Clash Setup Guide
for Every Platform

01 / PREREQUISITES

General Setup: Clients, Subscriptions and Traffic Routing

Know the Difference Between the GUI Client, Core and Service Configuration

In the Clash ecosystem, GUI clients manage subscriptions, policy selection and system integration. The core parses configuration, matches rules and establishes connections. mihomo is an actively developed core in this ecosystem, but not every app called Clash uses the same core or supports the same fields. Before setting up a configuration, check the core shown in the client's About or core settings, then confirm the subscription provider's supported format. Similar app names do not guarantee compatibility.

For everyday desktop and mobile use, start with Clash Plus; the downloads page also lists other clients for different needs. Linux users can choose Clash Verge Rev or FlClash. Use the standalone Mihomo core only if you specifically need a background service, router deployment or direct configuration management. For an overview of how these projects relate, see Clash, mihomo and the client ecosystem. Installing a client only means the app can launch; it does not guarantee a working proxy connection.

Prepare Your Subscription and Keep a Recoverable Backup

A subscription is usually an HTTPS URL that returns configuration text and may contain access credentials. It is not a regular information page or a single-node sharing link. When copying it, check for added line breaks, spaces or punctuation from chat apps. Never post a full URL containing credentials on a public forum. Check the service status, expiry date and device limit. If the provider offers separate general-purpose and mihomo formats, choose the one that matches your current core instead of trying every option.

Before your first setup, note the current system proxy state, active VPNs and network interface names. Export existing configurations or copy them to a separate folder, and record any manually selected policies. Remote subscription updates may overwrite local edits; keep custom rules in the client's supported override or merge feature. Exported configurations and logs may contain server addresses, usernames or subscription URLs. Redact each item before sharing screenshots, not just node names.

Choose a Routing Mode, Then a Traffic-Capture Method

Rule, Global and Direct modes determine how traffic is routed; system proxy and TUN determine how traffic enters the core. These are separate layers. Rule mode checks rules from top to bottom. Global mode sends requests entering the core to the global policy, while Direct bypasses proxy nodes. For an initial test, use Rule mode, manually select a working node and check the connection log. Global mode can help isolate a rule issue, but it cannot fix an expired subscription or an unreachable node.

TUN captures traffic through a virtual network interface and routing rules, so it typically covers more traffic than the system proxy. Its actual scope still depends on OS restrictions, exclusions and client implementation. On mobile, it usually requires system VPN permission; desktop clients may need a privileged service. Avoid running multiple traffic-capture tools during initial setup. Verify one route first, then add TUN. When troubleshooting, identify exactly how the affected request entered the core instead of relying on the app's connection toggle.

Establish a Minimal Test Baseline

Test one site that should connect directly and another that requires your chosen proxy route. Record the current network, client mode, selected policy group and time of any error. Then find the same domain in the connection log and check its matched rule, policy chain and exit. A latency test only confirms that a specific test request completed at that moment; it does not guarantee all domains, UDP traffic or login flows will work. If the underlying network is already having problems, disable traffic capture and restore normal connectivity before troubleshooting the client.

02 / WINDOWS

Windows: Installation, System Proxy and Service Permissions

Choose an Installer for Your System Architecture

Check your processor type and system architecture in Windows Settings under System information, then visit the Windows client downloads. Clash Plus is the recommended option; alternatives include Clash Verge Rev, FlClash and Clash Nyanpasu. Clash for Windows is archived and no longer maintained, so it is not recommended for new installations. Do not reuse another computer's installer just because it is the same brand; check the architecture and the app's system requirements separately.

When running the installer, review the publisher and destination folder. Install the app in a regular applications directory rather than running it indefinitely from a temporary browser download folder. If security software blocks it, check the file source and alert details instead of disabling protection altogether. After launch, leave system proxy and TUN off while checking that the interface, configuration storage and logs work. Run only one proxy client at a time to prevent background apps from repeatedly changing proxy settings.

Import a Subscription and Confirm the Active Configuration

On the configuration or subscription page, import from a URL, give the entry a recognizable name, and wait for it to download and parse. If the import succeeds but no nodes appear, check whether you imported a full configuration or just a proxy collection. Node-only content may require a provider or template. A completed download does not mean the configuration is active: select the imported entry in the list, then confirm its policy groups appear on the proxy page.

