Routing ChatGPT, Gemini, and Claude with Clash

When configuring rules for ChatGPT, Gemini, or Claude, sign in, send a message, and upload a file separately, recording each domain and outbound route. A working homepage confirms only some page requests; other requests to the same service may use different policies. If something already fails, use the table below to locate it by action.

If authentication requests and the first API requests after sign-in use different egress paths, the service may request verification again or invalidate the session. While troubleshooting, create a manual policy group, pin one working node, and keep the account page, primary site, and endpoints on the same egress throughout one sign-in session.

This does not mean all three services must share one node forever. After confirming the problem, you can create separate groups for ChatGPT, Gemini, and Claude, but each service's own authentication and data requests should remain in the same region. An unavailable account, a service not offered in your region, or product-side rate limiting will not disappear because you add more Clash rules.

Clear connection records, then perform just one action, such as logging in to Claude, sending a short message in Gemini, or uploading a small file in ChatGPT. Record the hostnames, matched rules, and outbounds around the failure to find requests that were not forwarded as intended.

Start recording from known product entry points: ChatGPT uses chatgpt.com, while the OpenAI API uses api.openai.com. The Gemini web app uses gemini.google.com, and a common Gemini API endpoint is generativelanguage.googleapis.com.

The Claude web app uses claude.ai, while the Anthropic API uses api.anthropic.com. Add sign-in redirects, static assets, and upload addresses from your own connection records.

Place new rules before broad GEOIP entries, rule sets, and MATCH. Google sign-in domains are also shared by services such as Gmail and YouTube, so do not permanently bind a broad domain such as accounts.google.com to an AI group solely for Gemini.

Only after connection records confirm that an authentication request used the wrong egress should you add the host seen in that session to the AI group and verify again.

The example below is not a complete configuration to paste unchanged. Find a group defined in your current subscription and replace every YOUR_EXISTING_GROUP; otherwise, you will get group not found. After creating the three AI groups, open the existing groups they reference, pin working nodes, and then add the rules.

Browsers usually read the Windows or macOS system proxy, but a Python SDK, command-line tool, IDE extension, or container may not. Check whether the failed request appears on the Clash connections page. If no record appears, check that process’s proxy settings and whether it actually sent the request; an empty list alone does not prove that the request bypassed the proxy.

Command-line tools can temporarily set HTTP_PROXY, HTTPS_PROXY, and NO_PROXY; desktop development environments can also configure a proxy as documented by the app. Consider TUN only when several processes genuinely ignore the system proxy. If the connection already appears in the records, stop changing environment variables and inspect its matched rule, policy group, and node.

When browser secure DNS, system DNS, and Clash DNS operate at the same time, the same service may resolve to different addresses in different programs. During troubleshooting, temporarily disable the browser's independent DoH so both domain queries and connections pass through Clash, then check whether blank pages or resource-loading failures persist.

Only when resolution succeeds but the TLS handshake or connection still times out should you return to node quality and rules. Do not switch among ten cities because of one DNS failure, and do not change Fake-IP, sniffing, and upstream DNS together without first observing the result.

AI conversations maintain long-lived streaming connections. An automatic group that reselects nodes too frequently can make the home page consistently fast while answers stop midway. During testing, use one pinned node to complete a long response, regenerate it, and upload a file; then compare whether the automatic group actually improves the experience.

For an upload failure, also determine whether the request was sent. If progress stays at 0%, first check whether the upload address matched. If it stops partway with a specific HTTP status, inspect the size limit, file type, and service response. Clash can change the network path, but it cannot bypass the product's own restrictions.

When login is stable but a conversation stops, keep the authentication rules and inspect model requests. When the browser works but the API client has no connection records, check that process’s proxy settings. Change only settings relevant to the failing action each time.