Clash Meta for Android: Bypass Selected Apps

Excluding an app is different from adding direct rules for websites

You may need a proxy in your browser while wanting another phone app to use its normal network connection. Finding every domain that app uses and writing direct rules for them is not always the simplest approach. Clash Meta for Android’s access control can exclude selected apps before Android’s VPN takes over their traffic. There is no requirement for the button to be called “per-app proxy”: the actual controls are in the network settings.

This guide covers the actively maintained Clash Meta for Android (CMFA) 2.11.34.Meta, from the official v2.11.34 release. Its interface labels, settings pages, and VPN implementation were checked against that version; the steps below use the English labels. The project requires at least Android 5.0, while its README recommends Android 7.0 or later. This is for a phone where CMFA is already installed and connecting successfully. It does not cover choosing a CPU architecture, downloading an APK, or replacing the core. The architecture-specific packages share this settings logic, but that does not mean it was tested on every phone.

The steps apply within the same Android user or profile. Do not extend the conclusions to work profiles, cloned apps, another VPN, or an app’s own proxy settings. This bypass concerns only this CMFA VPN; it does not turn off a proxy on the Wi-Fi router or elsewhere on the upstream network. These are not the menus for the old Clash for Android, FlClash, or the desktop application Clash Verge Rev.

Check that direct access is permitted: Excluded apps no longer rely on CMFA’s VPN connection and normally use the phone’s underlying network. If Android has Block connections without VPN enabled, those apps may lose network access altogether. On a managed device, or one that requires all traffic to use a VPN, do not disable a security policy just to follow this guide. Stop before making the change.

Read the mode before interpreting the checked list

Access Control Mode and Access Control Packages are separate settings. The list records which apps are selected; the mode determines what those selections do.

Interface option	Meaning of the selected apps
`Allow all apps`	The list is not used to filter apps. Previously saved selections are not automatically cleared.
`Allow selected apps`	Selected apps enter CMFA’s VPN; unselected apps do not.
`Deny selected apps`	Selected apps bypass CMFA’s VPN. This is the direction used in this guide.

Here, “deny” means deny entry to this VPN, not deny Internet access. Conversely, entering the VPN does not mean every request uses a remote proxy node: traffic still follows the current configuration and mode, which may send it directly.

Record the current mode and the complete checked list first. If you currently use Allow selected apps, do not switch to Deny selected apps while keeping the same list: that would reverse the selection policy for the apps. The steps below are for a setup that currently allows all apps, or already uses the exclusion mode with an existing list whose purpose you understand.

Stop the connection, edit the list, then start again

Choose a time when a brief network interruption is acceptable, and save work in other apps. This version disables VPN options such as the access control mode while the service is running, so stop the connection before opening the settings. Swiping CMFA out of recent apps or force-stopping its process is not the same operation.

Return to CMFA’s home screen. Tap Running to stop the connection, and wait until the status says Stopped.
Open Settings → Network. Confirm that Route System Traffic, which is used to capture traffic, is already enabled. If your setup only uses the local proxy port, these VPN exclusion steps do not apply.
Open Access Control Mode and choose Deny selected apps. Leave DNS, IPv6, and other network options unchanged.
Open Access Control Packages, find the target app, and check it. Verify both its name and package name. Review the whole existing list: every checked app must be one you intend to exclude. When switching from Allow all apps, old checked entries become effective too.
Use the page’s back control or Android’s Back action to leave the app list normally, then return to the home screen. This version saves selections when you leave the list; there is no additional Save button to find. Do not force-stop CMFA immediately after selecting apps.
Tap Stopped on the home screen to establish the connection again. If Android requests VPN permission, confirm that it is the CMFA request you just initiated before responding to the system prompt. Wait until the service is running before testing.

Why reconnect? Android applies the allowed or excluded app list when establishing the VPN. In this CMFA version, editing the list while running and then leaving it normally also stops and starts the service automatically. Avoid changing it during a download or call. Stopping first in this guide lets you edit the mode and choose when the interruption happens.

Do not use Select All or Invert Selection just to exclude one app; these actions change the list in bulk. If an app is missing, first check whether it is installed in the current profile and whether the list is hiding system apps. Do not guess by selecting a similarly named component. No verified real screenshot matching this exact version and page was available, so an older subscription-import screenshot is not presented as an illustration of these steps.

Test the selected app, not just a browser’s exit address

After the connection is restored, reopen the app you just selected and make a new network request. An exit address shown in another browser describes that browser’s connection; it does not prove that the target app bypasses the VPN. Compare against a destination you already confirmed was using a proxy node before the change. A domestic page that was already reached directly is not enough on its own.

Check the target app: Basic network access should work, and new connections should behave as they do on the phone’s direct connection. Compare exit IPs only if the app can identify its own exit and the direct connection and proxy node have different exits.
Check other apps: Apps you did not exclude should still follow the original configuration. The VPN icon can remain in the status bar; it does not establish that every app uses the proxy.
No network after exclusion: Check whether Android blocks connections outside the VPN and whether the target service was reachable directly on the underlying network. Bypassing a proxy does not make an otherwise unreachable service available.
No apparent change: Check for the wrong mode, a different cloned instance of the app, leaving without saving normally, or not yet establishing a new VPN connection. Do not switch nodes while also clearing app data.

To undo the change, stop CMFA, return to the same list, and uncheck only the entries added during this procedure. Leave the list normally and start the service again. If you also changed the mode from Allow all apps, restore the mode and list from your initial notes instead of clearing somebody else’s settings. Once the app enters the VPN again, its traffic still follows the original rules; not every request is guaranteed to use a proxy node.

No Root access, ADB, reinstall, or YAML editing is needed. Keep your subscription and working nodes, change only the intended app selections and the necessary access control mode, and undo the change if testing does not match your expectations. This guide cross-checks fixed-version source code with Android’s official VPN behavior. It is not a promise of hands-on compatibility testing across all phone brands.

Official sources and version scope

Version numbers, filenames, and interface labels can change. Confirm them in the linked project documentation before making changes.