Switch to Rule mode and select a node in a manual selection group. Auto-test groups may change the exit based on test results, so use an explicit manual choice while troubleshooting for the first time. If a subscription update changes policy group names, your previous selection may no longer work; check it again rather than simply restarting the app. If the client has a configuration validation tool, fix syntax errors and missing policy references before enabling the system proxy.

Test Browser Traffic with the System Proxy

Turn on the client's system proxy, then open Network & Internet > Proxy in Windows Settings and confirm that the manual proxy points to the local loopback address and the actual listening port. A common address is 127.0.0.1; use the port shown by your client. A loopback address refers only to the current computer. Entering it on another device will not connect to this Windows machine. Before enabling LAN access, identify who needs access and configure the firewall accordingly.

If the browser works but terminal tools do not, they may not read the system proxy settings. Run the command below to test an explicit HTTP proxy connection to a public HTTPS site, replacing the port with the actual value. An HTTP response confirms that the request reached the specified proxy entry point. If you receive a proxy authentication error or a rejection from the destination, distinguish between the proxy entry, exit and site policy; not every non-success response means the port is at fault.

curl.exe --proxy http://127.0.0.1:7890 --head https://example.com/

TUN, Loopback Restrictions and Port Conflicts

Enable the client's service mode and TUN only when you need to capture traffic from apps that ignore the system proxy. Service mode typically uses system privileges to manage virtual interfaces and routes; being able to open the GUI does not mean the service is installed or running. Follow the client's authorization steps, then check the logs for successful interface creation and route setup. Never give administrator privileges to an untrusted script just to try TUN, and do not run another VPN that captures the same routes.

Some UWP apps are restricted from accessing loopback addresses, so they may fail to connect to a local proxy even when the browser works. First confirm that the app uses the system proxy, then follow the UWP loopback exemption guide for that specific app instead of granting access to every app. If behavior changes after enabling TUN, check the connection log to see whether the request entered the core; do not mistake an app's own login or certificate error for a loopback issue.

If a port is already in use, run Get-NetTCPConnection -LocalPort 7890 -ErrorAction SilentlyContinue in PowerShell and identify the process by its ID. After confirming the old client has exited, start the current one; do not terminate an unfamiliar system process. If you change the listening port, update the system proxy, browser extensions and terminal variables too. Turn off traffic capture before exiting. If the web stops working after an unexpected exit, restore the system proxy to its previous state, restart the client and check the logs.

03 / MACOS

macOS: Architecture, Network Permissions and Proxy Recovery

Check Your Mac's Chip and Install the App

Open About This Mac from the Apple menu and check whether it lists Apple silicon or an Intel processor. Then visit the macOS downloads and choose the matching installer. Clash Plus is recommended; Clash Verge Rev and FlClash are alternatives depending on your preferred interface and features. ClashX Meta is archived and no longer maintained. Do not assume menu locations or core features in older tutorials apply to current clients.

When installing from a disk image, drag the app into Applications and launch it from there. Running it long-term from a mounted image can interfere with updates, permission associations and helper-service paths. If a security prompt appears on first launch, check the source and app details, then follow the instructions under Privacy & Security in System Settings. If macOS says the app is damaged or cannot be verified, download the correct build for your architecture first; removing security attributes recursively is not a universal fix.

Grant Only the Permissions Required by the Feature

System proxy settings, privileged helper services and network extensions are separate mechanisms. Some clients only change proxy settings for the current network service; some TUN implementations need a helper, while others use a system network extension. Grant permission only when the client requests it and the feature requires it. There is no need to look for a setting the app does not use. After authorizing, return to the app and check its status. Some changes require restarting the app or reconnecting as prompted by macOS.

A Keychain prompt usually means the app is saving or reading credentials. Check the app name, Keychain item and requested action before deciding whether to allow it. Do not set all password access to Always Allow just because a prompt mentions a proxy. If the prompt appears at every launch, check whether the app was moved, its signing identity changed or the helper component path is still correct. For details on path differences, see macOS network extension and Keychain permissions.

Import a Subscription and Check Network Services

Add the subscription URL on the client's configuration page. Once downloaded, enable that entry and check the policy groups on the proxy page. On macOS, the menu bar and main window may show connection status and configuration lists separately; closing the window does not usually quit the app. Check that no other client in the menu bar is still managing network traffic, so the app in the foreground is not different from the one that changed the system proxy. In Rule mode, select a specific node before testing a site.

