Clash Netflix & Disney+ Split Tunneling Setup Guide 2026

Preface

Streaming services do not always need the same network path as ordinary websites. A Netflix or Disney+ session may require a proxy node in a supported region, while local news, banking, shopping, and domestic websites usually work faster through your normal internet connection. Sending everything through one remote server can create unnecessary latency, region mismatches, buffering, or failed logins.

Clash is well suited to this situation because it can make routing decisions by domain, IP range, rule provider, or policy group. In this guide, we will build a practical split-tunneling setup for Netflix and Disney+. Streaming traffic will use a dedicated proxy group, selected local websites will remain DIRECT, and unrelated international traffic can follow a separate general-purpose policy.

The examples use YAML syntax compatible with the Mihomo core used by many current clients, including Clash Verge Rev. Menu names can differ slightly between Clash Verge, Clash for Windows, Clash for Android, ClashX, and Mihomo-based applications, but the underlying ideas are the same: create policy groups, place specific rules above broad rules, verify DNS behavior, and test one service at a time.

1How Split Tunneling Works in Clash

Split tunneling means that different traffic is sent through different paths instead of forcing every connection through the same tunnel. In Clash, this behavior is controlled by a combination of mode, proxy groups, and rules. Rule mode is normally the best choice because it allows you to express exactly which domains should use a proxy and which should bypass it.

A rule is evaluated from top to bottom. The first matching rule determines the final policy. This ordering is important. If a broad rule such as GEOSITE,geolocation-!cn,Streaming appears below a catch-all rule such as MATCH,DIRECT, it will never be used. Likewise, if a local-domain rule is placed too low, local traffic may accidentally enter the streaming proxy group.

The Three Policy Group Roles

• Streaming: A selector containing nodes that can reach Netflix and Disney+ reliably. It may also include an automatic URL test group.
• Proxy: Your normal international traffic group for websites, software updates, and services that are not specifically classified as streaming.
• DIRECT: A built-in policy that sends traffic through the local network without a proxy.

This separation gives you more control than simply selecting Global Mode. Global Mode can be useful for temporary testing, but it sends local and international traffic through one path and makes it harder to identify the source of a problem. Rule Mode provides a stable daily configuration, while Global Mode remains a useful diagnostic tool when you need to confirm that a service is reachable through a particular node.

2Create Dedicated Netflix and Disney+ Groups

Before adding rules, create a group that is reserved for entertainment traffic. A dedicated group makes node switching easier and prevents a node chosen for ordinary browsing from being used accidentally by Netflix or Disney+. If your subscription already provides proxy groups, you can reference those existing names instead of creating new groups. Always copy the group name exactly, including capitalization and punctuation.

Example Policy Group Configuration

The following example uses a selector and a URL-test group. Replace the sample node names with names that actually exist in your profile. If your provider uses automatically generated groups, retain the provider's names and only add the rules shown later.

The url-test group measures response time, but a low latency result does not prove that a node can play a specific catalog. Some nodes respond quickly to a test URL while their IP address is blocked or categorized incorrectly by a streaming provider. For that reason, treat automatic selection as a starting point and manually test two or three candidates when playback fails.

Choose Nodes for Streaming Stability

For video playback, sustained throughput and IP reputation are usually more important than the smallest ping number. A node with a slightly higher latency but stable bandwidth may deliver a better experience than a fast node that changes IP quality or disconnects during playback. Prefer nodes with consistent response times, sufficient bandwidth, and a location that matches the catalog you intend to use.

• Use a geographically appropriate node rather than choosing a random country.
• Avoid repeatedly switching nodes during an active playback session.
• Keep at least two backup nodes in the streaming group.
• Do not assume that a node labeled “Netflix” supports every service or catalog.
• Test on the same home network and device where you plan to watch content.

3Add Targeted Netflix and Disney+ Rules

Now route the service domains to the dedicated Streaming group. The exact domain set can change as providers update their applications, so broad but carefully chosen suffix rules are generally easier to maintain than a long list of individual hostnames. Place these rules above general regional rules and above the final MATCH rule.

Recommended Rule Structure

These examples illustrate the structure rather than promising a universal domain list. CDN behavior differs by region, and a provider may use shared infrastructure for several products. The broad akamaized.net example deserves particular caution: it can cover unrelated websites and may send more traffic to the streaming group than intended. If you notice ordinary websites being routed through the proxy, remove that broad rule and replace it with confirmed hostnames from Clash logs.

Some subscription formats support rule providers, which are easier to update than manually maintained YAML. If you use a provider, inspect its contents before enabling it and check whether its policy name matches your group. A rule provider that sends traffic to Netflix will not work if your actual group is named Streaming unless the configuration maps the names correctly.

Verify Rule Order

1. Put exact service rules and confirmed service suffix rules near the top.
2. Put special application rules, such as your work or gaming policies, after the streaming rules if they do not overlap.
3. Put local-domain and local-IP rules before broad international matching rules.
4. Keep MATCH,Proxy or MATCH,DIRECT as the final fallback.

4Keep Local Websites and Devices DIRECT

Local routing is the other half of split tunneling. Websites hosted in your own country, private network devices, printers, smart TVs, and local DNS services generally should not travel through a remote proxy. Direct routing reduces latency and prevents local services from failing because they receive an unexpected source region.

Local Bypass Rules

Private address rules are useful for accessing a router dashboard, NAS, printer, or media server. The no-resolve option prevents Clash from trying to resolve a domain for an IP-based rule, which avoids unnecessary DNS queries. Do not add public service domains to a local bypass list merely because the service has a local-language website. A domain can look local while its video API or authentication endpoint is hosted elsewhere.

