ClashX Pro macOS System Proxy Setup: Auto-Enable Guide

ClashX Pro can route traffic for macOS applications in two different ways: an app can use ClashX Pro’s local proxy port explicitly, or macOS can send supported system traffic to ClashX Pro automatically through the system proxy setting. The second option is usually the most convenient for browsers, command-line tools, productivity apps, and other software that respects macOS network settings. This guide explains how to enable the ClashX Pro macOS system proxy, choose the appropriate mode, verify that traffic is actually being routed, and fix applications that continue to connect directly.

The most important distinction is that starting ClashX Pro does not automatically mean that every Mac application is using it. ClashX Pro may be running normally while the system proxy remains disabled, the wrong proxy mode is selected, or an application uses its own network stack. Understanding this separation makes troubleshooting much faster.

How the ClashX Pro macOS System Proxy Works

When you enable the system proxy in ClashX Pro, the client modifies the proxy settings for the active macOS network service. Usually this is the Wi-Fi service, but it may also be a wired Ethernet connection, a USB adapter, or a VPN-created interface. macOS then advertises a local HTTP proxy and, depending on the client configuration, a local SOCKS5 proxy. Applications that read the system proxy configuration send their requests to ClashX Pro instead of connecting directly to the internet.

The traffic path normally looks like this:

1. An application creates a network request, such as opening a website or downloading an update.
2. macOS checks the proxy settings for the active network service.
3. The request is sent to the ClashX Pro local listener, commonly on 127.0.0.1.
4. ClashX Pro matches the destination against its rules.
5. The selected proxy node, proxy group, or DIRECT policy handles the connection.

ClashX Pro is therefore responsible for two separate jobs. First, it exposes local ports that accept application traffic. Second, it decides where that traffic goes according to the current mode and rules. The system proxy switch only connects macOS applications to those local ports; it does not decide whether a destination should use a proxy.

Another common source of confusion is the difference between HTTP proxy, SOCKS5 proxy, and TUN mode. An HTTP proxy can handle ordinary HTTP requests and HTTPS connections through the HTTP CONNECT method. SOCKS5 is more general and can carry TCP connections from applications that support it. TUN mode operates at a lower network layer and can capture traffic from applications that ignore ordinary proxy settings. ClashX Pro’s system proxy is convenient, but it is still dependent on application support.

Before You Enable the Proxy

Before changing macOS settings, confirm that ClashX Pro is installed correctly and has a usable profile. The profile should contain at least one working proxy node or a proxy group with an available node. If the profile is empty, expired, or unable to load, enabling the system proxy may make applications appear offline because their requests are redirected to a local service that has no functional upstream route.

Check the following items first:

• ClashX Pro is running: its menu bar icon should be visible, and opening the menu should show the current profile or mode.
• A profile is loaded: confirm that the configuration contains proxies, proxy-groups, and rules or an equivalent rule structure.
• A proxy group has a usable selection: if the active group points to REJECT, an unavailable node, or an empty group, requests will fail even though the local proxy is active.
• The local ports are available: ClashX Pro must be able to bind its HTTP and SOCKS ports without conflicts from another proxy application.
• The Mac has a normal network connection: test the internet with ClashX Pro completely disabled before diagnosing proxy behavior.

ClashX Pro versions and bundled cores can present slightly different menu names. You may see entries such as Set as System Proxy, Set System Proxy, or a system-proxy toggle under a mode submenu. The wording may also differ between an original ClashX Pro build and a newer fork that uses a Mihomo-compatible core. The underlying concept is the same: enable or disable macOS proxy settings from the client menu.

Enable the macOS System Proxy Step by Step

The safest approach is to select a profile and proxy mode first, test one application, and only then enable system-wide routing. This prevents a bad profile from affecting every application at once.