After enabling the system proxy, open the details for your current Wi-Fi or Ethernet connection and review its proxy settings. macOS stores settings per network service, so switching to a dock adapter, Ethernet or a new Wi-Fi network may change them. The command below shows the currently active proxy information. Check the enabled flags, server and port rather than looking for one specific field. If a terminal tool does not read the system proxy, specify the proxy explicitly or set environment variables for that process.

scutil --proxy
networksetup -listallnetworkservices
lsof -nP -iTCP:7890 -sTCP:LISTEN

TUN and Recovery After Sleep

To capture traffic from more apps, install or start the required service using the client's workflow, then enable TUN. Check the logs for permission errors, interface creation failures or route conflicts. Company-managed devices may have restrictions; seeing a setting in System Settings does not mean a regular user can change it. If you also use a corporate VPN, check its routing scope and usage requirements first. Do not remove device management settings to force traffic capture.

If connections fail after waking from sleep, first confirm that normal network access has returned. Then check whether the core is still running and the subscription configuration remains active. Switching Wi-Fi may change the default route and DNS, and existing connections may not have been rebuilt. Stop the connection, wait for the network to stabilize, reconnect and test with a new request; do not rely on a page that has been open for a long time. If only TUN fails while explicit proxy requests work, check the virtual interface, routes and DNS before reinstalling the configuration.

Before uninstalling or migrating, turn off system proxy and TUN in the app, then remove any helper service according to the client's instructions. After an unexpected app exit, check whether the current network service still has a local proxy configured and restore its previous state if needed. Do not delete all network locations or Keychain items indiscriminately; other apps may depend on them. Once normal access is restored, install the new client and import the backup. Restore one settings layer at a time to isolate configuration issues from system integration.

04 / ANDROID

Android: Subscription Formats, VPN Permission and Background Operation

Choose an Installer and Compatible Configuration

Visit the Android downloads; Clash Plus is recommended, with Clash Meta for Android, FlClash and Surfboard as alternatives. Before downloading, check the device architecture and the app's minimum OS requirements. Most newer phones use ARM64, but you cannot tell from appearance alone on older devices or specialized systems. If Android reports an incompatible package, check the architecture, OS version and signing key instead of repeatedly downloading the same file.

When installing through a browser or file manager, Android may ask you to allow app installs from that source. Grant temporary permission only to the source you're using, and turn it off afterward if you prefer. Keep the subscription URL and local configuration before upgrading. If a mismatched signing key prevents an in-place update, do not uninstall immediately, as this may erase app data. First check whether you have the wrong app with a similar name or a build from a different distribution channel, then decide how to migrate based on your backup.

Check which configuration format the client supports. The fields supported by Clash Plus, Clash Meta for Android and FlClash depend on their core and implementation. Surfboard uses a different configuration system from Clash YAML, so a full Clash configuration cannot simply be pasted into it. If your subscription provider offers multiple formats, choose one explicitly supported by your app. Conversion services can access subscription information; assess the service before use and never submit a credential-bearing URL to an untrusted website.

Check the Configuration Before Connecting

Add the remote URL on the configuration or profile page. After it downloads, check for policy groups and nodes, then set the configuration as active. A successful URL request can still return a login page, expiry notice or error HTML that the client cannot parse. Check the subscription status and error summary first. Do not repeatedly open a credential-bearing URL in your phone's browser or delete YAML structures at random to work around an error.

On the first connection, Android typically displays a system VPN permission prompt. Confirm that it came from the app you just installed, approve it, then check the system VPN status and the client's connection log. Here, VPN means the app uses the system interface to capture traffic; it does not mean a proxy node is connected. Even if the VPN icon appears in the status bar, the policy group may still choose Direct or the node may be unavailable. Verify the actual route with a request to your target.

Per-App Routing and Other VPNs

Android's VPN interface generally cannot be used by multiple standard VPN apps at once. If a work VPN, ad blocker or other VPN-based network tool is running, starting this client may disconnect it. Decide which traffic-capture route to keep and check whether Always-on VPN is enabled. If your organization locks that setting, follow its device management requirements; do not reset network settings to get around them.

Per-app routing usually offers either an allowlist or a bypass list: with an allowlist, only selected apps are routed; with a bypass list, selected apps avoid routing. Read the current mode description after making changes, then restart the target app to establish a new connection. If a chat app works but the browser does not, they may simply be on different lists; it is not necessarily a node issue. Also distinguish existing long-lived connections from new ones after a configuration change, since old sessions may not switch routes immediately.

