Install Clash on Windows: Complete Setup Guide, Proxy Configuration, and Common Fixes

Confirm your system, architecture, and client type before installation

On Windows, “Clash” usually refers not to one specific app but to a group of graphical clients built on the Clash or mihomo core. The original Clash for Windows is no longer maintained. Continuing to use an old installer can mean an outdated core, incompatible subscription fields, and system proxy restoration problems. For a new installation, choose a maintained client that clearly supports Windows, preferably with the mihomo core.

Before installing, open “Settings” → “System” → “About” to check your Windows version and system type. A typical PC shows “64-bit operating system, x64-based processor,” which corresponds to packages labeled x64, amd64, or x86_64. Devices with Qualcomm Snapdragon or other ARM processors should use arm64. Only older 32-bit Windows systems need x86 or ia32; most current clients no longer offer this architecture.

Installer or portable version?

• Installer: Usually provided as an .exe or .msi setup program. It can create Start menu shortcuts, an uninstall entry, and a startup task, making it suitable for a personal PC used regularly.
• Portable version: Usually distributed as an archive that runs after extraction. Configuration, logs, and core files may be stored in the extracted folder, so exit the client before moving it.
• Microsoft Store version: Updates follow a centralized path, but app permissions, data locations, and features may differ from the standalone build. Check the project notes before installing.

Download the installer and complete the first launch

Open the client’s Windows section from this site’s download page, confirm the architecture, and then download the installer. After the browser finishes, check that the filename, extension, release version, and source page match. If the project provides a digital signature, right-click the file and choose “Properties” → “Digital Signatures” to review the signer and signature status.

Handle Windows security warnings

When you first run a newer release with relatively few downloads, Microsoft Defender SmartScreen may display “Windows protected your PC.” This warning is based on file reputation and does not by itself mean that malicious behavior has been confirmed. First verify that the file came from the project’s official release channel, then click “More info” to review the app name and publisher. If the source cannot be verified, do not continue.

Keeping the default installation directory is usually the simplest option. For a portable build, do not run the program directly from the archive preview; extract it completely to a writable folder, such as an applications folder under your user profile. Avoid system directories that require administrator permission to write, or core updates, configuration saves, and log files may fail.

1. Exit any older Clash client that is running so its process does not occupy the port or system proxy.
2. Run the installer and review the installation path and startup options.
3. When setup finishes, launch the client from the Start menu and wait for the main interface and core status to load.
4. Open “Settings” → “Core” or “Settings” → “Core Settings” and confirm that the core starts normally.
5. Before importing a configuration for the first time, leave TUN disabled and use the system proxy for the initial checks.

Import a subscription and verify the configuration

The client itself does not provide usable nodes. Obtain a Clash YAML configuration URL or a subscription URL explicitly supported by the client from your service provider. A subscription URL is an access credential; do not paste it into public webpages, screenshots, log posts, or shared documents.

Menu names vary slightly between clients. Common paths include “Profiles” → “New” → “Import from URL” or “Subscriptions” → “Add subscription.” Paste the complete URL, set a name and update interval, and click Import. A successful import should show an update time, proxy groups, and a node count in the profile list—not merely create an empty profile.

Separate these three causes when an import fails

• URL cannot be reached: The browser returns 403, 404, a timeout, or a login page. Check whether the subscription has expired, whether any characters were lost during copying, and whether the server restricts access.
• Incompatible format: The URL returns content, but the client reports a YAML parse error, a missing proxies key, or an unknown field. A plain Base64 node list cannot be used directly as a complete Clash configuration.
• Configuration imports but contains no nodes: The subscription account may be inactive, filtering may have excluded every node, or the server may have returned an empty configuration.

A runnable Clash configuration generally contains proxy nodes, proxy groups, and rules. In rule mode, connections are matched from top to bottom against rules, with unmatched traffic handled by MATCH. “Configuration imported successfully” only means the file was accepted; it does not confirm node connectivity, correct rules, or an active subscription.

mixed-port: 7890
mode: rule
allow-lan: false
log-level: info

proxy-groups:
  - name: Node Selection
    type: select
    proxies:
      - DIRECT

rules:
  - GEOIP,CN,DIRECT
  - MATCH,Node Selection

The snippet above only illustrates the structure and cannot replace an actual subscription. mixed-port: 7890 means HTTP and SOCKS traffic share local port 7890. Some clients use HTTP 7890 and SOCKS 7891 separately, while others may override the port in the configuration file through the graphical interface. During troubleshooting, use “Settings” → “Port Settings” or the listening address shown in the runtime log as the source of truth.

Enable the system proxy and verify each layer

After importing the subscription, open “Proxy,” select a node in the target proxy group, and set the mode to “Rule.” Then open “Settings” → “System Proxy” and enable the switch. The client will usually set the Windows proxy server to 127.0.0.1, with the port pointing to the local HTTP or mixed port, such as 7890.

