Why Academic Research Needs Deliberate Clash Routing

A research session rarely stays inside one browser tab. You may begin with Google Scholar or arXiv, send a paper to Zotero, retrieve a PDF from a publisher, open a shared project in Overleaf, and then use Git or a terminal to update notes and source files. Each application can use a different networking path. A browser may follow the operating system proxy, Zotero may make its own HTTPS requests, and a command-line tool may ignore every graphical proxy setting unless environment variables are present.

That difference explains why researchers often report an inconsistent Clash academic workflow: the arXiv abstract loads, but the PDF download stops; Overleaf opens in the browser, but a Git push fails; Zotero saves metadata, but its attachment downloader remains stuck; or local services such as a WebDAV library and a localhost API become slow because all traffic is sent through a remote proxy. The problem is not always a bad node. It is frequently a missing rule, an incomplete capture path, or a DNS decision that happened before Clash could classify the request.

The goal of this guide is not to force every research connection through one proxy group. A dependable setup should make an intentional distinction between remote scholarly services, local research tools, and ordinary domestic or institutional resources. Remote services that are difficult to reach can use a stable proxy group; local applications and private network addresses should remain direct; and traffic that does not need special handling should follow your normal policy. This produces fewer surprises during literature reviews, citation management, and collaborative writing.

Map Zotero, arXiv, Overleaf, and Local Services

Before editing YAML, observe what your workflow actually contacts. Start Zotero and perform one representative action: search a library, save a web item, retrieve metadata, and download one attachment. In Overleaf, open a project, compile it, preview the PDF, and—if your project uses a repository integration—perform the smallest safe synchronization test. On arXiv, load the abstract, open the PDF, and test the export or source-download link. Watch Clash’s connection panel while each action runs.

The connection log is more reliable than a copied domain list because academic websites use several supporting services. A paper page may load from one hostname while the PDF comes from another CDN. Overleaf can involve the main application, authentication, asset delivery, compile services, and persistent connections for live collaboration. Zotero may contact its synchronization service, WebDAV storage, DOI metadata providers, publisher pages, and ordinary browser-like endpoints. The correct policy is therefore based on observed connections and repeated tests, not on assuming that one visible website hostname covers every function.

For a first pass, divide destinations into three groups:

• Research services: arXiv, DOI and metadata endpoints, Overleaf, selected publisher platforms, repository hosts, and any external service required by your project. These can use a dedicated proxy group when direct access is unreliable.
• Local and private services: localhost, 127.0.0.1, private LAN ranges, local WebDAV servers, NAS devices, and institutional resources that are reachable directly from your network. These should normally remain DIRECT.
• General traffic: operating-system updates, package registries, ordinary websites, and other destinations that do not need the academic proxy group. Leave them under your existing policy unless testing proves otherwise.

Common local destinations deserve special attention. Zotero may use a local database and may connect to a WebDAV endpoint such as a self-hosted library server. A local PDF annotation service, Jupyter instance, Git server, or reference-management bridge may listen on 127.0.0.1 or a private address. If TUN mode is enabled and your rules do not explicitly protect these ranges, a broad final proxy rule can send local requests into a remote node, causing long timeouts or failed authentication.

Build a Safe Research Policy in Clash

Use the profile’s existing proxy groups whenever possible instead of creating a large collection of nearly identical groups. A practical arrangement is one group for stable everyday browsing, one group for research services, and a direct option for local or institutional traffic. A research group should favour reliability over a short benchmark result. Literature downloads and Overleaf compilation can involve many sequential requests, and a node that wins a ten-second latency test may still reset long connections or throttle larger PDF transfers.

