Compare the three modes: Start with Rule

Clash’s proxy mode determines how connections that have already entered the Clash core are handled next. It does not determine which apps send their connections to Clash. For everyday use, beginners should usually choose Rule to route traffic according to the subscription’s rules. Try Global temporarily when troubleshooting routing issues, or choose Direct when you want intercepted connections to reach their destinations without a remote proxy.

Mode How connections are handled Best for What to check
Rule Rules are evaluated in order. The first match specifies a direct connection, a proxy group, or a rejection. Everyday browsing, routing traffic to domestic and international services, and accessing your local network. Which rule matched and which policy it points to.
Global Instead of choosing an outbound route based on regular routing rules, all traffic uses the current selection in the GLOBAL policy. Temporarily testing a proxy route and comparing it with Rule mode. Whether GLOBAL currently selects a node, another policy group, or DIRECT.
Direct Connections that have entered the core reach their destinations directly, without a remote proxy node. Temporarily restoring direct access and comparing your local network with the proxy route. Whether your local network can reach the destination, and whether interception and DNS settings are still active.

Rule mode: Match rules in order, then choose an outbound route

Rule mode checks the rules list in your configuration from top to bottom. When a rule matches, Clash uses its specified policy and does not continue searching for a “better” match. The order of domain rules, IP rules, and the final catch-all rule can therefore directly affect the outcome.

A straightforward routing example

This is a rule snippet, not a complete subscription. Assume the configuration already contains a policy group named “Everyday Proxy”; example.com is included only to illustrate rule matching.

mode: rule
rules:
  - DOMAIN-SUFFIX,example.com,Everyday Proxy
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - MATCH,Everyday Proxy
  • example.com and its subdomains match the first rule and are handled by “Everyday Proxy.”
  • A destination of 192.168.1.10 can match the second rule and connect directly, illustrating how traffic to a local network address is routed.
  • no-resolve means the IP rule will not trigger a DNS lookup to match the rule. It does not disable DNS for the entire client.
  • MATCH is the catch-all rule and belongs at the end. If it comes first, later regular rules will never get a chance to match.

Matching a proxy group doesn’t guarantee a remote node is used

A policy group may let you select DIRECT. Even if a rule points to “Everyday Proxy,” the connection will still go direct if that group currently selects DIRECT. When troubleshooting, follow the chain from “rule → policy group → actual route” instead of checking only whether the mode button says Rule.

Subscription updates can also change the rules and policy group structure. If you need to add custom routing rules long-term, first check which override, Mixin, or configuration-processing options your client supports. Direct edits to subscription-generated files may be overwritten the next time the subscription updates. Override syntax also varies between clients.

Global mode: One outbound route, not system-wide interception

Global mode is useful for a quick test: if a site won’t load in Rule mode, switch to Global, explicitly select a working node, and see whether access changes. If Global works but Rule doesn’t, check which rule matched, the policy group selection, and any differences in DNS behavior between the two routes. That alone isn’t enough to conclude that “the subscription rules are broken.”

  1. Open the client’s proxy page and switch the mode to Global.
  2. Find the global policy, GLOBAL, and explicitly select a node you know works. Some clients may show a localized name.
  3. Start a new connection, then check the Connections page to confirm the route actually used.
  4. When you’re done testing, switch back to Rule so local network traffic and requests that could connect directly aren’t sent through a proxy node unnecessarily.

“Global” describes policy selection for traffic that has entered the core; it does not promise system-wide coverage. For example, when only the Windows system proxy is enabled, browsers that honor it will usually use the proxy. Apps that establish connections themselves or ignore the system proxy may still connect directly. Switching to Global will not automatically intercept those apps.

Direct mode: No proxy node, but the client may still handle connections

Direct sends connections that have already entered Clash straight to their destinations. It’s useful for comparing access over your local network with access through a proxy, but it doesn’t mean the client has been bypassed. If the system proxy still points to a local listening port, apps will connect to Clash first, and the core will then connect directly to the destination.

Likewise, if TUN is enabled, the virtual network adapter, route interception, and configured DNS handling may remain active after switching to Direct. So if domain lookups fail in Direct mode, don’t rule out Clash’s DNS configuration.

How to fully disconnect from the proxy chain

  • To temporarily stop using remote nodes, switch to Direct and establish a new connection.
  • To restore the original route for apps that honor the system proxy, turn off System Proxy and check whether the app has its own manual proxy settings.
  • To undo TUN interception, turn off TUN in the client, confirm that routes associated with the virtual network adapter have been restored, then exit the client if needed.
  • If your browser can’t connect after you exit, check whether the system proxy still points to a local port that is no longer listening.

