Epic Games Launcher Stuck at 0% or Login Spinning? Split Epic and CDN Domains in Clash: Step Fix

1. Symptoms that point to split routing, not “Epic is down”

Frustrated players often blame Epic maintenance or home ISP quality first. Clash users should listen for a sharper pattern: the launcher opens, the library skeleton renders, yet game updates never start, the progress bar sits at zero percent for minutes, or the Epic account panel spins indefinitely while a browser login on the same PC works. That asymmetry usually means some hostnames in Epic’s traffic graph reach the internet while others do not, which is exactly what happens when subscription rules send different suffixes to conflicting policies.

Another giveaway is TLS or HTTP errors that appear only after you enable a strict “domestic direct” profile. A catch-all rule that forces generic CDN-looking names to DIRECT can strand Epic’s HTTPS calls that still need the same exit as your storefront session. Before you cycle through exit nodes, confirm whether the failure tracks with a profile switch rather than with Epic’s status page.

If editing YAML still feels intimidating, skim our subscription import tutorial so you know where provider bundles end and where your personal rule section should live. The rest of this article assumes you can append suffix rules without breaking schema validation.

2. A Windows-first checklist before you blame the node

Swapping servers feels decisive, yet it wastes time when EpicGamesLauncher.exe never hit Clash in the first place. Work through this sequence on Windows, capturing evidence from your client’s live connection view at each step.

1. Decide whether Epic traffic should use system proxy or TUN mode, then confirm the launcher actually inherits that path (some builds ignore manual OS proxy when compatibility shims or per-app overrides exist).
2. Open the connection log, reproduce the stuck download or login spinner, and read the policy column per hostname. Stray DIRECT rows next to proxied Epic hosts are the usual culprit.
3. Audit DNS: upstream reachability, fake-ip expectations, and whether campus or corporate resolvers special-case gaming CDNs.
4. Expand split rules to cover storefront APIs, static assets, online-service subdomains, and large-object download hosts you actually observe—not only epicgames.com.
5. After routing is coherent, pick stable nodes for interactive login and avoid ultra-aggressive auto failover that reconnects mid-handshake.

For port collisions, invalid rules, and core startup failures, keep the general Clash troubleshooting guide open. Here we focus on multi-endpoint desktop launchers where one missing CDN suffix mimics a platform outage.

3. Why Epic breaks when only the “main” domain is proxied

Epic’s ecosystem deliberately separates concerns. The visible launcher wraps web views and JSON-driven catalog calls; account flows may bounce through distinct hosts; bulk payloads often terminate on regional download edges or third-party CDNs fronted by Epic-owned DNS names. A minimal profile that proxies epicgames.com but leaves a high-volume static or chunk hostname on DIRECT can still strand the UI because embedded views never receive scripts or manifests from the orphaned host.

Install and update workloads add another axis. Chunk downloads may attempt to saturate a path that your rules classify differently from the small HTTPS calls that authorize the session. Users perceive that as “the Epic Games Launcher is broken” even though some bytes are moving—another hint that inconsistent policy selection, not universal packet loss, is the root cause.

Login spinners deserve the same mental model. OAuth-style redirects and token refresh traffic must see a stable exit and consistent SNI behavior. If one leg rides a flaky node while another leg hits DIRECT through a censored resolver, the UI can loop forever without a crisp error string.

Regional catalogs add subtlety. Epic may choose different library rows or entitlement checks based on the perceived country of your exit. A profile that mixes domestic-direct rules for generic CDNs with an overseas proxy for the storefront can produce contradictory geo signals: the shell thinks you are in one region while chunk or entitlement endpoints behave as if you are elsewhere. When you see “not available in your region” alongside otherwise healthy HTTPS, treat it as a routing-consistency bug first, then as a true licensing restriction.

Finally, remember that the launcher updates itself. A background self-update can introduce new hostnames overnight. If “it worked yesterday” is your only evidence, capture a fresh log after the update channel moves—your old YAML may simply be incomplete rather than wrong in principle.

4. System proxy versus TUN for Epic on Windows

System proxy is the lighter-touch option when Windows and the Epic Games Launcher both honor the OS proxy settings and nothing else on the machine fights them. The failure mode mirrors browsers: the first HTTPS request succeeds, but secondary hosts bypass the proxy, leaving embedded panels empty or downloads stalled at zero.

TUN mode pushes routing deeper so fewer executables can silently skirt Clash. The trade-off is operational: driver permissions, route tables, and occasional conflicts with other VPN-class software. If you already walked through our TUN mode guide, repeat the experiment while watching Epic-specific hostnames in the log. TUN is not mandatory for everyone; it is the right lever when evidence shows stubborn bypass despite correct YAML.

Regardless of mode, confirm the GUI is using the profile you edited. Editing one file while another snapshot remains selected manufactures phantom regressions that have nothing to do with Epic’s infrastructure.

