What Rule mode and Global mode mean in ClashX Pro

ClashX Pro is a menu-bar client for macOS that wraps the same Mihomo (Clash Meta) engine you read about in YAML tutorials. The engine always evaluates every connection with an outbound mode first—that is the high-level policy that decides whether traffic follows your ruleset or jumps straight into a single proxy chain.

Rule mode means “respect the rules: section.” Domains, IP CIDRs, GeoIP tags, and the final MATCH line in your profile dictate whether a flow goes to DIRECT, a policy group such as Proxy, or another outbound. This is the mode most people should use on a daily basis because it keeps local banking sites, company VPNs, and LAN printers off the tunnel while still letting curated lists steer international services through your nodes.

Global mode (sometimes labeled Global in English builds) tells the core to skip per-domain decisions for the broad proxy path and send traffic through the Global policy stack defined in your configuration—practically speaking, everything that is not explicitly carved out as DIRECT at a lower layer tends to ride the same outbound chain. People reach for Global when they want a blunt instrument: confirm a node works end-to-end, compare latency without wondering whether a rule mis-fired, or temporarily override a noisy ruleset while traveling.

Direct mode deserves a mention because it completes the story. Direct tells Clash to stop proxying and forward eligible flows straight out your normal interface. It is not “Rule with better ping”; it is a deliberate off switch for the tunnel while keeping the app alive for later.

None of these modes automatically explains TUN. TUN mode is about kernel-level capture; Rule versus Global is about policy selection once traffic has already reached Clash. You can be in Rule mode with TUN on, or Global mode without TUN while only browsers honor the macOS system proxy. Keeping that distinction straight prevents half the support threads you see on forums.

Before you switch: profile health and expectations

Modes only help when the underlying profile is sane. If your subscription failed to fetch, the active file still references removed policy groups, or the Mihomo core crashed silently, toggling Global will not magically repair DNS or authentication errors.

Open the ClashX Pro dashboard window if you use it, or the log panel from the menu bar, and confirm the runtime is green. Hit Update subscription when your provider rotates endpoints. If you recently blended custom rules with a remote ruleset, make sure the merge order still ends with a MATCH rule that points at a group you actually defined.

Decide whether you expect system-wide coverage or browser-only coverage. macOS applications are inconsistent: Safari and many Electron apps adopt CFNetwork settings when you enable ClashX Pro’s Set as system proxy, while Terminal, some IDEs, and old binaries ignore it unless you export environment variables as in Route macOS Terminal Through Clash. Knowing that split upfront saves you from declaring “Global mode is broken” when the problem is actually a shell that never saw HTTPS_PROXY.

Step 1: Open the ClashX Pro menu bar controls

Look at the upper-right of the menu bar for the ClashX Pro icon (exact artwork varies by theme). Click it once to open the drop-down. The layout has remained familiar across recent builds: a compact status area at the top, outbound or policy mode entries in the middle, and deeper actions—dashboard, remote control, config folder—near the bottom.

If the icon is missing, the app may not be running or macOS hid extras because the notch or “Bartender-like” tools collapsed the tray. Launch ClashX Pro from Applications, allow any helper permissions you deferred, and recheck Launch at login only after you trust the profile.

Advanced users who drive Clash through an external web UI should still know this menu; it is the fastest place to yank a laptop from Global back to Rule before you join a video call on a capped cellular plan.

Step 2: Pick Rule, Global, or Direct from the outbound mode list

In the menu, find the section that lists Rule, Global, and Direct. Click the mode you need. The active row shows a checkmark or highlight depending on the skin your build uses.

When you choose Rule, Clash immediately resumes evaluating the YAML rules array for each new connection. Existing keep-alive sessions might linger on an old path for a few seconds; that is normal TCP behavior, not a bug.

When you choose Global, new flows align with the profile’s Global outbound stack. If traffic still looks domestic on an IP test, your configuration may map Global to a group that contains balancing rules, or an upstream node exits in the same country you expect—always read the node's real egress using provider documentation.

When you choose Direct, Clash stops steering through remote outbounds for covered connections. Use it on captive portals, airline Wi-Fi login pages, or when corporate split tunneling demands a pristine path. Remember to return to Rule afterward or you will wonder why no streaming rule fires.

Step 3: Pair the mode with Set as system proxy on macOS

Toggle Set as system proxy from the same menu when you want macOS-wide apps to pick up Clash’s HTTP and HTTPS listeners automatically. The entry might read slightly differently in localized builds; the behavior is what matters: it pushes the system configuration toward Clash’s mixed or discrete ports as defined in your active profile.

A practical workflow looks like this: start in Rule mode, enable Set as system proxy, refresh a domestic news site (should stay fast if rules mark it DIRECT), then open a service your rules send through Proxy. Switch to Global with system proxy still on; the foreign IP checker should now follow your proxy even if a typo in rules previously caused a leak. Switch back to Rule once you finish testing.

If you disable system proxy but leave Clash running, browsers that were relying on it may fall back to direct internet. That state is useful when you want only explicitly configured tools—like a browser extension or a dev container—to use Clash, which is common among engineers who read Docker Desktop on macOS with host Clash.

