With the system proxy on, you may find the browser working fine while certain Microsoft Store (UWP) apps cannot connect at all or bypass the proxy. That is not a Clash bug - it is a Windows security mechanism.

The cause: UWP loopback isolation

For sandboxing, Windows forbids UWP apps from connecting to the local loopback address (127.0.0.1) by default. The system proxy happens to live at 127.0.0.1:7890, so a UWP app's proxy requests are refused by the OS itself. Store versions of chat and mail clients are typical victims.

The fix: the UWP Loopback tool

  1. Open CFW's Settings page, find UWP Loopback, and launch the tool (Microsoft's official EnableLoopback Utility).
  2. Tick the UWP apps that should use the proxy. Search by name if unsure.
  3. Click Save Changes, then restart the affected app.

Verification and notes

  • After the restart, the app's process should appear on the Connections page.
  • Exemptions are per-app and reset after the app (or Windows) is reinstalled - re-tick as needed.
  • If an app still bypasses the proxy after exemption, it likely uses its own network stack - TUN mode covers it at the network layer without any loopback exemption.
Tip: the restriction only affects proxying through 127.0.0.1. In TUN mode traffic never touches loopback, so UWP apps are proxied with no exemptions - one more reason many users simply run TUN.