On Windows and macOS, local traffic can also be affected by system proxy settings, TUN mode, or a firewall. If a printer or smart TV stops responding after TUN mode is enabled, confirm that LAN access is allowed in the client. In Clash Verge Rev, check the TUN and system permission settings; in mobile clients, check whether the VPN profile allows local network access. The exact label differs by platform, but the requirement is the same: permit private subnet traffic to bypass the proxy.

5Configure DNS, TUN Mode, and Application Behavior

Correct rules can still produce inconsistent results if DNS resolution and application traffic do not follow the same path. Modern streaming apps may use HTTPS, IPv6, background API calls, and CDN hostnames that are not obvious from the main website address. A predictable DNS configuration makes troubleshooting much easier.

Mihomo DNS Example

The example uses fake-ip mode and disables IPv6 for a predictable baseline. If your ISP, router, or selected nodes support IPv6 correctly, you may enable it later and test again. If only some components support IPv6, applications can attempt a path that does not follow your intended rules, resulting in slow loading or a blank playback screen.

After changing DNS or rules, reload the profile and clear stale state. Close and reopen the streaming application, clear the browser's site data where appropriate, and restart the Clash core if the client does not automatically flush its cache. Do not repeatedly change five settings at once; make one change, test the service, and record the result.

When to Use TUN Mode

System proxy mode is often enough for a browser, but dedicated streaming applications, smart-TV companions, and some desktop players may not honor the operating system proxy. TUN mode captures traffic at the network layer and can handle more applications. It also requires elevated permissions and deserves extra care because it affects more of the device.

• Use system proxy mode first when you only need browser-based playback.
• Enable TUN mode when the application ignores the system proxy.
• Keep private-network bypass enabled for routers, printers, and local media servers.
• Test DNS and IPv6 after enabling TUN mode, especially on Windows.
• Disable other VPN clients while testing to avoid competing tunnel adapters.

6Test Playback and Troubleshoot Failures

Testing should be systematic. Start with a clean browser profile or private window, select one known-good node in the Streaming group, and open the service website. In Clash, open the connections or logs panel and confirm that the main page, authentication requests, images, and video hosts are matching the expected policy. Seeing only netflix.com in the log is not enough; playback may use separate CDN domains.

A Practical Diagnostic Checklist

If Netflix works but Disney+ does not, do not assume that the entire Clash configuration is invalid. Streaming platforms maintain different domain structures and access policies. Check whether Disney+ traffic is actually reaching the selected group, then try a node in the correct supported region. The same principle applies in reverse.

If a browser works but the native application fails, compare their DNS and proxy behavior. The application may use QUIC, certificate pinning, a separate embedded browser, or direct connections that bypass system proxy settings. Temporarily disabling QUIC in the client or application can help with testing, but do not treat that as a universal fix. Also verify that the device clock is accurate; incorrect time can cause TLS and authentication failures that look like routing problems.

7Maintenance and Safer Daily Practices

Streaming rules are not a set-and-forget feature. Providers change domains, nodes expire, and IP addresses can lose access without any change on your device. Keep your configuration readable by grouping related rules, adding comments, and avoiding duplicate entries from several rule providers. Save a backup before editing a subscription profile so that a mistaken indentation change can be reversed quickly.

Review your setup whenever you change devices, routers, subscriptions, or DNS providers. On a desktop, confirm whether the client is using system proxy mode or TUN mode. On Android, remember that only one VPN service can normally be active at a time. On macOS, check that the selected profile and system extension have permission to operate. On a home network, decide whether routing should happen on each device or centrally on a router; mixing both approaches can create double proxies and confusing results.

• Use the smallest rule scope that solves the problem.
• Keep a direct fallback for local services and private address ranges.
• Use stable nodes and avoid constant switching during playback.
• Do not expose your Clash controller port to the public internet.
• Protect subscription URLs because they may contain account credentials or access tokens.
• Follow the terms and regional requirements of each streaming service.

Most importantly, distinguish between a routing problem and a service-side restriction. Clash can select a network path, but it cannot guarantee catalog availability, remove account limitations, or make every proxy IP acceptable to a streaming platform. A transparent diagnosis leads to a more reliable setup than endlessly adding domains to the rules list.

Frequently Asked Questions

Should Netflix and Disney+ use separate groups?

One shared Streaming group is convenient when the same nodes work for both services. Separate groups are better when the services require different regions or when you want independent node selection. You can create Netflix and DisneyPlus selectors and point each service's rules to its own group without changing the rest of the configuration.

Why are local websites still going through the proxy?

Usually, a broad rule is matching before your local bypass rule, or the site uses a CDN domain that your configuration classifies as international. Check the connections log, move confirmed local rules above broad rules, and avoid routing an entire shared CDN suffix DIRECT unless you understand the other traffic it serves.

Do I need TUN mode for streaming?

Not always. Browser playback generally works with system proxy mode, while native applications may ignore it. Enable TUN mode only when necessary, allow LAN access, and test for conflicts with other VPN software, firewall rules, and IPv6.

What should I do when a previously working node stops working?

Check the node manually, test another node in the same region, and inspect which requests are failing. If the node is reachable but the service rejects it, the issue may be IP reputation rather than YAML syntax. Keep multiple backup nodes and avoid changing unrelated DNS or rule settings at the same time.