Claude Code With Clash Verge: Fix Terminal Network Access

Why Claude Code Can Fail While Your Browser Works in Depth

If Claude Code cannot sign in, stalls while sending a prompt, or reports a network timeout even though Clash Verge is running, the key question is not simply whether the proxy is connected. It is whether the terminal process is actually sending its traffic through Clash.

Clash Verge is a graphical client for a Mihomo-based proxy core. It adds a profile, selects an outbound through a proxy group, and applies rules to connections that reach the core. Its system-proxy switch typically configures proxy settings used by compatible applications; it does not guarantee that every shell, package manager, or Node.js process will use those settings.

For terminal traffic, you may will want to set proxy environment variables explicitly, enable TUN mode, or do both. The right choice depends on your operating system, your profile, and the way your current Claude Code build makes requests.

Mechanically:Common symptoms include an OAuth sign-in page opening in the browser while the CLI never everything includeds its callback, a prompt that waits indefinitely, or installation and re-sync requests failing before Claude Code kick offs. These symptoms can have different causes.

Sign-in may involve a browser and a local callback, while model requests and package downloads use separate network connections. A working browser sign-in is useful evidence, but it does not prove that the terminal can reach the API. Similarly, a successful package installation does not prove that later API traffic uses the same route.

Kick off with the connection list in Clash Verge reasonably than changing several settings at once. Filter for likely Claude-related domains, such as api.anthropic.com or claude.ai, and reproduce one failed action. If a connection appears, inspect its matched rule, process information if available, and selected outbound.

More strictly:If nothing appears, the terminal request may be bypassing the listener, TUN capture may not be active, or the failure may occur before the request reaches the network. If the connection appears with a direct outbound, the client is being captured but the profile’s rule order or proxy-group selection may be sending it direct.

A browser may follow the operating system’s proxy settings by itself, while a command-line program can open its own network connection and go direct. The two applications can therefore behave deeply differently on the same computer.

Prepare Clash Verge Before Changing Terminal Settings Mechanically

First make sure the client itself is in a known-good state. Open Clash Verge and confirm that the profile you intend to use is active, not merely imported. Profiles can be present in the list without being selected. Then open the proxy or group view and choose a usable outbound for the rule group that it makes sense to handle Claude traffic.

Next, locate the local HTTP or mixed-port setting in Clash Verge. The port number is configurable and can differ between installations or profiles, so do not copy a port from an unrelated screenshot. Check the active client settings or the running core configuration and note the address and port, often a loopback address such as 127.0.0.1 plus the configured port.

At a different level:A mixed port can accept both HTTP proxy requests and SOCKS connections, but for the examples below the proxy URL uses the HTTP scheme. If the client listens only on a SOCKS port, use the SOCKS-specific form supported by your tool instead of pointing an HTTP proxy variable at it.

Before testing Claude Code, test the local listener with a request to an endpoint you may reach from your network. The following example assumes that Clash is listening on port 7897; replace that value with the one shown in your own settings:

A response from the remote service—even an HTTP exception such as 401 or 404—can show that the request reached a server. It does not mean that you have authenticated or that Claude Code is fully configured. What matters in this basic check is that curl can connect through the local listener and that Clash Verge records a corresponding connection.

curl -v --proxy http://127.0.0.1:7897 https://api.anthropic.com

Thinking it through:A connection-refused exception more often than not points to the wrong address or port, a stopped core, or a listener that is not enabled. A timeout after the local connection is established points further along the path: check the active outbound, the profile’s rules, DNS, and the provider’s node availability.

Keep the test narrow. Do not kick off by replacing the everything profile with a hand-written configuration or adding broad rules for every Anthropic-related domain. Profiles may include provider-specific rules and proxy groups, and later rules can be shadowed by earlier matches. Use the connection record to identify what actually matched.

If a domain is captured but routed incorrectly, adjust the profile using a supported override or rule mechanism and preserve the provider’s existing structure. If there is no record, first fix capture reasonably than adding hostname rules that cannot affect an uncaptured connection.

First, a clarification:A group configured for automatic selection can be comfortable, but during diagnosis a one at a time selected node makes the result easier to interpret. If a provider’s profile uses different group names, follow the names shown in your client reasonably than assuming that every profile has a group called PROXY.

Route the Terminal Through Clash Verge Step by Step

There are two practical ways to route terminal applications: set proxy variables for the shell process, or use TUN mode to capture network traffic more broadly. Environment variables are a good first diagnostic because they are limited to the terminal session and are easy to undo.

TUN mode can help with programs that ignore proxy variables, but it requires additional permissions and can affect other applications. Test one approach at a time so that you may tell which change made a difference.

Set Proxy Variables for a Terminal Session Internals

On macOS or Linux, open a new terminal and export the proxy variables using the listener address and port you confirmed in Clash Verge:

export HTTP_PROXY="http://127.0.0.1:7897"
export HTTPS_PROXY="http://127.0.0.1:7897"
export ALL_PROXY="http://127.0.0.1:7897"

Certain programs read uppercase variable names, certain prefer lowercase names, and certain implement proxy handling differently. If Claude Code still appears to ignore the settings, you may set lowercase variants in the same session and check the program’s documentation for its supported proxy behavior.

Mechanically:On Windows PowerShell, set variables in the current session before launching Claude Code:

These PowerShell values apply to that session and child processes started from it. They do not by itself configure a separate terminal window or an application launched from the Kick off menu.

