Clash Rule, Global, and Direct Modes: How They Work and When to Use Each

The Three Modes: What Handles Traffic After It Enters the Core

Use rule mode for everyday traffic. Switch to global mode when you need to temporarily bypass routing rules, or direct mode to check whether your local network can reach a destination without a proxy. These modes change how the Clash core handles connections—not your subscription or the node servers themselves.

One important caveat: a connection must first reach Clash. The core can choose a route only when traffic comes through the system proxy, an app connects to a proxy port directly, or TUN captures it. Connections that never enter the core won't be routed through a proxy just because you switched to global mode.

Mode and value	How it routes traffic	When to use it
Rule mode `rule`	Matches rules in order and applies the matched policy	Everyday traffic routing, LAN access, and choosing different routes for different sites
Global mode `global`	Uses the built-in `GLOBAL` policy group	Temporarily use one route for all traffic; check whether a rule is causing the issue
Direct mode `direct`	Uses direct egress instead of selecting a proxy from the regular rule list	Check the local network or temporarily bypass remote nodes

Rule mode: Rules are checked in order; the first match wins

With mode: rule, the core checks connections against rules in order. Once a rule matches, the connection uses that rule's policy, and later rules usually don't affect its route. A policy can be a node or policy group, or a built-in option such as DIRECT or REJECT.

How to read a minimal rule example

mode: rule

rules:
  - DOMAIN-SUFFIX,example.com,DIRECT
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - MATCH,Proxy

example.com and its subdomains match the first rule and go direct.
Connections to destinations in 192.168.0.0/16 match the second rule. no-resolve means the core won't trigger a DNS lookup just to match this IP rule.
Connections that don't match an earlier rule fall through to MATCH and use the policy named Proxy.

This is a rule snippet, not a complete subscription file. Before using it, make sure your existing config defines a node or policy group named Proxy. If the actual group is named “Select Node,” use that exact name. A mismatch will fail config validation; it won't be replaced with a node automatically.

Rule mode doesn't automatically recognize every site

Routing depends on the rules in your config, whether rule sets are up to date, and the current policy group selection. A site may match a selector that's set to DIRECT, so its traffic still goes direct. Conversely, a site in mainland China may match MATCH,Proxy and use a remote node. You can't determine the route from a site's location alone.

If one site takes an unexpected route, check its domain, matched rule, and outbound in the client's Connections view before changing anything. To add an exception, place the more specific domain rule before broader rules. Put MATCH last so earlier rules have a chance to apply.

Global mode: Uses GLOBAL, but doesn't proxy every device automatically

With mode: global, connections normally controlled by the mode use the built-in GLOBAL policy group instead of being routed by the regular rules list. After switching, open the proxy or policy group view and make sure GLOBAL selects an available node or a policy group that ultimately selects one.

If GLOBAL selects DIRECT, traffic still goes direct. If it selects an automatic latency-testing group, the final route depends on that group's candidates and selection logic. “Global” means a single decision point; it doesn't guarantee a particular node, the lowest latency, or that every app is captured.

Useful for a quick comparison, not a substitute for checking traffic capture

Note the full domain that fails in rule mode and the rule matched by its connection.
Switch to global mode and select a known-working node in GLOBAL.
Close the existing page connection and try again, or start a new browser session so an old connection doesn't keep using its previous route.
If the site works in global mode but not rule mode, switch back to rule mode and check the matched policy and node. Don't delete the entire ruleset.

Global mode can also route router admin pages, printers, or corporate intranet traffic through an unsuitable outbound. Traffic excluded by the system proxy bypass list or TUN routes still won't enter the core. With mihomo, also check any extra routes, listeners, or advanced rules in the config. The mode name alone doesn't tell you what happens to all traffic.

Direct mode: Keep traffic flowing through the core, but use your local network for egress

With mode: direct, connections that enter the core use direct egress. This helps determine whether an access issue depends on the remote proxy. For example, if a site loads in direct mode but not global mode, check the GLOBAL selection, node availability, and network conditions on that route.

Direct mode doesn't mean the client is off. The system proxy may still point to a local listening port, TUN may still be active, and the core may still handle DNS. If you quit the client without restoring the system proxy settings, apps may try to connect to a port that is no longer listening, leaving every site inaccessible.