1. Launch ClashX Pro and wait until its menu bar icon is active.
2. Open the menu bar menu and choose the profile or configuration you want to use.
3. Open the mode submenu and select Rule for normal daily use, unless you specifically need Global or Direct behavior.
4. Open the active proxy group and select a working node or an automatic group such as a latency-test group.
5. Return to the main ClashX Pro menu and click Set as System Proxy or the equivalent system-proxy option.
6. Open a browser and visit a neutral test page, then test one destination that should use the proxy and one destination that should remain direct.
7. Return to ClashX Pro and inspect the connection list or traffic panel to confirm that the browser request appears there.

In macOS, you can also inspect the underlying setting manually. Open System Settings, choose Network, select the active connection, and open its details. Depending on the macOS release, proxy controls may appear under Details, Proxies, or an advanced network panel. You should see the web proxy and secure web proxy fields populated with a local address such as 127.0.0.1 and the port configured by ClashX Pro. Do not change these values randomly; the port must match the listener exposed by the client.

HTTP proxy host:   127.0.0.1
HTTP proxy port:   7890
SOCKS5 host:       127.0.0.1
SOCKS5 port:       7891

The numbers above are examples, not universal defaults. Your installation may use different ports, and some profiles define a combined port for both HTTP and SOCKS traffic. Always use the values displayed by your ClashX Pro build or configuration. If macOS points to port 7890 while ClashX Pro is listening on 7892, the system proxy will be enabled but unusable.

Choose the Right Clash Mode

Rule mode is the recommended starting point. Clash evaluates domain, IP, geographic, and rule-provider entries, then sends each request to the appropriate policy. This allows local services, domestic websites, and private networks to remain direct while selected destinations use a proxy.

Global mode sends traffic handled by the proxy listener through the chosen global proxy group. It is useful for diagnosing rules: if a destination works in Global mode but not Rule mode, the problem is probably a rule order, a policy name, or a DNS-related mismatch. Global mode is not always ideal for daily use because it can proxy services that would work better through a direct connection.

Direct mode intentionally bypasses proxy nodes. Use it as a control test. If an application works in Direct mode but fails in Rule or Global mode, check the selected node, the group state, and the application’s connection history. Mode names may vary slightly, but the testing logic remains consistent.

Verify That Traffic Is Actually Proxied

A successful system-proxy toggle is not enough. Verification should cover the local listener, application behavior, rule matching, and external IP address. Start with the simplest test: open a browser after enabling the proxy and watch the ClashX Pro connection panel. A new request should appear with the destination domain, process name, matched rule, and selected policy.

If the connection panel remains empty, the browser may not be using the system proxy, the system proxy may have been applied to a different network service, or ClashX Pro may not have a working listener. Check the proxy settings in macOS and confirm that the active service is the one being modified. A Mac can have Wi-Fi, Ethernet, VPN, and virtual interfaces active at the same time, and applications may choose a route that differs from the one you expected.

Use several tests rather than relying on one IP-checking website:

• Open a normal website that should be reachable directly.
• Open a destination covered by your proxy rules.
• Check the external IP address in a browser and compare it with the expected proxy exit address.
• Open a new private browsing window to avoid cached pages and persistent connections.
• Inspect ClashX Pro’s connection log to see the matched rule and policy.

Command-line tools can provide an additional comparison. The following examples explicitly tell curl which local proxy to use, so they test the listener rather than the macOS system-proxy integration:

curl -I -x http://127.0.0.1:7890 https://example.com
curl -I --proxy socks5h://127.0.0.1:7891 https://example.com

The socks5h form is useful because hostname resolution is performed through the SOCKS proxy rather than locally. If both commands fail, investigate ClashX Pro’s profile, node, port, or DNS configuration. If the commands succeed but a browser does not appear in the connection panel, focus on macOS proxy settings or browser-specific proxy behavior.

For a more complete test, temporarily switch to Global mode and send one request. If the request is visible and succeeds, switch back to Rule mode and inspect which rule handles the same domain. This isolates routing logic from basic connectivity. After testing, restore your normal mode and avoid leaving Global mode enabled merely because it makes a single destination work.