Layer 1: Confirm the core and node

1. Check the client’s status bar and confirm that the core is running.
2. Run a latency test on the “Proxy” page. The latency only shows that the test address is reachable; it does not mean every website will work.
3. Open “Logs,” keep the level at info, and look for authentication failures, connection timeouts, DNS failures, or rule parsing errors.
4. Open “Connections,” visit a test website, and confirm that a new TCP or UDP session appears.

Layer 2: Confirm the Windows system proxy

Press Win + I to open “Settings” → “Network & Internet” → “Proxy.” After enabling it, the area around “Use a proxy server” should show the local address and port. Do not enable an old proxy app, a browser proxy extension, and another system proxy tool at the same time; the last program to write the settings will overwrite the previous one.

You can check the WinHTTP proxy in Command Prompt, but note that WinHTTP and the WinINET system proxy used by ordinary desktop apps are separate settings:

netsh winhttp show proxy

If this command shows “Direct access,” that does not necessarily mean the Clash system proxy is broken. Desktop browsers such as Chrome and Edge usually read the Windows system proxy, while some system services read WinHTTP settings. Do not blindly run a global import just to change the command output unless you have confirmed that the target program depends on WinHTTP.

Layer 3: Verify separately with a browser and the command line

For browser testing, first disable proxy extensions, open the target site in an incognito window, then return to Clash’s “Connections” and “Logs” pages to inspect the records. If the browser works but PowerShell does not, the command-line program usually is not reading the system proxy—not a failure of the Clash core.

Use curl.exe to avoid the curl alias differences in older PowerShell versions and specify the local HTTP proxy directly:

curl.exe -I --proxy http://127.0.0.1:7890 https://example.com
curl.exe -I https://example.com

If the first command succeeds and the second fails, the Clash listening port and node are basically working, but the terminal is not automatically using the system proxy. Set environment variables in the current PowerShell session:

$env:HTTP_PROXY="http://127.0.0.1:7890"
$env:HTTPS_PROXY="http://127.0.0.1:7890"
$env:ALL_PROXY="socks5://127.0.0.1:7890"

These variables affect only the current terminal and its child processes. Some tools recognize only lowercase variables, while others have their own proxy options. Git can be configured with git config; npm, Python package managers, and development tools should be configured according to their own documentation. Do not generalize from browser results to every command-line program.

Port conflicts, lingering proxy settings, and LAN access

Port 7890 is already in use

When the core log shows “address already in use,” “bind failed,” or “unable to bind port,” another process is already listening on that port. Open Command Prompt as administrator and run:

netstat -ano | findstr :7890
tasklist /fi "PID eq 1234"

The far-right column of the first command shows the PID. The 1234 in the second command is an example; replace it with the actual number you find. After confirming what the process does, exit the conflicting software or change the mixed port to an unused value, such as 7892, under “Settings” → “Port Settings.” Then toggle the system proxy off and on again so Windows records the same port the client is listening on.

The internet remains disconnected after exit

If the client is force-closed, Windows crashes, or an update fails, Windows may retain a proxy setting pointing to 127.0.0.1:7890 even though no program is listening on the local port. Open “Settings” → “Network & Internet” → “Proxy,” disable “Use a proxy server,” and restart the client. If the browser still reports a proxy error, fully exit and reopen it because some processes cache network settings.

Allow LAN devices to connect to this computer’s proxy

By default, listening on 127.0.0.1 allows access only from the local computer. Enable “Allow LAN connections” or set allow-lan to true only when a phone or another computer needs to connect. Then find the current LAN IPv4 address, such as 192.168.1.25, and enter that address together with the Clash port on the other device.

LAN access is also affected by Windows Defender Firewall, network profiles, and client isolation on the router. Set a home network to “Private” and allow the client to listen only on the network ranges that need it. Opening a local proxy port on a public network is not recommended.

UWP apps versus TUN mode

The traditional system proxy mainly covers apps that actively read Windows proxy settings. Some Microsoft Store apps use a UWP sandbox that does not allow loopback access by default. As a result, a Store app may connect directly or report a network error even while the browser works through 127.0.0.1:7890.

UWP loopback exemption

Clients that support this feature usually provide “Settings” → “UWP Loopback” → “Launch Helper.” Select the apps that need the proxy and save. Add exemptions only for apps that genuinely need local proxy access; selecting everything is unnecessary. After a system upgrade or app reinstall, the package identity may change, so check again.

PowerShell can be used to view app package names:

Get-AppxPackage | Select-Object Name, PackageFamilyName

The command-line tool CheckNetIsolation.exe can also manage loopback exemptions, but package family names are long and easy to select incorrectly. Prefer the graphical helper provided by the client, and fully exit and reopen the target UWP app after making changes.

