Why the System Proxy Matters
Clash Verge Rev can be running normally while your browser continues to connect directly to the internet. This is one of the most common Windows 11 configuration problems: the application has imported a profile, proxy nodes are visible, and the core appears healthy, but websites behave exactly as they did before. In most cases, the missing step is enabling the Windows system proxy or selecting a routing mode that actually uses the active proxy group.
The system proxy is a Windows-level setting that tells compatible applications where to send HTTP and HTTPS requests. When Clash Verge Rev enables it, Windows applications that respect the operating system proxy configuration can route traffic through the local Clash listener. The client then applies your selected rules and sends each request through a proxy node, directly to the destination, or to a blocked policy according to the profile.
This guide focuses on Clash Verge Rev on Windows 11. It explains how to turn on the system proxy, select Rule or Global mode, confirm the correct mixed-port settings, test browser traffic, and troubleshoot the most frequent causes of a direct connection.
Expected Result
Clash Verge Rev stays active in the Windows tray, Windows proxy settings point to the local Clash listener, and your browser traffic follows the selected Clash mode.
1Check the Client Before Changing Windows
Before changing system settings, confirm that Clash Verge Rev itself is ready. Enabling a system proxy without an active profile or usable proxy group can make the internet appear broken, even though the Windows setting is technically correct.
- Open Clash Verge Rev: Launch the application and wait until its main dashboard is fully loaded.
- Confirm the core is running: The Mihomo core should show a running or healthy state. If the core is stopped, the local listener cannot accept browser connections.
- Load a profile: Go to the Profiles page and make sure one profile is selected and activated. A downloaded subscription is not necessarily the same as an active profile.
- Check proxy groups: Open the Proxies page and select a usable node or an automatic selection group. Avoid leaving a policy group on an unavailable node.
- Confirm the port: Look for the HTTP, SOCKS, or mixed port shown in the client settings. A mixed port is usually the simplest choice because it supports both HTTP and SOCKS5 clients.
Typical local listeners use addresses such as 127.0.0.1:7890 or 127.0.0.1:7897, but you should not assume the port from another tutorial. Different profiles, client versions, and operating systems may use different values. Always use the port displayed by your own Clash Verge Rev installation.
Important Distinction
A connected subscription does not prove that traffic is being proxied. It only proves that Clash has profile data. The profile, core, policy group, listener, Windows proxy, and application must all work together.
2Enable the Windows 11 System Proxy
Clash Verge Rev normally provides a convenient system-proxy switch in its dashboard or tray menu. When enabled, the client writes the required proxy information to Windows and uses its local listener as the proxy server. The exact wording can vary slightly between releases, but the function is usually labelled System Proxy, Set System Proxy, or Proxy.
Open Clash Verge Rev Settings
- Start Clash Verge Rev from the Start menu or desktop shortcut.
- Look at the main dashboard, sidebar, or system-tray menu for the System Proxy switch.
- Turn the switch on. If Windows displays a permission prompt, approve it with an administrator account.
- Wait several seconds, then reopen the Windows proxy page to confirm that the setting was applied.
Verify Windows Proxy Settings
To inspect the Windows 11 configuration directly, open Settings, choose Network & internet, and select Proxy. Under the manual proxy area, Windows should show a local address and port supplied by Clash Verge Rev. In many installations the address is 127.0.0.1, which means the proxy service is running on your own computer.
Do not enable an unrelated proxy manually if Clash Verge Rev is already managing the setting. Multiple proxy tools can overwrite each other, and an old port from another client may cause browsers to report that the proxy server refused the connection. If you need to change the port, change it in Clash Verge Rev first, disable and re-enable the system proxy, and then test again.
- The manual proxy switch is enabled or is being managed by Clash Verge Rev.
- The server address points to a local address such as
127.0.0.1. - The port matches the active HTTP or mixed listener in Clash Verge Rev.
- No old VPN, proxy manager, or browser extension is overriding the connection.
3Choose Rule, Global, or Direct Mode
Turning on the system proxy only sends requests to Clash. The selected mode determines what Clash does after receiving those requests. For most Windows 11 users, Rule mode is the best starting point because it balances convenience, performance, and selective routing.
| Mode | How it works | Best use | Common limitation |
|---|---|---|---|
| Rule | Matches domains, IP ranges, and applications against the profile rules. | Daily browsing, mixed local and international traffic. | A poor or outdated rule set may select the wrong policy. |
| Global | Sends nearly all compatible traffic through one selected proxy group. | Testing whether the node and listener work. | Local services may become slower or inaccessible. |
| Direct | Sends traffic directly without using a proxy node. | Diagnosing whether Clash is the source of a problem. | Restricted or proxy-required sites will not be routed through Clash. |
Use Global mode for a short diagnostic test. Select a known working proxy group, open a browser, and visit an IP-checking website. If the public IP changes, the local listener and selected node are probably working. You can then return to Rule mode for normal use. If Global mode does not change the IP, switching between rule providers will not solve the underlying problem; check the system proxy, port, core, and node first.
