What is the `FINAL` rule in Clash? Must it be placed last?

Yes, the `FINAL` rule is the catch-all rule that handles all traffic not matched by preceding rules. It must be placed on the last line of the rule list. It is typically pointed to a `select` or `url-test` type proxy group as the default exit, e.g., `- MATCH,🚀 Auto Select`.

What do `DIRECT` and `REJECT` mean in proxy groups?

`DIRECT` means a direct connection, where traffic bypasses all proxy servers and connects directly to the target. `REJECT` means the connection is rejected, commonly used to block ads, malicious websites, or specific traffic. The client will actively disconnect requests that match a `REJECT` rule.

After updating my subscription, will my manually modified configuration (e.g., added rules) be overwritten?

This depends on the client's configuration management mode. Typically, directly updating a remote subscription completely overwrites the local config file. The recommended approach is: 1) First, copy the subscription config as a local config; 2) Make custom modifications (like adding rules) in the local config file; 3) Subsequently, update node information via "Overwrite Update" or by manually merging node lists to avoid overwriting rules. Many clients (e.g., Clash for Windows) support this feature.

Clash Tutorial: Subscription Import, Proxy Groups, Rules, and Troubleshooting

2/19/2026 · 4 min

Clash Tutorial: From Beginner to Pro

Clash is a powerful network proxy tool widely acclaimed for its flexible rule configuration and excellent performance. This article details the usage of its core features.

1. Importing Subscription Links

Subscription links are the most convenient way to obtain proxy server configurations.

Manual Import

Obtain the Subscription Link: Get a Clash-formatted subscription link (usually starting with https://) from your service provider.
Open the Clash Client: Launch Clash on your device (e.g., Clash for Windows, ClashX, Stash).
Paste the Link: In the Config Management or Profiles section, click "New" or "Add" and paste the subscription link into the URL field.
Update Configuration: Click "Download" or "Update". The client will automatically fetch and parse the configuration file.

Automatic Updates

Most clients support scheduled subscription updates. Enable the "Auto Update" option in the profile details and set an interval (e.g., every 6 hours) to ensure node information is current.

2. In-Depth Proxy Group Configuration

Proxy groups are the core of Clash's rule system, used for logically grouping proxy nodes and routing traffic.

1. Proxy Group Types

select (Manual Selection): Users can manually choose a node from the list. Suitable for scenarios requiring frequent switching.
url-test (Latency Test): Automatically selects the node with the lowest latency. Requires specifying a test URL (e.g., http://www.gstatic.com/generate_204) and interval in the configuration.
fallback (Failover): Selects the first available node in order, providing high availability.
load-balance (Load Balancing): Distributes traffic among different nodes according to a strategy.

2. Configuration Example (YAML Format)

proxy-groups:
  - name: "🚀 Auto Select"
    type: url-test
    proxies:
      - "HongKong-01"
      - "Japan-02"
      - "USA-03"
    url: 'http://www.gstatic.com/generate_204'
    interval: 300

  - name: "🎯 Manual"
    type: select
    proxies:
      - "🚀 Auto Select"
      - "DIRECT"
      - "HongKong-01"
      - "REJECT"

  - name: "📺 Streaming"
    type: select
    proxies:
      - "🚀 Auto Select"
      - "USA-03" # Node specialized for streaming
      - "DIRECT"

3. Configuring the Rule System

Rules determine which proxy group or direct connection specific traffic should use.

1. Rule Types

DOMAIN-SUFFIX: Matches domain name suffixes (e.g., google.com matches mail.google.com).
DOMAIN-KEYWORD: Matches keywords in domain names.
DOMAIN: Matches exact domain names.
IP-CIDR: Matches IP address ranges.
GEOIP: Matches using a country IP database (e.g., GEOIP,CN matches Chinese IPs).
FINAL: The final rule, must be placed last.

2. Rule Providers (Rule Sets)

You can use online rule sets to simplify configuration. Reference remote rule set links in the config file, and Clash will update them periodically.

rule-providers:
  reject:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/reject.txt"
    path: "./ruleset/reject.yaml"
    interval: 86400

rules:
  - RULE-SET,reject,REJECT
  - GEOIP,CN,DIRECT
  - MATCH,🚀 Auto Select # Final rule, points to the default proxy group

4. Troubleshooting Common Issues

1. No Connection / No Internet

Check System Proxy: Ensure Clash's "System Proxy" or "TUN Mode" is enabled.
Check Configuration: Confirm the config file loaded successfully and has no syntax errors (YAML format is sensitive).
Check Nodes: Test the latency and availability of individual nodes on the "Proxies" page.
Check Rules: Try changing the rule to MATCH,DIRECT to test if a direct connection works, ruling out rule errors.

2. Specific Websites Unreachable

Check Rule Matching: The site might be incorrectly directed to REJECT or an unavailable proxy by a rule. Use the client's "Connections" or "Logs" page to see which rule was matched.
Update Rules/GEOIP Database: Outdated rules or IP databases can cause misjudgments.
Check Node/Group Policy: Ensure the target proxy group contains available and functional nodes (e.g., some nodes may not unlock streaming).

3. Slow Speeds

Switch Nodes: Try manually switching to other nodes within the proxy group.
Adjust Group Type: For services requiring low latency, point relevant rules to a url-test type group instead of select.
Check Local Network: Rule out issues with your local ISP or network environment.

4. Subscription Update Failed

Check Link Validity: Directly visit the subscription link in a browser to see if a .yaml file can be downloaded.
Check Client Version: An outdated client might be incompatible with new subscription formats.
Manually Update GEOIP/MMDB: Find the database update option in the client settings.