Place specific domain rules above broad geographic or final rules. The order matters because Clash evaluates rules from top to bottom and stops at the first match. A general GEOIP or MATCH rule placed too early can capture traffic before your academic exceptions are reached. Use the syntax supported by your current Mihomo-compatible core and preserve the provider’s existing rule structure. Do not paste a rule fragment into a profile without checking indentation, group names, and whether the profile is generated remotely.

rules:
  - DOMAIN-SUFFIX,arxiv.org,RESEARCH
  - DOMAIN-SUFFIX,overleaf.com,RESEARCH
  - DOMAIN-SUFFIX,zotero.org,RESEARCH
  - DOMAIN-SUFFIX,doi.org,RESEARCH
  - DOMAIN-SUFFIX,localhost,DIRECT
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - MATCH,Your-Existing-Default

The example is a starting point, not a universal domain inventory. A hosted institutional repository may not use an obvious academic suffix, and an Overleaf integration may contact a service that is not covered by overleaf.com. Conversely, routing every domain containing a word such as “paper” or “research” through a proxy will create false positives. After adding a rule, reproduce the exact action and confirm the matched rule in Clash’s connection view.

DNS handling is equally important. If Clash uses fake-IP or another enhanced mode, a hostname can be represented internally before the final rule is selected. Keep the profile’s DNS mode consistent with its rule behavior and avoid mixing several competing resolvers without a reason. If a domain works in the browser but fails in Zotero, compare the resolved address and the process shown in the connection log. If the browser and the desktop application use different DNS paths, the visible hostname alone may not explain the difference.

Hands-On Setup: Test the Complete Academic Workflow

Make changes in a controlled order so that a failure has an obvious cause. Export or duplicate the active profile first. If your provider overwrites custom rules during an update, use the client’s documented override or merge feature instead of editing a generated file that will disappear later. Then select a stable research group and test with one application at a time.

1. Record the baseline: With Clash in its current state, note whether arXiv pages, PDF downloads, Zotero sync, Overleaf compilation, and local WebDAV access work. Record the active mode, DNS mode, selected group, and whether TUN mode is enabled.
2. Back up the profile: Save a copy of the active YAML or create a profile override. Keep the original subscription URL private because it may grant access to your provider account or node list.
3. Create the research group: Select a stable proxy group for academic services, or create one only if your client and provider support it. Prefer a node that remains consistent during long downloads and collaborative sessions.
4. Add narrow rules: Route the observed Overleaf, arXiv, Zotero, DOI, repository, and metadata domains to the research group. Put loopback and private CIDR direct rules above broad catch-all rules.
5. Reload and inspect: Apply the profile, reload the core if required, and clear only the application cache that is relevant to the test. Do not change the node, DNS mode, TUN mode, and application settings simultaneously.
6. Test Zotero: Save one item, refresh metadata, download an attachment, and run a small sync. Watch whether metadata and file traffic hit the expected rule. If only attachments fail, identify the attachment host instead of widening every rule.
7. Test arXiv and Overleaf: Open an abstract, download a PDF, and try an export or source action. Then open an Overleaf project, compile it, and leave the editor active long enough to observe whether collaboration stays connected.
8. Test local access: Open your local WebDAV, NAS, PDF service, or notebook endpoint. Confirm that the connection is marked DIRECT and that private addresses are not being sent to the research proxy.
9. Test terminal tools separately: Run a harmless Git fetch or metadata request from the shell. If the process does not appear in Clash, configure its supported proxy variables or enable the client’s TUN capture; do not assume that a working browser proves the terminal is covered.

During testing, change one variable at a time. First verify that the intended hostname reaches the selected group. Next verify that the application completes its full operation rather than merely opening a landing page. Finally, switch to another node in the same group and repeat the longest operation. This distinguishes a rule problem from a node-quality problem. A successful Overleaf homepage is not enough if compilation fails, and a successful Zotero metadata lookup is not enough if attachment retrieval still times out.

Cover Git, CLI Tools, and Citation Automation

Many researchers combine Zotero and Overleaf with Git, command-line downloaders, Pandoc, Jupyter, or small Python scripts. These tools can bypass the system proxy because their network libraries read different configuration sources. Some honour HTTPS_PROXY and HTTP_PROXY; some require an application-specific setting; some work only when TUN mode captures the process. Check the tool’s documentation and confirm the result in Clash rather than exporting variables blindly.

