Clash Netflix & Disney+ Split Tunneling Setup Guide

Understand the routing model before changing rules

Separating Netflix and Disney+ traffic in Clash is a rule-routing task, not simply a matter of choosing a faster proxy. The client imports the configuration, the mihomo or Clash core evaluates each request from top to bottom, and the first matching rule sends that request to a policy group such as Streaming, Proxy, or DIRECT. The policy group then chooses a node or another group according to your selection and health-check settings.

A practical setup has three independent parts. First, create a dedicated streaming policy group. Second, place the relevant Netflix and Disney+ domains above broad rules such as GEOIP,CN,DIRECT or MATCH,Proxy. Third, keep local services and local network ranges on DIRECT. If any one of these parts is missing, the result may look inconsistent: the homepage can load while playback fails, Netflix can use the intended node while Disney+ goes through another group, or local banking and printer traffic can be sent through a distant proxy.

Choose system proxy mode or TUN mode

System proxy mode is usually sufficient for a browser or application that respects the operating system’s HTTP and SOCKS proxy settings. It is easier to inspect because only proxy-aware applications enter Clash. TUN mode creates a virtual network interface and can capture applications that ignore the system proxy, including some media players, games, launchers, and background services. However, TUN also captures more traffic, so correct DNS and direct rules become more important.

Start with system proxy mode when testing the rule design. Enable TUN only if the streaming application does not follow the system proxy or if playback uses a separate process that bypasses it. Never enable TUN merely because a website fails before checking the selected node, DNS result, and core logs.

Prepare a dedicated streaming policy group

A streaming group prevents Netflix and Disney+ rules from competing with a general-purpose proxy group. In the client, use the configuration editor or a local override section rather than editing a subscription that is regenerated on every update. The exact menu names differ between FlClash, Clash Verge Rev, and other clients, but the YAML structure remains familiar when the active core supports these fields.

The following example assumes that the configuration already contains proxy names such as US West 01, Japan 01, and Singapore 01. Replace every example name with an exact name from your own proxies list. A name mismatch prevents the group from selecting that node.

proxy-groups:
  - name: Streaming
    type: select
    proxies:
      - US West 01
      - Japan 01
      - Singapore 01
      - DIRECT

  - name: Streaming Auto
    type: url-test
    url: https://www.gstatic.com/generate_204
    interval: 300
    tolerance: 80
    proxies:
      - US West 01
      - Japan 01
      - Singapore 01
      - DIRECT

A select group gives you manual control. It is useful when you know which region works for a particular service and want to keep that choice stable. A url-test group measures reachability and latency against its test URL, but low latency does not prove that Netflix or Disney+ will accept the node. A node may respond quickly to the test URL while its streaming IP is blocked or its region is unsuitable.

For a first deployment, use select and test one node at a time. After identifying several reliable nodes, you can create an automatic group for convenience. Keep DIRECT in the group only if you intentionally want a quick fallback and understand that the service will then use your ordinary network address. If the purpose of the group is to prevent accidental direct access, remove DIRECT.

Avoid group-name and proxy-name mistakes

• Use exact names: YAML references are normally matched by the complete visible proxy name, including spaces, punctuation, and region suffixes.
• Do not place a policy group under proxies: The group belongs in proxy-groups. A group can reference another group, but the nesting must be valid.
• Check the active profile: Editing one configuration while another profile is running produces no visible routing change.
• Keep one source of truth: If a subscription update replaces local edits, use the client’s override feature or a separate local configuration layer.
• Watch for unsupported fields: Classic Clash and mihomo do not expose exactly the same options. If the core reports an unknown field, remove that field or use a syntax supported by the active core.

Add domain-based rules in the correct order

Domain rules are the most predictable starting point because the service domains can be routed to the dedicated group before a broad geographic or final rule catches them. Put the streaming rules above GEOIP and MATCH rules. The example below covers common service domains and related endpoints without claiming that this is a complete or permanent list.

rules:
  - DOMAIN-SUFFIX,netflix.com,Streaming
  - DOMAIN-SUFFIX,netflix.net,Streaming
  - DOMAIN-SUFFIX,nflxvideo.net,Streaming
  - DOMAIN-SUFFIX,nflximg.net,Streaming
  - DOMAIN-SUFFIX,nflxso.net,Streaming
  - DOMAIN-SUFFIX,nflxext.com,Streaming
  - DOMAIN-SUFFIX,disneyplus.com,Streaming
  - DOMAIN-SUFFIX,disney-plus.net,Streaming
  - DOMAIN-SUFFIX,bamgrid.com,Streaming
  - DOMAIN-SUFFIX,disney.com,Streaming
  - DOMAIN-SUFFIX,disney.demdex.net,Streaming
  - GEOIP,LAN,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - GEOIP,CN,DIRECT
  - MATCH,Proxy

DOMAIN-SUFFIX matches the domain and its subdomains, so DOMAIN-SUFFIX,netflix.com,Streaming can match both the base domain and a host below it. Do not use a loose rule such as DOMAIN-KEYWORD,netflix,Streaming unless you have a specific reason. Keyword rules can match unrelated hostnames and make later troubleshooting harder.

The list above is a starting point, not a promise that every playback request will expose one of these names. Streaming platforms can use content delivery networks, authentication services, telemetry, advertising systems, certificate checks, and application-specific endpoints. Some applications also resolve a hostname and then connect to an IP address in a way that makes domain-only matching insufficient. When TUN is enabled, DNS mode and sniffing behavior can affect whether the core learns the original domain.