5. DNS, fake-ip, and resolver conflicts for Epic

Clash’s fake-ip mode answers quickly with synthetic addresses, yet it tightly couples DNS to rule evaluation. When the resolver and the rule engine disagree about what an Epic hostname “means,” you can observe TLS retries, stalled web views, and account panels that never leave the loading state.

A practical mitigation has two parts. First, ensure upstream DNS servers are reachable through the policy path you expect for general browsing, and avoid resolver chains that intermittently drop international queries. Second, consider targeted policies—commonly nameserver-policy in Mihomo-compatible cores—for suffixes you see repeatedly in Epic traffic. Always verify keys against the documentation bundled with your exact core build instead of copying aged forum snippets.

When DNS fixes clear most symptoms without changing proxy groups, you have strong evidence the bottleneck was resolution, not bandwidth. That distinction tells you whether to invest in resolver hygiene or in node stability next.

6. How to collect Epic hostnames you can defend in a ticket

Static rule posts decay because CDNs and feature flags shift. Build a fresh inventory whenever Epic updates the launcher or your subscription provider rearranges geo rules.

On Windows, open Resource Monitor or your Clash client’s live connections while reproducing the stuck download or login loop. Sort by image name to isolate EpicGamesLauncher.exe and related child processes, then note every remote hostname. Cross-check with the Clash connection table: if a name appears in Resource Monitor but never in Clash, you still have a visibility problem rather than a rule-depth problem.

For browser-only comparisons, you can load the Epic Games Store in a regular browser tab with developer tools open, but remember that the embedded launcher view may not issue identical requests. Prefer evidence from the actual launcher process when possible.

When you document fixes for friends or a community, paste the hostname list with a capture date. Future you will appreciate the timestamp when a CDN cutover suddenly invalidates yesterday’s YAML.

7. Domain buckets from launcher shell to CDN edges

After collection, group hosts so your configuration stays readable. Names drift; verify each suffix against your own logs before you paste anything into production YAML.

Treat any public “Epic domain list” as a starting hypothesis. Your Mihomo log is the authoritative source for which hostnames your PC contacted on the day you troubleshoot.

When you see third-party CDN branding in TLS certificates or response headers, resist the urge to paste generic “Cloudflare” or “Fastly” keyword rules unless your logs prove those patterns are both necessary and safe. Over-broad keyword rules can accidentally steer unrelated browsing through the wrong group. Prefer suffixes you observed on Epic’s own names, then widen only when repeated captures justify the risk.

If you run multiple Epic products—Unreal Editor, Fab, or auxiliary tools—expect additional graphs that partially overlap the launcher. You can reuse the same baseline epicgames.com coverage, but verify editor-specific calls separately because compile workflows sometimes hit distinct endpoints with heavier long-lived connections.

8. Rule snippets: explicit coverage and clean ordering

The YAML fragments below illustrate steering traffic to a proxy group named PROXY. Rename that token to match your real policy label and insert these lines before broad provider rules that might prematurely return DIRECT for “domestic” CDNs that Epic also uses.

# Example only — replace PROXY with your policy group name; verify suffixes against your logs
rules:
  - DOMAIN-SUFFIX,epicgames.com,PROXY
  - DOMAIN-SUFFIX,unrealengine.com,PROXY
  - DOMAIN-SUFFIX,on.epicgames.com,PROXY
  - DOMAIN-SUFFIX,epicgames.dev,PROXY

The list is intentionally conservative: Epic frequently introduces new subdomains for services and experiments. After you paste baseline coverage, refine with additional DOMAIN-SUFFIX rows for any *.ol.epicgames.com families you see repeatedly, always prioritizing log evidence over forum copy-paste.

Prefer DOMAIN-SUFFIX when you can express intent precisely. Reserve DOMAIN-KEYWORD for noisy vendor patterns you cannot enumerate, because substring matches are powerful and easy to overfit.

If your subscription injects aggressive geo rules, duplicate critical Epic lines in a user-controlled section that loads with correct precedence, or merge providers thoughtfully so your exceptions win. The same structural advice appears in our Discord CDN and RTC split article, which walks through another desktop client with heavy fan-out—different hostnames, similar debugging discipline.

9. Download domains: when to split chunks from the launcher shell

Some households want storefront browsing on a privacy-conscious exit while keeping multi-gigabyte chunk traffic on a direct path to a nearby edge. That is legitimate, but only if you consciously carve policies rather than letting a stale rule accidentally strand half of the client.

When experimenting, clone your proxy group as PROXY_STORE and point storefront-related suffixes there, leaving download hosts on DIRECT or a dedicated PROXY_DOWNLOAD group with different failover behavior. Document the choice: aggressive auto-switching on huge flows can starve interactive HTTPS sessions if the same pool backs both.

If downloads are fast but the Epic account window still spins, you almost certainly still have an auth or API hostname outside the proxied set—return to the log and look for the odd DIRECT row next to online-service names.

