Install and Set Up Clash on Windows: Download, Configure, and Enable the System Proxy

1. Before You Install: Client, Core, and Subscription

Using Clash on Windows involves three separate components: the client provides the interface, system tray, and access to system settings; the core reads the configuration and handles connections; and a subscription or local YAML file supplies nodes, proxy groups, and rules. A successful installation only means the app can start. It does not mean you have a working route or that browser traffic is being sent through the proxy.

Clash Meta continues development under the name mihomo. Clients based on mihomo can use configuration fields supported by that core, but older Clash cores may not be able to read the same configuration. If you see errors such as “unsupported proxy type” or “unknown field,” first check the subscription format and core compatibility rather than repeatedly reinstalling the app.

Three Things to Check Before Downloading

Windows version and architecture: Open Windows Settings → System → About and check “System type.” Most 64-bit Intel and AMD PCs need the x64 build. For ARM devices, check whether the client offers an ARM64 package and supports your device.
Client and core versions: After installation, note both versions in the About or version information section. Include both when reporting an issue; “latest version” alone isn’t enough.
Configuration source: Get a Clash- or mihomo-compatible subscription URL from your provider, or prepare a working YAML file. An account management page URL usually cannot be imported as a subscription.

2. Download and Install: Test the Standard Proxy Before Changing Permissions

Choose a Windows client from the downloads page on this site, and check its system requirements, architecture, and maintenance status. If you already have an older client, turn off its system proxy and quit it from the system tray first to prevent both apps from competing for the same listening port.

Install or extract the app. Follow the installer, or fully extract a portable archive to a fixed folder, such as C:\Tools\ClashClient. Don’t run the app directly from inside an archive utility.
Start the app normally. For the first test, use the system proxy and leave TUN disabled. A standard local proxy usually doesn’t require running the entire client as an administrator.
Check the system tray and core. The app may keep running in the notification area after you close its window. Check the logs for configuration load failures, port binding errors, or a core that keeps exiting.
Leave auto-start off for now. Enable “Start on boot” or “Enable system proxy at startup” only after you’ve tested the subscription, rule mode, and website access. This keeps troubleshooting simpler.

SmartScreen and Antivirus Warnings

If you see “Windows protected your PC” after downloading a file, treat it as a reputation or risk warning—not as proof that the file is safe or unsafe. First confirm where you downloaded it, check the publisher in the file properties, and review the specific detection name from your security software. If you can’t verify the source, don’t run the file. Turning off real-time protection is not an installation step.

If the file disappears after you start the app, open Windows Security → Virus & threat protection → Protection history to check what was blocked and why. On a work PC, organization policies may also restrict app execution or driver installation; ask your administrator to verify. Only consider handling a file-specific detection after confirming its source and risk. Don’t exclude your entire Downloads folder.

3. Import a Subscription: Downloading It Isn’t Enough

Open the client’s “Subscriptions,” “Configurations,” or “Profiles” page and add the subscription using “New,” “Import,” or a URL field. The menu depends on the client. Make sure you both fetch the configuration and select it as the active one: seeing it in the list doesn’t necessarily mean the core is using it.

Paste the complete subscription URL, check for leading or trailing spaces, and keep any existing query parameters.
Download or update the subscription, then check the result. After a successful update, confirm that nodes and proxy groups appear.
Activate the imported configuration and check the logs to confirm it loaded.
Open the “Proxies” or “Proxy Groups” page. Make sure the main group used by your rules has a working node selected, or that the configuration’s automatic selection group is active.

Subscription Errors: Check the Response Type

What you see	What to check first
HTTP 401 or 403	Check whether the token is valid, your account has permission, and the provider allows access. Read the response details; reinstalling won’t fix this.
HTTP 404	Check that the URL is complete and whether your provider has changed the subscription address.
Timeout or DNS lookup failure	Check your local network and access to the subscription domain. Confirm that an old proxy setting isn’t affecting the download request.
YAML parsing error	Check whether the response is a login page or error page, or whether the configuration file has broken indentation.
Unsupported proxy type	Check whether the subscription format matches your current core and whether the client’s core supports the protocol in use.

4. Rule Mode and System Proxy: Configure and Test Them Separately

For your first setup, choose “Rule” mode. Rules determine whether requests handled by the core go direct, through a proxy group, or are rejected. “Global” mode generally sends requests to the global policy, while “Direct” bypasses remote proxy nodes. Switching modes changes how the core handles traffic; it doesn’t make every app send requests to the core.

Turn on “System Proxy” in the client, then check the manual proxy status in Windows Settings → Network & Internet → Proxy. The client often sets the server to 127.0.0.1 and uses the current HTTP or mixed listening port. Some clients connect through other proxy settings; follow the client’s documentation and don’t add conflicting manual settings on top.

Use the Same Port Throughout the Connection Path

For example, if your configuration uses mixed-port: 7890, the explicit HTTP test address is http://127.0.0.1:7890. A mixed port accepts both HTTP and SOCKS proxy connections. A SOCKS-only port cannot be used directly as the Windows manual HTTP proxy port. The external-controller management interface is not a browser proxy endpoint.