To compare outbound routes only: Leave the client running, switch to direct mode, and start a new connection.
To test the network without the client: Turn off the system proxy and TUN, then confirm the operating system's proxy settings have been restored before testing.
Before quitting the client: Use its normal exit option and check for leftover proxy settings.

Direct mode doesn't guarantee that a destination will be reachable. The site may be down, local DNS may be failing, network access may be restricted, or corporate authentication may be required. Direct mode helps isolate route differences; it's not a universal fix.

How to set the mode field in config.yaml

mode is a top-level YAML field, alongside mixed-port and rules. Don't indent it under dns or a policy group. Use lowercase values: rule, global, or direct. This example uses 7890 as a mixed proxy port; not every client uses this port by default.

# Merge into the top level of your existing config; don't define a field twice
mixed-port: 7890
mode: rule

To switch to global or direct mode, replace only the value on the same line:

# Global mode
mode: global

# Direct mode
mode: direct

Using the GUI and editing config files together

In desktop clients that offer this option, open Settings → Clash Settings or Core Settings, then find Proxy Mode. Some clients put the mode selector right on the home screen. Names and locations vary by client and version.
If you need to edit a file, first check the Config or Subscription page to see which config is active. Save a copy, then edit it through the appropriate editor.
After saving, use the client's reload option. Check for YAML parsing errors and confirm the mode shown in the interface.
Start a new connection and check its route in the Connections view. A successful file save doesn't prove that the running core has picked up the new value.

System proxy, TUN, and DNS: Three boundaries that are easy to confuse

The system proxy determines whether an app sends connections to a local port

Suppose the config listens on 127.0.0.1:7890. A browser that follows the system proxy can reach the network through that endpoint; a game, command-line tool, or other app that ignores the system proxy may still connect directly. In Windows 11, check Settings → Network & Internet → Proxy. On macOS, check System Settings → Network → your current network service → Details → Proxies. The address and port must match the client's actual listener settings.

TUN determines what gets captured; mode determines where captured traffic goes

TUN uses a virtual network interface and routes to send traffic from more apps to the core. It's not a fourth proxy mode and isn't mutually exclusive with rule mode. A common setup is “TUN on + rule mode,” with rules determining which traffic goes direct or through a proxy. When enabling TUN, check permissions, route exclusions, and conflicts with other VPNs. “Global mode” doesn't prove that TUN is on.

Switching modes doesn't replace your entire DNS configuration

DNS settings such as nameserver and fake-ip are separate from mode. With mihomo, DNS egress may also depend on respect-rules and proxy server hostname resolution settings. If DNS still fails in direct mode, or a domain fails in global mode while its IP is reachable, check the DNS logs instead of cycling through the three modes.

Troubleshooting by symptom: What to check after switching modes

Symptom	Check first
Works in global mode, but not rule mode	Which rule matched, the selected policy group, and whether traffic is going through DIRECT or REJECT by mistake
Works in rule mode, but not global mode	The current GLOBAL selection, whether the selected node works, and whether the route for internal network traffic changed
No connection records in any mode	Whether the app follows the system proxy, whether the port is correct, and whether TUN is actually capturing traffic
The page behaves the same after switching	Browser cache, reused connections, or persistent background connections; test again with a new connection
Direct works, but proxy egress fails	Node connection errors, subscription node status, and the policy group's final outbound

Keep other conditions the same during testing: use the same domain, app, and capture method, and change only the mode or one policy group at a time. Record the current mode, matched rule, final outbound, and error message. These details are more useful than simply noting whether a page loads. Before sharing logs, remove subscription URLs, access tokens, and other sensitive information.

Everyday use: Rule mode by default; use global and direct for comparison

For everyday browsing, work, and LAN access: Use rule mode, maintain any necessary domain exceptions, and check which policies your commonly used groups select.
To temporarily route everything through one node: Use global mode and check GLOBAL—don't just switch the mode selector.
To check whether your local network is working: Compare with direct mode first. To rule out the client itself, disable traffic capture and check your system settings.

Use this three-step check: First confirm that traffic reaches the core, then check the current mode, and finally inspect the outbound route. Understanding these layers explains why some apps still bypass the proxy in global mode and helps distinguish rule, node, and DNS issues. For field-by-field details, see Clash Configuration Fields. If you're importing a config for the first time, start with the Quick Start Guide.