Clash Netflix and Disney+ Split Tunneling Setup Guide

What Split Tunneling Should Achieve for Netflix and Disney+

Streaming services are a good test of whether a Clash configuration is designed around real traffic rather than a generic “proxy everything” switch. Netflix and Disney+ may load through an ordinary browser connection, yet still show different catalogs, reject playback, or repeatedly ask you to sign in when their application traffic is split across inconsistent routes. A dedicated streaming policy gives these services a predictable path while allowing local websites, banking portals, printers, software updates, and nearby network devices to use a direct connection.

In this guide, “split tunneling” means rule-based routing inside Clash or a Mihomo-based client such as Clash Verge Rev, Mihomo Party, or another maintained desktop interface. Netflix and Disney+ domains are assigned to a streaming proxy group, while local addresses and selected domestic services are assigned to DIRECT. Everything else can follow your normal rule policy. This is more precise than leaving the entire system in Global mode, and it avoids the unnecessary latency that occurs when every request travels through a remote node.

The important limitation is that a streaming rule cannot guarantee access to every regional catalog. Netflix and Disney+ evaluate account location, billing country, device signals, DNS behavior, IP reputation, and sometimes playback authorization separately. A node that opens the homepage may still fail when the video license or media segment request begins. The goal is therefore a consistent, low-latency route—not a promise that any particular proxy will bypass a platform’s regional restrictions.

Tip: Test one service at a time. First confirm that Netflix works through the selected group, then test Disney+. If both fail after a rule change, return to a known-good profile before changing DNS, TUN mode, and proxy selection simultaneously.

Prepare the Clash Profile and Proxy Groups

Before writing rules, make sure the active profile actually contains usable proxies and a group that rules can call. In Clash, the rule target is not usually a server name. It is the name of a proxy-group, such as Streaming, Netflix, or Disney. If your rules refer to a group that does not exist, Mihomo may reject the configuration or fall back in a way that is difficult to diagnose.

Open your client’s profile editor or use its YAML override feature. Keep the provider-generated proxy definitions intact unless you understand how the subscription is structured. Add your own groups through a merge mechanism when possible, because directly editing a downloaded subscription can cause your changes to disappear at the next update. The exact menu differs between clients, but the principle is the same: separate provider data from personal routing policy.

A single streaming group is convenient when you want one node selection for both services. Separate groups are better when Netflix performs well on one region while Disney+ performs better on another. Start with the simpler design and split the groups only after real testing shows a reason to do so.

Step A — Confirm the active profile: Check that the profile shown as active is the one you are editing. Many “rules do nothing” reports come from modifying a draft profile while another profile remains selected.

Step B — Confirm the listener: Verify the mixed port or HTTP/SOCKS ports used by your client. A desktop browser may use the system proxy, while a phone or command-line application may need a separate port or TUN capture.

Step C — Confirm the group name: Use one exact group name in the proxy group definition and in every matching rule. Group names are case-sensitive in practice, and spaces or punctuation can make a copied rule point to the wrong target.

Step D — Save a backup: Export or copy the working profile before adding streaming rules. A small YAML indentation mistake can prevent the profile from loading, and a backup makes rollback immediate.

A basic group can use automatic selection, manual selection, or a URL test. Manual selection is useful during diagnosis because you know exactly which node is being tested. Once playback is stable, a health-checked group can automatically avoid unavailable nodes, although latency alone does not prove that a node is accepted by Netflix or Disney+.

Build Domain Rules for Netflix and Disney+

Streaming traffic is spread across more than a single homepage domain. Authentication, catalog metadata, artwork, playback authorization, telemetry, and video delivery may use different hostnames. Exact domain rules are safer when you know the endpoint, while DOMAIN-SUFFIX rules are easier to maintain when a service uses many subdomains.

For a first configuration, route the principal service families through your streaming group. A typical rule section may look like this:

rules:
  - DOMAIN-SUFFIX,netflix.com,Streaming
  - DOMAIN-SUFFIX,netflix.net,Streaming
  - DOMAIN-SUFFIX,nflxvideo.net,Streaming
  - DOMAIN-SUFFIX,nflximg.net,Streaming
  - DOMAIN-SUFFIX,disneyplus.com,Streaming
  - DOMAIN-SUFFIX,disney-plus.net,Streaming
  - DOMAIN-SUFFIX,disney.com,Streaming
  - DOMAIN-SUFFIX,bamgrid.com,Streaming
  - DOMAIN-SUFFIX,local,DIRECT
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - MATCH,PROXY

The exact domain inventory can change, and third-party lists may contain broad entries that route unrelated Disney or Netflix services. Treat the example as a starting point rather than a permanent universal list. Use the client’s connection log while opening the app, signing in, browsing a title, starting playback, pausing, and seeking. If a request is rejected or takes a direct path, inspect its hostname before adding a narrower rule.

