Gemini 2.5 Pro With Clash: China Access Setup Guide

Why Gemini 2.5 Pro needs coherent Clash routing in China

Gemini 2.5 Pro is not a single webpage request. A normal session may involve Google account authentication, safety and policy services, model selection, streaming inference, static JavaScript assets, telemetry endpoints, and browser-side requests that do not all use the same hostname. From mainland China, one part of the page may load while another request stalls, so the visible symptom can be a blank workspace, a repeated sign-in screen, or a response that stops halfway through generation.

This is why simply opening a browser and switching on a proxy is not always enough. Clash makes a routing decision for each connection. If Google account traffic goes through one path, Gemini application traffic goes DIRECT, and a required static asset is sent to a third group, the session becomes internally inconsistent. Authentication may succeed, but the application cannot obtain a usable session token. The interface may appear normally, but the model request times out. Conversely, the chat page may load through a proxy while DNS resolution for a related Google hostname still follows the local network path.

A better approach is to establish one predictable outbound path before troubleshooting the application itself. Use a maintained Clash client, import a subscription from a provider you trust, choose a stable node rather than the fastest-looking node for one isolated probe, and route the relevant Google and Gemini traffic through the same policy group. This does not guarantee access to every service: account eligibility, regional availability, Google policies, payment status, and service-side risk controls remain separate issues.

Requirements: a maintained Clash client, subscription, and clean baseline

You need three things before changing rules. First, install a current Clash-compatible client such as Clash Verge Rev, a maintained Mihomo-based desktop client, or another application that clearly documents its core version and operating-system support. The menus differ between clients, but the important concepts are shared: Profiles, proxy groups, rule mode, DNS behavior, system proxy, and—when necessary—TUN mode. Avoid unknown repackaged installers that hide the core version or inject unrelated extensions.

Second, obtain an HTTPS proxy subscription URL from a provider you trust. A subscription is normally a remote YAML, JSON, or base64-encoded configuration containing nodes and policy groups. Treat the URL like a password: it may contain an access token, and anyone who obtains it may consume your traffic quota. Do not paste the complete URL into public issue trackers, screenshots, chat rooms, or browser history shared with other users. If the provider offers a reset function, rotate the URL after accidental exposure.

Third, create a clean testing baseline. Close other proxy applications, VPN clients, traffic accelerators, and browser extensions that modify routing. Multiple applications can compete for the same mixed port, install overlapping virtual adapters, or repeatedly rewrite the operating system proxy settings. If you are testing on a company or campus device, confirm the network policy first; a successful Clash connection does not make an unauthorized tunnel acceptable.

Before importing anything, check that your computer clock is synchronized. Incorrect time can invalidate TLS certificates and make Google login cookies appear expired. Also verify ordinary connectivity without Clash by opening a permitted local website and confirming that the browser is not trapped behind a captive portal. A hotel login page, expired Wi-Fi session, or restrictive corporate DNS resolver can imitate a Gemini outage even when your subscription is perfectly healthy.

Choose stability over a single latency score

Gemini sessions often use long-lived HTTPS or streaming connections, so the node with the lowest ten-second delay is not necessarily the best choice. A useful node should complete TLS handshakes consistently, maintain a stable route during several minutes of traffic, and avoid frequent IP changes that trigger account security checks. Start with a manual selector group so you know exactly which exit is active. Once the setup works, you can test a url-test or fallback group, but do not introduce automatic switching while diagnosing sign-in or streaming failures.

Import a subscription and enable the correct Clash mode

Open the Profiles or Subscriptions page in your Clash client and add the provider URL. Use a descriptive name such as gemini-test instead of leaving several profiles with identical labels. After the download completes, confirm that the profile has actual proxy groups and nodes. A green “updated” message only proves that a file was downloaded; it does not prove that the YAML is valid, that the nodes are alive, or that the selected group contains usable members.

Select the imported profile and inspect the proxy group layout. Most subscriptions provide groups such as a regional selector, an automatic test group, or a fallback group. For the first test, choose a specific node manually in the top-level proxy group. Record the selected node and the time of the test. If the result changes later, you will know whether the failure came from a rule change, an expired node, or an automatic group decision.

Next, set the client to Rule mode rather than Global mode. Global mode is useful as a short diagnostic: it can show whether a broad proxy path works at all. It is not a good permanent configuration because it sends unrelated domestic sites, banking pages, private intranet services, and software updates through the same exit. Rule mode lets you keep ordinary traffic on its normal path while assigning Gemini-related requests to a deliberate policy group.

Enable Set system proxy or its equivalent, then open a fresh browser window. Existing tabs may retain cached failures, stale service workers, or cookies created under a different route. If your browser does not follow the operating-system proxy, configure its proxy settings explicitly or test with a separate clean profile. Do not enable TUN immediately unless the browser or application clearly bypasses the system proxy; first prove that the simpler HTTP and SOCKS listener path works.

The local mixed port is commonly used by both HTTP and SOCKS5 clients, but the exact port depends on your profile. Check the client dashboard rather than copying a port from an unrelated tutorial. A port conflict may produce the misleading impression that Clash is connected while applications are still using an old listener. If a command-line test is necessary, point it at the actual local port and remove the setting after testing so that later diagnostics do not silently use a stale environment variable.

curl -I -x http://127.0.0.1:7890 https://gemini.google.com/

Replace 7890 with the mixed port shown in your client. A successful HTTP response is only a transport signal. It does not confirm that a Google account is permitted to use Gemini, nor does it validate every API request made by the web application. Treat command-line checks as one layer of evidence rather than a final verdict.

