First-Run Setup Checklist for FlClash: Key Steps and Common Issues on Windows, macOS, and Android

1. Before First Launch: Check the Installer, Permissions, and Existing Proxies

FlClash manages configurations, proxy nodes, and connection status; its integrated mihomo core handles traffic forwarding. A successful installation only means the app can launch—it doesn't mean a subscription has loaded or system traffic is routed through the core. Check these three stages separately during initial setup. Changing ports, DNS, and routing all at once makes it much harder to identify the cause of a problem.

Quit any other proxy clients and VPNs before you begin. Closing a window may only minimize the app to the system tray, so quit from the tray menu and check whether the system proxy still points to the old app. This guide uses 7890 as an example mixed port; it is not a claim about the default in every FlClash version. Use the port, option names, and permission steps shown by your installed version.

Check the installation for your operating system

• Windows: Go to Settings → System → About to check your system type. Choose an x64 or ARM64 installer to match your device. Start the app without elevated privileges first; grant permissions only if you enable TUN, install a service, or create a virtual network adapter and the client requests them.
• macOS: Open the Apple menu → About This Mac to check whether your Mac has Apple silicon or an Intel processor. Move the app to Applications before opening it. If macOS blocks it, verify where it came from, then check the specific message under System Settings → Privacy & Security. Disabling macOS security protections entirely is not an installation step.
• Android: When installing an APK, grant Install unknown apps permission only to the browser or file manager you’re using, and revoke it after installation if you like. Settings vary by manufacturer; search for the permission in Settings. The first time you start the VPN, Android shows a separate system authorization prompt—this is not the same as the install permission.

Keep a backup of any existing working configuration. Subscription URLs may contain authentication tokens, so don’t post the full link, its QR code, or logs containing tokens in public forums.

2. Import a Subscription, Then Check the Active Configuration and Nodes

After the first launch, open the client’s configuration manager and add a subscription URL or import a local configuration file. When pasting a subscription URL, check for leading or trailing spaces and line breaks, and keep all existing query parameters. Don’t use your provider’s login page URL as a subscription URL. You’ll need to obtain a subscription yourself; installing the client does not provide a proxy service.

1. In the configuration manager, add a remote subscription, give it a recognizable name, paste the full URL, and save.
2. Run an update and wait for it to download and finish parsing. If an error appears, address it first; don’t repeatedly switch TUN, DNS, or global mode.
3. Set the imported configuration as the active one. A subscription appearing in the list doesn’t mean it has been loaded.
4. Open the proxies or proxy groups page and check that nodes and groups are listed. For a manual selection group, choose an available node. For an automatic group, make sure it has at least one available member.

Know the Difference Between a Successful Import and a Successful Connection

A successful import only means the downloaded content could be parsed. An expired node, authentication error, or unreachable server may not become apparent until a connection is attempted. Conversely, a failed subscription update doesn’t necessarily mean the nodes are down: the update URL and proxy node use separate network paths.

If the response is a web page, login prompt, or access restriction page, it isn’t a valid configuration—even if the HTTP status is 200. Check the update error for format and parsing details, then ask your subscription provider whether the client is supported. Don’t submit a private subscription to an unfamiliar online conversion service.

On your first subscription update, you won’t have a working proxy yet. A subscription URL that requires a proxy to access can create a startup dependency. Use an update URL provided by your provider that you can reach, or retrieve the configuration through an existing trusted connection. Repeatedly toggling a proxy that has no available nodes won’t resolve this dependency.

3. System Proxy or TUN: Test One Traffic Routing Method First

A system proxy sends requests from apps that honor the operating system’s proxy settings to a local port. TUN uses a virtual network adapter and routing to capture traffic, making it useful for apps that ignore system proxy settings. Both can be used together in specific configurations, but for initial troubleshooting, enable just one to reduce interactions between routing, DNS, and proxy settings.