Rule order is decisive. Clash evaluates rules from top to bottom and stops at the first match. Place service rules above broad categories such as a general streaming rule, a regional rule, or GEOIP. Put private-network exceptions where they can be matched before a broad final proxy rule. A common mistake is adding GEOIP,CN,DIRECT above Netflix rules and then wondering why the service never uses the streaming group; domain rules must appear before that country-based shortcut if the service domains resolve to addresses classified as local.

Warning: Do not paste a large “Netflix unlock” list without reviewing it. Some lists route analytics, cloud storage, operating-system endpoints, and unrelated content-delivery domains through the same proxy. That can increase bandwidth usage and create confusing failures in services that should remain direct.

DNS, Fake-IP, and Region Consistency

DNS is often the hidden reason a rule appears correct but playback still fails. A domain rule can select the right proxy group while the DNS request itself is answered by a local resolver, an ISP resolver, or a remote resolver in a different region. The resulting address may send the connection to a content-delivery edge that does not match the proxy’s apparent location. For streaming, route consistency matters: the resolver path, TCP or QUIC connection, license request, and media request should not constantly disagree about where the client is located.

Mihomo commonly offers fake-IP and redir-host modes. Fake-IP maps domains to synthetic addresses so the core can identify the original hostname and apply rules efficiently. Redir-host returns real addresses and can be easier to understand when troubleshooting, but it may provide less control for applications that open connections in unusual ways. Neither mode is automatically “better” for Netflix or Disney+; the correct choice depends on the client, operating system, TUN implementation, and resolver behavior.

If you use fake-IP, exclude devices and domains that are known to be incompatible with synthetic responses. Local routers, printers, captive portals, and some smart-TV discovery protocols may require real addresses. Do not broadly exclude every streaming domain just because one application behaved strangely. First check the connection log, the DNS mode, and whether the application is bypassing Clash entirely.

Use a controlled DNS design rather than mixing many resolvers without a reason. A practical approach is to keep local-network names on a local resolver, send ordinary public lookups through your chosen Clash DNS policy, and ensure that the resolver used for streaming is not unexpectedly forced through a different tunnel. On systems with IPv6 enabled, also check whether AAAA records create a direct path outside the IPv4 proxy route. A browser that receives an IPv6 address may appear to ignore your carefully configured IPv4 rules.

  • Check whether the streaming hostname is visible in the Clash connection log.
  • Check whether the connection is marked as DIRECT, the expected streaming group, or another unexpected group.
  • Compare behavior with IPv6 temporarily disabled only as a diagnostic test, not as a permanent recommendation.
  • Flush the operating-system DNS cache after changing resolver mode, then fully restart the streaming application.
  • Keep the resolver location and proxy location logically consistent when regional playback is important.

Apply the Rules in Common Clash Clients

On Clash Verge Rev or another Mihomo desktop client, import or select the profile first, then open the profile editor, override section, or YAML management panel. Add the proxy group and rules in the location supported by that client. Save the profile, reload it, and select Rule mode. If you remain in Global mode, the rule list may be perfectly valid but never used for individual destinations.

For Clash for Windows, the terminology is familiar—Profiles, Proxies, and Rule mode—but its core and maintenance status are no longer equivalent to a current Mihomo client. Older CFW installations may not support newer rule-provider syntax, modern protocol types, or current DNS options. If a configuration uses features that CFW cannot parse, do not weaken the profile merely to preserve an obsolete client. Move the profile to a maintained application and test again.

On Clash for Android or a Mihomo Android client, enable the VPN service after importing the profile. Android applications do not all honor the system HTTP proxy, so a browser test alone is insufficient. Per-app routing can also override your global service rules. If Netflix is excluded from the VPN list, no domain rule can force it through Clash. Conversely, if local casting or device discovery breaks, review the bypass and local-network settings before changing the streaming group.

On macOS clients such as ClashX or Clash Verge Rev, system proxy mode usually covers browsers and many desktop applications, while TUN mode captures applications that ignore system proxy settings. TUN can improve consistency but also changes DNS and local-network behavior. Enable it only after the basic rule policy works, and grant the requested network extension permissions from the operating system rather than using random third-party helper files.

Tip: Use a short test sequence after every reload: open a local website, open Netflix, start a title for several minutes, stop it, then repeat with Disney+. This confirms that direct traffic still works and that both services remain attached to the intended group during playback rather than only during page loading.

