Complete Windows Clash Setup Guide: Download, Install, and Enable the System Proxy

Check your Windows version and processor architecture first

There is more than one Clash client for Windows. The original Clash for Windows is no longer maintained; actively updated desktop clients typically use Clash Meta, powered by the mihomo core. Button names vary slightly between clients, but the workflow is largely the same: install the app, import a configuration, choose a node, enable the system proxy, and turn on TUN when needed.

Press Win + R, enter winver, and press Enter. Windows 10 22H2 or Windows 11 23H2, 24H2, or later is recommended. Older releases may lack the WebView2 runtime, network drivers, or libraries required by newer builds, causing a blank installer, an immediate exit after launch, or a tray icon with no usable main window.

x64, ARM64, and portable builds

Open “Settings” → “System” → “About” and check “System type.” Choose x64 for most Intel and AMD processors. Devices powered by ARM processors such as the Snapdragon X series should use ARM64. Do not select ARM64 merely because Windows says “64-bit”; ARM64 is specifically for the ARM architecture.

Download and install Clash on Windows

On the download page, choose Windows and the matching architecture. Installers commonly use .exe or .msi; portable packages are usually .zip files. After downloading, check the architecture in the filename before running the installer. Do not install an ARM64 build on a standard x64 PC.

Handle Microsoft Defender SmartScreen warnings

When you first run an installer published by a community project, Windows may display “Windows protected your PC.” If you have verified the file source and project name, click “More info,” confirm the app name and publisher, then select “Run anyway.” Whether a client is code-signed, and whether its certificate is current, affects whether this warning appears.

If the dialog only offers a block option, right-click the installer and open “Properties” → “General.” Files downloaded from a browser may show an “Unblock” checkbox. Select it, click “Apply,” and launch the installer again. On company-managed PCs, Group Policy may block unknown apps; contact your administrator because a standard account cannot bypass organizational policies.

How to assess antivirus blocks

• First verify that the download source, filename, architecture, and project release record all match.
• Check whether the alert targets the installer, the proxy core, or a temporary file extracted during an automatic update.
• Do not disable real-time protection entirely. If a file needs to be restored, act only on the verified installation directory.
• If multiple security engines continue to identify a specific Trojan family, pause the installation and wait for an explanation from the project maintainer.

Keeping the default installation directory is recommended. Installed builds typically write to the current user’s application directory or Program Files, while runtime data is stored in the client directory under %APPDATA% or %LOCALAPPDATA%. Do not extract portable builds into the system temp directory or run them from a ZIP preview window.

Import a subscription and complete the initial setup

After launching the client, look for “Configuration,” “Profiles,” or “Subscriptions.” Labels vary, but these pages normally include a URL import field. Paste the subscription URL supplied by your provider, then click “Import,” “Download,” or “Update.” Subscription URLs often contain account credentials, so do not share screenshots or paste them into untrusted online converters.

1. Open “Configuration” → “Subscription management” or “Profiles.”
2. Paste the HTTPS subscription link and give it a recognizable name.
3. Click Download or Import and wait for the client to parse the configuration.
4. Select the newly imported profile to make it active.
5. Open the “Proxies” page and choose a node with a reasonable latency or a proxy group.

When import fails, identify the error type first

HTTP 401 or 403 usually means expired subscription credentials, a truncated URL, or access restrictions on the server. A 404 often indicates that the subscription path has changed. Timeouts may be caused by the current network, DNS, or server status. If the client downloads a web page instead of a YAML configuration, logs commonly show parse failures, invalid field types, or unexpected content on the first line.

A standard Clash configuration normally includes ports, proxy nodes, proxy groups, and rules. With the mihomo core, you may also see rule-providers, proxy-providers, tun, and enhanced DNS settings. Do not randomly remove indentation to fix an import failure: YAML uses spaces to represent hierarchy, and tabs or inconsistent indentation will cause parsing errors.

mixed-port: 7890
allow-lan: false
mode: rule
log-level: info

proxies:
  - name: example-node
    type: socks5
    server: 192.0.2.10
    port: 1080

proxy-groups:
  - name: Node selection
    type: select
    proxies:
      - example-node
      - DIRECT

rules:
  - MATCH,Node selection

How to interpret latency results

Latency tests in the client usually use HTTP probes rather than ICMP ping. On a home connection, 30–120 ms to a nearby entry node is common; anything above 500 ms or repeated timeouts suggests that the route is currently unavailable or the probe address cannot be reached. The lowest latency does not guarantee the fastest downloads, which also depend on node load, international routing, and peak-hour congestion.

Enable the system proxy and verify that it works

Once the profile is active and a node is selected, return to “Settings,” “General,” or “General” and enable “System Proxy.” The client writes a local loopback address into Windows proxy settings, commonly 127.0.0.1:7890. If the configuration uses separate HTTP and SOCKS ports, 127.0.0.1:7890 may serve HTTP while 127.0.0.1:7891 serves SOCKS.

You can open Windows “Settings” → “Network & internet” → “Proxy” and check whether “Use a proxy server” is enabled. The address should be 127.0.0.1, and the port must match the client’s current port. When the client manages the proxy, avoid repeatedly editing Windows settings by hand; an incorrect port may remain after the program exits.

