How to Set Up Clash on Windows: System Proxy, Firewall, and Startup

Get the system proxy working before trying TUN mode

For a reliable Clash setup on Windows, follow this order: install the client, import and activate a subscription, choose Rule mode and an available node, enable the system proxy, then configure service mode, TUN, and startup if needed. Don’t turn everything on at once. If your connection drops, it’s much harder to tell whether the cause is the subscription, proxy port, or virtual network routing.

This guide focuses on Windows GUI clients that use the mihomo core. Button names vary across clients such as Clash Verge Rev and Clash Nyanpasu, so the instructions below refer to both feature names and ways to verify them. Menu locations may differ by version. The original Clash core and mihomo support different configuration features. If a protocol or field isn’t supported, check which core you’re using instead of repeatedly toggling the system proxy.

1. Check your system architecture and install location

Choose between x64 and ARM64

In Windows 11, go to Settings → System → About and check System type. In Windows 10, find it under Settings → System → About. Most Intel- and AMD-based PCs need the x64 installer. For devices with an ARM processor, choose the ARM64 package if the client provides one. Don’t rely on “64-bit operating system” alone to identify your processor architecture.

1. Choose a Windows client from the Clash download page and check its system requirements.
2. Install the client in a fixed location. For a portable version, extract all files before running the main program; don’t launch it from inside the archive.
3. Keep the default settings on first launch. If Windows displays a security warning, verify the download source and publisher before proceeding. Don’t disable your security protections just to launch an app.
4. Wait for the system tray icon to appear, then check the client’s core status or logs. An open window doesn’t necessarily mean the background core is running and listening on a port.

The Settings interface differs between Windows 10 22H2 and Windows 11 24H2. These versions are cited to illustrate where settings may be found, not as a guarantee that every client supports them. Work-managed PCs may also restrict service installation, proxy changes, or virtual network adapters. Check your organization’s device policies first.

2. Import a subscription and activate the configuration

Open the client’s Subscription, Profiles, or Configuration page. Add a remote subscription, paste the Clash or mihomo configuration URL provided by your service, then download or update it. Subscription URLs often contain authentication tokens. Don’t post them publicly or show the full URL in a support screenshot.

1. Download succeeded: The configuration appears in the list and its last-updated time changes. If you see a 401, 403, or 404 error, check whether the URL has expired and was copied in full.
2. Configuration activated: Select the configuration and look for a Current, Active, or selected indicator. Adding a subscription to the list doesn’t always make it the active configuration.
3. Proxy groups available: Open the Proxies page and check that nodes and proxy groups appear. Select a node, or confirm that an automatic selection group has chosen one.
4. Core loaded successfully: Check the logs for configuration parsing errors, unknown proxy types, or missing proxy groups.

If an update fails, don’t start by changing DNS or TUN

If the subscription download times out, first check whether you can reach the subscription service without a proxy and whether your computer’s clock is correct. Some subscription sites require a particular network. You can use the client’s subscription-update proxy setting if you already have a working proxy connection. On the first import, you can’t rely on a configuration that hasn’t loaded yet to proxy its own download.

A login page or error page isn’t a valid configuration, even if the download request reports success. Check that the subscription format is supported by your core. For example, an older original Clash core may not load features supported only by mihomo. Choose a compatible format or client instead of deleting configuration fields at random.

3. Set Rule mode and check the local proxy port

For everyday use, start with Rule mode, which uses the configuration’s rules to decide whether traffic goes direct or through a proxy. Global mode can help with a quick comparison, but still depends on the selected proxy group or node being available. Direct mode can’t verify whether a proxy node works. After changing modes, existing long-lived connections may keep using their previous route, so start a new request to test the change.

Point the system proxy to the port that’s actually listening

Check the HTTP or mixed port in the client’s port settings. This guide uses 7890 as an example; your client may use a different port. A mixed port generally accepts both HTTP and SOCKS proxy requests. The control port, such as 9090, is for the management API, not browser traffic.

After enabling System Proxy in the client, check the address and port in Windows 11 under Settings → Network & internet → Proxy → Manual proxy setup. In Windows 10, go to Settings → Network & internet → Proxy. Some clients set the system proxy differently, so the interface may not show the same state. Check the request logs as well instead of relying on a single toggle.

4. Use logs and commands to check node failures and port conflicts

Test an explicit proxy in addition to your browser

With the system proxy enabled, visit a site you want to test in your browser while checking the client’s connection log. Look for the domain, the matching rule, and whether the request went direct or through a proxy group. If your browser has a separate proxy extension, set it to follow the system settings so it doesn’t override the Windows proxy.

You can also run the command below in PowerShell. It calls curl.exe explicitly to avoid PowerShell environments that interpret curl as a different command. Replace 7890 with your actual port:

curl.exe -I --connect-timeout 10 --max-time 20 --proxy http://127.0.0.1:7890 https://example.com

• Immediate local port connection error: Check that the core is running, the port is correct, and the configuration loaded successfully.
• Timeout after connecting to the local proxy: Check node connection errors, the matched rule, and the remote service status. A reachable local port doesn’t mean the node is working.
• Response received from the destination: This explicit proxy request reached the destination. Check the logs to confirm its route; this doesn’t prove that every app is using the proxy.

If you see “address already in use,” find the process using the port

If two clients both try to listen on 7890, the core started second may report that the address is already in use. The PowerShell commands below show the listening process ID and name. No output usually means there was no TCP listener on that port when you ran the query.

