Clash Proxy Modes Explained: Rule, Global, and Direct

Three modes, three ways to route traffic after it reaches the core

Clash proxy modes control how the core handles connections it has already intercepted. Rule mode evaluates rules one by one, Global mode uses a single global policy, and Direct mode connects straight to the destination. If you regularly use services in mainland China and abroad, Rule mode is usually the best starting point. Use Global mode to briefly test the proxy route, and Direct mode to check whether your local network can reach a destination without a proxy.

First, separate two questions: Does the connection reach Clash, and if so, which route does it take? System proxy settings and TUN mainly affect the first question; Rule, Global, and Direct mainly affect the second. So selecting Global mode does not automatically send traffic from every app on your computer through the proxy.

Rule mode: direct access in mainland China and proxy access abroad can coexist

Rule mode corresponds to mode: rule in the configuration. The core checks the rule list from top to bottom and applies the policy for the first match. If that policy is a policy group, the final route depends on the group's selection or operating mode. It does not try every node and automatically pick one that can open the site.

Rule order matters more than rule count

This is a configuration snippet, not a complete subscription you can run on its own. Before using it, make sure the existing configuration has a policy group named “Egress” with at least one working proxy node. When merging, replace the relevant fields rather than appending a second rules section to the bottom of the file.

mode: rule
mixed-port: 7890
allow-lan: false

rules:
  - DOMAIN-SUFFIX,bilibili.com,DIRECT
  - DOMAIN-SUFFIX,github.com,Egress
  - MATCH,Egress

• mixed-port: 7890 sets the local mixed HTTP and SOCKS proxy listening port. This is the value used in this example; not all clients use this port.
• DOMAIN-SUFFIX,bilibili.com,DIRECT sends the domain and its subdomains direct. It does not cover every third-party domain used by the service.
• DOMAIN-SUFFIX,github.com,Egress sends matching connections to the “Egress” policy group. Whether they use a proxy depends on the group's selection.
• MATCH,Egress catches connections that have not matched any earlier rule, so it must come after the specific rules you want to take effect.

If you put MATCH,DIRECT first, the domain rules below it will never handle those connections. Large subscriptions often use RULE-SET to reference external rule sets, which follow the same ordering. When troubleshooting, check the rules actually loaded by the client—not just a section you edited in the subscription file.

Rule mode can still send all traffic through a proxy

“Rule” describes how connections are matched; it does not guarantee direct access in mainland China. If the configuration only has MATCH,Egress, or a site in mainland China has no matching rule and falls through to a proxy, that connection will still use the proxy. Conversely, if a policy group has DIRECT selected, connections routed to that group will go direct. To understand the result, check the matching rule, policy group, and final route.

Global mode: use one policy for a quick comparison

Global mode corresponds to mode: global. Intercepted traffic no longer passes through the regular rule list; instead, it goes to the built-in GLOBAL policy. In the client, changing the mode and choosing a global node are usually separate steps: switch to Global, then check which node or policy group the global policy uses.

If DIRECT is selected under GLOBAL, Global mode can still send traffic directly. Seeing “Global” in the interface does not prove that a proxy is in use. Check the policy chain in the connection details and confirm the route with a trusted public IP lookup.

How to use Global mode to troubleshoot an inaccessible overseas site

1. Visit the destination in Rule mode and note the domain, matching rule, and final policy in the connection details.
2. Switch to Global mode, explicitly select a verified working proxy node, and leave the system proxy or TUN settings unchanged.
3. Close the existing connection and try again. Restart the app if needed to prevent an old persistent connection from being reused.
4. If Global works but Rule does not, check rule order and policy group selection first. If neither works, check the node, DNS, traffic interception entry point, and destination service.

This comparison cannot completely rule out DNS differences, but it can narrow down the cause. Don't stay in Global mode permanently just to restore access to one site. Fix the incorrect rule and switch back to Rule mode to keep direct local access to services in mainland China.

Why Global mode can slow down sites in mainland China

Sites in mainland China can often be reached directly through a local ISP. If Global mode uses an overseas node, requests may travel to a proxy server abroad before returning to a domestic origin server or CDN. The longer route can increase latency, expose traffic to cross-border network fluctuations, and make it subject to the proxy server's bandwidth. A different exit location may also change CDN routing or trigger additional account verification.

