The node has been selected and the delay is normal. Why can’t the browser open the web page?

The node's TLS handshake latency (latency) and the actual bandwidth (throughput) are two different things. Low latency only means that the handshake can be performed, but it does not mean that the node itself can forward traffic normally. Possible reasons: the node bandwidth is full, the airport speed is limited, the node export IP is blocked by the target website, the node server is temporarily faulty. First click 'Test current node' in the client node group, and then try another node with a similar delay.

Which system proxy or TUN mode is turned on? Can they be opened at the same time?

It is safer to choose one of the two. System proxy is to modify the HTTP/SOCKS proxy settings of Windows/macOS. Browsers and most desktop applications will read this setting; TUN mode is to take over the entire machine traffic through the virtual network card, and even applications that do not read the proxy (such as UWP, command line git) will be proxied. Enabling both at the same time may cause DNS loops or routing conflicts, and some clients will force only one to be enabled.

Android FlClash status bar shows that VPN is connected, but the browser cannot open any web pages?

Successful establishment of the VPN tunnel does not mean that the traffic can flow out normally. Prioritize checking: (1) whether the node is really available - test the delay on the FlClash node page, all ∞ indicates node failure; (2) whether the application diversion whitelist is enabled - check whether the browser is excluded from the proxy; (3) whether the battery optimization of the domestic mobile phone system kills the FlClash background.

FAQ · Connection and proxy · 7 typical reasons

Cannot connect to the Internet after turning on the proxy Layered troubleshooting and solutions

The proxy switch is turned on and the node is selected, but the browser cannot open the web page. The problem may lie at any layer: the node is unavailable, the system agent does not really take effect, the TUN mode conflicts with the system agent, the rule assigns the target domain name to DIRECT, DNS pollution, firewall blocking. This article starts from the shallowest level and investigates it layer by layer.

1-minute quick diagnosis 7 common reasons Return to FAQ

Symptom self-check

The client is already running and the node is selected
The system proxy/TUN/VPN switch is turned on
The browser times out or circles when opening any website
Can access domestic network normally after turning off the proxy
All four conditions are met, which is the problem to be solved in this article

The client itself does not contain nodes and requires a subscription to connect to the Internet. No node? Signing up for this high-speed airport will give you 1GB of Hong Kong high-speed experience traffic, which is valid within 24 hours. You can try the speed first after importing it; buy if it suits you. Alipay pays directly. It also supports cryptocurrency payment. No cards are tied and no real-name records are left.

Get high-speed node

Quick diagnosis

5 steps to locate the fault layer

Troubleshooting in order, each step can eliminate one type of cause. Most problems can be found in the first 3 steps.

1
"Test the current node" on the client

Click "Test Delay" in the node group or test the current node individually. Result:
- All nodes displayed ∞/Timeout: The client is blocked from the node, see the reason #1 or #6
- Display number (such as 200ms): The node is normal, the problem is from the client to the browser, skip step 2
2
Switch to "global mode" test

Client switch Global (global) mode, reopen the browser and try again:
- It works: the rule mode used to move the target to DIRECT, let’s see the reason #4
- Still not working: It is not a rule problem, skip step 3
3
Check whether the system proxy/TUN is actually in effect

Desktop: Open the "Connections" page on the client and see if there are real-time connection records appearing.
- "Connection" page: the proxy is working, see below DNS / export problems
- The "Connection" page is empty: the browser is not using a proxy. See the reason #2
4
Access IP address instead of domain name

Browser attempts to access https://1.1.1.1 (Cloudflare's IP):
- Can be opened: There is a problem with DNS resolution, see the reason #5
- Still not working: The node exit is blocked or blocked by a firewall, depending on the reason #6 / #7
5

Look at the client "log" page

"Log" page keyword search:timeout / reject / no route / refused. The logs will directly indicate whether DNS, outbound, or rules were blocked.

Root cause analysis

7 common causes + solutions

Arrange from high to low probability of occurrence. The first 3 cover 80% of cases.

The current node itself is unavailable

The most common situation. The node server is down, the airport server is migrated, and the node IP is blocked by the target region. Just because a node appears in the list does not mean it will work.

Solution:

Click "Test Delay" in the node group to refresh the availability of all nodes
Pick a node with normal latency (< 500ms) to switch
Try niche/paid nodes during the evening peak; free nodes will be destroyed
If it continues to be unavailable, contact the airport customer service or check the airport announcement

The system proxy is not really enabled (the browser does not read the proxy settings)

The "system proxy" switch in the client only modifies the system registry/configuration, but the browser may: (a) use its own proxy settings to ignore the system settings (b) have cached the old settings (c) fail to write the system settings.

Solution:

Windows: Settings → Network and Internet → Proxy → Make sure "Use proxy server" is turned on, the address is 127.0.0.1, and the port is consistent with the client configuration (usually 7890)
macOS: System Settings → Network → Current Network → Details → Proxy → Confirm that "Network Proxy (HTTP / HTTPS / SOCKS)" is checked and configured correctly
Firefox: The system proxy is not read by default, select "Use system proxy settings" in Settings → Network Settings or configure it separately
I really can’t figure it out: Switch directly to TUN mode (see reason #3), bypassing the system proxy settings

TUN mode conflicts with system agent being turned on at the same time

Having the two at the same time will cause the traffic to be bypassed twice: the browser will go through the system proxy → client → TUN network card → client, causing an infinite loop or routing confusion. DNS erraticity may also occur on Windows.

Solution:Turn off the "system agent" and only enable TUN; or turn off TUN and only enable the system agent. Choose only one of the two. If you don't know which one is right for you:

Daily surfing the Internet and watching videos → The system agent is sufficient and the resource usage is low
Play games, use Telegram, run Steam to download, command line git → TUN mode

Rule matching takes the target domain name away DIRECT

In rule mode, the client determines whether each domain name should go through proxy or direct connection according to the rule set. If the rule set incorrectly assigns the target domain name to GEOSITE-CN or private IP, access will be through local direct connection, and naturally it will not be able to connect to sites outside the wall.

