macOS: Clash Won’t Open — Network Extension Permissions and Keychain Prompts

Identify the prompt before changing permissions

An app that won’t open, a failed TUN startup, and a Keychain access request are three different issues. Note the exact prompt, the name of the requesting app, and what you did to trigger it. Then check the relevant setting. Don’t assume every problem is a permissions issue or change several security settings at once.

Clash is a common name for a rule-based proxy core and its client ecosystem. macOS clients don’t all use the same background components. Using the Clash Meta (now mihomo) core doesn’t necessarily mean an app installs an Apple Network Extension. Some clients use a privileged helper to start the core and create a virtual TUN interface.

“Can’t be opened”: check compatibility and Gatekeeper

Make sure the installer matches your Mac

1. Open the Apple menu → About This Mac. If it shows an Apple M-series chip, choose the Apple Silicon or arm64 build. If it shows an Intel processor, choose the x64 or Intel build.
2. Quit any older client that’s running. Drag the app from the disk image into Applications, then eject the installer. Don’t keep launching the app from the DMG.
3. Launch the app from Applications and note the exact system message. An incompatible build, an unsupported macOS version, and a developer verification warning each need a different fix.

You can also run this read-only command in Terminal. In a native Terminal session, arm64 usually indicates Apple Silicon. If Terminal itself is running under Rosetta, the result may be x86_64; in that case, check the chip shown in About This Mac.

uname -m
sw_vers -productVersion

Allow a verified app to open

If macOS says the developer can’t be verified, first confirm that you downloaded the app from the expected project release channel. Then open the Apple menu → System Settings → Privacy & Security. Scroll to the Security section and click Open Anyway next to the block message for that launch. Authenticate and confirm when prompted. This option usually appears only after you’ve tried to open the app.

In some cases on macOS 13 and 14, you can also Control-click the app in Finder and choose Open. macOS 15 has tightened this workaround for apps that aren’t properly signed or notarized. Use the controls in Privacy & Security instead; repeatedly right-clicking won’t help.

Network Extension approval: check how the client works first

A system proxy usually doesn’t require a Network Extension. It mainly changes macOS proxy settings, such as HTTP and HTTPS, so apps that honor the system proxy can connect to a local listening port. TUN routes traffic through a virtual network interface. The required permissions depend on whether the client uses Network Extension or a privileged core and helper.

If you see an extension or VPN prompt

1. Turn on the relevant feature in the client and check the app name in the system prompt. Approve a VPN configuration or enable an extension only if the name, source, and action all match what you expect.
2. In macOS 15, go to System Settings → General → Login Items & Extensions and check Network Extensions under Extensions. If the client is listed, make sure its extension is enabled.
3. In macOS 13 and 14, if macOS shows a blocked system software or extension approval prompt, check Privacy & Security for the relevant approval option. Regular app extensions may not have the same button.
4. If System Settings shows a VPN page or a VPN configuration under Network, check its name and connection status. Approving a VPN configuration and approving a system extension are separate steps; not every client requires both.

After approving, return to the client and turn the feature off and back on. Restart your Mac only if macOS explicitly asks you to. Company- or school-managed Macs may require an administrator to approve the software through a management policy. Reinstalling the same app won’t bypass that restriction.

If there’s no Network Extension listed

Check the client’s documentation, core logs, and service mode status. If the log reports operation not permitted when creating a TUN interface, check the privileged service rather than looking for a Network Extension switch that may not exist. If TUN starts but domains won’t load, check DNS and routing rules instead; that usually isn’t an extension approval issue.

Installing a helper service: when you need an administrator password

Some clients ask to install a privileged helper to create a TUN interface, manage routes, or run the core with the required permissions. This macOS authentication prompt may ask for an administrator account name and password. It isn’t your subscription password or Apple Account password. Whether you can use Touch ID depends on your system’s authentication settings.

1. Quit other proxy or VPN apps first. Keep only the client you’re configuring active to prevent an older background process from changing routes at the same time.
2. Look in the client for options such as Service Mode, Helper Service, or Install Service. Names vary, so follow the interface for your specific client. Don’t assume menu paths are the same across all Clash clients.
3. Choose Install or Repair Service, check the requester shown in the authentication prompt, and enter your Mac administrator credentials. If you use a standard account, ask an administrator for help. Don’t try to launch the entire GUI app as root from Terminal.
4. Open System Settings → General → Login Items; in macOS 15, choose Login Items & Extensions. Under Allow in the Background, check whether the developer or helper component has been disabled.
5. Return to the client and check that the service is ready, then enable TUN. If it still fails, note the error from the service installation instead of repeatedly entering your password.

