Clash Process-Name Routing on Windows:
Split Proxies for Games and Office Apps

1 When “change my node” is the wrong abstraction

Many users first learn Clash through system proxy or a single GLOBAL selection. That model is simple: every compatible application shares one outbound. The next step is usually rule mode with domain lists—send video sites to proxy A and domestic sites direct. That works beautifully until two heavy consumers disagree about what “good routing” means. A multiplayer title may want the nearest gaming POP with aggressive UDP behavior, while your browser and office suite benefit from a different region, a static IP pool, or simply a separate subscription you trust for HTTPS-heavy work.

You cannot express “Chrome uses group Office, Valorant uses group Game” with DOMAIN-SUFFIX alone when both programs hit overlapping CDNs, update endpoints, or cloud APIs. The same hostname might appear in both contexts depending on timing and QUIC usage. What you need is a layer keyed on the originating process, not only the destination name. That is exactly what PROCESS-NAME rules are for in Mihomo-compatible cores: they classify traffic based on the executable that opened the connection, then hand the packet to whichever proxy-group you list on the right-hand side.

This article assumes you already understand proxy-groups and basic rules syntax. If you want automatic latency selection inside a pool, pair this workflow with a url-test group as described in our URL-Test and Fallback tutorial; process-name lines only decide which group applies, not how that group picks members.

2 What PROCESS-NAME actually matches

On Windows, a PROCESS-NAME rule compares the connection’s owning process against the file name of the executable—typically something like chrome.exe or Code.exe, not the full path. Matching is oriented around how the kernel and the Mihomo stack observe the process object when the socket is created. You list one executable per rule line, then the policy target (another policy group name, DIRECT, or a built-in keyword). The mechanism is complementary to Sniffer-based domain recovery for HTTPS; where Sniffer fixes “wrong host in rules,” process-name fixes “right host, wrong app family.” See the Meta Sniffer guide when TLS SNI and FakeIP interactions confuse domain rules.

Because the match key is the executable, renaming binaries or using wrapper launchers changes what you must write in YAML. Games distributed through custom launchers often spawn a small updater first; the long-lived connection may belong to a different .exe than the shortcut name suggests. Later sections cover how to discover the true process name with Task Manager and Resource Monitor so your rules survive patches and reinstalls.

3 TUN is not optional for reliable per-process splits

Traditional system proxy settings steer applications that honor WinHTTP/WinINET proxy configuration. Many games, anti-cheat modules, and modern Electron apps either ignore those settings or tunnel in ways that bypass user-mode hooks. Even when proxy settings work, the stack may not expose consistent process attribution for every socket in a way your rules can consume. TUN mode installs a virtual adapter and routes eligible IP traffic through the Mihomo core, which can associate flows with processes before evaluating rules.

For Windows desktops, plan on enabling TUN in your GUI (for example Clash Verge Rev), accepting the driver or helper installation, and running elevated if your client requires it. Our Clash Verge Rev TUN guide walks through stack options, elevation, and common “traffic still escapes” symptoms. If you skip TUN and rely only on manual proxy configuration, expect PROCESS-NAME lines to apply inconsistently or not at all for the very programs you most wanted to separate.

4 Discovering executable names that survive updates

Open Task Manager, switch to the Details tab, and read the Name column while your target application is running. Sort by CPU or network to surface hot processes during a match or a large download. For browsers, remember that background helpers (chrome.exe with multiple PIDs) still share the same executable name for matching purposes—each connection inherits the process context of the PID that created it, but the rule key remains the binary name you place in YAML.

Resource Monitor (resmon.exe) is useful when several similarly named processes appear: filter by network activity, note which image path corresponds to the game versus the launcher, and prefer the long-running executable that owns the UDP sockets you care about. Write rules against that name. If a publisher ships both GameClient.exe and GameClient_BE.exe for anti-cheat, you may need separate lines or accept that the EasyAntiCheat module carries its own traffic profile.

Store-bought Microsoft Store apps (UWP) often run under ApplicationFrameHost.exe or packaged hosts where the visible name differs from the intuitive label on the taskbar. In those cases process-name routing is less reliable than for classic Win32 programs; consider domain rules or split tunnel exclusions for those packages, and test after each Windows feature update.

