Platform Setup 14 min read

How to Install Clash on Windows: From Setup Package to System Proxy and Troubleshooting

A step-by-step Windows guide to installing Clash, allowing it through the firewall, importing a profile, enabling the system proxy, and fixing UWP loopback, port conflicts, and service mode errors.

Before You Install: Windows Version, Client Type, and Profile Source

Common Clash clients for Windows typically combine a graphical interface, the Clash or mihomo core, profile management, and system proxy controls. The interface handles subscription imports, proxy selection, and logs; the core listens on local ports, matches rules, handles DNS, and forwards connections. A successful installation only means the program can launch. To make it usable, you still need to import a profile, start the core, enable the system proxy, and verify connectivity.

Use a supported release such as Windows 10 22H2, Windows 11 23H2, or Windows 11 24H2. Windows 7, Windows 8.1, and earlier Windows 10 releases may lack newer WebView2 components, runtimes, driver interfaces, or system components. The installer may open successfully while the core, interface rendering, or TUN mode still fails.

Know the Difference Between Installers and Portable Archives

  • EXE installer: Usually includes a setup wizard, Start menu entry, and uninstall information, making it suitable for long-term use.
  • MSI installer: Integrates with Windows Installer and is commonly used for managed or bulk deployment.
  • ZIP archive: Runs directly after extraction. Updates require manually replacing files, and whether the profile directory moves with the program depends on the client.
  • x64 and ARM64: Choose x64 for most Intel- and AMD-based PCs; Windows devices with Snapdragon or other ARM processors should generally use ARM64.

Open Settings → System → About and check “System type.” Choose x64 for “64-bit operating system, x64-based processor” and ARM64 for “64-bit operating system, ARM-based processor.” Do not infer the architecture from the Windows 11 edition name alone.

Install Clash and Handle Windows Security Prompts

After downloading a package that matches your processor architecture, close any older client that is running. If its icon remains in the notification area, choose “Exit” from the menu, then open Task Manager and confirm that the interface and core processes have ended. An old process that keeps listening on ports 7890, 7891, or 9090 can make the new version report a port conflict immediately after launch.

Standard Installation Sequence

  1. Double-click the EXE or MSI installer and review the version and destination folder shown by the setup wizard.
  2. For a standard single-user PC, the default folder is usually fine. On devices managed by enterprise policy, use the folder specified by your administrator.
  3. After installation, launch the client from the Start menu. There is no need to run it as administrator on the first launch.
  4. If Windows Firewall asks whether to allow network access, select “Private networks” for a home or trusted office network. Decide separately whether access should be allowed on public networks.
  5. Wait for the interface to finish loading and confirm that the status page shows no “Core failed,” core startup error, or repeated restart message.

Clash normally only needs to listen for proxy traffic on the local loopback address. In the configuration, allow-lan: false means the proxy is not exposed to devices on the local network, which is safer when only this PC needs access. If phones or other computers must connect, enable LAN access manually and also restrict inbound firewall rules, configure authentication, and limit access to trusted subnets. Do not expose the port on every network interface.

Directories Worth Checking After the First Launch

Directory names vary by client. Common data locations include %APPDATA%, %LOCALAPPDATA%, and a dedicated folder under the user profile. Press Win+R, then enter %APPDATA% or %LOCALAPPDATA% to inspect them. Profiles, logs, cores, and caches are usually outside the installation folder, so user data may remain after uninstalling the interface client.

Import a Subscription and Verify That the Clash Profile Loads

After the client starts, open “Profiles,” “Configuration,” or “Subscription Management.” Menu labels vary by project; common paths include Configuration → New Subscription or Profiles → Download from URL. Paste the subscription URL, give the profile a recognizable name, then download or import it.

Four Checks After Importing a Subscription

  1. Last updated: Confirm that the page shows a recent update rather than an old cached timestamp.
  2. Profile status: Confirm that the current profile is selected and that no YAML parsing error is shown.
  3. Proxy groups: Check whether the “Proxy” or a similar policy group contains selectable nodes.
  4. Logs: Look for port binding, DNS initialization, or rule-loading errors during core startup.

A basic configuration for a local system proxy usually defines proxy ports, proxy groups, and rules. The snippet below illustrates the structure only; it is not a complete subscription:

mixed-port: 7890
allow-lan: false
mode: rule
log-level: info

proxy-groups:
  - name: Proxy
    type: select
    proxies:
      - Node-A
      - DIRECT

rules:
  - GEOIP,CN,DIRECT
  - MATCH,Proxy

mixed-port: 7890 allows both HTTP and SOCKS requests to use one mixed port. Some older profiles use port: 7890 and socks-port: 7891 separately. Always follow the ports in the current profile and the client’s status page rather than assuming common defaults.

