Most "it will not open", "it is slow" and "it routed the wrong way" problems have their answer sitting in the Connections and Logs pages. Learning to read those two beats searching the internet.
The Connections page, column by column
Open Connections in the left menu and you get a live table:
| Column | Meaning | What it is good for |
|---|---|---|
| Host | Destination domain or IP | Finding the site you care about |
| Rule | Which rule matched | The most valuable column |
| Chain | The node or policy chain used | Confirming direct vs proxied |
| Process | Which program opened it | Finding out who is talking |
| Upload / Download | Traffic on this connection | Finding the heavy user |
| Time | How long it has been open | Long-lived connections stay listed |
The most common use: did this site go through a node?
Say you want to know whether github.com is actually being proxied:
Reading the Chain column:
- DIRECT → direct, no node involved
- A node or group name → proxied
- REJECT → blocked by a rule, typically ad filtering
The Rule column tells you why — GEOIP,CN for instance means it went direct because the destination IP resolved into that region.
Second use: finding out what is eating your data
Sort by the Download column and look at the top few. The Process column names the program.
Common surprises: a piece of software updating in the background, a cloud drive syncing, or a browser tab quietly autoplaying video.
Third use: an abnormal number of connections
Ordinary browsing sits in the tens. If you see hundreds or thousands and climbing:
- Something may be reconnecting frantically (check the Process column)
- It could be P2P software
- Or a misconfiguration is causing connections to fail and immediately retry
"Close all connections" at the top right clears the list; watch which entries reappear instantly.
The Logs page: set the level first
The Logs page has a level selector at the top right:
A translation table for common errors
| Log message | What it means | What to do |
|---|---|---|
dial tcp x.x.x.x:443: i/o timeout | Timed out connecting to the node | Node is unreachable; try another |
connection refused | The target actively refused | Wrong node port, or the service is down |
unsupported proxy type: xxx | The core does not know this protocol | Update the Mihomo core |
unmarshal error / yaml: line N | Config syntax error | Check the subscription or your custom config |
no such host / DNS resolve failed | Name resolution failed | A DNS configuration problem, see below |
EOF | The far end cut the connection | Unstable or throttled node |
context deadline exceeded | Internal timeout | Usually a very slow node |
Stalls after Start initial provider | A rule set will not download | Network problem, or a dead rule-set URL |
Three typical problems, solved with these two pages
"This site will not open"
"It is slow"
Start by reading the actual transfer rate for that connection on the Connections page.
- The rate itself is low → a node or line problem; test another node
- The rate is fine but pages load slowly → possibly slow DNS, or the page pulls resources over several different routes
Switch the log to debug and look at DNS query timings. Large numbers of queries taking hundreds of milliseconds means your DNS configuration needs work.
"The proxy is on but this program still goes direct"
Find the program in the Process column.
- No connections from it at all → it does not read the system proxy; you need TUN
- Present, but Chain says DIRECT → a rule sent it direct; read the Rule column to see which one
- Present, Chain shows a node, but the program still complains → the program's own problem, or the node does not support what it needs (UDP, for instance)
An advanced trick: working backwards from a connection to a rule problem
Suppose api.example.com is going direct and you want it proxied. The Connections page shows GEOIP,CN in the Rule column.
That tells you: the domain resolved to an address in that region, so the GEOIP rule sent it direct.
The fix is to insert a more specific rule before the GEOIP one:
prepend-rules:
- DOMAIN-SUFFIX,example.com,PROXYBecause rules match top to bottom, putting it first makes it win.
Exporting logs to ask for help
When you need someone else's eyes, supplying useful information makes an enormous difference:
In short
- The Rule and Chain columns together are the fastest way to diagnose routing
- Switch to debug to see DNS and rule-matching detail, then switch back to info
- Most "it will not open" problems resolve in one glance at the Connections page: either it never routed, it routed wrongly, or the node itself is down
Related: the three proxy modes and port settings explained.