Background Restrictions, DNS and Network Changes

If the connection drops after the screen has been locked for a while, check whether the system killed the client process or the VPN status disappeared. Use the phone manufacturer's battery settings to allow required background activity and auto-start. If the app uses a foreground service notification, allow it to run normally. Do not disable battery restrictions for every app at once. On the same network, test requests with the screen on, locked and just after waking, and record whether the drop happens consistently to distinguish process management from network changes.

Android Private DNS, browser Secure DNS and client DNS are separate paths. If name resolution fails, record their settings before changing anything. Strict Private DNS can disrupt connectivity if its server is unreachable; browser-level DNS can also change what you observe with domain-based routing. Restore a known baseline, then enable settings one at a time and check the domain and error type in the connection log instead of relying only on node latency tests.

Moving from Wi-Fi to mobile data can change carrier routing, IPv6 paths and UDP availability. Pause the connection to confirm that the underlying network works, reconnect and test a new request. If only one protocol fails, compare it with another node explicitly supported by the provider; do not change a large number of core parameters without keeping notes. Save a necessary configuration backup before traveling, but remember that node availability depends on the service; having a local configuration does not guarantee a reachable remote exit.

05 / IOS

iOS: Install Clash Plus, Import a Subscription and Use System VPN

Install from the App Store and Check Compatibility

iPhone and iPad users can find Clash Plus in the iOS downloads or open its App Store page directly. The client website is clashplus.io. Check device compatibility and system requirements on the store page before installing. After installation, open the app to find its configuration and connection controls. Do not follow macOS menu bar instructions or apply desktop helper-service steps to a phone.

iOS traffic routing relies on system extension capabilities, so the available controls differ from those in desktop clients. A mihomo configuration that parses on a computer does not guarantee that its TUN settings, file paths, external controller or scripts will work on a phone. Check the app's configuration support before importing. If a field is unsupported, ask the subscription provider for a compatible format instead of deleting an entire section without checking.

Import a Subscription and Refresh It

Add the remote URL from the configuration or subscription section in Clash Plus, name it as prompted and save. Check that the URL is complete, including its beginning, end and parameters; copying from Notes or a messaging app can introduce line breaks. Once downloaded, select the entry, check that its policy groups appear and choose a node. If the app supports importing through the system share sheet, still verify which entry was loaded to avoid connecting to an older subscription with the same name.

Subscription updates usually download the remote content again and may not preserve every manual edit. After your first successful connection, note the configuration name, mode and policy selection. Recheck them if groups change after an update. Do not save subscription URLs in public shared notes or screenshots. Before switching devices, use the app's export feature or a system backup to save what you need, and check whether it includes sensitive URLs. Convenient syncing does not replace access control.

Approve the VPN Configuration and Verify Traffic

When you connect for the first time, iOS may ask to add a VPN configuration and confirm with your device passcode or biometrics. Check the app name and approve, then return to the client and wait for the connection result. If you previously denied permission, try connecting again and follow the current system prompts. You can check the VPN list in Settings to confirm which app owns the configuration. Do not delete known work or school VPN profiles just to make one app work.

The VPN indicator means the system has a corresponding connection state; it does not prove that your selected proxy handles a particular site. Start in Rule mode, choose a specific node, open a new page and find the domain and policy in the client's connection log. A DIRECT match means the rule chose a direct route. If the request uses a proxy policy but times out, check the exit and destination. For your first test, use a regular browser page rather than relying on a cached login, App Store session or push connection.

Do Not Confuse Wi-Fi Proxy Settings with the Network Extension

The HTTP proxy setting on an iOS Wi-Fi details page is separate from the VPN extension created by the client. If you previously entered a proxy for your device or LAN, note it and check whether it is still active. Mobile data does not inherit a manual proxy configured for a Wi-Fi network, so “works on Wi-Fi, fails on cellular” needs to be investigated separately. During initial troubleshooting, keep only the one routing method you need to avoid overlapping traffic capture.

Other VPN profiles, content filters and device management policies can also affect the connection. If another tool immediately replaces the VPN after you connect, check the system VPN status and that tool's auto-connect settings before deciding which to keep. If the app offers on-demand connections, enable them only after manual connections are stable and you have checked the trigger conditions. Do not turn on every automatic reconnect option before validating the configuration.

Lock Screen, Network Changes and Mobile Troubleshooting

The iOS app interface and its network extension have different lifecycles. Sending the app to the background does not necessarily stop the extension, and seeing the app open does not guarantee the extension is healthy. If the connection fails after locking the screen or switching networks, confirm that the underlying network works, then check the client's status and recent logs. Do not make force-quitting the app a routine fix; it can change the current state and make the issue harder to reproduce.

