Clash for MacDownload & Setup

Rule mode selects an outbound based on the configured matching order, making it suitable for accessing local services and remote resources at the same time. Global mode generally sends requests that reach the core through the global proxy group, which can be useful for temporary comparisons. Direct mode lets you check what happens without a proxy. Switching modes does not create nodes or capture traffic from apps that never reached the client. First, make sure a usable option exists in the proxy group. Then send a new request and check its actual outbound on the Connections page. Existing long-lived connections may keep using their original route.

The system proxy points your operating system's network settings to the client's local listening address. It's suitable for browsers and desktop apps that honor that setting. Before enabling it, start the core and select a valid profile. Use the mixed port shown in the client. Some command-line tools, games, and apps with their own proxy settings won't use this entry point automatically; configure them separately or consider TUN mode. If the network stops working after you quit the client, check whether the system proxy still points to a stopped local service. Don't immediately change your subscription or reinstall the app.

TUN mode captures traffic through a virtual network interface and routes, making it useful for apps that ignore system proxy settings. It still depends on a valid profile, a working outbound, and correct DNS handling; it does not mean every request will be proxied. Before enabling it, read the selected client's service setup guide and consider administrator permissions, other VPNs, virtual network adapters, and security software. If local devices become unreachable or domain names stop resolving, turn TUN off to compare behavior, then check route exclusions and DNS settings. Change one setting at a time to narrow down the cause.

rules:
  - DOMAIN-SUFFIX,apple.com,DIRECT
  - GEOIP,LAN,DIRECT
  - MATCH,Proxy

Rules are usually evaluated from top to bottom, and the first match determines the outbound for a request. Domain suffix rules cover related domains, process rules match apps, and rule sets let you maintain large groups of entries as separate resources. Before editing, confirm the policy name matches a proxy group, and place specific rules before the catch-all rule. The Proxy shown in this example must correspond to an actual proxy group; don't copy it into every configuration unchanged. After editing, check that the profile loads, then review the matched rule in connection details. Don't judge rule behavior only by whether a page opens.

The Connections page shows request destinations, matched rules, and outbound routes. The Logs page helps trace errors while loading profiles, parsing configuration, and establishing connections. When troubleshooting, note the affected app and the time of the error, then retry the request to narrow down the records to check. If the request doesn't appear on the Connections page, check the traffic entry point first. If it does appear but fails, check DNS, the node, and the destination service. Temporarily raise the log level for more detail, then restore your usual setting. Before sharing logs, remove subscription URLs, node credentials, and personal browsing details.

The Profiles page manages subscription URLs, local files, and the active profile. After importing successfully, select the profile and check that the expected proxy groups appear on the Proxies page. Saving a subscription URL alone does not switch the core to that profile. Remote updates may overwrite edits made directly to a subscription file; use the client's supported override or merge features for rules you need to keep. Subscription conversion sends the original configuration to a conversion service, so check how it handles your data and whether you trust it. Before switching sources, keep a recoverable copy of your profile, but never commit files containing credentials to a public repository.