Clash Verge FAQ
Clash VergeFAQ and Troubleshooting
Start with client, core, and architecture selection, then work through subscription imports, system proxy settings, TUN, DNS, node timeouts, and Windows loopback issues.
Getting Started
Clients, cores, and proxy modes
Start by separating the graphical client, mihomo core, processor architecture, and traffic-capture method so package issues do not get mixed up with configuration issues.
How are Clash Verge, Clash Verge Rev, and the mihomo core related?
Clash Verge is a desktop graphical client for importing configurations, switching proxies, managing the system proxy, and viewing logs. Clash Verge Rev is a community-maintained fork. mihomo is the proxy core called by the client; it parses configurations, establishes connections, applies rules, and handles DNS. The UI version and core version are separate, so check them independently when troubleshooting compatibility.
Which client should I choose for Windows, macOS, Android, iOS, and Linux?
For desktop systems, prioritize a maintained graphical client that supports mihomo. On Android, choose a version matching your device’s APK architecture. On iOS, use a client published on the App Store. Linux desktops can use a graphical client, while servers and routers typically run the mihomo core directly. Before downloading, verify the OS version, processor architecture, and package format.
How do I tell x64, ARM64, Apple Silicon, and Intel versions apart?
Most Windows PCs use the x64 or AMD64 version; choose ARM64 only for Windows devices with ARM processors such as Qualcomm chips. Macs with M-series chips use Apple Silicon and need arm64 or aarch64; older Intel Macs use x64 or x86_64. If unsure, check the processor or chip information in system settings rather than guessing from the device’s release year.
What is the difference between Rule, Global, and Direct modes?
Rule mode follows the configuration’s rule sets to send connections through a proxy, directly, or reject them, making it suitable for daily use. Global mode sends most interceptable connections through the selected proxy policy and is useful for temporarily testing a node. Direct mode bypasses proxy nodes and helps determine whether the client is causing the issue. After switching modes, start a new connection; existing connections may keep their previous route.
What is the difference between the system proxy and TUN mode?
The system proxy affects apps that honor the operating system’s proxy settings. It is easy to configure and toggle, but some games, command-line tools, and specialized network programs may ignore it. TUN mode uses a virtual network interface to capture a broader range of traffic, but it also requires system permissions plus compatible routing and DNS settings. Start with the system proxy and enable TUN only when broader traffic capture is needed.
Installation & Setup
Subscription imports, installation, and permissions
Check three lines of evidence: whether the configuration is valid, whether the package matches the system, and whether system authorization is complete. This usually locates the issue faster than repeated reinstalls.
What should I do if an imported subscription link is invalid or returns no content?
First, open the link in a browser to confirm that it still works, and check that no spaces, line breaks, or trailing punctuation were copied with it. If it returns a login page, error page, or blank response, resolve authorization or expiration issues with the subscription provider. If the link opens but the client cannot parse it, the response format may be incompatible with the current core. Check parsing errors in the logs and ask the provider whether the subscription supports Clash or mihomo configuration formats.
Why are no proxy nodes visible after importing a subscription?
Confirm that the new configuration finished downloading and is set as the active configuration rather than merely stored in the configuration list. Then check that the proxy page uses the correct policy group and that the file actually contains entries such as proxies, proxy-providers, and proxy-groups. If the logs report invalid field types, indentation errors, or failed rule-provider loads, fix the configuration format before reloading it.
Does Clash Verge need administrator privileges to install or start on Windows?
Routine UI operations and the system proxy generally do not require the client to run as administrator, but installing a service, creating a TUN interface, or changing certain Windows network settings may trigger a permission prompt. Download a package matching the system architecture and verify the program name and source shown in the prompt. If permission requests repeat, check whether the service was installed successfully instead of always launching the client as administrator.
What should I do when macOS says the app cannot be opened or the developer cannot be verified?
First, confirm that the package matches your Intel or Apple Silicon architecture, then drag the app from the disk image into the Applications folder. If macOS blocks it, open the Privacy & Security page in System Settings, review the related record, and use the explicit option provided by macOS to confirm the launch. Do not weaken system-wide security settings for a single app; if the file is damaged, download the package for the correct architecture again.
What should I do if enabling TUN reports insufficient permissions or service installation failure?
Quit other proxy or VPN programs that may create virtual network adapters, then install or reinstall the service through the client’s provided entry point. On Windows, check that the system service starts normally. On macOS, complete the network extension authorization. On Linux, confirm that the current account can create TUN devices and modify routes. Restart the client after installation; if it still fails, inspect device-name, permission, and routing errors in the logs.
Can I install the desktop version of Clash Verge directly on iOS?