Get-NetTCPConnection -LocalPort 7890 -State Listen -ErrorAction SilentlyContinue |
  Select-Object LocalAddress, LocalPort, OwningProcess

Get-NetTCPConnection -LocalPort 7890 -State Listen -ErrorAction SilentlyContinue |
  ForEach-Object { Get-Process -Id $_.OwningProcess }

If another proxy client is using the port, exit it normally before starting the current client. Don’t force-quit a process just because you see its ID. If you need to change the port—for example, to 7891—also update the system proxy and any proxy address entered separately in other apps. If the client manages the system proxy automatically, turn that feature off and back on, then check the settings again.

5. Handle firewall prompts without disabling the firewall

When Windows Firewall asks whether to allow network access, first check the program path and whether the prompt refers to the GUI client or the core. Typical default rules restrict unsolicited inbound connections while allowing outbound traffic. Using a proxy locally through 127.0.0.1 is not the same as allowing devices on your LAN to connect to your computer.

1. For local use only, leave Allow LAN connections turned off. Don’t open all inbound ports just because a website won’t load.
2. If you need to share the proxy, make sure you’re on a trusted network first. Then check the app entry under Windows Security → Firewall & network protection → Allow an app through firewall.
3. Grant only the permissions needed on trusted private networks. Don’t also enable access on public networks by default. For more precise source address and port ranges, use Advanced settings.
4. If a client update changes its installation path, check whether an old firewall rule still points to the previous file. Ask your administrator to handle restrictions set by your organization rather than disabling security services.

Allowing an app through the firewall only addresses access covered by the relevant firewall rules. It won’t fix an expired subscription, a failed node, or incorrect routing rules. If the system proxy works and only other devices on your LAN can’t connect, focus on the listening address, inbound permissions, and network isolation settings.

6. Install the service if needed, then enable TUN

If your browser works but an app still connects directly, first check whether the app supports the system proxy or lets you set an HTTP or SOCKS proxy separately. Some command-line tools, games, and background services ignore the Windows user proxy. In that case, consider TUN mode instead of continuing to change the system proxy address.

Check service mode in the right order

1. In the client settings, look for Service mode, Install service, or a similar service management option. Installing the service may trigger a User Account Control prompt.
2. Make sure the service is running. If needed, press Win + R, enter services.msc, and look for the service name used by your client. Don’t guess or modify a Windows service with a similar name.
3. Return to the client, enable TUN, and check the logs to confirm that the virtual interface, routes, and DNS initialized successfully.
4. For comparison, turn off other VPNs or virtual network tools that route traffic. Change only one setting at a time.

Installing the service alone doesn’t guarantee that traffic will enter TUN; the client must also generate the right configuration. Clients manage options such as automatic routing, interface detection, and DNS handling differently. Don’t copy an entire tun: section from another client and overwrite your settings. TUN also doesn’t guarantee that all traffic will use the proxy: connections entering the core are still affected by routing rules, process exclusions, and route scope.

7. Verify startup works after you sign in

For most GUI clients, Run at startup means launching after the current user signs in to Windows—not providing a proxy before anyone logs in. The background service’s startup state is separate from the GUI’s startup setting. A running service alone doesn’t prove that a subscription is active or the system proxy is set.

• Start with the client’s own startup option: Then check Settings → Apps → Startup in Windows, or the Startup apps list in Task Manager. If the client uses a scheduled task, check Task Scheduler as well.
• Avoid duplicate startup entries: Don’t combine a Startup folder shortcut, a custom scheduled task, and the client’s own startup option. Multiple entries can launch duplicate instances that compete for the same port.
• Keep the installation in a fixed location: If you move a portable client, its startup entry may still point to the old path. Turn startup off and on again to recreate the entry.
• Watch for permission differences: Always running the entire GUI as administrator can interfere with startup after a normal user sign-in. Prefer the service mechanism provided by the client.

Check these four things after restarting

Save your settings, restart the PC, and sign in. Then check the tray icon, active configuration, listening port, and request logs in order. The client may start before the network is ready, so a failed subscription update on first launch doesn’t necessarily mean startup is broken. Confirm that the GUI and core are running, then manually update the subscription once the network is available.

If the client has exited but your browser still tries to connect to the local port, check for a manually configured Windows proxy. You can temporarily turn off Use a proxy server in the system settings to restore a direct connection, then investigate why the client exited unexpectedly. Don’t keep toggling the system proxy when the core isn’t running.

Windows Clash setup checklist

A reliable Windows Clash setup should pass all six checks below. If something goes wrong, undoing your most recent change is usually more useful than reinstalling everything.

1. The client matches your PC’s architecture, the core starts, and the logs show no configuration parsing errors.
2. The subscription updates and is active, with an available node in its proxy group.
3. Rule mode behaves as expected, and the system proxy address matches the listening port.
4. The browser and explicit proxy command both appear in the connection logs, and you can confirm the route each request takes.
5. Enable LAN access or TUN only when needed, and test both internal and external services separately.
6. The client starts after you sign in again, and no stale proxy setting remains after you exit. Check the service and GUI status separately.

For more troubleshooting, see the proxy, rules, and DNS sections in the Clash Configuration Guide, or find the relevant symptom in Frequently Asked Questions. When asking for help, include the client name and version, Windows version, and relevant error lines. Hide your subscription URL, node credentials, and management API secret.