Windows and macOS: Establish a Browser Baseline First

Start the core with TUN disabled, then enable the system proxy. On Windows, check the manual proxy under Settings → Network & Internet → Proxy. On macOS, check the current network service under System Settings → Network → [current network service] → Details → Proxies. Menu labels vary by OS version, but you’re checking the same thing: the proxy host and port.

Browser extensions, built-in proxy settings, and enterprise policies can override system settings. For your first test, temporarily disable proxy extensions and use a regular browser window to visit one site you know should connect directly and another that should use the proxy. If only one browser fails, check its own settings before reinstalling the client.

Android: The VPN Icon Doesn’t Mean Every App Is Covered

Accept Android’s VPN connection request, and check that no other VPN is running. An Android user can generally have only one active VPN service at a time, so other VPNs and some VPN-based filtering apps may conflict with FlClash. If per-app routing is enabled, make sure your test browser is included in the apps being routed.

Android’s system VPN capture works differently from a desktop system proxy. Don’t enter the desktop address 127.0.0.1:7890 as your phone’s Wi-Fi proxy and expect it to point to your computer: on your phone, 127.0.0.1 refers to the phone itself.

4. Check the Mixed Port: 7890, Port Conflicts, and Listening Address

mixed-port accepts both HTTP proxy and SOCKS connections on the same port. The port used by apps must match the port the core is actually listening on. These examples explain the fields; they’re not a complete configuration to replace your subscription with, and you don’t necessarily need to change these values manually.

mixed-port: 7890
allow-lan: false
mode: rule
log-level: info

• mixed-port: 7890: Apps configured with a manual proxy must use this same port. If you change it to 7891, update browsers, terminals, and other tools where you entered the port manually.
• allow-lan: false: If you’re only using FlClash on this device, leave LAN access disabled initially. Allowing LAN connections also involves the listening address, firewall, and authentication. Don’t enable it just to troubleshoot a local connection.
• mode: rule: Selects outbound connections according to rules. It controls routing policy; it does not enable the system proxy or create a TUN adapter.
• log-level: info: Suitable for routine startup and connection checks. If you temporarily change it to debug, switch it back after troubleshooting to avoid excessive logs.

Windows: Find the Process Using a Port

If the startup log includes address already in use, run the commands below in PowerShell. The first lists listening ports and their process IDs; the second resolves an ID to a process name. No output means no matching TCP listener was found at the time of the check—it doesn’t prove the core started successfully.

Get-NetTCPConnection -LocalPort 7890 -State Listen |
  Select-Object LocalAddress, LocalPort, OwningProcess

Get-NetTCPConnection -LocalPort 7890 -State Listen |
  ForEach-Object { Get-Process -Id $_.OwningProcess }

macOS: Check Local Listening Ports

lsof -nP -iTCP:7890 -sTCP:LISTEN

Once you’ve identified the process, decide whether to quit the old client or change the port. Don’t terminate an unknown process. A port conflict may come from another proxy app or a second instance of the core. If you change the port in the client, restart the core and verify the active value. A subscription update may overwrite direct edits to a file, so use settings or an override mechanism supported by the client for persistent changes.

5. The Right Order for Rules, DNS, and Connection Tests

Rule mode is a good starting point. Rules are usually evaluated in order, and the first matching rule determines the target policy; a policy group then selects a node. Global mode still depends on a working selected policy and node, so it can’t fix an incorrect node password, port, or transport settings. Direct mode can’t be used to check whether a proxy node works.

Check all four layers—not just the latency number

1. Core: After startup, there are no configuration parsing, listening, or permission errors. Seeing the app window doesn’t mean the core is running correctly.
2. Node: Test latency for nodes in the active policy group. Results apply only to the test address and time; they don’t show actual download bandwidth or guarantee access to every site.
3. App: After the browser makes a request, look for the destination domain, matched rule, and outbound policy in the client’s connection list or logs. If no request appears, check the traffic routing method first.
4. Destination: If a request reaches the core but fails, check the DNS result, node connection errors, and destination server response. A page returning 403 or 429 is a different issue from a connection timeout.