Disk and antivirus interactions deserve a quick mention. A full disk or an on-access scanner that pins EXE and chunk files during write can mimic a network stall at zero percent. Cross-check free space and temporarily pause aggressive real-time scanning only if your security policy allows it. If Resource Monitor shows steady disk activity while the UI claims “not downloading,” you may be looking at storage or AV, not Clash.

When you intentionally split chunk traffic from the shell, document the rationale in your config comments. Future profile merges from subscription providers can silently reintroduce broad DIRECT or domestic rules that undo your careful carve-out. A one-line note—“Epic chunks direct per 2026-04-19 log capture”—saves hours when someone else merges your YAML six months later.

10. Node strategy: stable sessions beat leaderboard ping

The launcher and account flows are not speed-test workloads. A node that posts impressive RTT but drops every minute forces TLS rebuilds that embedded web views interpret as sluggish or broken pages. Pin interactive browsing and login to providers that hold steady, reduce flappy failover on those destinations, and avoid stacking multiple tunnel products that re-encapsulate the same flow.

For background on transports under loss, read Shadowsocks vs Trojan vs Hysteria2. The goal is to match protocol behavior to your packet-loss profile for long-lived HTTPS, not to crown a single global winner.

UDP is not the headline protocol for Epic’s launcher the way it is for Discord voice, yet some builds still probe STUN-like helpers or auxiliary services during multiplayer-adjacent flows. If you later launch games through Epic and see new UDP rows, revisit your profile with the same evidence-based mindset: read the policy column, confirm whether TUN captures the socket class you expect, and avoid blanket UDP DIRECT unless traces show it is safe for your threat model.

Latency-sensitive users sometimes pin interactive traffic to a nearby city while allowing downloads to use a different pool. That is fine when documented. What fails silently is the opposite—using an ultra-cheap long-haul node for tiny auth calls because your auto-url-test picked it for raw speed on unrelated pings. Separate pools for “interactive Epic HTTPS” and “bulk chunk pulls” when your provider UI supports it.

11. GUI workflow: logs are the source of truth

Desktop clients such as Clash Verge Rev expose live connections, DNS panes, and rule editors side by side. When Epic misbehaves, filter connections for epic substrings and read the chosen policy per row. If anything sensitive shows DIRECT while similar hosts use PROXY, fix precedence before swapping servers.

If the baseline install still feels unfamiliar, follow the Clash Verge Rev setup guide to confirm ports, subscriptions, and first launch before you chase Epic-specific ghosts.

When you export diagnostics for a forum thread, redact tokens and subscription URLs, but keep hostname lists intact. Other readers cannot reason about rule precedence if you only post a screenshot of ping charts. A short table of “hostname → policy → outcome after change” turns ambiguous rants into reproducible science.

12. How this differs from Steam or Discord guides

Our Steam CDN split article targets Valve’s depot and storefront graph—similar CDN split routing instincts, yet Steam’s hostname universe differs from Epic’s online-service layout. Likewise, Discord emphasizes updater CDNs and voice-adjacent realtime paths; Epic’s launcher stresses chunked downloads and account handshakes without Discord’s voice stack.

Enterprise readers should remember that TLS inspection and split-horizon DNS can make overseas storefronts look broken even when Clash is perfect. If only Epic-facing domains fail while unrelated HTTPS succeeds, involve the network team with connection logs rather than assuming the proxy core is misconfigured.

Compared with Steam, Epic leans more visibly on modern web tech inside the launcher and on frequently rotated online-service hostnames. That does not make routing harder in principle—it makes log hygiene more important. Steam veterans who copy Valve-oriented rules verbatim without reading Epic captures often stop at the apex domain and wonder why the symptom persists. Treat this article as a parallel playbook with a different noun list, not a substitute for your own connection table.

13. Antivirus, overlays, and dual VPN stacks

Third-party “game boosters,” HTTPS-filtering antivirus suites, and aggressive overlays sometimes reorder traffic in ways Clash cannot see. Disable them briefly during triage. Running two VPN-class products simultaneously invites routing loops that masquerade as application bugs.

If you also use WSL or containers alongside Epic, remember those environments inherit none of your Windows YAML unless you explicitly bridge them—our WSL2 host-proxy guide covers the Linux side, which can confuse diagnostics when you test with curl from Ubuntu while the launcher runs natively.

14. Close with evidence, not superstition

Stuck downloads and endless login spinners are infuriating because the Epic Games Launcher still looks authoritative even when the network path is fractured. Treat every frozen bar as a prompt to open the connection log, read policies row by row, and reconcile DNS with the hostnames the launcher actually contacted. Thoughtful Clash split coverage for Epic’s graph, calm resolver settings, and deliberate Epic Games proxy choices are the mechanical layer; stable nodes are the polish once the path is honest.

Compared with blind global proxy toggles, a maintained desktop client with Mihomo integration keeps diagnostics visible and reduces YAML foot-guns when storefronts iterate quietly in the background. → Download Clash for free and experience the difference