For cellular issues, check whether the app is allowed to use mobile data, whether the data plan is working and whether the node supports the current network. If only one app is affected, compare it with the browser and check domain rules and restrictions imposed by the service. If logs show a DNS failure, investigate name resolution; for a connection timeout, check the exit. For certificate errors, check the device clock and the site's certificate. Do not disable certificate checks as a substitute for fixing the cause. If the issue remains after disconnecting, check for a leftover Wi-Fi proxy or another VPN.

06 / LINUX

Linux: Packages, Desktop Proxy Settings and Core Services

Choose Between a Desktop Client and a Standalone Core

Desktop users can visit the Linux downloads; Clash Verge Rev is recommended, with FlClash as an alternative. Choose an available package for your distribution and check the processor architecture. Debian-based and RPM-based packages are not interchangeable by changing the file extension. If the downloads page does not list a particular combination, do not assume a build for another architecture will run. The standalone Mihomo core is for users who specifically need command-line operation or a server or router deployment.

Before installing desktop software, review the package manager's dependency warnings. Do not force installation past missing dependencies that may indicate an incomplete graphical runtime. Minimal servers usually lack a full desktop session, so a GUI app is not a suitable background service solution even if it installs. Launch the app as a regular user first, then check that the subscription directory is writable and configurations load. Grant permissions through the client's process only if TUN or a service requires them.

Import a Configuration and Check Desktop Proxy Settings

Add a subscription URL in the GUI client, enable the downloaded configuration and select a node on the proxy page. Linux desktop proxy settings depend on the environment's integration, such as GNOME or KDE. A setting successfully written to the desktop does not mean every app reads it. Sandboxed apps, browsers and terminals may use different proxy paths. Test the core listener with an explicit proxy first, then check whether the issue is with desktop settings reaching apps instead of enabling TUN straight away.

The environment variables below affect only the current shell and child processes started from it; they do not change programs that are already running. Match the port to the client. no_proxy keeps local connections direct; configure exclusions according to what the app supports. Close the terminal or unset the variables when testing is done. Do not immediately add test values to a global startup file, or package managers and development tools that depend on them may fail whenever the client is not running.

export http_proxy=http://127.0.0.1:7890
export https_proxy=http://127.0.0.1:7890
export no_proxy=localhost,127.0.0.1,::1
curl --head https://example.com/
unset http_proxy https_proxy no_proxy

Test the Standalone Core Before Running It

For the standalone Mihomo core, choose the right platform and architecture in the core downloads, extract it to a controlled directory and make it executable. Prepare a configuration directory and config.yaml, and ensure the account running the core can read the configuration and write any required cache files. The commands below assume the executable is named mihomo and the configuration is in a directory under the current user. Validate the configuration first, then start the core in the foreground to inspect errors. Consider running it as a service only after it is stable.

chmod u+x ./mihomo
./mihomo -t -d "$HOME/.config/mihomo"
./mihomo -d "$HOME/.config/mihomo"

A successful configuration test confirms only that the static structure and relevant checks pass. It does not guarantee that remote nodes are online, rule resources can be downloaded or system routes can be changed. After starting in the foreground, check the listening address and port and confirm that the configuration loaded, then send a request through an explicit proxy. When creating a service, use absolute paths and specify the run account, working directory and configuration directory. Environment variables in an interactive shell are not automatically passed to system services, and a desktop user's home directory may differ from the service process's home directory.

TUN, DNS and Permission Management

TUN typically requires access to /dev/net/tun and permission to configure networking. Containers, restricted hosts and router firmware may not provide these capabilities. If the device is missing or an operation is not permitted, first check whether the host environment supports TUN; changing DNS repeatedly will not fix a permission issue. Prefer a service setup supported by the client. If you write your own service, use the least privileges necessary. Running the entire desktop session as root is not a standard solution.

Linux systems may also use NetworkManager, systemd-resolved and local DNS services at the same time. Before taking over DNS, identify which service is listening and how lookups are routed. Do not overwrite /etc/resolv.conf blindly; it may be managed by the system and point to a local stub resolver. If a change works briefly but stops after reconnecting, a network manager may be rewriting the file. Preserve the original settings, identify which layer manages resolution and integrate DNS using a method supported by the client.

