Clash Rule, Global, and Direct Modes: Differences and Which to Choose

In the Clash client, Rule, Global, and Direct determine how traffic is routed after it reaches the Clash core. These modes do not change the number of nodes in your subscription or automatically alter node protocols. Instead, they control whether rules are evaluated, whether all connections are sent through one policy group, and whether connections access their destinations directly.

Rule is usually the best choice for everyday use. Global is useful for temporarily testing a node or investigating a rule that failed to match, while Direct helps determine whether a problem is caused by the proxy path. Before choosing a mode, distinguish between two concepts: the system proxy or TUN mode sends traffic into Clash, while the proxy mode decides where that traffic goes after entering the core.

What each mode changes

Rule mode: match rules in order, then choose an exit

Rule mode corresponds to mode: rule. After a connection enters the core, Clash checks the rules list from top to bottom against domains, IPs, ports, processes, or rule providers. As soon as the first rule matches, checking stops and the connection is sent to the policy group, proxy node, DIRECT, or REJECT specified by that rule.

For example, when accessing intranet.example, a domain-suffix rule can send the connection directly. For other destinations, the final MATCH rule can send traffic to the “Node Select” policy group. Rule order directly affects the result, so narrower and more specific rules should generally appear before broader ones.

mode: rule
mixed-port: 7890

rules:
  - DOMAIN,intranet.example,DIRECT
  - DOMAIN-SUFFIX,example.org,Node Select
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - MATCH,Node Select

The main value of Rule mode is not simply that “some websites use the proxy.” It lets different types of traffic use different exits. LAN addresses can go direct, domains that should not be accessed can be rejected, common online services can use an automatic latency-testing group, and everything else can go to a manually selected group. With sensible rules and policy groups, you will not need to switch modes frequently in daily use.

Global mode: skip the rule list and send traffic to GLOBAL

Global mode corresponds to mode: global. In this mode, ordinary connections are no longer routed by evaluating rules one by one. Instead, they are sent to the built-in policy entry named GLOBAL. In the client’s Global policy section, you must select a specific node or policy group; otherwise, the previous selection may remain active.

“Global” describes routing inside the Clash core. It does not mean that every packet on the computer must pass through the proxy. Programs that ignore the system proxy, protocols not captured by TUN, processes excluded by the client, and some LAN broadcast traffic may never enter Clash. When a browser uses the system proxy, Global mode generally affects the browser and other programs that honor that setting.

Direct mode: use the local network exit after entering the core

Direct mode corresponds to mode: direct. Even when a connection enters Clash through the system proxy port or TUN adapter, the core selects a direct connection to the destination instead of using a subscription node. This mode is useful for comparing results with and without a proxy, and for testing LAN services, corporate intranet sites, or local development servers.

Direct mode does not mean that the client has been closed. If the system proxy still points to 127.0.0.1:7890, requests still reach Clash first, and Clash then opens a direct connection. If TUN remains enabled, traffic may also continue through the virtual adapter. To fully restore the operating system’s original network path, disable the system proxy or TUN and verify that the system network settings have been restored.

Use this table to identify the traffic path

Comparison	Rule mode	Global mode	Direct mode
Configuration value	rule	global	direct
Reads rules	Matches in order	Usually skipped	Usually skipped
Primary exit	Determined by the matching rule	Node or policy group selected in GLOBAL	Local network via DIRECT
Typical uses	Everyday use and fine-grained routing	Force proxying, test nodes, troubleshoot missed matches	Comparison tests, LAN access, rule out proxy-related factors
Common risks	Incorrect rule order or an unsuitable final rule	Local services are sent through the proxy, increasing traffic usage	Destinations that require a proxy become unreachable

Which mode should you use daily?

Use Rule mode for long-term operation

When a subscription provides a complete rule set, Rule mode is usually the best default. It can send local websites, LAN devices, and destinations that require a proxy along the appropriate paths while reducing unnecessary proxy traffic. For subscriptions with traffic multipliers, Rule mode also prevents system updates, LAN file transfers, and similar connections from being sent through proxy nodes by default.