How to Fix YAML Parsing Errors

YAML is indentation-sensitive. Keep the number of spaces before list items consistent; tabs can also cause parsing failures. If the subscription is generated by a server, do not rewrite the original file extensively in the client. Refresh the subscription first to rule out an interrupted download or stale cache. For manual profiles, check spaces after colons, list dashes, matching quotation marks, and whether every proxy group references an existing node name.

Choose a Node and Rule Mode, Then Enable the Windows System Proxy

Once the profile loads, open “Proxy,” “Proxies,” or the policy-group page. Select a node in the main proxy group and run a latency test. The latency figure measures the test URL’s connection time, not sustained download speed. A result of 85 ms only means the node was responsive during that test; “Timeout” means the test did not complete within the client’s timeout.

Rule, Global, and Direct: What’s the Difference?

  • Rule: Matches the configured rules from top to bottom and decides whether traffic is direct, proxied, or rejected. This is the usual day-to-day mode.
  • Global: Sends most connections entering Clash through the selected global policy. It is useful for temporarily checking whether rules are routing traffic incorrectly.
  • Direct: Sends connections entering Clash directly to their destinations without using a proxy node. It is commonly used for comparison tests.

Changing modes does not automatically change the Windows proxy switch. After selecting a node and mode, enable “System Proxy” on the client’s home or settings page. A common path is Settings → System Proxy → Enable, although some clients place the switch at the top of the main window.

After enabling it, open Windows 11 Settings → Network & internet → Proxy to verify the setting. The client usually writes a manual proxy address of 127.0.0.1 and the relevant HTTP or mixed port, such as 7890. When the client manages this value, do not set a different port manually in Windows, or the client status and actual system setting may diverge.

Verify That the System Proxy Is Actually Working

  1. Open the client logs and keep the log level set to info.
  2. Fully close and reopen the browser so it does not reuse old connections.
  3. Visit a regular HTTPS page and check whether the logs show its domain and matched policy.
  4. Test both rule mode and direct mode, then compare the egress address and page connectivity.
  5. Turn off the system proxy and test again to confirm that the result changes with the switch.

A browser working successfully does not mean that every Windows program will use the proxy. Programs that follow WinINET or the system proxy settings usually work; applications with their own network stack, hard-coded direct connections, environment-variable-only proxy support, or special protocols may bypass it. Check the application’s own proxy settings, or use TUN mode only after understanding its scope and impact.

Port Conflicts, Core Failures, and Local Connection Refused Errors

If the logs show bind: Only one usage of each socket address, address already in use, or a port-in-use message, another process is already listening on the same address and port. Common causes include an older Clash core, another proxy application, development tools, and a service process that remains in the background after the interface closes.

Identify What Is Using Port 7890

netstat -ano | findstr :7890
tasklist /FI "PID eq process ID"

The last column of the first command shows the PID. Replace it with the actual number in the second command to inspect the corresponding process. PowerShell can also verify that a local listener exists with the following command:

Test-NetConnection 127.0.0.1 -Port 7890
Get-NetTCPConnection -LocalPort 7890 -ErrorAction SilentlyContinue

If TcpTestSucceeded is False, first confirm the actual listening port in the profile. If it is indeed 7890, check whether the core started, whether the profile loaded successfully, and whether security software terminated the process. Do not change both the profile port and the Windows proxy port and then repeatedly test. Choose one available port, such as 7890 or 7892, and let the client write it to the system proxy again.

Troubleshooting Order for Core Startup Failures

  1. Read the first error in the log rather than focusing only on repeated retry messages.
  2. Switch to the client’s built-in basic profile to determine whether the issue is in the core or the subscription file.
  3. Confirm that the core file has not been moved and that the core path configured in the client is valid.
  4. Close other proxy applications to rule out port and service-name conflicts.
  5. Restart Windows to clear leftover processes and unreleased driver state.
  6. If the problem persists, export the necessary logs after removing subscription URLs, node credentials, and public IP addresses.

UWP Loopback Restrictions: Store Apps Cannot Connect to the Proxy

Some Microsoft Store apps and AppContainer-isolated programs cannot access the local loopback address by default. In this situation, a browser may connect normally through 127.0.0.1:7890 while a Store app continues to report no network connection. This is usually a UWP loopback restriction, not a node failure.

Use the Client’s Loopback Tool First

Some Windows Clash clients provide a management page at Settings → UWP Loopback or Settings → UWP Loopback. Open the list, select only the apps that genuinely need the local proxy, save the change, then fully exit and restart the affected apps. Do not select every package at once, because this can also alter traffic from system components and background apps.

