time. See DNS leak tests and fake-ip configuration for the mechanics and limitations of fake-ip. Don't draw conclusions from just one result on a test page.

Network changes, auto-connect and config migration

When switching from home Wi-Fi to cellular, existing connections may drop briefly and new ones may be affected by the change in network address. Wait for the system connection to stabilize, then check whether the tunnel recovers. If it continues to fail, stop and reconnect it, and make sure cellular data is allowed for both the client and target app. On public Wi-Fi with a sign-in page, authenticate to the network before testing the proxy. Changing nodes and rules before network authentication is complete usually adds noise.

If you enable on-demand connection or a similar auto-reconnect feature, a system rule may turn the VPN back on after you switch it off manually. To pause it temporarily, check both the client's auto-connect settings and the system VPN status instead of repeatedly tapping the main toggle. Configure automatic behavior for how you use your network. Knowing exactly when the tunnel starts is more useful than always seeing a connected status, especially on unfamiliar networks, when accessing work resources or troubleshooting local devices.

When switching devices, you can migrate subscriptions and necessary rules, but check system permissions, auto-connect behavior and local network access again. Before enabling cloud sync, check what it includes; don't assume it will migrate logs, credentials and every local setting. Remove subscription copies you no longer need from the old device. If you think a URL has been exposed, update its credentials with the subscription provider instead of only deleting the entry from your client.

If the issue occurs only while the screen is locked, test a new request after unlocking separately from push notifications received while locked. These may use different system pathways. Note the network type, whether the signal changed and whether reconnecting is required. That helps distinguish system scheduling, network handoff and app behavior from a proxy node issue.

Linux: GUI clients and running the core

Choose a package for your distribution

For desktop use, choose Clash Verge Rev or FlClash from the Linux downloads section. Clash Verge Rev is our recommended starting point for this platform. Check your distribution and architecture before choosing a package: Debian- and Ubuntu-based systems usually use deb packages, while Fedora and similar distributions usually use rpm packages. Follow the package listed on the download page. Don't install an AMD64 package on an ARM64 machine, or mistake a core archive for a complete desktop app with a menu, subscription editor and system tray.

cat /etc/os-release
uname -m

Install the local package using your system's software installer or package manager, and review any dependency warnings. If the GUI won't open, launch the installed client from a terminal and check the error. Distinguish missing GUI libraries or display session issues from core configuration errors. Tray support varies across Wayland, X11 and desktop environments. A missing tray icon doesn't necessarily mean the app isn't running: check its window and process before changing desktop components.

Import a subscription and set the desktop proxy

Import a subscription in the GUI client, enable the config and choose a proxy group exit, much like on other desktop platforms. System proxy settings differ between desktop environments and apps: GNOME and KDE use different settings, and terminal programs may not read the desktop proxy at all. First use an explicit proxy command to verify the core's listening port. Then configure your current desktop environment. Don't change the desktop proxy, shell environment and package manager settings all at once and assume one web request tells you which layer worked.

curl --proxy http://127.0.0.1:7890 -I https://example.com

# Affects only the current shell and the child processes it starts
export http_proxy=http://127.0.0.1:7890
export https_proxy=http://127.0.0.1:7890
export no_proxy=localhost,127.0.0.1,::1

The HTTPS proxy variable here still uses an HTTP proxy endpoint. It means the tool establishes a tunnel through that endpoint; it does not require the local port to serve HTTPS. Supported variable names and configuration priority vary between tools, so check their documentation. After testing, use unset http_proxy https_proxy no_proxy to clear these settings for the current session. Before adding them to a shell startup file, check whether this machine needs a persistent local proxy; otherwise, terminal networking may break when the client is stopped.

TUN, permissions and DNS resolvers

Linux TUN usually requires /dev/net/tun and network permissions. With a GUI client, use its service installation process instead of elevating the entire user session. A container or restricted host may not have the required device or capabilities; running as an administrator may not be enough to create an interface. Confirm that the environment allows network routing before troubleshooting config fields. In a container, distinguish routes on the host, in the container network and in the app.

After enabling auto-routing, check for conflicts with existing VPNs, virtual machines and container bridges. DNS may also be managed by NetworkManager or systemd-resolved. Overwriting a resolver config file can either be reverted by the system or disrupt the current network. Check how DNS is actually resolved on the system, then decide which requests the client should handle. TUN DNS hijacking applies only to traffic on the relevant route; encrypted DNS built into an app needs separate consideration.

ip route
ip rule
resolvectl status
ss -lntp

Some Linux distributions don't include resolvectl. A missing command does not mean DNS is broken; use the network management tool your distribution actually uses. In routing output, check the default route, policy routing and duplicate virtual interfaces. In listener output, distinguish loopback from all interfaces. Don't post full output publicly: it may contain private subnets, interface addresses and organization network details.