Solution:

Temporarily switch to "global mode" test, if it can pass, it is a rule problem
View the actual access record on the client "Connection" page to see which rule the target domain name hits and which outbound route (DIRECT / node name)
Update subscription ruleset (airports usually maintain an up-to-date set of rules)
Or manually override the policy group on the client's "Proxy" page and change "Match → Proxy"

DNS resolution abnormal/polluted

Characteristics: Access to IP (such as 1.1.1.1) is possible, but access to domain name is unavailable. It means there is no problem with outbound traffic, but DNS resolves the domain name to the wrong IP (such as 0.0.0.0 or domestic IP).

Solution:

Enable "DNS Hijacking" or "Fake-IP" in the client "Settings → DNS"
Put DNS Upstream changed to https://1.1.1.1/dns-query(Cloudflare DoH) or tls://8.8.8.8（Google DoT）
Enabling TUN mode can also make DNS proxy (more thorough)
Clear the browser DNS cache: Chrome access chrome://net-internals/#dns Click "Clear host cache"

Local firewall/security software intercepts proxy traffic

Windows Defender Firewall, Enterprise EDR, 360, and Tinder may block the client's TCP/UDP outbound, or block the TUN network card. The performance is that the node measurement delay is all ∞ but the network itself is normal.

Solution:

Windows Firewall: Control Panel → Windows Defender Firewall → Allow apps → Check all items in Clash Verge
Add the Clash Verge installation directory to the security software whitelist
Temporarily turn off the security software test to confirm whether it is the problem
Linux: Check iptables -L / firewall-cmd --list-all

The node exit IP is blocked by the target website

The node itself is available, but its egress IP is marked as a proxy/data center IP by the risk control system of the target website (such as Netflix, ChatGPT, Google), returning 403 / "This service is not available in your region". This is not a client issue.

Solution:

Change the node, especially the node marked "Native IP" / "Unlocked Streaming Media"
Visit ordinary websites (such as google.com, wikipedia.org) to test. If it can be opened, it means that the node itself is normal, but the current export is limited to specific services
Paid airports usually provide dedicated streaming nodes

Mode quick check

System Agent vs TUN vs Global vs Rules

Many users confuse the two dimensions of "agent mode" and "rule mode". They are orthogonal and can be used in combination.

Agent method (choose one)

System proxy (HTTP / SOCKS)

The client modifies the system's proxy settings; browsers and most desktop applications will read this setting and go to 127.0.0.1:7890; applications that do not read proxy settings (such as games, command line git)Unaffected。

TUN Mode

The client creates a virtual network card and lets the operating system route all TCP/UDP traffic in; no application cooperation is required. All traffic of the entire machineUse a proxy; administrator rights and service mode are required.

Rule mode (choose one)

Rule mode (Rule)

Determine whether each domain name should be connected through proxy or directly according to the rules set that comes with the subscription; domestic sites should be directly connected, and foreign sites should be connected through nodes; the most recommended daily mode.

Global mode (Global)

All traffic goes through the currently selected proxy node; domestic websites also go through it, which is slow and wastes traffic; it is only used for debugging or special scenarios.

Direct mode (Direct)

All traffic does not go through the proxy; the client is still running, but it is not turned on. Used to temporarily shut down the agent.

Combined example:Daily recommendation "System agent + rule mode" in the terminal (lightweight, automatic diversion); game / Telegram / command line git recommended "TUN + rule mode"(Full machine takeover, automatic offloading); Temporary debugging recommendation"System agent + global mode"。

Platform differences

Additional troubleshooting points by platform

Windows

• Defender firewall is the most common interception source
• Confirm in "Settings → Network → Proxy" that it points to 127.0.0.1
• Firefox / some enterprise browsers do not read the system proxy
• Turn off "Auto-detect proxy" to avoid conflicts

macOS

• The system proxy may not be automatically enabled after switching Wi-Fi, restart the switch
• The first activation of TUN mode requires authorization Helper
• Safari's proxy is always consistent with the system settings
• Chrome's own DNS-over-HTTPS may bypass proxy

Linux

• Different desktop environments (GNOME / KDE) system proxy takes effect in different ways
• Some applications do not read GNOME's proxy settings, which requires http_proxy Environment variables
• firewalld / iptables check release rules
• TUN mode required cap_net_admin Permissions

Android (FlClash)

• No key icon in the status bar = VPN is not really established
• Don’t mistakenly exclude the browser from the application diversion whitelist
• Domestic ROM background killing process is the most common reason
• Enable "Always on VPN" to prevent the system from killing connections

Still not working

Please prepare this information before asking for help

Question template

**Client**：Clash Verge Rev v2.5.2
**System**：Windows 11 23H2
**Representation**：System Agent / TUN
**Rule mode**：Rule / Global
**Delay results at nodes**：__ ms / Timeout
**Global Mode Test**：Yes. / You can't.
**Visits 1.1.1.1 IP**：Yes. / You can't.
**Client"Log"Page Critical Error**：___
**Attempted**：___

Must-see points

Connect page: Are there any real-time connection records being generated
Log page: Search for error / timeout / refused keywords
Node test delay: Refresh to see the results
Rule page: Actual hit rules vs. target outbound
DNS page: DNS resolution records vs. upstream

Is the problem solved? These may also be useful

No nodes after importing subscriptions

Subscription and node resolution issues

Return to FAQ center

Summary of all common problems

TUN Mode Instructions

What is TUN and how to use it

Tutorial Center

Basic client usage