Confirm in three steps that traffic reaches the core

1. Open the client’s “Connections” page and clear or note the current connection count.
2. Open a new private browser window and visit a known-working HTTPS website.
3. Check whether the connection list shows the destination domain, matched rule, and final policy.

If the browser loads the page but no new entry appears in the client’s connection list, the browser may be using a separate proxy extension or another VPN may be handling the request. If the connection shows DIRECT, the traffic has reached Clash but the active rule selected a direct connection. A node name indicates that the request went through the corresponding proxy policy.

Rule, Global, and Direct modes

During troubleshooting, briefly switch to Global mode. If Global works but Rule mode does not, focus on rule sets, proxy group selection, and DNS. If neither mode works, continue checking the node, subscription, listening ports, and local firewall.

How to enable Service Mode and TUN mode

The system proxy affects only apps that honor Windows proxy settings. Some games, command-line tools, Microsoft Store apps, and software with its own network stack do not read them. In that case, consider TUN mode, which lets mihomo create a virtual network interface and handle more IP traffic.

Most clients provide an installation option under “Settings” → “Service Mode” or “System Service.” Installing the service requires administrator privileges; enable “TUN mode” afterward. Some clients call it Service Mode, Helper, or Daemon. The names differ, but the goal is the same: allow the network component to create interfaces, modify routes, and run in the background with sufficient permissions.

Recommended activation order

1. First disable the system proxy and TUN, then confirm that ordinary direct internet access works.
2. Install the service using the client’s built-in button; do not copy service files manually.
3. After installation succeeds, restart the client and confirm that the service status says “Running.”
4. Enable TUN and check whether Windows creates a new virtual network adapter.
5. Open the connection log and test both the browser and an app that normally bypasses the system proxy.

With TUN enabled, the system proxy can remain off or be enabled as the client recommends. When both are active, clients usually avoid processing traffic twice, but older versions or complex networks may create a loop. If connection counts spike, CPU usage stays high, or the same destination repeats in the log, first disable the system proxy and test with TUN alone.

Port conflicts, startup failures, and inaccessible websites

Port 7890 is already in use

Clash commonly uses 7890 as its mixed port, but it is not mandatory. If the log shows address already in use, bind failed, or “port already in use,” exit other proxy clients first, then use a terminal to identify the process holding the port.

netstat -ano | findstr :7890
tasklist /fi "PID eq process ID"

The last column of the first command shows the PID. Substitute the actual number in the second command to see the process name. After identifying the owner, close that program normally or change Clash’s mixed port to an unused port such as 7897 or 7898. Toggle the system proxy off and on afterward so Windows writes the new port.

The system proxy is enabled, but the browser is still offline

• Confirm that the current profile is active, rather than merely downloaded.
• Check that the proxy group has selected a working node and that latency tests are not continuously timing out.
• Open “Settings” → “Network & internet” → “Proxy” and confirm that the port matches the client.
• Disable proxy extensions in the browser so their settings do not override the Windows system proxy.
• Temporarily switch to Global mode to determine whether the issue is caused by the node or by rule-based routing.
• Look for terms such as DNS, TLS, timeout, and connection refused in the logs.

The computer loses internet access after exiting Clash

This usually happens when Windows keeps the 127.0.0.1 proxy after the program exits unexpectedly. Open “Settings” → “Network & internet” → “Proxy” and disable “Use a proxy server.” You can also restart the client, turn off “System Proxy,” and then exit normally. If TUN is enabled, make sure its virtual interface and service have stopped.

DNS resolution problems

If a node connects but domains do not load while entering an IP address works, check DNS. Common mihomo enhanced modes include fake-ip and redir-host. Fake-IP returns a mapped address first, then the core restores the domain and applies rule matching. If certain LAN devices, games, or enterprise software are incompatible, add their domains to the Fake-IP exclusion list instead of disabling DNS entirely.

The Windows DNS cache may also retain stale results. Run ipconfig /flushdns in a regular terminal to clear the system cache, then fully close and restart the browser. If the issue appears only with TUN enabled, check whether TUN DNS hijacking overlaps with another VPN, accelerator, or security product.

Startup, subscription updates, and routine maintenance

After verification, enable “Start on boot” under the client’s “Settings” → “Startup settings.” If you also use Service Mode, understand the division of responsibilities: the service handles privileges and network components, while the client interface handles profiles, node selection, and status. Do not create multiple scheduled tasks, which can cause duplicate launches and port contention.

Follow the update interval recommended by your provider. Common automatic intervals are 12 or 24 hours; refreshing every few minutes is unnecessary. If node names or proxy groups change after an update, check whether the previously selected policy still exists. A profile update may not preserve every local override automatically.

Troubleshooting details worth recording

• The Windows version, such as Windows 11 24H2.
• The client and core versions, such as mihomo 1.19.x.
• The installer architecture, such as x64 or ARM64.
• The current mode, mixed port, system proxy status, and TUN status.
• Log excerpts from immediately before and after the error; remove subscription URLs and credentials first.
• Whether the issue disappears after switching to Global mode, disabling TUN, or changing nodes.

If the client stops launching after an update, back up the configuration first, then close the client and background service before installing a stable version. Do not run two tools that modify system proxy settings or routing tables at the same time. After recovery, enable features in this order: activate the profile → choose a node → enable the system proxy → enable TUN. Test after each step to isolate the actual failure.