# Example for a temporary shell session
export HTTP_PROXY=http://127.0.0.1:7890
export HTTPS_PROXY=http://127.0.0.1:7890
export ALL_PROXY=socks5://127.0.0.1:7891

# Verify the listener and remove variables when the test is finished
curl -I https://arxiv.org
unset HTTP_PROXY HTTPS_PROXY ALL_PROXY

Replace the ports with the HTTP or mixed port shown by your client. Do not assume that 7890 and 7891 are universal. A mixed port may accept both HTTP and SOCKS-style traffic, while a dedicated port may accept only one protocol. If a command returns an authentication error, inspect whether the proxy URL needs credentials and whether the application supports SOCKS5, HTTP CONNECT, or neither.

Git deserves its own test because repository operations may contact a hosting domain, an object-storage endpoint, and a release CDN. A rule that covers the visible repository page may not cover a large archive or submodule. For a research project, test clone, fetch, push, and large artifact download separately. Keep credentials out of shell history where possible, and avoid using a proxy configuration that logs private repository URLs if your threat model requires confidentiality.

Automation should also fail clearly. If a script downloads papers or metadata, log the URL host, HTTP status, elapsed time, and whether the request passed through the expected Clash rule. Add retries with a reasonable limit rather than an infinite loop that hides a routing error. For reproducible work, store the routing assumptions in the project documentation: which services need the research group, which local endpoints must be direct, and which command requires explicit proxy variables.

Troubleshoot Common Research Failures

Only PDF downloads fail: inspect the exact PDF hostname and redirect chain. The abstract page and file server may be different services. Add the missing domain narrowly, then retest a fresh download. If the connection is proxied but repeatedly resets, try a more stable node rather than adding unrelated domains.

Zotero metadata works but sync fails: separate library sync, file attachment sync, and WebDAV storage. They may use different destinations and authentication flows. Confirm that your local WebDAV or NAS remains direct, while the remote sync endpoint follows the intended policy. Re-authenticate only after the network route is stable; repeated login attempts can create misleading account-lock or token errors.

Overleaf loads but compilation hangs: observe the connection panel during compilation, not only while opening the editor. Long-running compile requests and live collaboration may expose a node with poor sustained performance. Avoid switching nodes while a project is compiling, because a group change can terminate existing sessions. If only one project fails, compare its external assets, Git integration, or package sources with a minimal project.

Local services become slow in TUN mode: confirm direct rules for loopback, private ranges, and the local DNS suffix. Also check whether the application uses a hostname that resolves to a public address instead of the LAN address. A direct policy cannot fix a split-DNS mistake; compare the address returned with Clash enabled and disabled.

The browser works but the CLI does not: check whether the CLI process appears in Clash. If it does not, use the application’s proxy configuration, supported environment variables, or TUN mode. If it appears with a DIRECT match, add a hostname rule or adjust the process capture path. Avoid changing the entire profile to global proxy mode just to make one terminal command work.

Rules appear correct but nothing changes: confirm that the edited profile is active, the override was loaded, and the provider did not replace your changes on update. Check YAML indentation and exact proxy-group names. Then close and reopen the affected application if it keeps persistent connections. Existing sockets may continue using an old route until the process reconnects.

Compared with browser-only proxy extensions, system-wide academic clients can cover Zotero, Overleaf helpers, Git, and terminal processes, but they usually require more careful DNS and rule maintenance. Lightweight desktop tools may have fewer settings, yet often provide limited visibility into matched rules or TUN capture, which makes a split workflow harder to debug. Clash Official Site is useful here because it keeps profile import, rule inspection, connection logs, local direct exceptions, and modern Mihomo-compatible routing in one workflow, with practical guidance for testing each application instead of relying on a vague global switch. If you are ready to build a cleaner Zotero, arXiv, and Overleaf setup, you can download Clash Official Site and apply the checklist one service at a time.