If the client has no graphical tool, use PowerShell to query an app’s Package Family Name:

Get-AppxPackage | Select-Object Name, PackageFamilyName

After confirming the target app’s package family name, add a loopback exemption from an elevated Command Prompt:

CheckNetIsolation LoopbackExempt -a -n=actual PackageFamilyName
CheckNetIsolation LoopbackExempt -s

The first command adds the specified app; the second lists current exemptions. Reinstalling an app can change its package identity, so check it again afterward. If the app does not read the Windows system proxy, a loopback exemption alone will not help; configure a proxy inside the app or use a broader traffic-capture method.

Service Mode Failures, Startup, and Permissions

Some clients offer “Service Mode,” “Service Mode,” or “System Service.” This typically uses a Windows service to provide specific networking capabilities, allowing TUN, a system-proxy service, or core startup to operate without the foreground interface. Service mode is not required for a standard system proxy. If you only use a browser and software that follows system proxy settings, running the client in the foreground with the system proxy enabled is usually enough.

Common Reasons Service Installation Fails

  • The client directory was moved, but the service still points to the old path.
  • The old service was not removed, causing a service-name conflict.
  • Windows User Account Control confirmation was not completed during service installation.
  • Enterprise Group Policy prevents standard users from creating or starting system services.
  • Security policy blocks the driver, service executable, or core file from starting.

In the client, first go to Settings → Service Mode and uninstall the service. Exit the client and restart Windows. Reopen the client, install the service again, and complete the permission prompt. If the button continues to report failure, open services.msc to check for an old service and its status, but do not delete a service whose purpose you cannot confirm.

Use only one startup mechanism. If the client has already created a startup task under Settings → General → “Launch at startup,” do not also place a shortcut in shell:startup. Duplicate startup entries can launch two interface processes, causing port conflicts, repeated system-proxy changes, or duplicate tray icons.

When to Use TUN Mode and How to Troubleshoot DNS

The system proxy only affects programs that actively read Windows proxy settings. Game launchers, command-line tools, some messaging apps, and applications with their own network stack may bypass it. TUN mode uses a virtual network interface to capture a broader range of IP traffic, which helps with apps that cannot be configured separately, but it also brings greater complexity, permission requirements, and potential impact when something goes wrong.

Complete These Three Baseline Tests Before Enabling TUN

  1. The browser can reliably reach the target page in system proxy mode.
  2. A usable node is selected in the proxy group used by rule mode.
  3. The logs show no recurring DNS timeouts, port conflicts, or profile parsing errors.

After the baseline checks pass, open Settings → Network → TUN Mode and enable the required switches. First-time setup may require administrator approval and installation of a virtual network adapter or service. After enabling it, check local-network access, printers, corporate VPNs, virtual machines, and game platforms. Multiple virtual adapters, VPNs, and traffic-filtering drivers can conflict over route priority.

If the logs repeatedly show DNS timeout, no such host, or abnormal resolution results when connecting to a domain, first distinguish system DNS from Clash DNS. Disable TUN and the system proxy, then run nslookup example.com to confirm that the base network can resolve names. Start Clash again and check whether the core DNS module is listening on its configured address. mihomo profiles may use the enhanced fake-ip or redir-host mode; their caching and application compatibility differ, so do not switch between them without understanding the existing rules.

ipconfig /flushdns
nslookup example.com
route print

ipconfig /flushdns only clears the Windows DNS client cache; it does not clear every browser cache or Clash core cache. Use route print to inspect route priority among TUN, corporate VPNs, and physical adapters. Change one variable at a time: node first, then rule mode, DNS, and only afterward TUN and its drivers.

Post-Installation Checklist

A complete Windows Clash deployment must satisfy five layers: the program, profile, ports, system proxy, and rules. A tray icon or latency number alone is not enough to confirm that everything works.

  • The client version matches the Windows architecture, and both the interface and core start reliably.
  • The subscription shows a recent update time, and the current profile loads successfully.
  • A node is selected in the main proxy group, and the latency test returns a clear result.
  • The local HTTP, SOCKS, or mixed port is listening.
  • The Windows system proxy address and the client’s listening port match.
  • When a page is opened, the logs show the domain, matched rule, and final policy.
  • Turning off the system proxy changes the test result as expected.
  • UWP apps that need the proxy have a loopback exemption.
  • Enable service mode and TUN only when they are actually needed.
  • Subscription URLs, profile files, and credentials in logs are stored securely.

When troubleshooting, start with the first log error, then verify the profile and ports, check the Windows system proxy, and only afterward investigate UWP, service mode, TUN, and DNS. Working layer by layer avoids changing several switches at once and makes it easier to identify whether the issue lies in the client interface, the Clash core, Windows networking, or the remote node.

Download Clash