Step 4: Optional—adjust policy groups in the dashboard

Modes answer “ruleset versus global stack,” but your day-to-day node choice usually lives in policy groups such as Proxy, Auto, or provider-specific names. Open ClashX Pro’s dashboard window from the menu if you need a larger surface than the tray lists.

In Rule mode, changing the selected node inside Proxy affects every rule that references that group. In Global mode, you may still see a Global group or the same Proxy chain depending on how the author wrote global and proxy-groups. If that sounds abstract, think of mode as the freeway entrance and policy groups as the lane you pick afterward.

Latency tests inside the UI help, yet they only measure control-plane pings, not YouTube bitrate. Combine them with real browsing tests whenever you switch countries or transport protocols.

Step 5: Verify routing without fooling yourself

Open a private browser window and load a reputable IP or DNS leak page. Record the reported country and ASN. Repeat after switching Rule → Global → Rule, each time waiting a beat for tabs to establish fresh connections.

Use ClashX Pro’s logging or a compatible API viewer to watch domain hits. You should see Match lines referencing rule names in Rule mode, whereas Global mode logs often collapse decisions toward the global chain. If logs never appear for an app you care about, that app is probably not sending traffic through Clash yet— revisit system proxy, TUN, or per-app settings.

For command-line tools, remember the macOS split discussed earlier. curl happily ignores the system proxy unless you export variables. Global mode in Clash will not change that fact; it only adjusts what happens to flows that reach the core.

When to stay on Rule, when to try Global, and when to bail out to Direct

Stay on Rule for normal work: you preserve split tunneling, respect domestic CDNs, and keep latency low for services that perform better without an offshore detour. Well-maintained rulesets already encode the nuance you would otherwise micromanage by hand.

Use Global for diagnostics: you suspect a complex rule order, you want to prove the upstream node itself is healthy, or you are on hotel Wi-Fi that breaks split DNS. Switch back as soon as you finish because blanket proxying wastes bandwidth and can confuse SSO cookies.

Use Direct when you must touch the raw internet: hotel captive portals, banking apps that dislike foreign ASNs, or moments when your provider is offline and you need bare connectivity. Pair Direct with system proxy disabled to avoid partial states.

Troubleshooting mode switches that seem ignored

“Global feels like DIRECT for some sites”

Check whether your profile’s Global outbound still embeds filtering, whether browser extensions enforce their own proxy, or whether the domain is pinned via HOSTS. Corporate DNS filtering can also short-circuit results.

“Rule mode leaks foreign traffic on domestic sites”

Open the YAML and inspect order: catch-all rules placed too high hijack traffic. GeoIP databases need periodic refresh. Some streaming services shift hostnames hourly; a static domain list may lag.

Menu entries greyed or core not responding

Quit ClashX Pro cleanly, clear stale lock files if your build documents them, and relaunch with a known-good config. If helpers were revoked in System Settings → Privacy & Security, reauthorize before expecting TUN or packet tunnel features to return—though that path is separate from simply picking Rule or Global.

TUN is on but modes behave oddly

TUN raises every packet toward Clash, yet outbound selection still follows Rule or Global. If you never read the dedicated guide, walk through How to Enable Clash TUN Mode slowly so you are not debugging two unfamiliar knobs at once.

If you landed here from a search about “Clash proxy mode switch,” you probably do not need a from-scratch install walkthrough. Our Clash Verge Rev article targets cross-platform beginners, while Stash on iPhone covers iOS imports. Neither replaces ClashX Pro’s macOS-native tray workflow.

Likewise, LAN proxy sharing helps other devices reuse your Mac’s listener; it assumes you already know which outbound mode you want before friends connect their tablets.

Quick FAQ reminders

Does Apple Silicon change any of this? M-series Macs use the same menu structure; only helper installations and Rosetta quirks differ, not the semantic difference between Rule and Global.

Can I script mode changes? Power users sometimes call Clash’s external controller or use Shortcuts; that is outside this UI-focused article, but the underlying API is why automation is possible at all.

Is Global “more private”? Not inherently. It is simpler, not safer. Privacy comes from node trust, TLS hygiene, and DNS policy—not from bypassing your own rules.

Summary

ClashX Pro on macOS makes Rule mode, Global mode, and Direct mode a single click away in the menu bar, yet the labels only help after you understand that they steer Mihomo’s policy engine—not the same problem TUN solves. Pair mode switches with a deliberate Set as system proxy choice, verify with fresh browser sessions and logs, and remember Terminal tools need environment alignment.

Compared with all-in-one VPN apps that hide every routing decision behind a cartoon switch, Clash-family clients reward readers who want transparent YAML—but that depth also means more places to misclick. Generic VPN UIs rarely expose split rules at all, so when they mis-classify traffic you get binary outcomes: everything slow or everything blocked. With Clash you keep Rule precision while still having Global as a wrench when debugging. When you want that balance on macOS without patching together half-documented forks, grabbing the maintained Clash ecosystem from one place keeps your modes, subscriptions, and updates coherent; download Clash for free and keep Rule and Global switches under your control.