Clash for Windows: Complete Installation and Setup Guide, from Installer to System Proxy

1. Check Your Windows Architecture and Client Type

On Windows, “installing Clash” usually means installing a graphical client that manages the proxy core. The interface handles subscriptions, toggles, and logs; the core listens on ports, matches rules, and connects to proxies. Clash Meta continued development under the name mihomo. Check the core documentation and release notes for supported configuration fields—don’t rely on the window title alone.

These instructions follow the Windows 11 settings paths; labels may differ slightly in Windows 10. The examples use a mihomo-based graphical client such as Clash Verge Rev, but button locations can vary between clients and versions.

1. Open Settings → System → About and check “System type.” In Windows 10, look under Settings → System → About.
2. If it says “x64-based processor,” choose an x64 or AMD64 build. AMD64 builds aren’t limited to AMD processors.
3. If it says “ARM-based processor,” choose an ARM64 build if the client offers one. If the download page has no ARM64 build, check the project’s supported platforms. An x64 installer is not a native ARM64 package.
4. Make sure your Windows version meets the client’s minimum requirements in its release notes. “64-bit” does not mean every Windows version is supported.

Choose a Windows client from our Download Center, then check the project’s release notes. Clash for Windows is no longer maintained. If you need to migrate an existing setup, back it up first, then import it into a maintained client. Don’t let two clients control the system proxy at the same time.

2. Install and Launch: Standard vs. Elevated Permissions

Keep a Rollback Option Before Installing

• Quit any old proxy client and temporarily disable its startup entry to prevent it from overwriting the system proxy after sign-in.
• Note the current settings under Settings → Network & Internet → Proxy. Don’t delete proxy scripts or server settings already configured on a work device.
• Save the installer in a dedicated folder. Fully extract portable packages before running them; don’t launch them from an archive preview window.

You usually don’t need to run the client as administrator to open the interface, import a configuration, or use the system proxy. The client may request elevated permissions to install a service, configure a virtual network adapter, or perform certain network operations. When User Account Control appears, check the app name and download source before approving.

Handle SmartScreen and Antivirus Warnings Separately

“Windows protected your PC” may be a SmartScreen reputation warning; it doesn’t necessarily mean malware was detected. Check the download source, any digital signature shown in the file properties, and the project’s release records. If you can’t verify the source, don’t run the file—don’t click through by default.

If Windows Security has quarantined the file, open Windows Security → Virus & threat protection → Protection history and check the detection name and affected path. Include those details when reporting the issue. Don’t disable real-time protection across the device or exclude the entire Downloads folder. On a managed device, contact your administrator.

3. Import a Subscription and Activate the Configuration

A subscription URL is provided to deliver proxy nodes or a complete configuration; it isn’t a website login address. A complete Clash configuration usually includes proxies, proxy groups, and rules. A subscription containing only a node list needs to be combined with a client or configuration template. If you see a format error, first check that the provider’s format is compatible with Clash or mihomo.

1. Open the client’s Subscription or Profiles page, then paste the URL using Add, Import, or the URL field.
2. Download or update the subscription, then confirm the client reports success—not just that a subscription name has appeared.
3. Select and activate the configuration. Some clients can store multiple profiles, but only one is active at a time.
4. Open Proxies, check that the proxy groups are listed, and select an available node for the group you plan to use.
5. Check the logs for YAML parsing errors, unknown proxy names, or failed rule-provider loads.

If importing returns a 401 or 403 error, check whether the subscription has expired, its token is still valid, or you’ve reached a device limit. For a timeout, check whether the subscription domain is reachable. Repeatedly clicking Update won’t fix an authentication error. Subscription URLs often contain account tokens, so redact the full URL in screenshots, logs, and support requests.

When using a remote subscription, avoid editing the downloaded main configuration directly; an update may overwrite your changes. For ports, rule overrides, and similar settings, use the client’s settings or override features where possible, then confirm the changes appear in the active configuration after reloading.

4. Enable the System Proxy: Check the Port, Then Test a Request

The system proxy directs apps that honor Windows proxy settings to a local proxy endpoint; it doesn’t capture traffic from every program. Browsers usually use it, but games, some command-line tools, and apps that manage their own network connections may not. An HTTP proxy also can’t handle arbitrary UDP traffic by itself.

Set the Local Proxy Address and Port

Find “Mixed port” or mixed-port in the client settings. The example below uses 7890; this isn’t a fixed default for every client. mixed-port accepts both HTTP and SOCKS proxy requests on the same port. If the client has separate HTTP and SOCKS ports, use the endpoint for the protocol you need.

1. Make sure the core is running, and note the actual mixed port.
2. Turn on the client’s System Proxy toggle, then check the server address and port in Windows Proxy settings. If your environment uses a PAC script, checking only the manual proxy fields isn’t enough.
3. Set the mode to Rule and select a node in the proxy group. In Rule mode, some sites may still connect directly; that can be the result of a rule, not a broken toggle.
4. Open a site you want to test while checking the destination, matched rule, and outbound route on the client’s Connections page.

