FlClash FAQ

FlClash is a graphical client built with Flutter. It manages configurations, proxy selection, and settings. mihomo is the core that handles protocol connections, DNS, and rule matching; it was formerly known as Clash Meta. In tutorials, a Clash Meta configuration usually refers to the configuration format used by this core ecosystem—not another application you need to install. If a configuration option isn’t supported, check the capabilities of the bundled core and the configuration syntax rather than relying on the name shown in the interface. When comparing clients, also consider platform support, permission handling, and configuration management.

You’ll need a working proxy configuration. FlClash is a client; installing it doesn’t provide a proxy service. Your provider usually supplies a subscription URL or a YAML file containing proxies, proxy groups, and rules. Before importing, make sure the source is trustworthy, the service is active, and the format is compatible with mihomo. Subscription URLs may contain account credentials, so don’t post them in public comments, screenshots, or support tickets. Installing the client and signing up for a proxy service are separate steps; troubleshoot them separately if you can’t connect.

For everyday use, start with Rule mode. Rules in the configuration are evaluated in order to send requests either directly or through a proxy group. Global mode sends ordinary connections that reach the core through the global proxy group; make sure that group has a working proxy selected. Direct mode connects to the destination without a proxy. Global mode doesn’t automatically capture traffic from every app: traffic must still reach the core through the system proxy, a manually configured proxy, or TUN. You can switch modes temporarily to compare results while troubleshooting, but don’t use Global mode as a permanent workaround for incorrect rules. Restore your original routing settings after testing.

FlClash is commonly available for Android, Windows, macOS, and Linux. Check the package details for supported architectures and system requirements. iPhone users need a different client that supports iOS; Android packages can’t be installed on iOS. The downloads page lists clients by platform, including an App Store link for Clash Plus and its official website, clashplus.io, under iOS. You can reuse a compatible subscription across devices, but system proxy settings, VPN permissions, background operation, and ports must be configured on each device. Syncing a file alone won’t configure these settings.

Make sure you copied the full subscription URL—not your provider’s login, purchase, or sharing page—and check for leading or trailing spaces or text cut off by a messaging app. Next, check your device’s date and time, local network, and account status. Try updating once and note the exact error. A login page or web page usually means the URL is incorrect or requires authentication; a configuration parsing error points to an incompatible or malformed subscription. If the subscription domain can only be reached through a proxy, update it using an existing working connection or ask your provider for an accessible URL. Avoid repeated imports that create multiple configurations with the same name.

A successful import only means the content was saved. It doesn’t mean the configuration is active or that every proxy can connect. Select the newly imported item in the configuration list and make sure the core starts without errors. Then open the proxy page and choose a working proxy for the group referenced by your rules. On desktop, enable the system proxy or use TUN if your apps require it; on Android, grant the system VPN permission. Finally, open a regular web page and check whether a request appears in the connection log. If there’s no entry, check how traffic reaches the core. If there is an error, investigate the proxy service and rules.

TUN creates a virtual network interface and changes routes, so it usually needs more privileges than the system proxy. On Windows, check whether the client requires service mode to be installed or started, then follow the authorization steps for your version. On macOS and Linux, check the required permissions or service installation steps. Android uses the system VPN permission and usually doesn’t require root; only one app can use the VPN connection at a time. If TUN still fails after authorization, check the logs for interface, route, or service errors, and quit other VPN apps. Don’t leave your firewall disabled or grant elevated permissions to unknown scripts just to enable TUN.

Choose based on your device’s processor architecture, not just its operating system. Most Intel or AMD PCs use x64. For Windows on ARM, check whether a compatible build is available and review its requirements. Choose an ARM build for Apple Silicon Macs and an x64 build for Intel Macs. Most newer Android devices use ARM64; older devices may need an ARM build. Choose a universal package only if the client offers one. You can find processor details in your system’s About settings. If installation fails or the format isn’t supported, check the platform, architecture, and system requirements rather than downloading the same file repeatedly.