When to use the mihomo core on a server

For servers, routers and other headless systems, choose the mihomo core from the downloads page. Before installing, check the operating system, processor architecture and binary requirements. Prepare a complete config, validate its syntax and start the core in the foreground to review its logs. The commands below assume the core is in your PATH and the specified path points to a valid config. They do not create nodes or proxy groups.

mihomo -t -f "$HOME/.config/mihomo/config.yaml"
mihomo -f "$HOME/.config/mihomo/config.yaml"

For long-running services, restrict access to the config file so ordinary users can't read subscription credentials. Keep only as much logging as needed and return to the normal level after troubleshooting. If sharing a proxy on your LAN, expose only the required listening address and firewall sources. Never publish the proxy port or controller interface to the public internet. When uninstalling or stopping the service, clean up its service definition, proxy environment variables and leftover routes, then confirm direct network access is restored.

Common config issues: trace the request path

Config won't load: check the download and parse errors

Keep the original error message and note when it occurred. Then distinguish a failed subscription request from a config parsing error. The request may have failed because the URL expired, the server is unreachable or the network requires authentication. Parsing problems often involve indentation, field types, unsupported protocols or referenced names. YAML requires space-based indentation, with correct list nesting and string types. If an error points to a particular line, check the previous line too; it may be missing a colon or quote. Don't just delete the flagged line.

If no nodes appear after import, check whether the response contains only a proxy list or whether the subscription download redirected to a login page. If nodes appear but a proxy group reports an error, check that its referenced names are correct and that any proxy provider downloaded successfully. Some rule sets require separate resources; a successful main config load doesn't mean all external files are ready. If the problem started after an update, restore a backup and compare what changed. Don't keep overwriting your only working copy.

No connection records: check how traffic gets in

If a target app makes a new request but the client shows no activity, check traffic routing before checking the proxy. For a system proxy, verify the address and port; for TUN, check service permissions and routes; on mobile, check VPN authorization and the per-app list. The app may be reusing an existing connection, so reopen it or make a new request after changing settings. Check the connection page's display filters too. If only one type of connection is shown, that doesn't prove all traffic is missing.

If the browser works on this device but the terminal doesn't, try an explicit proxy request. If another device can't use a shared proxy, check Allow LAN, the listening address and firewall rules. A loopback address only works on the device itself; other devices must connect to the proxy device's LAN address, not their own 127.0.0.1. The external controller port cannot replace the mixed port. If authentication is enabled, enter the matching credentials in the connecting app.

Connections appear but the result is wrong: check mode and rules

Rules are checked in order, so an earlier broad rule can take precedence over a more specific rule later in the list. Even when a proxy group matches, check its current selection: a group that looks like a proxy group can still be set to DIRECT. Global mode usually bypasses normal rule-based routing; use it briefly for comparison, not as a permanent substitute for fixing rules. Direct mode is useful for checking the underlying network. Test with new connections after switching modes, as existing ones may keep using their original route.

This snippet shows the order of rules. PROXY must be the name of an existing proxy group. This is not a complete config; don't use it to replace the entire subscription. Whether a domain rule matches also depends on whether the core knows the target domain. If an app connects directly to an IP address, don't assume a domain suffix rule will match it.

rules:
  - DOMAIN-SUFFIX,example.com,PROXY
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - MATCH,PROXY

Timeouts, DNS failures and protocol differences

A timeout can happen during DNS resolution, connection to the remote server, a protocol handshake or the target's response. Reproduce the problem using the same target, network and proxy selection, then change one variable at a time. If one proxy fails but others work, start by checking that proxy. If every proxy fails on one network, check network restrictions and DNS routing. A single speed test can help with selection but doesn't represent every protocol, website or time of day.

Web browsing mainly uses TCP; voice calls and some games may rely on UDP. The node protocol, server and client settings must all support the required connection. A working HTTPS page does not prove that UDP works. A badly incorrect system clock can also cause encrypted connection checks to fail, so start by enabling reliable time synchronization. After changing DNS, cached results may still affect tests. Start a new connection and, if needed, clear the cache using the system's recommended method; don't indiscriminately reset network settings.

Updates, overrides and recovery notes

Automatic subscription updates help keep remote configs current, but set the frequency according to the provider's guidance; more frequent updates aren't always better. If every update removes your custom rules, move them to an override feature supported by the client and check the merge order. Some options append to a list; others replace it entirely. The saved source file may differ from the config currently running in the core. Verify the final result in the client's active config view or logs.

When troubleshooting is done, restore the normal log level, turn off temporary Global mode and any LAN listener you no longer need, and make sure the current config is backed up. To go through the setup steps again, see the User Guide. For a term you don't recognize, the Glossary is quicker. Return to the relevant platform section for installation issues; for connection problems, trace the request path one layer at a time. You don't need to start by uninstalling and reinstalling.