Clash Proxy Modes Explained: Rule, Global, and Direct

Understand the Difference Between Traffic Capture and Proxy Modes

Clash’s Rule, Global, and Direct modes determine how traffic is handled after it enters the core—not which apps send traffic to the core. When only the system proxy is enabled, browsers and apps that follow the system proxy settings typically pass through Clash. Apps that ignore those settings may still connect directly. With TUN enabled, the client can capture more network traffic, but the actual scope still depends on client settings, OS routing, and exclusions. So switching to Global mode does not mean every connection on your device will use a proxy.

To check what’s happening, ask two questions: first, is System Proxy or TUN enabled in the client? Then, is the selected mode Rule, Global, or Direct? Changing the mode without checking how traffic enters can make it easy to mistake “this app isn’t going through Clash” for “the rules aren’t working.” The comparison below applies to connections that have entered Clash. Menu names vary by client, but the mode selector is usually on the Overview or Proxies page.

How the Three Modes Route Traffic

DIRECT is a connection target, not a way to “turn off Clash.” In Direct mode, if System Proxy or TUN is still enabled, traffic may still pass through the client before going out over your local network. Global mode also depends on the target selected in the global policy group: traffic uses a proxy node only if one is selected. If you choose DIRECT, connections still go direct. When checking the mode, note the policy group’s current selection too.

Rule Mode: Check Which Rule Matches for Everyday Use

Rule mode checks rules in the configuration’s rules list in order. Usually, the first matching rule determines where a connection goes. For example, a home router address in the 192.168.0.0/16 range can use DIRECT; specific domains can go through another policy group; and MATCH catches connections that didn’t match any earlier rule. Rule mode does not automatically “pick the fastest node for every site.” Domain routing depends on the rules in your subscription or local configuration, while node selection depends on the relevant policy group.

This snippet illustrates the order rules are checked. 节点选择 must exist in the same configuration’s proxy-groups; these lines alone do not make a complete configuration. Before adjusting the order, check that the group name matches your configuration.

rules:
  - DOMAIN-SUFFIX,example.com,DIRECT
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - MATCH,Node Selection

These rules first match example.com and its subdomains, then matching local IP ranges; all other connections go to “Node Selection.” no-resolve means this IP rule won’t trigger an extra domain lookup for matching. It does not disable all DNS requests. If you put MATCH earlier in the rule list, later rules won’t get a chance to match. Back up your configuration before editing one generated from a subscription; subscription updates may overwrite changes made directly to it.

How to Check Routing in Rule Mode

1. Under the client’s Config section, make sure the expected configuration is active—not an empty one left over from an earlier test.
2. Switch to Rule under Overview or Proxies, open the client’s Connections or Logs, then visit the address you want to check.
3. Check which rule matched, which policy group was used, and the final node shown for that connection. If it shows DIRECT, review the relevant rule and its position. If there’s no connection record, first check whether traffic is entering through System Proxy or TUN.

The domain shown in the log may not exactly match the one in your browser’s address bar. A webpage may also request images, APIs, and other domains, so it’s normal for one page load to create connections with different routes. When troubleshooting, focus on a specific connection instead of judging the entire ruleset by whether the page loads.

Global Mode: A Short-Term Troubleshooting Test

If a site won’t open in Rule mode but works after you switch nodes, try Global mode briefly. Select a known working node in the global policy group, then visit the same address. If Global works but Rule doesn’t, check which group the rule matched, what’s currently selected in that group, and whether its node is working. If neither mode works, check the subscription configuration, node connection, System Proxy, or TUN. Repeatedly changing rules usually won’t fix an issue with traffic capture or a failed node.

Global mode is useful for troubleshooting, but it doesn’t mean LAN traffic should always be routed through a proxy. When opening your router’s admin page at 192.168.1.1 or connecting to a LAN printer, the global policy group selection and the client’s routing exclusions can both affect the result. For reliable access to local devices, Rule mode with DIRECT rules for LAN traffic is usually a better everyday choice; verify the actual connection records. When you’re done testing, switch back to Rule mode and try the original site again.

Direct Mode: Tell Network Issues from Node Issues

Direct mode sends connections that have entered Clash without using proxy nodes, making it useful for comparing against your local network. For example, if a locally accessible site fails in Rule mode but works in Direct mode, check the matching rule, policy group, and node. If it still fails in Direct mode, start by checking your local network, the destination address, and the app itself. This test alone won’t identify a specific faulty rule; check the records under Connections or Logs as well.

LAN access also depends on whether an app uses the proxy entry point. If your browser uses the system proxy to reach your router, Direct mode can be a useful comparison. But an app that already bypasses the system proxy won’t behave differently when you switch modes. If nothing changes after switching to Direct, don’t assume the mode isn’t working.

Choose a Mode for the Task, Then Check Connection Records

• Everyday browsing: Use Rule mode. Check that frequently used sites match the expected policy groups, and let LAN addresses go direct according to your configuration.
• Troubleshooting a specific site: Note the target matched in Rule mode, then switch to Global mode and test with a specific node. Switch back to Rule mode when you’re done comparing.
• Testing your local network: Switch to Direct mode briefly and visit an address that should be reachable on your LAN. Then restore your previous mode.
• Accessing a router or printer: Check the address’s IP range, LAN DIRECT rules, and connection records first. There’s no need to keep changing the mode for your entire device just to reach a local address.

A common case: your browser works in Rule mode, but a game or command-line app doesn’t appear in the connection list. Switching between the three modes usually won’t help because the app may not be entering the core at all. First check the app’s own proxy settings. If you need to capture traffic from more apps, follow the client’s instructions to check TUN, system permissions, and exclusions. TUN changes which traffic enters the core; Rule, Global, and Direct determine how that traffic is handled once it’s in.

A reliable way to choose a mode is to follow this order: confirm how traffic enters, confirm the active configuration, select a mode, then check the connection records. Use Rule mode day to day. When something goes wrong, compare briefly with Global and Direct. Change only one setting at a time, and note the destination, matched rule, and final connection target to pinpoint whether the issue is traffic capture, routing, or the node.