For example, an app may still be using 127.0.0.1:7890 after Clash has exited. If no other proxy is listening on that port, requests may fail. 7890 is just a common configuration value; use the port shown in your client.

Where to switch modes in Clash for Windows

In the commonly used English interface of Clash for Windows 0.20.39, select an imported configuration under Profiles, then open Proxies in the left sidebar and choose Rule / Global / Direct at the top. In Rule mode, check the policy groups from your subscription. In Global mode, check the current GLOBAL selection.

The system proxy toggle is under General → System Proxy. It is configured separately from the three modes on the Proxies page. Depending on the interface language, fork, or other client using the mihomo core, you may find it under “Proxies” or “Settings → Proxy Mode.” Check the labels in your client.

What to check after importing a subscription for the first time

  1. Under Profiles, make sure the configuration has downloaded and is selected; seeing a subscription name in the list alone isn’t enough.
  2. Open Proxies, choose Rule, and select a working node or suitable automatic policy group in your main proxy group.
  3. Under General, check the actual listening port and enable System Proxy if needed. If you need to intercept traffic from more apps, learn about TUN permissions and routing separately.
  4. Open the target website, then check Connections for the destination, matched rule, and policy chain. The fields shown vary by client version.

Nothing changes after switching? Check the connection in four steps

Step 1: Confirm the connection is reaching Clash

Keep the Connections page open while visiting the destination. If the corresponding connection doesn’t appear, first check the system proxy, the app’s own proxy settings, and the scope of TUN interception. A very short-lived request may disappear before it shows up, so check the logs as well. Repeatedly switching between modes usually won’t fix an issue with how traffic enters Clash.

Step 2: Start a new connection instead of just refreshing an existing session

Mode changes mainly affect newly established connections. Browsers may reuse persistent HTTP/2 connections, while chat apps and download tools may keep existing sessions open. Close the relevant tab or pause the task before trying again; if needed, close only the connection to the destination. Closing all connections can interrupt other downloads and calls, so check what will be affected first.

Step 3: Check the matched rule and final policy

In Rule mode, check whether the rule points to the expected policy and whether the policy group has unexpectedly selected DIRECT. In Global mode, confirm that GLOBAL has the intended node selected. If the connection is already using the expected node but still fails, check node availability, authentication, and restrictions at the destination service rather than continuing to switch modes.

Step 4: Troubleshoot DNS separately

A domain lookup failure is not the same as a proxy node connection failure. Global won’t automatically fix an unreachable DNS server, and Direct doesn’t guarantee that the system’s original DNS resolution path will be used. With TUN, also check DNS interception and the actual path used by the browser’s secure DNS. If you’re dealing with fields such as fake-ip and nameserver, keep a copy of the original configuration, change one thing at a time, and record the results.

Common use cases: browsing, gaming, and local network access

Should you leave Global mode on for everyday browsing?

Usually, start with Rule so the subscription rules can route direct and proxied traffic appropriately. Use Global only when you specifically need a single outbound route or are troubleshooting briefly. If a site consistently uses the wrong route, check its rule rather than relying on Global to work around the problem.

Does switching to Global always route game traffic through a proxy?

Not necessarily. A game may ignore the system proxy or use UDP. First confirm that its traffic reaches the core, then check whether the node and interception method support the relevant protocol. TUN can intercept traffic from more apps, but it doesn’t guarantee lower latency or replace the game’s own network requirements.

Can’t access a printer, NAS, or router admin page? What should you check first?

First check whether Global is enabled and whether the local network address is being routed through a remote node. Switch back to Rule and verify that private IP addresses have direct-connection rules; also check TUN route exclusions. Don’t assume that adding a single domain rule will restore all local network access.

What does it mean if a website still opens after switching to Direct?

It only shows that access worked under those conditions; the page itself doesn’t tell you which route was used. Cached content, an existing connection, or an app bypassing the proxy can all affect what you see. Establish a new connection and check the policy record in Connections for a more reliable result.

Remember this order: Confirm the connection reaches Clash, check the mode, check the policy group, then check the node and DNS. Use Rule for everyday traffic and Global or Direct briefly for troubleshooting. This makes it easier to find the cause than attributing every access issue to the mode.