First, distinguish a failed subscription download from an unavailable proxy service: the former prevents you from fetching the configuration, while the latter affects connections. They don’t necessarily happen at the same time. Check your provider’s account page for expiration, traffic limits, or a reset subscription. If the URL has changed, edit the URL in the existing configuration and update it manually. If the old configuration still works, keep it for now so you don’t lose a way to troubleshoot. After updating, check whether the active configuration or proxy group selection changed. Never submit a full subscription URL to a public testing site. For support, share only the domain with credentials removed, the time, and the error type.

A mixed port accepts both HTTP and SOCKS5 proxy requests through the same endpoint. 7890 is a common default, but check your current settings. If you’re only using the proxy on your own device, you usually don’t need to allow LAN connections. To share your computer’s proxy with a phone or TV on the same trusted network, enable the option and check the listening address and firewall rules. On the other device, enter your computer’s LAN IP address and actual port—not 127.0.0.1, which points to that device itself. Don’t forward the port to the public internet. Disable sharing on public Wi-Fi or strictly limit which devices can connect.

Start in Rule mode, then check the order of the rules in your active configuration. Rules are usually matched from top to bottom, and evaluation stops at the first match. Put specific domain rules before broader rules that could override them. Depending on your configuration, you can combine GEOSITE and GEOIP rules with a final MATCH rule. Make sure the referenced proxy groups exist and geographic data can be loaded. If a site uses the wrong route, check its domain, matched rule, and final policy in the connection log, then adjust the relevant rule. Don’t infer a site’s location from its language: domain categories, IP geolocation, and actual requirements may not align.

First check whether Android is stopping FlClash in the background, then review battery optimization, background activity, and your device manufacturer’s auto-start settings. Follow your device’s instructions to allow the client to run in the background, and keep any foreground service notification required by the system. If your device offers Always-on VPN, you can enable it if needed. Before blocking connections that don’t use the VPN, be aware that your network may stop working if the client exits. If the connection drops only when switching to mobile data after the screen locks, also check Wi-Fi-to-cellular handoff, server connection status, and logs. Settings vary by manufacturer, so use the options shown on your device.

Pause the proxy first and make sure your local network can reach ordinary websites. Rule out public Wi-Fi networks that require a browser login. Then check your system date and time zone, subscription update status, and service account. Confirm that the right configuration and proxy group are selected. If every proxy fails, investigate shared dependencies such as DNS, network restrictions, firewall rules, and conflicts with other VPN apps. If only a few proxies fail, ask your provider to check those routes. Change one thing at a time and note connection errors in the logs. Timeout tests are only clues; verify with actual web requests, and avoid running repeated batch tests that add noise.

Check that the FlClash core is running and that the system proxy’s address and port point to the current client. Make sure another proxy app or organization policy hasn’t overridden the setting. Send a new browser request and check the connection log. If there’s no entry, the request may not be reaching the core. Some apps use their own proxy settings or ignore the system proxy; configure a proxy in the app, or use TUN after confirming permissions and routing are correct. Restart affected apps after changing settings so existing connections don’t skew the results. If your network remains abnormal after quitting the client, check for leftover system proxy settings and restore them to match the client’s current state.

If a desktop browser works but a UWP app restricted by its app container can’t reach the local proxy, check its loopback restrictions. First confirm that the app uses an app container and find its package identity. If your client includes a UWP loopback tool, enable the exemption only for the app that needs it. You can also use Windows’ CheckNetIsolation tool as described in the system documentation; this usually requires administrator privileges. Don’t enable exemptions for every app indiscriminately. Loopback exemptions won’t help if the app isn’t UWP or the problem is caused by DNS, the server, or an organization policy. If you’re using TUN, check the actual routes as well.

First determine whether the problem is a DNS resolution failure, connection timeout, or certificate error. Don’t assume every page that fails to load has a DNS problem. Check the logs for resolution errors, and make sure the configured DNS upstream, bootstrap resolution, and proxy policies work together. Avoid relying on a DNS server that itself needs a connection that hasn’t been established. If your browser uses secure DNS, its request path may differ from the system’s; temporarily use the same settings to compare. With fake-ip, check filters, TUN routes, and conflicts with other VPN apps. After making a change, reconnect and clear the cache using your system’s usual method. Keep the original configuration, change one option at a time, and don’t disable certificate verification without a clear reason.