Clash Verge Beginner FAQ: Subscription Setup, Proxy Modes, and Connection Issues

1. Why do I need a subscription after installing Clash Verge?

The client manages configurations, the system proxy, and the core. A subscription usually provides proxy nodes, policy groups, and routing rules. Installing the client alone does not give you a remote proxy server to connect to. Use a subscription URL from a service you are authorized to access. The client does not replace your service account or determine your data allowance or subscription period.

• Clash Verge Rev: A desktop GUI client for managing subscriptions and controlling the core.
• mihomo: The core that handles protocol connections, DNS, and rule matching; also commonly known as Clash Meta.
• Subscription configuration: Data describing proxy nodes and routing behavior—not an installer or a website login URL.

Before you start, have your subscription link ready and make sure your service is still active. If you only have a single ss:// or vmess:// node link, do not assume it can be imported as a complete Clash configuration. Check whether your provider offers a dedicated Clash or mihomo subscription instead.

2. How do I import a subscription and confirm it works?

Open the “Subscriptions” page in the left sidebar, paste the URL into the subscription field, and click “Import.” Wait for the configuration card to appear, then select it as the active configuration. In some versions, this option is under “New”; choose the remote subscription type and enter the URL. After importing, open “Proxies” and check that the policy groups and nodes are listed—not just a subscription card.

1. Copy the original URL and remove any leading or trailing spaces or punctuation added by a messaging app.
2. Finish importing and select the configuration. Check for parsing errors or a failed core reload.
3. Open “Proxies,” expand the policy group for external traffic, and select an available node.
4. Start with “Rule” mode, enable “System Proxy,” then open a webpage to test.

A subscription URL often contains a token that grants access to your account configuration, so treat it like a password. Hide the full URL in screenshots, and check request URLs before sharing logs. When asking for help with a configuration, share only excerpts with server credentials and subscription tokens removed.

3. What should I do about YAML errors, 403 responses, or import timeouts?

First, distinguish a download failure from content that cannot be parsed. A 403 usually means access was denied, a token expired, or the server has restrictions. A 404 usually means the path does not exist. For a timeout, check whether your current network can reach the subscription server. These issues are different from YAML indentation errors.

If the subscription server can only be reached through a proxy, but you do not yet have a working configuration, you may run into a catch-22 during the initial import. Get the configuration over another authorized network or ask your provider for an accessible endpoint. Never submit a token-bearing link to an unfamiliar online conversion site.

4. When should I use Rule, Global, or Direct mode?

For everyday use, start with “Rule” mode. The core checks configuration rules from top to bottom and routes each connection according to the first match. A rule can point to a proxy group, DIRECT, or REJECT. Rule mode does not automatically proxy all traffic outside mainland China and send all traffic within mainland China direct; routing depends on the active configuration.

• Rule: Routes traffic based on rules such as domains, destination IPs, and processes. Best for everyday use with a configured ruleset.
• Global: Sends every connection that reaches the core to the global policy. You still need to select the actual outbound route in the global group.
• Direct: Connections that reach the core go straight to their destinations without using a remote node.

“Global” does not force every program on your computer through the proxy; it only changes how connections that have reached the core are routed. If an app ignores the system proxy entirely, switching to Global usually will not solve the interception issue. You can briefly switch to Global to compare results, then return to Rule mode once you have identified the problem.

5. Why do some apps still connect directly with the system proxy enabled?

The system proxy is a setting for apps to use, not a network-level traffic redirect. Browsers generally follow it, but some download tools, terminal apps, games, and apps with their own networking stack may use separate settings. First, check the client’s “Connections” page: after triggering a new request, look for a matching domain or process entry.

Use an explicit proxy request to pinpoint the issue

Assuming your actual mixed port is 7897, run the request below in a Windows terminal. Specifying the proxy directly avoids the uncertainty of whether an app reads the system proxy settings. On macOS or Linux, replace curl.exe with curl.

curl.exe --proxy http://127.0.0.1:7897 --connect-timeout 10 --max-time 20 -I https://example.com

An HTTP response means the connection process completed for this request, but check the connection log to confirm which policy was matched. If the connection is refused, check the local listening port first. If the explicit proxy works but an app does not, check that app’s proxy settings and consider TUN if needed. Make sure the explicit proxy test succeeds before enabling TUN, so you do not conflate a node issue with a traffic interception issue.

6. Why does a node time out, or show normal latency while webpages fail to load?

A node latency test usually asks the core to request a specific test URL through the node; the result reflects only that request. A reachable test URL does not guarantee that every website, UDP traffic, or all DNS queries will work. Conversely, an unreachable test URL does not necessarily mean the node is completely down.