No. Clash Verge is a desktop client. On an iPhone or iPad, use an iOS network client published for the platform, such as Clash Plus on the App Store. Import the subscription using the supported method, then authorize it when iOS displays the network configuration prompt. Desktop packages, Windows executables, and Android APKs cannot be used on iOS.
Usage Tips
System proxy, rules, and DNS
Confirm that system settings match the client’s listening state before handling subscription overrides, rule resources, and DNS modes. This reduces repeated edits after configuration updates.
What should I do if the system proxy is enabled but a browser or app still connects directly?
Confirm that the active configuration is enabled and the proxy port is listening, then test in a newly opened browser window. Some apps use independent proxy settings, extensions, or a fixed networking stack and do not read the system proxy; an old proxy address may also override it. Check that the system proxy host and port match the client, then review the app’s own settings. If traffic is still not captured, consider whether TUN mode is required.
Will updating a subscription overwrite manually selected nodes and rules?
A subscription update normally replaces configuration content generated from the remote URL, so nodes, rules, or DNS changes written directly into the subscription file may disappear on the next update. Whether the previous policy-group selection is retained depends on the client’s persistence behavior and whether the group name changes. For lasting changes, use the client’s override, extension-script, or configuration-merge features, then check the logs and policy groups after updating.
How should Clash ports be configured, and how can I identify a port conflict?
Typical configurations provide separate HTTP, SOCKS, or mixed ports; use the values shown in the active configuration and the client’s settings. The system proxy must point to the local machine and match the port actually being listened on. If startup logs show “address already in use” or a port-occupied warning, another program is already listening on that port. Close the conflicting program or choose an unused port, then update the system proxy and any manually configured apps.
How often should Clash GeoIP data or rule sets be updated?
GeoIP, GeoSite, and remote rule sets have no universal update schedule. Follow the configuration maintainer’s release cadence and your actual matching needs. If rules work normally, there is no need to refresh them frequently. Update when domain classifications change, a rule provider download fails, or logs indicate that a resource is outdated. Keep a working configuration before updating, then check provider status, the final matched rule, and DNS results afterward.
How should I choose between fake-ip and redir-host mode?
fake-ip first returns reserved addresses, then the core associates them with domains and applies rules, which generally enables more direct domain matching. redir-host returns real DNS results and can be clearer for some LAN devices, special applications, or scenarios that depend on real addresses. If LAN domains, printers, games, or a particular app behave unexpectedly, check the fake-ip filter list before replacing the entire DNS setup.
Troubleshooting
Timeouts, lost connectivity, and log analysis
Narrow the scope first: one node, one configuration, one app, or the entire device. Restore basic connectivity, then use the target address and error type in the logs to continue.
What should I check first when a single node keeps timing out?
Switch to another node in the same subscription to determine whether the issue affects one node or the entire configuration. Then verify the node address, port, protocol parameters, and system time, and confirm that the test address itself is reachable. A failed latency test does not necessarily mean every connection will fail; compare real access with the logs. If only that node repeatedly shows connection refusals, handshake failures, or timeouts, ask the node provider to check its service.
How should I troubleshoot when every node is unavailable or times out?
Switch to Direct mode to verify that the local network works, then pause TUN and the system proxy to rule out leftover routes. Reload the active configuration and check whether the subscription has expired, whether DNS can resolve node domains, and whether the system time is accurate. If multiple configurations fail, inspect the firewall, other VPN programs, and local security software. If only one subscription fails, focus on its contents and the remote service status.
What should I do if Windows UWP or Store apps bypass the system proxy?
Some UWP apps are affected by Windows loopback restrictions. Even when a browser uses the system proxy, the app may be unable to reach the local proxy port. Use the UWP loopback tool provided by the client, select the apps that need proxy access, and save the settings. Fully quit and reopen the target app afterward. If it does not appear in the list, launch it once, then check its package identity and the current user’s permissions.
How can I restore connectivity and diagnose the problem after enabling TUN breaks all network access?
Turn off TUN and the system proxy, quit the client, and confirm that direct connectivity has returned before continuing. This avoids repeatedly changing settings while routes are incorrect. Before enabling TUN again, check the TUN service, auto routes, strict routing, DNS hijacking, and network-interface selection, and temporarily quit other virtual-adapter programs. If connectivity drops immediately, inspect route writes, DNS listeners, and interface-creation errors in the logs, then restore settings one at a time.
What do DNS, TLS, and “connection refused” errors in the logs mean?
A DNS error usually means the resolver is unreachable, returned an abnormal response, or DNS hijacking was not applied. A TLS error is often related to the system time, certificate chain, server name, or protocol parameters. “connection refused” means the destination is reachable but its port is not accepting connections. During troubleshooting, record the time, target domain, selected policy, and matched rule, then determine whether the issue lies in the local configuration, node connection, or destination service.