On Windows, you can also run a comparison test by explicitly specifying an HTTP proxy. The command below applies only if the mixed port is actually 7890; on macOS, replace curl.exe with curl. If the example domain is assigned to DIRECT by your rules, success only confirms that the request passed through the local proxy listener—not that the proxy node works.

curl.exe --proxy http://127.0.0.1:7890 --connect-timeout 10 --max-time 20 -I https://example.com/

For DNS, start by keeping the setup already provided by your subscription and client. mihomo’s Fake-IP mode may return mapped addresses to apps, such as addresses in the 198.18.0.0/16 range; that doesn’t mean DNS has been poisoned. If DNS fails after enabling TUN, check DNS capture, upstream resolver reachability, and other encrypted DNS settings. Don’t change several public DNS providers at once.

A browser’s built-in Secure DNS can change the DNS resolution path, but it doesn’t necessarily cause failures. Disable it temporarily and retest only if a comparison confirms it conflicts with your current routing setup. Change one setting at a time and note its original value.

6. Common First-Run Issues on Each Platform

Windows: System Proxy Is On, but Command-Line Tools Still Connect Directly

Some command-line tools don’t use the Windows system proxy. They may require their own proxy options or environment variables. First verify the proxy with the explicit proxy command in the previous section, then check the documentation for the specific tool. A terminal that isn’t routed through the system proxy doesn’t mean the proxy switch has failed. If you switch to TUN, first confirm the browser baseline works, then grant the required permissions and test routing.

macOS: Proxy Stops Working After a Network Change, or Internet Access Fails After Quitting

macOS proxy settings are tied to network services. After switching from Wi-Fi to Ethernet, check the proxy configuration for the active service. Before quitting the client, turn off the system proxy and confirm direct access works. If the app exits unexpectedly while the system still points to a local port and the core has stopped, your browser may report that it can’t connect to the proxy server. Clear the stale proxy setting instead of importing the subscription again.

Android: Disconnects When the Screen Locks, or Some Apps Don’t Work

If the connection works with the screen on but fails after the phone has been locked for a while, check battery optimization and background activity restrictions first. Under Settings → Apps → FlClash, allow background activity as needed. Some manufacturers also require a separate auto-start permission. Don’t confuse battery restrictions with node timeouts; compare when the connection drops with the client logs.

If only LAN devices, casting, or work profile apps have problems, check per-app routing, LAN bypass, and work profile isolation. LAN destinations need the correct local routes; forcing all traffic through a remote node may make printers, NAS devices, or company intranet sites unreachable. Note the destination address and matched rule before adding any necessary DIRECT rules.

7. Initial Setup Checklist

Finish initial setup when you can verify that it works consistently—not when every switch is turned on. Keep the configuration as small as possible while still explaining how traffic is routed, then add startup behavior, per-app routing, or custom rules one step at a time.

• The subscription has updated, the intended configuration is active, and the proxy group has a clearly available node.
• The core is running normally, the active listening port is recorded, and there are no port conflict errors.
• On desktop, test the system proxy first. If you need TUN, verify its permissions, routing, and DNS separately.
• On Android, VPN permission is granted, the test app is included in the routed apps, and background activity is configured as needed.
• Test one direct destination and one proxied destination, and confirm you can explain the policy used for each in the connection log.
• After disconnecting, regular network access works again. After restarting the client, the configuration and node selection are still as expected.
• Enable automatic subscription updates and launch at startup only after the basic connection is stable. Don’t add multiple automation settings at the same time.

For details on mixed-port, mode, and rule syntax, see the configuration reference. For the full installation and usage walkthrough, see Getting Started. If a problem occurs later, keep a record of when it happened, your OS version, the client version shown in the app, the exact error, and your most recent settings change. This is more useful for troubleshooting than repeatedly reinstalling.