1. In “Proxies,” make sure you selected a node in the group actually used by your rules—not just switched nodes in an unrelated group.
2. Open “Connections,” find the failed request, and check the matched rule, policy chain, and destination address.
3. Switch to another node and retry the same URL without changing any other settings.
4. Open “Logs” and check errors from the same time to distinguish authentication failures, DNS errors, and connection timeouts.

If all nodes fail at once, first check whether your account has expired, whether you have data remaining, your local network, and your system clock. If only one site fails, focus on its rules and DNS results. A latency change from 80 ms to 120 ms does not mean the configuration is broken; connection establishment, throughput, and one-off latency are different metrics.

7. How do I find the app causing a port conflict?

The log message address already in use usually means another process is using the listening address and port. Common causes include an old proxy client still running in the background or another instance using the same port. Quit any duplicate clients first. If the conflict persists, identify the process using the port—do not terminate an unfamiliar system process.

On Windows, run the two commands below. The first filters for a local TCP listener on 7897 and shows its PID. The second looks up the program name for the PID you found; replace 1234 in the example with the actual result.

netstat -ano -p tcp | findstr LISTENING | findstr ":7897 "
tasklist /FI "PID eq 1234"

Alternatively, go to “Settings” → “Clash Settings” and change the mixed port to an unused value, such as 7898. If the menu has moved in your version, look for the field corresponding to mixed-port. After changing it, reload the core, toggle the system proxy off and back on, and update any browser extensions, terminals, or other apps where you manually entered the old port.

8. When should I use TUN mode, and why might it fail to start?

TUN mode uses a virtual network interface and routing to capture traffic, which is useful when apps cannot be configured to use a proxy. It operates at a different level from the system proxy, but is still affected by routes, process exclusions, core configuration, and system permissions. It cannot guarantee that all traffic will pass through a remote node.

• Windows: Check that “Service Mode” is installed and running under “Settings” before enabling TUN. Installing the service usually requires administrator approval.
• macOS and Linux: Make sure the client has the network permissions required by your version, and check the logs for permission errors.
• Another VPN is running: Temporarily pause other VPNs or virtual network tools that capture traffic to prevent conflicts over default routes and DNS settings.

If startup fails, note the first specific error and determine whether it involves permissions, interface creation, or route installation. When using Remote Desktop, avoid repeatedly switching unfamiliar TUN settings, as this could disconnect your session. TUN capturing traffic does not mean the node supports UDP; the protocol required by an app must be supported by both the node and the server.

9. Why did my custom rules disappear after updating the subscription?

Updating a remote subscription fetches the configuration again. Directly editing the downloaded file is usually not a reliable way to make lasting changes; a future update may overwrite them. For persistent rules, use the client’s supported override or extension mechanism and make sure it is associated with the active subscription.

Check Rule Order, Then Check the Policy Name

For example, to connect a sample domain directly, add the rule below. Place it before any broad rule that could match the request first—especially before the fallback MATCH rule at the end.

rules:
  - DOMAIN-SUFFIX,example.com,DIRECT

The example above shows only the structure of a rule field; it is not a complete subscription and should not replace your entire configuration. Override mechanisms may merge, prepend, or modify configuration with scripts, so do not assume that pasting a rules array will append it automatically. If the target is a custom policy group, its name must exactly match the final configuration. After saving, check the running configuration and connection log, then manually update the subscription to confirm the change persists. For details on the fields, see the configuration reference.

10. How do I restore my connection after quitting the client, and what troubleshooting details should I collect?

If the app has exited but your system still points to a proxy port on 127.0.0.1, your browser will send requests to an address with no program listening. First, reopen the client, turn off “System Proxy” and TUN, then exit normally. If you cannot start the client, restore your system network settings manually.

• Windows 11: Go to “Settings” → “Network & internet” → “Proxy.” Check “Use a proxy server” and “Use setup script,” and remove only settings left behind by this client.
• macOS: Go to “System Settings” → “Network” → your current network service → “Details” → “Proxies.” Check the web proxy, secure web proxy, and SOCKS proxy settings.
• Terminal: If you previously set HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY manually, remove the corresponding settings from the current terminal session and startup files too.

A company device may have proxy settings managed by your organization. Do not clear everything; record the original values and check with your administrator first. After restoring direct access, rebuild the setup one step at a time: start the core, confirm the port is listening, make an explicit proxy request, enable the system proxy, and only then test TUN.