To diagnose ports, run ss -lntp; check routes with ip route. Reading another user's process details may require extra permissions. Do not bind a proxy port or controller interface to all addresses and expose it to the public internet. When exiting or uninstalling, stop the service, clear proxy environment variables and restore captured routes before checking normal connectivity. If the system proxy works but a terminal app does not, check that app's own proxy settings rather than assuming the core has failed.

07 / CONFIGURATION & DIAGNOSTICS

Configuration FAQ: Troubleshoot One Layer at a Time

A Valid Configuration Does Not Guarantee a Working Proxy

YAML uses spaces for indentation, and list items need their hyphens; do not mix in tabs. Before merging a snippet, check the existing top-level keys. Duplicate rules or proxy-groups sections may be overwritten or rejected. Policy group references must match existing names, including case and punctuation. The standalone example below is a minimal Direct-only diagnostic configuration for mihomo. It tests the listener, mode and rule chain, but has no remote proxy nodes and cannot tell you whether a proxy service works.

mixed-port: 7890
allow-lan: false
mode: rule
log-level: info
proxy-groups:
  - name: CHECK
    type: select
    proxies:
      - DIRECT
rules:
  - MATCH,CHECK

If this configuration can make an explicit proxy request but the original subscription cannot, check its nodes, group references and rule resources next. If even the local listener is unreachable, investigate the process, port and firewall first. Do not overwrite your only subscription file with the diagnostic configuration; create a separate local entry and keep the original. When finished, switch back to the original configuration and confirm which entry is active so you do not mistake a Direct-only test for a proxy connection.

How to Tell a Subscription Failure from a Rule Issue

Classify subscription download errors first. For connection failures, check the underlying network and subscription domain. For authentication failures, check the URL credentials and service status. If the download succeeds but parsing fails, inspect the returned content and format. Some subscription URLs are accessible only through an existing proxy, while the proxy itself depends on that subscription, creating a startup dependency. Ask the provider for an accessible endpoint or use a known-good local backup; switching to Global mode without a working node will not fix the problem.

Rules are checked in order. A broad rule near the top can prevent more specific rules below it from matching. Before adding a domain rule, identify the domain the request actually uses rather than copying only the browser address bar; login, images and API calls may use different domains. Use the connection log to confirm the matched rule and policy chain. Rules that require GeoIP data also depend on resource downloads. Use the database format and update method supported by your current core instead of copying filenames and paths from old tutorials.

Auto-selection results also depend on the test URL, interval and network conditions. url-test selects mainly by test performance, fallback checks availability in order, and load-balance distributes connections according to its algorithm. These are not three different proxy protocols. If nodes keep switching, decide whether your use case needs a fixed exit before changing the policy. For field details, see auto policy groups: differences and configuration.

From Entry Point to DNS, Exit and Destination

Take care to avoid DNS dependency loops. If the core needs to resolve an upstream DNS server through a proxy, but reaching the proxy requires a hostname that has not yet been resolved, startup may fail. Some configurations support separate DNS settings for resolving proxy server addresses; check the fields available in your core. With fake-ip enabled, do not share synthetic addresses returned by system DNS as if they were real public IPs or add them to static rules. To troubleshoot app compatibility, identify the specific filter needed instead of replacing the entire DNS configuration at random.

If TCP works but games, voice calls or other UDP traffic fail, first confirm that the node protocol, server and client all support the required UDP route. Then check whether the traffic is actually being captured. Enabling TUN cannot add UDP support to an exit that does not have it. Check IPv6 across the OS, core, DNS and exit as a whole; disabling it at just one layer can produce inconsistent results. After each change, test a new connection and end old sessions normally if needed.

Preserve Evidence and Roll Back Safely

If you temporarily increase the log level, record when the issue occurred, the target domain, matched rule and error summary, then restore the normal level after reproducing it. Redact subscription credentials, server authentication details and unnecessary browsing records before reporting the issue. The OS, client, core, mode and traffic-capture method are more useful for diagnosis than a screenshot of a failed connection alone. If a section of the interface is unclear, see a quick guide to the proxy, configuration and log panels.

Roll back changes in reverse order: stop TUN, turn off the system proxy, remove temporary environment variables, then confirm normal network access. Once the underlying network works, restore the configuration, manual exit and system proxy in sequence; test TUN and automatic policies last. Change one variable per round and record the result. To repeat the full setup flow, return to the Getting Started tutorial. To switch clients, check supported platforms and requirements on the downloads page first; migration is not a substitute for troubleshooting.