If the client keeps asking to install a service after an upgrade, the old helper may not match the new app version, or the background component may be disabled. Start with the client’s built-in Uninstall Service or Repair Service option, then relaunch the app. Don’t guess which files to delete by name in /Library/PrivilegedHelperTools or /Library/LaunchDaemons; deleting the wrong item can break other software.

Keychain prompts: verify the item, then choose how much access to grant

Keychain stores passwords, tokens, certificates, and other information. If a client saves subscription credentials or other sensitive settings there, accessing them may trigger an authorization prompt. Not every Clash client uses Keychain this way. Check the item named in the prompt rather than automatically allowing access just because the app is a proxy client.

Check these three details

• Requester: Is it the client you just opened, or an unfamiliar process? An app update can change its path or signature and trigger a new prompt.
• Item name: Does it match the client, your account, or a credential you saved? Don’t judge whether a request is trustworthy by the appearance of the dialog alone.
• Keychain name: If macOS asks to unlock the “login” keychain, you usually need that keychain’s password. It’s often the same as your Mac login password, but the two aren’t always in sync.

If you can verify both the source and the item, choose Allow to grant access once. Choose Always Allow only if you’re sure the app will need ongoing access to that item. Deny blocks this access attempt and may mean you’ll need to sign in again or re-enter your credentials, but it doesn’t uninstall the app.

The prompt keeps coming back even though the password is correct

Search Spotlight for Keychain Access and open it. Select the login keychain and search for the item named in the prompt. Check the item details and its available Access Control settings to see whether the authorized app still points to an old version or path. Don’t change access to allow all applications. Newer macOS versions include the Passwords app, but it doesn’t replace all Keychain management features.

If an administrator previously reset your Mac password, the login keychain may still use the old password. Your new login password won’t unlock it; you’ll need the original keychain password or the macOS recovery process. Resetting the default keychain affects saved credentials, so don’t make it your first troubleshooting step.

Still offline after approval? Check the port, traffic, and DNS

First enable only the system proxy to test basic connectivity, then turn on TUN if needed. This helps distinguish a core that isn’t listening from a failure to route traffic through TUN. The example below uses mixed-port: 7890 from the active configuration. Port 7890 isn’t universal; check your current configuration or client settings first.

scutil --proxy
lsof -nP -iTCP:7890 -sTCP:LISTEN
networksetup -listallnetworkservices

• scutil --proxy displays the current system proxy settings. When using the system proxy, check that the enabled flags, server address, and port match the client. If only TUN is enabled, the system proxy being off isn’t necessarily a problem.
• Use lsof to check whether a process is listening on TCP port 7890. If there’s no output, confirm the port number and whether the core is running. Check the client logs if needed; don’t assume the node is down.
• networksetup -listallnetworkservices lists network service names. Before checking proxy settings manually, identify the Wi-Fi or Ethernet service you actually use so you don’t change an inactive interface.

If 7890 is the HTTP-compatible mixed port, you can run the explicit proxy request below. It only checks whether this request can reach its destination through the local proxy; it doesn’t prove that the system proxy or TUN covers every app.

curl --proxy http://127.0.0.1:7890 --connect-timeout 10 --max-time 20 -I https://example.com/

If the connection to the local port fails immediately, check whether anything is listening. If the local proxy connects but the request times out, check the node, policy group, and matching rules. If only a browser is affected, check its proxy extension and any old proxy settings. If only TUN is affected, check the service status, routes, and possible conflicts with other VPNs.

For a domain resolution error, check the core’s DNS logs and active configuration. dig may not use the same resolution path as your browser, so one failed query doesn’t prove that TUN approval failed. Keep a working configuration, then change DNS settings one at a time. Avoid changing Fake-IP, upstream resolvers, and routing rules all at once.

Before sharing diagnostics, check these details

Once setup is complete, the app should launch from Applications, any required helper service should be ready, and at least one working route should be verified: the system proxy or TUN. Not every Mac needs to show a Network Extension, a VPN configuration, and a Keychain prompt.

1. Record the full macOS version, chip architecture, client version, and the core name and version shown in the client.
2. Note what you did when the error occurred, such as “after clicking Install Service” or “after turning on TUN,” and include the exact prompt text.
3. Export logs for the relevant time period. Redact tokens in subscription URLs, node passwords, account details, and any other sensitive information.
4. Say whether the system proxy works, whether TUN works, and whether another VPN is running. This can reduce back-and-forth during troubleshooting.

Next, follow the Getting Started guide to import a subscription and configure rule mode. If the connection still fails, use Troubleshooting to check ports, DNS, and rules. Keeping the original error makes it easier to find the failing step than repeatedly reinstalling the app.