Build a practical rule strategy for Gemini and Google traffic

The central routing principle is consistency. During initial testing, route the application domain and the account-related Google traffic through the same selected group. A rule that covers only gemini.google.com may be too narrow if login, static assets, or account checks are handled by another hostname. At the same time, blindly proxying every Google-owned domain can disrupt local services and create unnecessary privacy or performance costs. Start with the smallest documented set that your client logs show is required, then expand only when a specific request fails.

Rule order matters. A narrow Gemini rule placed below a broad GEOIP,CN,DIRECT rule may never be reached. A generic Google suffix rule placed above an explicit domestic exception may send services in the wrong direction. Review the evaluated rule in the Connections or Logs panel instead of guessing from the YAML file. The useful question is not “is Clash on?” but “which rule matched this hostname, which group selected the node, and did the connection remain alive?”

A simplified profile fragment may look like this:

proxy-groups:
  - name: GEMINI
    type: select
    proxies:
      - Stable-Node
      - Auto
      - DIRECT

rules:
  - DOMAIN-SUFFIX,gemini.google.com,GEMINI
  - DOMAIN-SUFFIX,googleapis.com,GEMINI
  - MATCH,DIRECT

This is an illustration, not a drop-in subscription replacement. Group names must match the names defined by your profile, and providers may use rule providers, generated groups, or different domain requirements. Some clients also require a specific core syntax. Make a backup before editing, and prefer the provider’s documented override or merge mechanism so a later subscription update does not erase your changes.

Use the connection log while loading Gemini in a private test window. Look for repeated requests, failed handshakes, DNS errors, and connections that remain pending. If the same host alternates between DIRECT and GEMINI, your rules are too broad, duplicated, or ordered incorrectly. If all requests use the intended group but streaming still stops, test another stable node before rewriting the entire rule set. A clean change log prevents several unrelated modifications from hiding the original cause.

Understand DNS and TUN boundaries

DNS can make a correct proxy rule appear ineffective. With ordinary system proxy mode, the browser may resolve a hostname locally before handing the connection to Clash. With fake-IP or enhanced DNS modes, Clash may answer locally and resolve names through its configured upstream. These modes have different compatibility trade-offs, especially for local networks, banking domains, and applications that expect real address records. Do not switch DNS architecture and routing rules in the same test unless you are deliberately isolating both variables.

TUN mode is useful when a browser, desktop application, or helper process ignores system proxy settings. It captures traffic at the network layer and can cover more programs than a system proxy. However, it also introduces virtual-adapter permissions, route conflicts, IPv6 behavior, and possible interaction with other VPN software. Enable it only after documenting the working system-proxy configuration. If TUN makes the browser worse, turn it off and return to the known baseline rather than assuming the subscription is broken.

Keep local addresses and private networks out of an overly broad proxy rule. A rule set that sends every connection through a remote node can break printers, NAS devices, local development servers, and corporate resources. The objective is not maximum tunnel coverage; it is a predictable route for the traffic required by the permitted Gemini session.

Troubleshoot sign-in loops, timeouts, and incomplete responses

Start with the symptom and the layer where it appears. If the Gemini page is blank, inspect browser developer tools for failed JavaScript or API requests and compare those hostnames with Clash’s connection log. If sign-in loops, clear only the test profile’s site data, close all Google tabs, select one stable node, and authenticate again. Rapidly changing nodes during login can create a security signal or leave cookies associated with a different session path.

If the page loads but prompts never complete, verify that account-related requests are not bypassing the selected group. A successful Google homepage does not prove that the Gemini application uses the same route. Check system time, browser extensions, content blockers, and enterprise TLS inspection as well. A corporate security product may replace certificates or block streaming connections; in that case, consult the administrator instead of weakening certificate validation.

If short prompts work but long answers stop, suspect connection stability rather than DNS alone. Compare a manual node with an automatic group, watch whether the selected member changes during generation, and inspect idle timeout or reset messages in the log. Test a second prompt of similar length and note whether the break occurs at a predictable duration. A provider-side quota, account restriction, model capacity event, or browser extension can produce the same visible symptom, so preserve timestamps and error text before changing settings.

When nothing appears in the Clash log, the application probably did not use Clash at all. Check the operating-system proxy switch, browser-specific proxy settings, environment variables, and TUN status. Command-line tools may honor HTTPS_PROXY while graphical applications ignore it, or the reverse may occur. Do not stack a browser proxy extension on top of system proxy mode during diagnosis; choose one path and verify it with logs.

When every request appears in the log but all fail, inspect the node itself, subscription expiry, authentication requirements, and provider-side restrictions. Try the provider’s health check if available, then test another node from the same group. Avoid downloading random YAML files from public channels as a “repair”; unknown rules can redirect credentials, expose traffic, or replace your DNS settings. Export a backup of the working profile before attempting any merge.

• Use one manually selected node for the first complete sign-in and prompt test.
• Keep browser tabs and account cookies consistent during that test.
• Confirm the actual matched rule in Clash logs instead of inferring it from the interface.
• Change one variable at a time: node, rule, DNS mode, or TUN—not all four together.
• Record timestamps, hostnames, and error messages before refreshing the subscription.

Important: Never disable TLS certificate verification as a generic fix for Gemini loading problems. A certificate warning can indicate interception, a wrong system clock, or a damaged network path. Bypassing verification hides useful evidence and can expose account credentials.

Compared with browser-only proxy extensions, Clash V.CORE offers a more coherent control plane for this Gemini scenario: explicit rule order, reusable proxy groups, connection logs, subscription management, and optional TUN coverage when an application ignores system settings. Some lightweight extensions handle one browser tab but provide little visibility into account requests or streaming failures; older clients may also lack reliable Mihomo compatibility and modern DNS controls. Once you have confirmed that proxy use is permitted for your network and account, downloading Clash V.CORE gives you a clearer way to reproduce the route, isolate failures, and keep Gemini traffic separate from ordinary local browsing.