This checklist is ordered from "most likely and easiest to check" down to "relatively rare." Go through it in order and don't skip steps. The vast majority of "proxy is on but I still can't get online" cases come down to the first four items — you rarely actually need to get all the way to item 8 or 9. Working through it in order usually takes just two or three minutes to find the problem, with no need to immediately suspect some complicated network environment issue.

  1. Does the client show "Connected"? — the most basic step, and also the one most often overlooked. Some clients require you to manually click a connect button after installing; simply opening the app doesn't automatically activate it. Check the connection status in the bottom-left corner or on the home page first.
  2. Is the system proxy toggle actually on? — the client showing "connected" internally doesn't mean the OS-level proxy setting has actually switched over. On Windows, check whether "System Proxy" is checked in the tray icon menu; on macOS, check whether "Set as System Proxy" is selected in the menu bar icon.
  3. Did the subscription successfully import any nodes? — open the "Config / Profiles" page and check whether the node count is 0. If it is, the subscription link has usually expired or picked up extra spaces when copied — get a fresh link and try again.
  4. Are there any usable nodes in the current proxy group? — a normal node count doesn't guarantee the nodes actually work. Run a latency test on the group; if every node shows a timeout, the problem is most likely on your subscription provider's end — try a different subscription or contact them.
  5. Did a rule classify this site as direct connect? — this is the most common cause of "one specific site won't load but everything else is fine." Open the client's "Connections" panel and check whether the rule this request hit is DIRECT. If it really has been misclassified, you can add a rule to correct it manually, following the rule syntax article.
  6. Is a local port being used by another program? — Clash defaults to using port 7890 (proxy) and 9090 (external controller). If another proxy tool is running, or a previous Clash process didn't fully exit, a port conflict can prevent the proxy from listening properly. Restart the client or change the port settings to fix it.
  7. Has DNS been poisoned, or is it not using Fake-IP? — if pages connect but load abnormally slowly, or some sites resolve to the wrong IP, check whether Fake-IP mode is enabled in your DNS configuration. For the underlying principles and setup, see the DNS configuration article.
  8. Are TUN mode permissions set correctly? — if TUN mode is on but some apps still aren't going through the proxy, check whether the system permissions are properly granted: on Windows, is it running as administrator; on macOS, has the corresponding network extension been allowed in System Settings.
  9. Is it conflicting with another proxy/VPN tool? — running multiple proxy tools at the same time almost always causes conflicts, including some browser extensions with a built-in "VPN" feature of their own. Turn off every other proxy-related tool and test with only Clash running.

If the problem suddenly disappears when you reach a particular item while going through the list in order, that's most likely the cause — fix it first, then continue checking whether the remaining items also have issues. You don't need to finish all nine before drawing a conclusion.

Two Built-in Tools That Can Help You Troubleshoot

Most clients come with two troubleshooting tools built into the interface that a lot of beginners never touch: one is "Latency Test," which tests each node in a proxy group individually so you can quickly spot whether a specific node has gone down; the other is the "Connections" panel, which shows in real time which rule each network request hit and which node it went through — far more informative than guessing whether a rule is taking effect. When troubleshooting item 5 above ("rule misclassification"), this panel is nearly essential. Beyond that, some clients also offer a "Log" page — set the log level to debug to see a more detailed connection process, and if you run into a tricky problem, sending this log to your provider or asking the community for help usually gets you an accurate answer faster.

If You've Checked All Nine and It's Still Not Fixed

It's most likely a problem with the nodes themselves (say, a line outage on the provider's end) rather than your Clash client configuration. You can contact your subscription provider to check the line status, or switch to "Global mode" first to test connectivity across all nodes and rule out whether it's actually a rule-configuration illusion. If the problem persists after switching to several different nodes, you can basically rule out the nodes and go back through the nine checks above again — especially the two related to port conflicts and DNS, since those two categories of issues can sometimes disguise themselves as "nodes unavailable." This site's FAQ page also covers more targeted troubleshooting scenarios with more specific error messages than this checklist.