Keep local services and private networks direct

Local traffic should not be sent through a remote streaming node. Direct rules reduce latency for routers, printers, NAS devices, smart-home controllers, and local web panels. They also prevent a remote proxy from receiving requests for private addresses. The exact private ranges may be supplemented by your router’s own subnet, such as 192.168.50.0/24.

rules:
  - DOMAIN-SUFFIX,lan,DIRECT
  - DOMAIN-SUFFIX,local,DIRECT
  - IP-CIDR,192.168.50.0/24,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve

Do not add broad direct rules such as DOMAIN-SUFFIX,com,DIRECT as a shortcut. They can bypass the streaming entries and make regional routing impossible. If a local service uses a public domain name, add only that specific hostname after confirming it is safe to bypass the proxy.

Apply the configuration and test it step by step

Make a backup of the active YAML or export the current profile before editing. A simple backup lets you return to a known-working state if a subscription update overwrites the override or the core rejects the new syntax. Do not share the complete file publicly if it contains subscription tokens, server credentials, private keys, or external controller secrets.

1. Open the active profile: Confirm that the selected configuration is the one receiving your rule and group changes.
2. Add the policy group: Insert Streaming under proxy-groups and use only node names that already exist in the active configuration.
3. Add the rules: Place Netflix and Disney+ domain rules above geographic rules and MATCH.
4. Validate the YAML: Check indentation, commas, duplicate keys, and the spelling of group names. YAML uses spaces, not tabs.
5. Reload the profile: Use the client’s reload or switch-profile action. If the client shows a parse error, read the core log before changing unrelated settings.
6. Select one node manually: Begin with a node in the region you intend to test instead of using automatic selection.
7. Clear stale sessions: Close and reopen the browser or streaming app. Existing connections may remain attached to the old policy until they expire.
8. Inspect live connections: Confirm that the hostname is matched by Streaming and that the selected outbound node is the expected one.
9. Test playback: Check login, catalogue loading, and actual video playback separately. A successful homepage request does not prove that the media CDN request is routed correctly.

When a domain is not visible in the connection list, check whether the application is outside the system proxy path. This is a common reason to consider TUN mode. If TUN is already enabled, verify that its DNS mode, auto-route behavior, and virtual interface permissions are active. On desktop systems, firewall software and another VPN can also intercept or block the same traffic.

Change one variable at a time

If playback fails, do not simultaneously replace the node, enable TUN, change DNS, and rewrite every rule. First keep the configuration unchanged and switch to another node in the same region. If that fails, compare the live connection rule and inspect the core log. Next test the same node with the browser cache or application session removed. Only then evaluate DNS mode, TUN, or a broader domain list.

Choose regional nodes without sacrificing everyday traffic

Streaming services commonly evaluate the apparent location of the client, but the exact behavior differs by service and account. A node located in a particular country does not automatically guarantee access to that country’s catalogue. The provider may identify the IP as a data-center address, detect unusual account activity, or apply a different policy to the account, device, and title.

Keep separate groups when your normal browsing and streaming requirements differ. For example, a general Proxy group can serve ordinary international websites, while Streaming contains only nodes that you have tested for playback. This makes it easier to change a streaming node without changing the route used by work tools, software updates, or other browsing sessions.

• Prefer stable nodes: Playback needs sustained throughput and low packet loss, not only a good latency number.
• Compare peak hours: A node that works in the afternoon may buffer during evening congestion.
• Keep the region consistent: Avoid switching countries repeatedly during one account session.
• Use a small candidate list: Five reliable nodes are easier to troubleshoot than dozens of untested entries.
• Measure playback, not only ping: A successful ICMP or HTTP probe does not measure the service’s media path.
• Respect service terms: Node selection should not be treated as a guarantee of access to content restricted by licensing or account policy.

Handle DNS, TUN, and common failure modes

DNS can influence both rule matching and the destination that a service returns. In a basic system-proxy setup, the application may resolve a hostname locally before sending the connection through Clash. In TUN mode, the core may handle DNS requests through its configured DNS stack. If the selected DNS path and proxy path disagree about location, a service may see an unexpected combination of DNS and exit-IP regions.

Do not copy a DNS configuration from another profile without checking its purpose. Fields such as fake-ip, redir-host, nameserver policies, and fake-IP filtering can behave differently across clients and core versions. If a service fails only after enabling TUN, temporarily return to system proxy mode. This comparison tells you whether the problem is routing coverage or the streaming node itself.

dns:
  enable: true
  enhanced-mode: fake-ip
  nameserver:
    - https://dns.google/dns-query
    - https://cloudflare-dns.com/dns-query
  fake-ip-filter:
    - "*.lan"
    - "*.local"
    - "+.push.apple.com"

The example is illustrative rather than universal. Use DNS servers that are reachable in your network and compatible with your privacy and reliability requirements. If the active configuration already contains a provider-managed DNS section, prefer a local override that changes only the necessary setting. Duplicate dns keys can cause one section to replace another, depending on how the configuration is merged.

Read the core log instead of guessing

Set the log level to info while testing, then return to a quieter level after the issue is resolved. The log and connection panel can show whether a request was matched by Streaming, sent to DIRECT, rejected by a node, or closed after a DNS failure. A rule match confirms routing selection, not successful service authorization, so continue checking the node and playback result.

Common messages such as connection refused, timeout, no such host, and rule matched describe different stages. A timeout after the streaming group selected a node points toward node reachability or congestion. A no such host error points toward DNS. A successful connection followed by an application error can indicate the service rejected the exit IP or the account session.

Frequently asked questions