After selecting Rule mode, open “Proxies” → “Mode” in the client and confirm that Rule is selected, then check the active policy group. Different graphical clients may label this entry “Proxy Mode,” “Routing Mode,” or Mode, but the core value remains rule. Clash for Windows v0.20.39 shows the mode and policy groups on the Proxies page; clients based on mihomo typically provide Rule, Global, and Direct on the “Proxies” page as well.

Switch to Global mode for temporary troubleshooting

If a website will not open in Rule mode but node latency tests are normal, switch temporarily to Global and explicitly select an available node in GLOBAL. If the site works in Global, the problem is likely related to rule matching, policy-group selection, or a rule-provider update. If it still fails in Global, continue checking the node itself, DNS, system time, and the network connection.

1. Note the current mode and policy group so you can restore them after testing.
2. Open “Proxies” → “Mode” and select Global.
3. In the GLOBAL policy entry, select a node with a completed latency test.
4. Test the destination in a new private-browsing window to avoid browser-cache interference.
5. When testing is complete, switch back to Rule and check which rule actually matched the destination domain.

Keep Global tests to a few minutes whenever possible. Background connections from software updates, cloud-drive sync, and video playback may also use the selected node. Pause high-bandwidth tasks before testing so changes in the target request are easier to observe.

Use Direct mode for LAN and comparison tests

When accessing a router admin page, NAS, printer, or local development service, Direct mode can quickly show whether proxy routing is involved. For example, if 192.168.1.1, 10.0.0.20:8080, or localhost:3000 works after switching to Direct, the original rules may have incorrectly sent the private-network address to a proxy policy group.

The long-term fix is not to leave Direct enabled, but to add LAN rules in Rule mode. Common private address ranges include 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Place these rules before broad IP rules that could cover them, and consider adding no-resolve to avoid triggering extra DNS resolution for literal IP rules.

rules:
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - MATCH,Node Select

How the system proxy, TUN, and mode switching relate

The system proxy only captures programs that honor proxy settings

Common Clash HTTP, SOCKS, and mixed listening ports use 7890, but the actual value should be confirmed in the configuration file and on the client’s home screen. When the system proxy is enabled, Windows writes the proxy address to system settings. Browsers and some desktop programs read this setting and send requests to Clash; some games, command-line tools, and programs with their own network stacks may ignore it.

Therefore, switching to Global does not guarantee that programs ignoring the system proxy will suddenly enter Clash. In Windows 11, check the proxy status under “Settings” → “Network & internet” → “Proxy,” or review the client’s connection log. If the test program does not appear on the Connections page, the problem occurred before traffic reached the core and is unrelated to choosing Rule, Global, or Direct.

TUN expands traffic capture, but it does not replace routing mode

TUN uses a virtual network adapter and system routes to capture more traffic, making it useful for programs that do not support the system proxy. After TUN captures traffic, it still passes through the current routing mode: Rule checks the rules, Global sends it to the global policy entry, and Direct connects through the local network. TUN determines “how traffic enters the core”; the three modes determine “how it leaves afterward.”

In mihomo configuration, common TUN fields include enable, stack, auto-route, and strict-route. These fields affect the virtual adapter and system routes, but should not be used as substitutes for mode. During troubleshooting, change one variable at a time: keep TUN unchanged while switching modes, then keep the mode unchanged while testing TUN. The results will be easier to interpret.

DNS can also make test results look contradictory

Mode switching mainly determines the connection exit, while the DNS lookup path is also affected by the dns section, system DNS, the proxy implementation, and caches. A site that fails in Rule mode but works in Global mode is not necessarily affected only by a domain rule; different exits may also produce different resolution results. During testing, close and reopen the target application, clear the system DNS cache if necessary, and inspect the client log for the domain, destination IP, and matched policy.

When fake-ip is enabled, an application may see a mapped address in the 198.18.0.0/16 range. This is part of Clash’s domain-mapping mechanism and does not mean that the website’s real server is located in that range. To determine which rule matched, check Host, Rule, and Chains in the connection details instead of relying only on the destination IP shown by the application.