Practical Recommendation
Use Global mode to isolate connection problems, Rule mode for everyday browsing, and Direct mode only when you intentionally want to bypass the proxy.
4Test Browser Traffic and Confirm Routing
A successful test should verify more than whether a webpage opens. Some websites are reachable directly, so they cannot prove that the proxy is active. Use several checks and observe the request inside Clash Verge Rev while the browser is loading the page.
Perform a Clean Browser Test
- Close browser windows that were open before enabling the system proxy.
- Keep Clash Verge Rev running with the core and a proxy group active.
- Temporarily select Global mode and a known working node.
- Open a private browser window to reduce the effect of cached connections.
- Visit an IP-checking service and compare the displayed address with your normal ISP address.
- Return to Clash Verge Rev and inspect the connections or traffic page for the browser request.
If the browser request appears in Clash and the public IP matches the selected node, the system proxy is functioning. Switch back to Rule mode and repeat the test. The request should now follow the relevant rule and policy group. A domain may intentionally remain direct in Rule mode; that is normal when the profile contains a DIRECT rule for local or trusted services.
Understand Application Compatibility
The Windows system proxy is not a universal tunnel. Browsers and many desktop applications support HTTP or HTTPS proxy settings, but some programs ignore Windows proxy configuration completely. Games, command-line tools, update services, and applications using their own networking stack may require a separate proxy setting or TUN mode.
Do not enable TUN mode merely because one application ignores the system proxy. First determine whether that application supports a proxy, whether it is using a separate browser profile, and whether a security product is intercepting its traffic. TUN mode can route more applications, but it may also introduce DNS conflicts, driver permissions, or compatibility issues. Treat it as a separate routing method rather than a replacement for understanding the system proxy.
5Troubleshoot a Direct Connection
When the browser still uses a direct connection, troubleshoot from the local machine outward. This avoids changing several settings at once and makes it easier to identify the actual failure.
The System Proxy Switch Does Nothing
Check whether another proxy application, VPN, or endpoint security tool is controlling Windows. Quit competing tools temporarily, disable their automatic startup options, and toggle the Clash system proxy again. If the setting immediately turns itself off, Clash may not have permission to modify Windows networking settings, or another program may be restoring its own configuration.
The Browser Reports a Proxy Error
Messages such as “proxy server is refusing connections” usually indicate that Windows is pointing to the wrong address or port, or that the Clash core is not listening. Compare the Windows proxy port with the active mixed or HTTP port in Clash Verge Rev. Then confirm that the core is running and that the selected profile has not changed the listener configuration.
Global Works but Rule Mode Is Direct
This result normally indicates a rule or policy issue rather than a system-proxy issue. Open the Clash connections view, find the requested domain, and inspect the matched rule. If the rule selects DIRECT, the behavior is intentional. If it selects a proxy group with no available node, update the subscription, choose another node, or review the policy group configuration.
The IP Looks Correct but a Site Still Fails
Clear the browser cache, close existing tabs, and create a fresh private window. Existing HTTP/2, WebSocket, or QUIC sessions may continue using a previous route. Some browsers also use secure DNS or their own DNS policy. If the profile supports DNS handling, use the Clash DNS configuration consistently and test again. For a controlled diagnosis, temporarily disable browser extensions that provide VPN, proxy, ad blocking, or privacy routing.
Avoid Random Port Changes
Changing several ports, DNS providers, modes, and profiles at the same time can hide the real cause. Record the original values, change one item, and test after each adjustment.
Frequently Asked Questions
Is the Windows system proxy the same as TUN mode?
No. The system proxy routes applications that respect Windows HTTP or HTTPS proxy settings. TUN mode creates a virtual network interface and can capture a broader range of traffic, including some applications that ignore the system proxy. Start with the system proxy because it is easier to inspect and usually sufficient for browser traffic.
Why does Rule mode show a direct connection?
Rule mode follows the active profile. A domain may match a DIRECT rule, a local-network rule, or a rule provider that intentionally bypasses the proxy. Inspect the matched rule in the connections panel before changing the mode. If Global mode proxies the request successfully, the listener is working and the next step is reviewing rules or policy groups.
Do I need to restart Windows after enabling the proxy?
Normally, no. Close and reopen the browser so it creates new connections, then verify the Windows proxy page and Clash traffic panel. A restart is only worth trying if Windows retains a stale network state, another service fails to release the old proxy, or a corporate security policy has recently changed.
Why do some applications still bypass Clash?
Not every Windows application honors the system proxy. Some use direct sockets, custom DNS, QUIC, or their own proxy settings. Configure that application separately if supported, or evaluate TUN mode after confirming that the core, profile, and DNS settings are stable.
Final Check
For a reliable Windows 11 setup, confirm the active profile, running Mihomo core, selected node, enabled system proxy, correct listener port, appropriate mode, and visible browser requests in the Clash connection panel.