Fix Applications That Ignore the Proxy

Some applications do not read the macOS system proxy at all. Games, peer-to-peer clients, security software, virtual machines, container tools, and applications built with custom networking libraries may open sockets directly. Other apps respect the system proxy for web requests but bypass it for telemetry, updates, media streams, DNS, or real-time connections.

First, look for a proxy section in the application’s own settings. If it supports manual configuration, enter the local HTTP or SOCKS5 address shown by ClashX Pro. Prefer SOCKS5 when the application supports it and you need general TCP handling; choose HTTP when the application specifically requests an HTTP or HTTPS proxy. If the application offers a “use system proxy” option, enable it and restart the application completely.

Next, check whether the application is using a separate network environment:

• A terminal command may not inherit proxy variables even when the graphical application uses the system proxy.
• A virtual machine may have its own guest operating system and independent proxy settings.
• Docker containers often need explicit proxy environment variables or daemon configuration.
• Browsers may use extensions, secure DNS, or private relay features that change normal routing behavior.
• VPN clients and endpoint-security tools can install filters that take priority over ordinary proxy settings.

For applications that cannot be configured manually, TUN mode is usually the next option. TUN creates a virtual network interface and routes more traffic through the Clash core, including traffic from many programs that ignore HTTP and SOCKS proxies. It may require administrator approval, a network extension permission, or a DNS mode compatible with the selected core. Enable it only after confirming that your ClashX Pro build and profile support it.

Troubleshoot Common Proxy Failures

Nothing connects after enabling the proxy. Confirm that ClashX Pro is still running and that the configured local port is listening. Then select Direct mode as a control test. If Direct works but Rule and Global fail, test another node or proxy group. If Direct also fails, disable the system proxy temporarily and verify that the underlying macOS connection is healthy.

The browser works, but one application does not. The application probably ignores system proxy settings or uses a protocol not handled by the HTTP listener. Configure its own proxy settings, try SOCKS5, or consider TUN mode. Check the application’s documentation before forcing all traffic through a system-level interception mode.

The connection appears in ClashX Pro but uses the wrong route. Inspect the matched rule and its order. Clash evaluates rules from top to bottom, so a broad rule placed above a more specific domain rule can produce an unexpected result. Also check whether the destination is being represented as a domain or an IP address. DNS mode and fake-IP behavior can affect which rule types match.

Some websites load partially or keep reconnecting. This may be caused by QUIC or UDP traffic, an incompatible node, certificate inspection by security software, or a site using multiple domains that are covered by different rules. Test the site in another browser, temporarily disable browser extensions, and compare Rule mode with Global mode. Do not assume that changing DNS alone will fix a transport or node problem.

The proxy keeps returning after you disable it. Check whether another proxy client is running, whether a login item launches ClashX Pro automatically, and whether multiple macOS network services contain old proxy values. In System Settings, inspect the active Wi-Fi and Ethernet services individually. Remove stale entries only after recording the correct ClashX Pro ports, so you can restore the intended setup later.

Local devices or internal websites stop working. A global proxy or overly broad rule may be catching private address ranges. Ensure that local networks such as 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 are handled according to your network needs. Corporate domains, printers, NAS devices, and router administration pages often require explicit direct rules.

When troubleshooting, change one variable at a time. Record the current mode, selected group, local port, and affected application. Then test Direct, Rule, and Global modes in sequence. This simple method tells you whether the failure comes from macOS integration, Clash rules, DNS resolution, the proxy node, or the application itself.

Once the system proxy is working, keep the setup predictable: use Rule mode for daily traffic, maintain a reliable proxy group, verify that ClashX Pro restores macOS settings on exit, and use TUN only for software that genuinely bypasses the system proxy. With those habits, ClashX Pro becomes a quiet background service rather than a source of repeated connection problems.