Common mistakes and how to fix them

Mistake 1: treating Global mode as a faster mode

Global does not automatically reduce node latency or increase node bandwidth. It simply skips rule-based routing and sends connections through the selected exit. If a website is faster in Global, Rule mode may have selected a different policy group, or the rules may have sent the site to an unsuitable node. The correct approach is to inspect the connection details and fix the rule or policy group rather than using Global indefinitely to hide a routing problem.

Mistake 2: assuming the client is closed after switching to Direct

In Direct mode, the listening port, system proxy switch, TUN adapter, and DNS module may still be running. To test a network state that completely bypasses the client, disable TUN, disable the system proxy, exit the client, and then confirm in Windows proxy settings that the manual proxy is off. Switching to Direct only tests the proxy exit; it does not simulate a fully closed client.

Mistake 3: forgetting to select a GLOBAL node in Global mode

After switching to Global, check what GLOBAL currently points to. If it points to an automatic selection group, the final node may change as health checks run; if it points to an unavailable node, all ordinary connections entering the core will be affected. During troubleshooting, choose a specific node with a recent successful latency test and record its name and the test time.

Mistake 4: changing YAML and switching modes without reloading

After manually changing mode, rules, or a policy group, the client’s active configuration may not refresh automatically. Use “Profiles” → “Reload” or the equivalent Reload entry in your client. YAML uses spaces for indentation; tabs, missing colons, or inconsistent list indentation can all cause loading to fail.

mode: rule

proxy-groups:
  - name: Node Select
    type: select
    proxies:
      - Automatic Select
      - DIRECT

rules:
  - DOMAIN-SUFFIX,example.com,Node Select
  - MATCH,Node Select

Troubleshoot the mode based on the symptoms

The website works only in Global mode

• Find the destination domain on the Connections page and record the matched rule and policy chain.
• Confirm whether Rule mode matched DIRECT, a policy group for the wrong region, or an unavailable node.
• Manually update the subscription and rule providers, then reload the configuration.
• Add a more specific rule for the destination domain and place it before broader rules.
• Switch back to Rule and test again to confirm that Global is no longer required.

Direct works, but Rule and Global both fail

This usually means the local network can reach the destination directly, while the current proxy node or proxy path has a problem. Start by running a latency test on the node, then try another node in the same region. A latency test only confirms that its test address is reachable; it does not guarantee that the target service will work, so also check the connection log for timeouts, connection refusals, or failed TLS handshakes.

If multiple nodes fail, check whether the subscription has expired, whether the system clock is accurate, and whether security software is blocking the client process. When Windows time is off by several minutes, TLS certificate validation may fail. Go to “Settings” → “Time & language” → “Date & time,” enable automatic time setting, and select Sync now.

All three modes fail to access the destination

First confirm that traffic is entering Clash. If the connection list contains no request for the destination, check the system proxy, TUN, the application’s own proxy settings, and the listening port. If requests appear but all three modes fail, check DNS, the destination server, the local firewall, and the underlying network. You can also temporarily exit the client and access the destination directly to establish a clear comparison.

Mode selection quick reference

• Regular browsing, office work, and long-running background tasks: choose Rule and let the rule set handle daily routing.
• Suspect that a destination domain matched the wrong rule: choose Global briefly, compare the result, then fix the rule.
• Check whether a subscription node can carry traffic to a destination: choose Global and select that node in GLOBAL.
• Access a router, NAS, or local development service: start with Direct for comparison, then add LAN direct rules.
• Determine whether a problem comes from the proxy exit: keep the capture method unchanged and compare Rule, Global, and Direct one at a time.
• Test the system’s completely native network path: disable TUN and the system proxy, then exit the client; do not merely switch to Direct.

The most reliable habit is to use Rule as the default and treat Global and Direct as diagnostic tools. Change only one condition per test, record the current node, matched rule, capture method, and result, then restore the original settings. This makes rule problems easier to locate without conflating the system proxy, TUN, DNS, and proxy mode.