Isolate the Issue with an Explicit Proxy Command

Run the following commands in PowerShell. The test domain is only an example for checking connectivity. Even if the request succeeds, that only confirms this request used the local proxy endpoint—not that every site or proxy group is working.

Test-NetConnection 127.0.0.1 -Port 7890
curl.exe --proxy http://127.0.0.1:7890 --connect-timeout 10 --max-time 20 -I https://example.com/

TcpTestSucceeded : True only means a TCP connection to the port was established. The second command also tests proxy handling, the connection to the destination, and TLS. If you see 200 Connection established, that confirms only the proxy tunnel was set up; check the destination’s response or any later error. Use curl.exe to avoid conflicts with an alias of the same name in some PowerShell environments.

5. TUN and Service Mode: Enable Them Only When Needed

TUN uses a virtual network interface and routing configuration to capture matching IP traffic. It’s useful for apps that don’t honor the system proxy. Service mode is a mechanism the client uses to manage background services and permissions. They’re separate settings: installing the service doesn’t enable TUN, and enabling TUN doesn’t guarantee every connection will use a proxy node.

1. First verify the subscription, nodes, and rules in system proxy mode. Disable other VPNs or virtual network tools to reduce the chance of routing conflicts.
2. In the client’s Settings, look for Service Mode or Service Management, then install and start the service as instructed for your client. If administrator permission is requested, verify what is requesting it.
3. Enable TUN Mode or Virtual Network Adapter Mode, then check the logs for permission errors, failed device creation, or failed route additions.
4. Run the app you want to test. Check the Connections page to see whether its requests appear, then verify the matched rule and final outbound route.

In mihomo configuration, tun.enable controls TUN, auto-route configures related routes automatically, and dns-hijack captures matching DNS requests. The client may generate these fields automatically; don’t paste a TUN configuration you found online over your subscription. Encrypted DNS, IPv6, LAN access, and process detection also depend on the specific settings and runtime environment.

If enabling TUN disconnects you from a company intranet, makes network printers unavailable, or breaks networking after sleep, turn TUN off first and restore the original network state. Then check routes and DNS one at a time. Don’t start by resetting the entire Windows network stack; that can affect existing VPNs, static IPs, and virtual switches.

6. Troubleshooting: Check the Entry Point, Rules, and Exit Route

Browser Bypasses the Proxy, but an Explicit Proxy Command Works

This usually means the local endpoint and at least one request path are working, so first check how the browser gets its proxy settings. Edge and Chrome generally use the system proxy, but extensions, startup flags, and organizational policies can override it. In Firefox, go to Settings → General → Network Settings → Settings and choose “Use system proxy settings.” Close all browser windows and reopen the browser after making changes.

Check the connection log too. If the request appears and matches DIRECT, check the rules and proxy group. If there’s no matching connection, check where the browser gets its proxy settings. An IP address shown by a website is only supporting evidence; it doesn’t replace the connection log.

No Websites Load After Enabling the Proxy

• Turn off the system proxy to test your regular connection. If that doesn’t work either, check Wi-Fi, Ethernet, captive portal sign-in, or your router first.
• If the local port test fails, check whether the core has started and whether the log reports address already in use.
• If the port works but the destination times out, try another node in the same proxy group and check whether the failure is a connection timeout, a TLS error, or a DNS resolution failure.
• If only a few domains are affected, check their matched rules, DNS results, and the destination site’s status. Don’t reinstall everything right away.

To check which process is listening on 7890, run the following command in PowerShell. The last column is the PID; look it up under the Details tab in Task Manager. Don’t end an unfamiliar process until you’ve confirmed what it is, especially if it’s a system or enterprise security process.

netstat -ano | findstr LISTENING | findstr ":7890"

If you change the mixed port to 7891, update the Windows system proxy, browser extensions, command-line environment variables, and any apps with manually configured proxy settings. If the client rewrites the system proxy automatically, verify the result as well.

Network Still Broken After Quitting the Client

Windows may still be pointing to a local port that is no longer active. Restart the client and turn off the system proxy, or remove the manual proxy in Windows Proxy settings. If you had a work proxy or automatic configuration script before, restore the values you noted earlier. For TUN, first follow the client’s steps to stop virtual adapter routing, then quit the app.

7. Final Configuration Checklist

• Record versions: Note the graphical client version and core version under About. Record them separately; don’t just say “latest version” when asking for help.
• Subscription status: The active configuration is up to date, and the proxy group you’re using has a node selected.
• Matching endpoints: The Windows proxy port matches the core’s listening port, and no other client is overriding it in the background.
• Visible traffic: Check the connection log for one proxied request and one expected direct request, and confirm which rule each matched.
• Works after reboot: Once the configuration is stable, enable startup and reboot to confirm the service, core, and system proxy start in the right order.
• Network recovers on exit: Your regular connection still works after turning off the proxy or quitting the client.

When updating the client, keep the subscription source and any necessary overrides; there’s no need to copy all runtime files from the old client into the new version’s folder. If something goes wrong, check in this order: is the local port listening → does the app’s traffic reach the core → which rule matched → can the node connect? This is more effective than repeatedly toggling every setting. See the Quick Glossary for terminology, or the Protocol Reference for field definitions.