Check the listener first: Make sure the core is running on the target port and the system proxy uses the same address and port.
Then check the traffic: Open a new page in Edge or Chrome and see whether the request appears in the client’s Connections list.
Finally, check the route: Review the rule, proxy group, and node used by the connection. It’s normal for sites allowed by your rules to connect directly.

Browser extensions, organization policies, and app-specific proxy settings can override system settings. In Firefox, also check Settings → General → Network Settings and make sure “Use system proxy settings” is selected. So, “system proxy is on” does not mean “all apps use the proxy.”

5. Verify Your Setup: Separate Port, Node, and App Issues

First check the local port in PowerShell, then make an explicit proxy request. The commands below use mixed port 7890 as an example. The test URL demonstrates the method; results depend on the destination site and network access. This is not a measured performance result, and no specific response time is expected.

PowerShell · Local Listener and Explicit Proxy Test

Test-NetConnection 127.0.0.1 -Port 7890
curl.exe -I --connect-timeout 10 --max-time 20 --proxy http://127.0.0.1:7890 https://example.com/

TcpTestSucceeded: True only confirms that the TCP port is reachable; it doesn’t mean the remote node works. The second command explicitly specifies a proxy, eliminating whether the app uses the Windows system proxy as a variable. It uses curl.exe to avoid parameter differences caused by the curl alias in Windows PowerShell.

Can’t connect to the local port: Check that the core is running and the port is correct. Start by resolving configuration loading or listening errors.
Port is reachable, but the proxy request fails: Check the selected node, matched rule, credentials, DNS, and destination. Review the logs from the same time.
Explicit proxy works, but the browser fails: Check Windows proxy settings, browser extensions, and the browser’s own network settings.
The site loads, but there’s no entry in the Connections list: It may have used a direct connection, browser cache, or another proxy. Make a fresh request to check.

For HTTPS requests, 200 Connection established in the output means only that the HTTP CONNECT tunnel was established. Check the subsequent TLS handshake and destination response too. A 403 from the destination doesn’t mean the proxy port is down; review the full output to tell whether the destination site or the proxy path rejected the request.

6. Common Installation Issues: Port Conflicts, Permissions, and Overridden Settings

Port 7890 Is in Use: Identify the Process Before Taking Action

If the logs show address already in use or a binding error, use PowerShell to find the process listening on the port. The command below only reads information and won’t stop anything. You may need administrator privileges to see more process details.

PowerShell · Check Which Process Uses a Port

Get-NetTCPConnection -State Listen -LocalPort 7890 |
  Select-Object LocalAddress, LocalPort, OwningProcess

Get-Process -Id (Get-NetTCPConnection -State Listen -LocalPort 7890).OwningProcess

If it’s an old proxy app, quit it normally. If you need to keep that port, change the current client’s port setting or persistent override to an unused port, such as 7891. Update the Windows system proxy and explicit test command too. Subscription managers may overwrite the original YAML during updates, so editing a cached file directly often won’t last.

Permission Issues: File Access vs. TUN Service

“Unable to save configuration” may be caused by directory permissions, a read-only file, or security software blocking writes. First check the exact path in the error. Installing the TUN service, creating a virtual network adapter, and changing routes may require administrator approval. If the system proxy works, you don’t need TUN just to browse the web. Install the service and check permissions according to the client’s documentation only if you need to handle apps that ignore the system proxy.

Controller Errors: Don’t Use Port 9090 for Proxy Traffic

external-controller lets the interface manage the core; a common example is 127.0.0.1:9090. A conflict on this port may stop the interface from showing nodes or connections, but changing it is not a substitute for changing mixed-port. Keep it bound to localhost and set an access secret. Don’t expose it on all network interfaces to troubleshoot.

7. Proxy Failures and No Internet After Exit: Restore Connectivity Safely

If your browser works but your terminal, game, or other app doesn’t, first check whether that app supports the system proxy. Some apps use their own network stack, and some traffic uses UDP; changing the Windows HTTP proxy won’t capture it. Terminal tools may use their own options or proxy environment variables. The WinHTTP setting shown by netsh winhttp show proxy is not the same as the user proxy in Windows Settings.

TUN is an option for handling traffic at a later stage, not a requirement for the initial setup. It uses a virtual network adapter and routing to capture traffic within the configured scope. The result still depends on routes, DNS, exclusions, and core support. Complete the explicit proxy test in this guide before enabling it. If the underlying node doesn’t work, switching to TUN won’t fix it.

No Internet After Exiting the App

Reopen the client, turn off “System Proxy,” then quit normally. Check whether Windows has restored its proxy settings.
If the client won’t start, open Windows Settings → Network & Internet → Proxy and check whether it still points to a local port that is no longer running.
On a personal device, you can remove leftover manual proxy settings once you’ve confirmed they belong to this client. On a work network, record the original values and contact your administrator if the network uses a shared proxy or setup script.
Reopen your browser and test again. If it still fails, check for other VPNs, network filtering software, and DNS issues. Don’t reset all network settings as your first step.

When asking for help, include your Windows, client, and core versions, current mode, listening port, and redacted logs from the time of the error. Change one setting at a time and repeat the same tests to identify whether the issue is with the subscription, node, system settings, or a specific app.