When do you need TUN?

TUN mode creates a virtual network interface and takes over more traffic at the network layer. It is useful for apps that do not read system proxy settings, some game launchers, command-line tools, and scenarios requiring UDP forwarding. The mihomo core can use TUN on Windows, but the client may also need to install a service or driver, or require administrator permission during initial setup.

A common setup path is “Settings” → “Service Mode” → “Install,” followed by enabling TUN under “Settings” → “TUN Mode.” Exact names vary by client. If TUN still will not start after the service is installed, restart the client or Windows and check the logs for virtual adapter creation failures, route write failures, or DNS listening-port conflicts.

Troubleshoot startup failures and background services

“Start on boot” has at least two parts: whether the graphical client starts after sign-in, and whether the mihomo core or service runs correctly with it. Seeing only a tray icon does not prove that the core is listening on a port; conversely, a background service running does not prove that the system proxy has been written to Windows.

Check client startup

1. Open “Settings” → “Start on boot” in the client, turn it off, and enable it again.
2. Press Ctrl + Shift + Esc to open Task Manager, go to “Startup apps,” and confirm that the corresponding item is marked “Enabled.”
3. Press Win + R, enter shell:startup, and check for broken shortcuts left by an old client.
4. If the client uses a scheduled task, open Task Scheduler and review the latest run result and trigger conditions.

After some clients change their installation path during an update, an old startup entry may still point to a deleted executable. Disable in-app startup, fully exit the client, then reopen it and enable startup again. Portable builds likewise require the startup entry to be rebuilt after the folder is moved.

The system proxy does not turn on automatically after startup

Check whether “Restore system proxy on startup” or a similar option appears near “Settings” → “System Proxy.” Some clients start the program without enabling the system proxy to prevent an abnormal shutdown from leaving the network locked. If automatic takeover is needed, enable both startup launch and system-proxy activation after launch, and confirm that security software is not blocking the app from changing proxy settings.

If you use TUN, also check the service status. Press Win + R, enter services.msc, and confirm that the service installed by the client is not disabled. Service names vary by client; identify the correct one from the installation log and client settings. Do not delete a system service whose purpose you cannot verify.

DNS, rule mode, and “connected but cannot open pages”

When node latency is normal but webpages will not open, the problem may lie in DNS, rule selection, IPv6 routing, or the target site’s handshake. First check which rule and proxy group the request matched on the “Connections” page, then inspect “Logs” to see whether the error occurred during name resolution, proxy connection, or the TLS handshake.

Narrow the scope by symptom

• Domain fails, IP works: Check the DNS configuration, port 53 conflicts, and TUN DNS hijacking status first.
• Every request shows DIRECT: Check whether the current mode was mistakenly set to “Direct” and whether the final rule sends traffic to the wrong policy group.
• Works in Global mode: This usually indicates a rule-matching or policy-group selection problem. Do not use Global mode indefinitely to hide a configuration error.
• Only UDP apps fail: Confirm that the node protocol, server, and client all support UDP, and check whether TUN is actually taking over the app’s traffic.
• The browser occasionally continues using the old route: Disable secure DNS or proxy extensions in the browser for comparison, then fully exit its background processes.

Rule mode is the recommended starting point for everyday use. It selects DIRECT, REJECT, or a proxy group based on the domain, IP, process, or rule set. Global mode sends most connections to the selected proxy group and is useful for short-term comparison; Direct mode bypasses the proxy. After changing modes, send a new request and confirm the outbound policy for the new session in the connection record.

A repeatable installation checklist

1. Open “Settings” → “System” → “About” and confirm the x64 or ARM64 architecture.
2. Choose a client that is still maintained and supports your current Windows version.
3. Download an installer from the official release page, or fully extract the portable version.
4. After the first launch, confirm that the core is running before enabling TUN.
5. Import a Clash YAML subscription from the “Profiles” or “Subscriptions” page.
6. Select a node on the “Proxy” page and set the operating mode to “Rule.”
7. Open “Settings” → “System Proxy” and verify the local address and port.
8. Verify the traffic path through the browser, connection records, and logs.
9. Verify terminal programs separately with curl.exe --proxy.
10. When a port error occurs, use netstat -ano to find the process holding it.
11. Configure a loopback exemption when a UWP app cannot connect.
12. Install the service and enable TUN only after the system proxy passes verification.
13. Finally, test startup, configuration updates, and proxy restoration after an unexpected exit.

The key to installing Clash on Windows is not clicking the installer repeatedly; it is mapping the installer, core, subscription, listening port, system proxy, and app traffic layer by layer. Change one component at a time and check “Connections” and “Logs” together. Most issues can then be narrowed to a clear boundary.