FlClash User Guide: From Subscription Import to Connection Verification

Use Rule Mode for Everyday Use

Open the “Proxy” page or the mode selector on the home page. You will usually see Rule, Global, and Direct modes. For initial setup, choose “Rule.” Rule mode uses the subscription’s rules to route different domains, IPs, or network types through a proxy or direct policy. This keeps local services direct while sending requests that need a proxy to the appropriate policy group.

Global mode generally sends most traffic through the currently selected proxy. It is useful for temporarily checking whether rules are matching, but it should not be the only basis for judging an initial setup. Direct mode bypasses the proxy and can help determine whether a problem originates in the proxy path. Switching modes does not change the subscription or delete nodes, so you can switch briefly during testing and return to Rule mode afterward.

Choose a Node or Automatic Policy for a Policy Group

On the proxy page, you will see policy groups defined by the subscription. Common names may indicate node selection, automatic selection, failover, streaming, or final matching, but the actual names come from the provider. Find the main node-selection group and choose a healthy node, or select an automatic policy already configured by the subscription. Then check whether the “Final,” “MATCH,” or similar fallback group references that main policy, so traffic does not leave through a different outbound.

Latency in the node list is only a single probe result; it does not fully represent sustained speed, stability, or access to every website. For the first selection, prefer a geographically nearby node whose latency test completes, then verify it through real access in step four. If every probe times out, do not immediately assume that all nodes are unavailable: the probe target, current network, firewall, or DNS status may affect the results.

Leave DNS, Overrides, and Scripts at Their Defaults for Now

A common initial-setup mistake is changing DNS, TUN, override scripts, and rule sets before establishing a basic connection. When several variables change together, the cause is difficult to identify. This step only confirms the mode and main policy group; leave advanced settings at the subscription or client defaults. After the basic connection works, adjust settings one category at a time for your use case.

If you need to understand how mode, proxy-groups, rules, and DNS fields relate to one another, read the Configuration Fields Reference. That page documents fields and YAML structure; this guide avoids manual configuration so the first connection stays straightforward.

First Confirm That the Browser Can Reach Real Websites

Keep FlClash running in the background. Open a browser and visit websites that normally load reliably, then visit a target site that should use the proxy. If the page loads, the basic path from the app to the local proxy and on to the remote node is working. Next, use a trusted network-information site to check your current egress IP and approximate region; they should broadly match the selected node’s egress region. You only need to confirm the direction, not a specific address, since some services use dynamic egress IPs.

If the browser cannot access the internet at all, first disable the system proxy or TUN and confirm that the original network works again, then restart FlClash. If the original network works but the proxy connection fails, check the active node, subscription update time, and logs in the client. If the original network itself is failing, troubleshoot the local Wi-Fi, mobile network, or router first.

Review Connection Logs and Rule Matches

Open the “Connections” or “Logs” page, then refresh the website you just visited. The list should show a new domain connection, its matching rule, policy group, and actual outbound. If the target site is assigned to a proxy group and the actual outbound is the node selected in step two, Rule mode is working. If every request shows Direct, check that the mode is still Rule, the final policy does not point to Direct, and the subscription rules have loaded.

Connection logs are also the main way to investigate a single website. Find its domain first, then see which policy group received it. If the group is correct but the connection fails, try another node in the same group. If the group is unexpected, inspect rule order or the subscription provider’s routing design. During initial setup, avoid writing custom rules immediately; first confirm whether the issue comes from the existing subscription configuration.

Check Routing with Two Types of Websites

The goal of Rule mode is not to send all traffic through one egress, but to choose a path for each request. Visit a commonly used local service and a service that requires a proxy, then inspect the connection logs. The local service should usually match a Direct or local-region rule, while the proxied service should enter a proxy policy group. When both requests behave as expected, the routing path is complete.

If a website works after temporarily switching to Global mode but fails in Rule mode, the issue is usually a rule match or policy-group reference. If Global mode also fails, check the node and connection permissions first. Switch back to Rule mode after testing instead of treating Global mode as a permanent fix.

Check DNS Last

Once basic webpages load, check for slow domain resolution, domains that fail intermittently, or clearly different IPv4 and IPv6 results. Switch nodes first to rule out a single-egress issue, then reconnect to refresh the session. Investigate DNS settings only when domain access fails while direct network connectivity remains normal.

DNS involves the system resolver, the client listener, encrypted DNS, Fake IP, rule matching, caching, and other components, so it is not suitable for changing everything at once in a first-time guide. For persistent issues, record the affected domain, current mode, whether TUN is enabled, and the log results. Then see Common Issues; for field-by-field details, read the DNS section in the Configuration Fields Reference.