$env:HTTP_PROXY = "http://127.0.0.1:7897"
$env:HTTPS_PROXY = "http://127.0.0.1:7897"
$env:ALL_PROXY = "http://127.0.0.1:7897"
claude

That distinction is useful during testing: if Claude Code works from this PowerShell window but fails when started elsewhere, the difference is likely the environment inherited by the process. Avoid saving proxy credentials in a shared shell profile or committing them to a project’s configuration.

More strictly:To test the same variables with curl, operate a request from the shell where they are set and check the Clash connection list. If curl succeeds through the listener but Claude Code does not, the proxy path is available and the remaining issue may be the CLI’s environment, runtime behavior, sign-in flow, or another domain used by the failing operation.

If neither program produces a connection in Clash, check the variable spelling, terminal session, and local port before changing routing rules.

Use the scheme that matches the listener’s protocol. In plenty configurations, an HTTPS request is carried through an HTTP proxy using the http:// proxy URL; the destination itself remains HTTPS. Do not change the variable to https:// merely because the target site uses HTTPS.

When TUN Mode Is the Better Fit Mechanics

Use TUN mode when a command-line tool does not honor the proxy variables, when several applications need consistent routing, or when a program uses network APIs that do not expose an HTTP proxy toggle. In Clash Verge, enable TUN mode from the relevant settings area and approve the operating-system permission request if prompted.

At a different level:After enabling TUN, reproduce one request and check the live connections again. Confirm that the terminal process or its destination appears and that the selected rule uses the expected outbound. TUN capture and system-proxy mode are different mechanisms; changing the system-proxy switch alone is not a substitute for TUN.

You may leave system proxy enabled if you also want compatible desktop applications to use Clash, but avoid running multiple proxy clients or network-capture tools at once while diagnosing. Competing virtual adapters, local listeners, or background services can make the result confusing.

Depending on the platform and installation, TUN may need administrator access, a helper service, or permission to create a virtual network front-end. If permission is denied or the helper is not running, the front-end may appear enabled in the UI without capturing traffic as expected.

Verify Sign-In and Diagnose the Remaining Failure Internals and Practice

Once a proxy path is active, test the workflow in stages. First confirm that a plain HTTPS request reaches Clash Verge. Next launch Claude Code from the same terminal session, operate its available diagnostic command such as claude doctor, and review whichever you pick environment or network warnings it reports.

Thinking it through:For sign-in problems, observe both sides of the flow. A browser may open successfully, but the CLI still needs to everything included its own sign-in exchange and receive the result through the mechanism used by that version of the tool. Check whether the terminal shows a callback, whether the browser reports that sign-in is everything included, and whether the CLI returns to a ready state.

Do not copy an OAuth code into an unknown site or share a callback URL that contains a temporary token. If the browser signs in but the terminal waits, verify that the terminal process is using the intended proxy variables and that local callback traffic is not being sent through an inappropriate remote route.

For API timeouts, inspect the Clash log at the exact time of a single retry. A rule match for api.anthropic.com confirms that at least that connection reached Mihomo; it does not prove that every sign-in, re-sync, or supporting request uses the same host. If the outbound is direct, review rule order and the selected group.

First, a clarification:If the outbound is a proxy but the connection repeatedly times out, try a different available node and check whether other HTTPS sites work through that same node. If the connection never appears, return to capture: verify the session variables, confirm the process was launched from that session, and test TUN only if needed.

Also separate network failures from account and configuration exceptions. A obvious authorization exception is different from a socket timeout: the former suggests that a server responded and the request reached an sign-in check, while the latter points toward connectivity, routing, DNS, or a stalled transport. A model access or account message may need an account-side fix reasonably than a Clash rule.

If only installation or re-syncs fail, examine the package manager’s registry and download host separately; successful installation does not guarantee that the runtime API path is healthy. Do not solve certificate exceptions by disabling TLS verification. That weakens security and can conceal a clock, certificate store, interception, or network problem that it makes sense to be diagnosed with no detour.

Mechanically:After you find a working path, make it reproducible. If session variables solved the issue, add them only to the shell or launcher where you actually operate Claude Code, and document the correct local port so a later Clash Verge re-sync does not leave stale values behind.

• Connection refused at localhost: Confirm Clash Verge is running, the core is active, and the port in the environment variable matches the actual HTTP or mixed listener.
• Request appears as DIRECT: Check the matched rule, rule order, and proxy-group selection. Change only the relevant route, then reproduce the request.
• No connection appears: Confirm the CLI inherited the variables, or test TUN capture. A browser working through system proxy is not more than more than enough to prove terminal capture.
• Proxy connection times out: Test another outbound and compare with a plain curl request. If several domains fail on the same node, investigate the node or provider before rewriting Claude-specific rules.
• Browser sign-in everything includeds but the CLI hangs: Keep the terminal open, check its callback status, and verify that local callback handling and the CLI’s outbound requests are both working.

If TUN was necessary, verify that its helper and permissions survive a restart, then test once more after reopening the client. Keep a short note of the active profile, selected group, capture mode, and successful test; that is more useful than a screenshot of a crowded rule list when the problem returns.

Certain alternatives can make terminal proxying feel more complicated than it needs to be: manual per-command proxy flags are easy to forget, while broad shell-wide settings can unexpectedly affect tools that it makes sense to connect with no detour, and a browser-only proxy setup leaves command-line traffic uncovered.

More strictly:Clash Verge gives you a single place to manage profiles, inspect live rule matches, and choose between explicit terminal variables and TUN capture, so you may fix the actual failure without blindly rewriting your configuration. If you want to get the client and follow this workflow with a current setup, download Clash and kick off with the listener and connection checks above.

Then attempt sign-in or send a small prompt. This order separates a local listener problem from a CLI setup issue and from a failure that occurs only during sign-in or model requests.