Routing ChatGPT, Gemini, and Claude with Clash

Opening the home pages for ChatGPT, Gemini, and Claude proves only that some front-end requests succeeded. Account sign-in redirects to authentication domains, sending a message accesses model endpoints, and file uploads also use object-storage or content domains. If any one request goes direct, is rejected, or changes egress, the user often sees only a spinner.

Describe the failing action first: a blank page, a sign-in loop, a message that will not send, an interrupted streaming answer, or a file stuck uploading all correspond to different requests. Calling all of them “AI will not open” only produces an ever-longer domain list that cannot be verified.

If authentication requests and the first API requests after sign-in use different egress paths, the service may request verification again or invalidate the session. While troubleshooting, create a manual policy group, pin one working node, and keep the account page, primary site, and endpoints on the same egress throughout one sign-in session.

This does not mean all three services must share one node forever. After confirming the problem, you can create separate groups for ChatGPT, Gemini, and Claude, but each service's own authentication and data requests should remain in the same region. An unavailable account, a service not offered in your region, or product-side rate limiting will not disappear because you add more Clash rules.

Clear the connection records and complete just one action—for example, sign in to Claude, send one short message in Gemini, or upload a small file from ChatGPT. Record the hostnames, matched rules, and outbound paths that appear before and after the failure to identify the missing layer.

Start recording from known product entry points: ChatGPT uses chatgpt.com, while the OpenAI API uses api.openai.com. The Gemini web app uses gemini.google.com, and a common Gemini API endpoint is generativelanguage.googleapis.com.

The Claude web app uses claude.ai, while the Anthropic API uses api.anthropic.com. Add sign-in redirects, static assets, and upload addresses from your own connection records.

Place new rules before broad GEOIP entries, rule sets, and MATCH. Google sign-in domains are also shared by services such as Gmail and YouTube, so do not permanently bind a broad domain such as accounts.google.com to an AI group solely for Gemini.

Only after connection records confirm that an authentication request used the wrong egress should you add the host seen in that session to the AI group and verify again.

The following is not a complete configuration you can paste as-is. Find a group name that actually exists in the current subscription's policy-group list, and replace every YOUR_EXISTING_GROUP with it; otherwise, configuration validation will always report group not found. Add the rules only after creating the three AI groups.

Browsers usually use the system proxy on Windows or macOS. A Python SDK, command-line tool, IDE plugin, or container may not. First check whether the failing request appears on the Clash connections page. If there is no record at all, the request has not entered the rule engine.

Command-line tools can temporarily set HTTP_PROXY, HTTPS_PROXY, and NO_PROXY; desktop development environments can also configure a proxy as documented by the app. Consider TUN only when several processes genuinely ignore the system proxy. If the connection already appears in the records, stop changing environment variables and inspect its matched rule, policy group, and node.

When browser secure DNS, system DNS, and Clash DNS operate at the same time, the same service may resolve to different addresses in different programs. During troubleshooting, temporarily disable the browser's independent DoH so both domain queries and connections pass through Clash, then check whether blank pages or resource-loading failures persist.

Only when resolution succeeds but the TLS handshake or connection still times out should you return to node quality and rules. Do not switch among ten cities because of one DNS failure, and do not change Fake-IP, sniffing, and upstream DNS together without first observing the result.

AI conversations maintain long-lived streaming connections. An automatic group that reselects nodes too frequently can make the home page consistently fast while answers stop midway. During testing, use one pinned node to complete a long response, regenerate it, and upload a file; then compare whether the automatic group actually improves the experience.

For an upload failure, also determine whether the request was sent. If progress stays at 0%, first check whether the upload address matched. If it stops partway with a specific HTTP status, inspect the size limit, file type, and service response. Clash can change the network path, but it cannot bypass the product's own restrictions.

When one item fails, return only to that stage. If sign-in is stable but the conversation stops, leave the authentication rules unchanged. If the browser works but the API client has no connection record, address process-level proxying. The article's rules should not expand faster than the problem itself.