Clash on Windows: Complete Installation and Setup Guide with Common Pitfalls

Download and Install: Pick the Right Client First

Among the Clash clients still actively maintained on Windows, Clash Verge Rev is the current top pick: it is built on the Tauri framework, runs the actively developed mihomo core (formerly Clash Meta), offers a multilingual interface, and ships updates on a steady cadence. Clash for Windows was discontinued in November 2023 and its release repository was removed, so it is not recommended for new installs, and existing users should migrate sooner rather than later. On the client download page, choose the Windows platform and grab the installer ending in x64-setup; the portable build suits anyone who prefers not to touch the registry, with identical features.

Three Things to Watch During Installation

1. SmartScreen blocking: most open-source clients do not purchase EV code-signing certificates, so Windows may show a "Windows protected your PC" prompt the first time you run the installer. Click "More info" and then "Run anyway" to continue. This is a common prompt for unsigned open-source software, provided the installer genuinely came from this site's download page.
2. Install path: by default the client installs for the current user without requiring administrator rights, and keeping the default is recommended. If you customize the path, avoid non-ASCII characters such as Chinese characters, plus spaces and special symbols — some core components handle non-ASCII paths unreliably.
3. Firewall prompt: the first time the verge-mihomo.exe core starts, Windows Defender Firewall will ask for network access. Check "Private networks" and allow it. If you accidentally click cancel, the local proxy port may be blocked, leaving the client running but unable to connect.

Three Checks After the First Launch

• Interface language: recent versions default to Chinese; you can switch to English or other languages on the settings page.
• Core status: the settings or about page shows the mihomo version number. If it displays normally, the core is running; if it is blank or shows an error, the core process has likely been blocked by security software.
• Port check: Verge Rev uses mixed port 7897 by default, unlike the 7890 from the Clash for Windows era. All troubleshooting commands in this article use 7897 as the example — go by whatever your settings page shows.

Importing a Subscription: Where the Link Comes From and How to Update It

Clash clients ship without any nodes; you need a subscription link — a URL provided by your service provider's dashboard. To import: open the "Subscriptions" page on the left, paste the link into the input field, and click import. The client fetches a YAML config that appears in the list; click the card to set it as active and you are done. The subscription link is effectively an account credential — never paste it into public group chats or share screenshots of it.

Three Common Reasons Imports Fail

• The network cannot reach the subscription server: if your current network cannot connect directly, check "Update subscription via system proxy" first, or manually enable a working proxy before updating.
• Incomplete link: subscription URLs usually carry a token parameter, and missing even one character returns a 403 or 404. Select the link from start to finish when copying.
• Wrong subscription format: some providers hand out a generic subscription by default, which Clash cannot parse. In the provider dashboard, choose the "Clash subscription" type and copy again, or use a subscription converter to generate the Clash format.

How Often to Update

Node lists go stale over time, so enable auto-update: in the subscription card's settings, set the update interval to 12–24 hours. Shrinking the interval to a few minutes achieves nothing and may get you rate-limited by the provider; before switching nodes day to day, just tap the refresh button on the card for a manual update.

System Proxy vs. TUN Mode: Two Ways to Take Over Traffic

With installation and the subscription sorted, the last step is routing system traffic through Clash. Windows offers two takeover methods — understand the difference before enabling either.

System Proxy (Recommended by Default)

Flip the "System Proxy" switch and the client rewrites the Windows Internet proxy to 127.0.0.1:7897. Browsers, instant messengers, and the vast majority of desktop apps read this system setting, so it works out of the box. Command-line tools usually ignore the system proxy and need environment variables set manually, for cmd and PowerShell respectively:

:: cmd environment
set HTTP_PROXY=http://127.0.0.1:7897
set HTTPS_PROXY=http://127.0.0.1:7897

:: PowerShell environment
$env:HTTP_PROXY="http://127.0.0.1:7897"
$env:HTTPS_PROXY="http://127.0.0.1:7897"

TUN Mode (Takes Over All Traffic)

TUN mode creates a virtual network adapter that takes over traffic for the entire machine, including software that ignores the system proxy: some games, UWP apps, and command-line tools. TUN requires administrator privileges on Windows, and Verge Rev's answer is its "Service Mode": click install service on the settings page, and afterwards toggling TUN no longer triggers a UAC prompt every time. Note that system proxy and TUN are an either/or choice — running both only makes it harder to tell which path traffic took when troubleshooting. New users should get comfortable with the system proxy first.

Frequent Issues: Permissions, Port Conflicts, Proxy Not Working

Port Already in Use

If startup reports "port 7897 is already in use" or a mixed-port conflict, nine times out of ten another proxy app is still running — leftover v2rayN or Clash for Windows processes are the usual suspects. It can also mean the last shutdown was unclean and the core process is still in the background. Locate it with two commands:

netstat -ano | findstr :7897
tasklist | findstr <PID>

The first command lists the connections holding port 7897 along with their PIDs; the second looks up the process name by PID. If it turns out to be a zombie core process, run taskkill /PID <PID> /F to kill it. If it is another proxy app you actively use, either quit that app or change the mixed port in Clash settings to a free one such as 7899 — the system proxy follows the new port automatically.

Permissions and UAC

Day-to-day use of the system proxy requires no administrator rights. Only two operations involve elevation: installing Service Mode, and enabling TUN for the first time without the service installed. If clicking the TUN toggle does nothing, first check whether Service Mode is installed on the settings page. On company machines where group policy forbids installing services, just fall back to the system proxy — the only functional difference is the takeover scope.

Proxy Is On but Pages Won't Load

1. Check the proxy mode: the top-right of the proxy page should read "Rule"; in "Direct" mode no traffic goes through the proxy. You can temporarily switch to "Global" as a fallback test.
2. Test node latency: run the latency test on the proxy page and swap out any node that times out. If every node times out, the subscription has likely expired — go back to the previous section and update it.
3. Browser extension conflicts: proxy extensions such as SwitchyOmega override the system proxy settings. Switch the extension to "system proxy" mode or disable it temporarily, then test again.
4. DNS pollution: if the target site still won't open in Rule mode, go into settings, enable DNS override, switch to fake-ip mode, then clear the browser cache once and retry.

Finishing Touches: Auto-Start and Routine Maintenance

• Launch on boot: enable "Launch on boot" and "Silent start" on the settings page, so the client is ready in the tray after boot without popping up the main window.
• Subscription auto-update: keep the 12–24 hour interval; combined with manual refreshes, that is plenty.
• Log level: stay on info or warning for daily use; temporarily switch to debug when troubleshooting and switch back afterwards — running debug long-term slows things down and eats disk space.
• Config backup: keep a copy of your subscription link and any custom rule files, so you can import them directly to restore everything after a system reinstall or device switch.

Once you have walked through everything above, Clash on Windows is ready from the moment you boot. For more clients, see the client download page; for advanced subscription and rule syntax, see the setup guide and advanced configuration; for other issues, check the troubleshooting page.