For example, if the same page's time to first byte rises from 45 ms over a direct connection to 230 ms through a proxy, check the route before changing all your DNS settings. These figures illustrate how to record results; they are not measurements from this site or a general performance guarantee. For a meaningful comparison, use the same device and resource, record at least three runs for each route, and distinguish cached results from first loads.

Direct mode: it doesn't close the client or reset all network settings

Direct mode corresponds to mode: direct. Business connections that reach the core connect straight to their destinations instead of using regular rules to select a proxy route. Use it to check basic connectivity to sites in mainland China or see whether an issue is related to the remote proxy. If your current network cannot reach a destination directly, switching to Direct mode will not make it reachable.

Direct mode does not mean Clash has stopped running. If the system proxy still points to a local listening port or TUN is still routing traffic, connections may continue to be handled by the local core. The core's DNS module may also keep using its current configuration, so seeing “Direct” does not mean all DNS requests have reverted to the system defaults.

• Switch to Direct: Keep the client running while temporarily changing the route for business connections.
• Turn off the system proxy: Apps that follow the system setting will stop using that proxy entry point, but TUN will remain on.
• Turn off TUN: This disables interception by the corresponding virtual network adapter, but HTTP or SOCKS proxy settings configured in individual apps may still apply.
• Quit the client: Make sure the system proxy and routes are restored. A leftover proxy setting pointing to a local port can prevent you from connecting to the internet.

Where to switch: check the mode, policy selection, and traffic entry point separately

In the common desktop interface of Clash Verge Rev, open “Proxies” and select “Rule,” “Global,” or “Direct” at the top of the page. In the English interface, these options are Rule, Global, and Direct. Controls may appear as mode icons or a dropdown in other versions, so follow the labels in your current interface. After selecting Global, check the active global policy as well.

System proxy and TUN are usually separate toggles, not two more modes. When reading the cross-platform guide, start with the traffic interception settings for your platform. For installation, subscription import, and basic connectivity, start with the setup guide. Don't assume menu locations in one desktop client apply to every mobile app.

The three exact values to use in a configuration file

# Route traffic by rules
mode: rule

# Temporarily use one global policy
mode: global

# Send business connections direct
mode: direct

These three snippets show mutually exclusive options; do not copy all three as duplicate mode fields. A client interface may change the mode at runtime, and whether that change is written back to the configuration depends on the client. Subscription updates may overwrite manual edits, so after saving, check the active mode in the interface and confirm what happens after a restart.

Four common scenarios: which proxy mode to choose

Everyday browsing and work in mainland China: start with Rule

Choose Rule mode if you need to use video services, online banking, workplace apps, and overseas documents at the same time. After visiting a service in mainland China, check the “Connections” page to see whether the request matched DIRECT. If a service is routed incorrectly, add a more specific domain rule or fix the rule set order; there is no need to send all connections direct.

One overseas service is failing: use Global for a quick comparison

First make sure the node itself works, then switch briefly to Global. If access is restored, return to Rule mode and check whether the destination domain is matching an incorrect direct rule. A page may rely on separate domains for sign-in, static assets, and API requests, so loading the homepage does not mean every dependency is routed correctly.

A bank or local service reports an issue: check the actual route

First try routing the service directly in Rule mode; use Direct mode for comparison if needed. Re-establish the connection after switching so an existing session does not keep using the old route. For local network admin pages, also check private IP routing and TUN exclusions. Selecting Direct alone does not resolve every routing issue.

A game or command-line tool is unaffected: check how its traffic is intercepted

If switching from Rule to Global changes neither the app's traffic nor the connection list, first check whether the app's traffic reaches the core. Command-line tools may need a proxy configured separately, and some games use UDP rather than following the HTTP system proxy automatically. Decide whether to use TUN based on protocol support, permissions, and routing requirements.

Verify after switching: check the result with a new connection

1. Check the entry point. Confirm the proxy address and listening port used by the app. If it is configured to use 127.0.0.1:7890, it should not still be connecting to the old 7897 port.
2. Check the mode. Make sure the interface shows Rule, Global, or Direct as intended, and that a subscription reload has not reset it.
3. Check the policy. In Rule mode, check the matching rule; in Global mode, check the GLOBAL selection. For both, confirm the final route.
4. Start a new connection. Close the destination page or app and try again. A refresh alone may reuse an HTTP/2, HTTP/3, or other persistent connection.
5. Record the result. Note the destination domain, connection time, policy chain, and error message. Change one setting per test to avoid changing the mode, node, and DNS at the same time.