With a profile active, system traffic still needs to be steered into Clash. The most common way is the system proxy switch.

Turn it on

  1. Go to the General page.
  2. Enable System Proxy. Windows Settings → Network & Internet → Proxy will now show 127.0.0.1:7890.
  3. Confirm the outbound mode is Rule and the tray icon is no longer gray.

Verify #1: browser test

Open a site that normally cannot be reached directly. If it loads, the proxy works. If not, first benchmark your nodes to rule out a dead node.

Verify #2: check your exit IP

Visit https://api.ip.sb/ip or a similar IP echo service. The address returned should belong to your node's region, not your local ISP.

Verify #3: the Connections page

Open Connections in CFW and refresh a web page. New connections should appear with the node's name in the Chains column - the clearest evidence of which rule matched and which node was used.

Command-line check (optional)

curl -x http://127.0.0.1:7890 https://api.ip.sb/ip

Returning the node's IP proves the local proxy port works. Note that CLI tools do not read the system proxy by default - you must pass it explicitly as above, or use TUN mode.

Common misconception: the system proxy only affects programs that honor system proxy settings. Browsers are fine; some chat apps, games and CLI tools bypass it - that is by design, not a fault. See When Apps Bypass the Proxy.