#Clash Rule, Global, and Direct Modes: How to Choose? Beginner Switching Guide with Common Scenarios

##What each mode actually does

First, a bit of context: mode is a global switch on the client that determines "how outbound paths get chosen." It has nothing directly to do with which subscription or which node you're using. Here's how the three modes differ in behavior.

• Rule mode: every new connection is checked against the rules list in your config file, top to bottom, in order. The first rule it matches decides how it's handled (proxied, direct, or rejected) via the policy group that rule specifies. If nothing matches, it falls through to the final catch-all rule (usually MATCH or FINAL). This is the default mode for everyday use — domains inside mainland China going direct, domains outside going through the proxy, ad domains getting rejected outright, all of that runs on this matching logic.
• Global mode: skips every check in rules entirely. All connections go through the same single policy group (usually whatever node or policy group is currently selected on the main screen), regardless of domain, IP, or process.
• Direct mode: also skips rule matching, but in the opposite direction — every connection goes straight out through your local network connection. Proxy nodes aren't involved at all.

In other words, Rule means "fine-grained routing," Global means "proxy everything," and Direct means "proxy nothing." The three are mutually exclusive — only one can be active at a time.

##Rule mode's matching order and the pitfalls it causes

Rule mode is the most commonly used — and the easiest to get tripped up by — because of how matching order works. A typical rule snippet looks something like this:

rules:
  - DOMAIN-SUFFIX,cn,DIRECT
  - DOMAIN-KEYWORD,google,PROXY
  - GEOIP,CN,DIRECT
  - RULE-SET,reject,REJECT
  - MATCH,PROXY

The key point is that rules are matched top-to-bottom in order, and the moment one matches, it takes effect immediately — nothing below it gets checked. If a broad rule (say, a RULE-SET collection) sits above a more specific domain rule, that later, more precise rule may never get a chance to run. This is the number one reason people report "I changed the rule but nothing changed." Remote rule sets pulled in via rule-providers work the same way — they just insert a batch of rules at a given position, and the ordering issue still applies.

There's another detail in Rule mode that's easy to overlook: GEOIP-type rules depend on a GeoIP database to determine where a target IP is located. If that database is outdated or fails to load, those rules simply fail silently and fall through to the next one — which looks almost identical to "the rule isn't working," but the actual cause is a data file problem, not a rule syntax problem.

##When it's worth switching to Global mode temporarily

Global mode gives up fine-grained routing in exchange for "eliminate the noise, simplify the logic." In practice, a few scenarios are well suited to a temporary switch.

1. Checking whether a rule is written correctly: if you suspect that odd behavior on some site is a rule config problem, switch to Global mode first as a test. If access works fine in Global mode, the proxy node itself is fine and the problem lies in rule matching; if it's still broken in Global mode, the problem is with the node or subscription itself. This is the most basic and most useful troubleshooting move.
2. Comparing speed and latency: if you want to focus purely on how one particular node performs across various sites without rules interrupting the routing logic, Global mode guarantees all traffic takes the same path, giving you a clearer, more direct result.
3. A rule set is temporarily missing or broken: if a remote rule set fails to download or a syntax error breaks Rule mode entirely, switch to Global mode first to keep the network usable, then go back and fix the config.
4. Accessing sites outside China that a rule mistakenly routes as "direct": if a domain happens to match a direct rule it shouldn't, and you don't want to fix the config right away, Global mode works as a quick temporary workaround.

##What Direct mode is actually for

Direct mode looks like "turning off the proxy," but it's not quite the same as quitting Clash entirely — system proxy settings, TUN virtual adapters, and other takeover methods are still active; it's just that every connection is forced to be classified as direct inside Clash, with no node involved at all. Common uses include:

• Checking whether a proxy node is working: when access to some site seems off, switch to Direct mode as a test. If access works fine in Direct mode, you can be fairly confident the problem is with the proxy node or the destination server, rather than your local network or Clash's config.
• Checking whether the proxy itself is slowing things down: for LAN file transfers, accessing internal services, connecting to a home NAS, and similar cases, that traffic has no reason to go through a remote node — Direct mode avoids the unnecessary detour and cuts latency.
• Temporarily checking your baseline local network: when debugging a network issue and you want to know "what happens without Clash in the picture," Direct mode is more convenient than quitting the client outright, since you don't need to reconfigure your system's network settings, and switching back to Rule mode is a single click away.
• Software updates, large downloads, and other traffic-sensitive operations: some subscriptions have data caps, so routing large downloads through Direct mode saves your node's traffic allowance.

##Common reasons a mode switch seems to have no effect

The most common confusion for beginners is "I switched modes, but the result didn't change at all." Work through the following checks one by one.

Connection reuse — old connections never get re-routed

Browsers and client apps commonly reuse an already-established TCP connection or rely on HTTP Keep-Alive. A mode switch only affects newly established connections — connections that already exist won't be re-evaluated. When testing, close the relevant tabs or restart the app in question to make sure you're generating a brand-new connection.

DNS caching means the resolved address hasn't changed

If the client or the OS has cached the IP address for a domain, subsequent requests may still use that old resolution even after the mode change — this is especially common with Fake-IP or DNS-hijacking style configs. Try clearing the DNS cache or restarting the Clash core before testing again.

TUN mode has taken over traffic, and the GUI's mode setting isn't in sync

With TUN mode enabled, traffic at the system level is intercepted directly at the network adapter layer. If switching modes in the client UI only affects the proxy port without also refreshing the TUN adapter's routing table, you'll get the illusion that "the UI shows it switched, but nothing actually changed." If this happens, try restarting the TUN adapter or reloading the config file.

Rule mode is matching a rule you didn't expect

If behavior doesn't match what you expect after switching back to Rule mode, don't jump to assuming there's a client bug — first go back through the matching order described earlier and check your rule list, especially whether a RULE-SET rule set is written too broadly and is intercepting connections that should have matched something further down.

Dependencies between multiple policy groups

If what's selected in Global mode is a policy group rather than a single node, that group's internal load-balancing or auto-select logic still applies. The result might not exactly match your expectation of "always use this one node" — that's not a failed mode switch, it's the policy group's own scheduling logic at work.

##How to remember the three modes, and how to use them day to day

Boil the three modes down to one line: Rule mode is your everyday default, Global mode is a temporary tool for troubleshooting and speed testing, and Direct mode is your control group for isolating the proxy as a variable. Stay in Rule mode for daily use. When something seems broken, don't rush to edit the config — try Direct mode and Global mode one at a time first. That alone will usually tell you which of the three — local network, proxy node, or rule config — is actually the culprit, and fixing the right thing is far more efficient than editing config files blindly.