Test Playback, Region, and Performance

Do not judge the configuration solely by whether the homepage appears. A streaming session may make several requests after the initial page is rendered. Test sign-in, search, title artwork, playback start, seeking, subtitles, audio changes, and a second title. If video begins but seeking stalls, the media delivery domain may be missing from your rules. If the catalog is wrong but video plays, the account, resolver, and proxy region may disagree.

Measure stability over time rather than selecting a node only because it has the lowest latency. A fast ICMP response does not represent video throughput, and a node that passes a latency check may be blocked by a service’s IP reputation system. Try two or three nodes in the same intended region, record which one can start and sustain playback, and avoid repeatedly switching during a single session. Frequent changes can invalidate cookies, alter geolocation signals, or send authentication and license traffic through different exits.

Keep local traffic direct with explicit private-network rules. This prevents a remote node from becoming the accidental gateway for printers, NAS devices, router panels, and local development servers. If you use a broad final rule such as MATCH,PROXY, that final rule is useful as a safety net, but it should not replace deliberate local exceptions. Also review application-level split tunneling: an operating-system bypass list, Android per-app exclusion, browser extension, or corporate VPN can override what Clash sees.

When a stream buffers, collect evidence before changing configuration. Look at the active rule, selected group, node, DNS answer mode, connection protocol, and whether the request used TCP or QUIC. Temporarily disabling QUIC can help isolate UDP-related problems, but it is a diagnostic step. If TCP playback succeeds after QUIC is disabled, investigate the node and TUN UDP support rather than assuming every streaming domain must be blocked permanently.

Troubleshoot the Most Common Failures

The homepage loads but playback fails

This usually indicates incomplete domain coverage, inconsistent DNS, or a proxy exit that the service accepts for web content but not for media authorization. Check the log while starting a title and compare the rules for the authentication, license, and media hosts. Add only confirmed domains, reload the profile, and test a fresh session. Clearing application cookies can help, but do not repeatedly reset the account before confirming that the route is stable.

The catalog or region is incorrect

Catalog selection is influenced by more than the browser’s visible IP. Confirm that DNS is not leaking through the local network, that IPv6 is not bypassing the tunnel, and that all service requests use one proxy group. A subscription account created in one country may also have separate licensing limitations. Changing nodes repeatedly is less useful than testing one coherent route with a resolver and exit location that agree.

Local websites became slow after enabling the rules

Inspect whether a broad proxy rule appears above your local exceptions. Add or restore DOMAIN-SUFFIX,local,DIRECT and private CIDR rules, then check whether the browser is using the system proxy while Clash is in Global mode. If only one application is slow, review its own proxy settings, DNS-over-HTTPS feature, and VPN permissions. The purpose of split tunneling is to keep ordinary local traffic off the remote path, so this symptom usually indicates an ordering or application-capture issue.

The rules never appear in the connection log

Verify that the edited profile is active, Rule mode is selected, and the application is actually captured by Clash. A browser extension may connect to its own proxy, while an Android app excluded from the VPN service will never reach the Clash rule engine. On desktop systems, restart the application after changing system proxy or TUN permissions. Finally, confirm that the YAML indentation is valid and that the group target has the exact same spelling as the group definition.

Frequently Asked Questions

Should Netflix and Disney+ use the same proxy group?

They can, and one group is easier to maintain when both services work reliably through the same region. Separate groups are preferable when one service rejects a node, requires a different region, or needs a different fallback strategy. Begin with one group, then separate only after connection-log testing shows a practical benefit.

Can local websites stay direct while streaming uses Clash?

Yes. Put Netflix and Disney+ rules above broad regional or final rules, and add private-network and local-domain exceptions that target DIRECT. Also check application-specific bypass settings, because they can override the global Clash policy in either direction.

Do I need TUN mode for streaming?

Not always. System proxy mode is enough for applications that honor HTTP or SOCKS proxy settings. TUN mode helps capture applications that ignore those settings, but it introduces additional DNS, UDP, permission, and local-network variables. Establish a working rule policy first, then enable TUN when the target application requires it.

Will changing DNS guarantee a different streaming catalog?

No. DNS can improve consistency and prevent accidental resolver leaks, but catalog and playback decisions also depend on the account, exit IP, licensing, and service-side detection. Treat DNS as one part of a coherent routing path rather than a guaranteed regional unlock.

Compared with tools such as V2rayNG or Shadowrocket, which can be excellent for a single proxy profile but may require more manual per-domain maintenance or platform-specific split lists, Clash gives you a clearer rule engine, named proxy groups, reusable providers, and a consistent policy across Windows, macOS, Android, and other Mihomo-supported environments. That makes Netflix and Disney+ routing easier to inspect and adjust without forcing every local connection through a remote server. If you want to test these controls with a maintained client, visit the Clash download page to get the appropriate package, or download Clash and build a streaming profile that matches your everyday network.