5 Define separate policy groups for “game” and “office”

Before touching PROCESS-NAME, declare two (or more) proxy-groups that encode your operational intent. A minimal pattern is a select group for manual control, or url-test if you want the core to track latency inside each role. Names should be short and ASCII to avoid YAML quoting surprises.

proxy-groups:
  - name: "Game"
    type: select
    proxies:
      - hk-game-low-latency
      - sg-game-backup
      - DIRECT

  - name: "Office"
    type: select
    proxies:
      - office-static-ip
      - premium-general
      - DIRECT

Replace the leaf proxies with your subscription’s real node names. If you maintain separate subscriptions for gaming and work, merge them under proxies: first, then reference those names here. Nothing in this layer is Windows-specific—the same group objects also power macOS and Linux profiles—but the PROCESS-NAME lines you add next are where you exploit Windows executable names.

6 Add PROCESS-NAME lines ahead of broad catch-alls

The rules section is evaluated top to bottom; the first match wins. Place executable-specific lines above huge domain rule-sets and above the final MATCH, otherwise your game traffic will hit a generic domain rule and never reach the process clause you wrote at the bottom. A practical skeleton looks like this:

rules:
  - PROCESS-NAME,riotclientservices.exe,Game
  - PROCESS-NAME,valorant.exe,Game
  - PROCESS-NAME,chrome.exe,Office
  - PROCESS-NAME,ms-teams.exe,Office
  - PROCESS-NAME,OUTLOOK.EXE,Office
  - GEOIP,CN,DIRECT
  - MATCH,Office

The examples are illustrative: substitute executables you verified in Task Manager. Case sensitivity is not something to gamble on—mirror the exact spelling you see in the Details tab. Duplicate process names for unrelated software cannot be disambiguated with PROCESS-NAME alone; that is an inherent limitation of name-based routing. Where collisions bite, fall back to domain or IP rules for one of the conflicting apps.

The final MATCH target sets the default for everything not caught earlier. If you want games to be the exception rather than the office stack, swap which group sits in MATCH and move corresponding PROCESS-NAME lines accordingly. Think through “what should happen to random updaters and telemetry” so you do not accidentally steer system services through an expensive exit.

7 Ordering, overlaps, and performance expectations

Order is not just cosmetic. A RULE-SET that expands to thousands of domain keywords may sit above your PROCESS-NAME lines if you import providers without thinking—those domains will “win” first. After editing, reload the profile and trigger test traffic while watching the connection log: you should see the rule type that fired, not only the chosen node. If the log shows a DOMAIN keyword match while you expected PROCESS-NAME, move the process lines higher or narrow the domain set.

Another subtle interaction involves DNS and FakeIP. Misaligned DNS can make flows look unhealthy even when routing logic is correct. If you observe odd hostname fields while debugging, revisit resolver configuration alongside this guide; process-name routing does not remove the need for coherent DNS policy.

Throughput and CPU overhead for per-process rules are usually modest compared with encryption and tunneling costs. The heavier price is operational: every game patch might introduce new helper executables. Budget a few minutes after major updates to re-scan Task Manager and adjust YAML. Automation-friendly users sometimes script subscription merges with mixin overrides so personal PROCESS-NAME tweaks survive remote profile refreshes—worth exploring once basic routing is stable.

8 Launchers, kernel anti-cheat, and mixed Win32 / UWP setups

Launcher ecosystems such as Steam, Epic, Battle.net, and EA Desktop spawn child processes with their own network stacks. Often the actual game executable is what you want under the Game group, while the launcher updates can ride your default policy. Document which EXE corresponds to matchmaking versus patch downloads so you do not starve updates by sending them through a restrictive gaming node that rate-limits HTTP.

Kernel-level anti-cheat may load drivers that create connections from service processes outside your interactive session. Those names will not match “the game you clicked,” and some vendors discourage tunneling entirely. Respect Terms of Service and local law; this article describes transport mechanics, not bypassing contractual or technical protections.

Corporate VPN clients and Zero Trust agents sometimes compete with TUN adapters. If enabling Mihomo TUN breaks the corporate client or vice versa, split tunneling at the vendor client may be the pragmatic fix, with Mihomo handling only personal applications via PROCESS-NAME. There is no universal recipe—validate on your hardware.

9 Verification workflow

• Reload cleanly: After YAML edits, apply the profile and confirm no parse errors in the core log.
• Generate traffic deliberately: Open the browser to a known IP echo service, then launch the game and observe separate connections.
• Read the hit rule: The UI or log should cite PROCESS-NAME when the executable matches; if it cites DOMAIN, revisit ordering.
• Cross-check the outbound: The selected node should match the Game or Office group, not a stale manual selection in another group.
• Iterate on executables: If a new patch adds SomeLauncherHelper.exe, add another line or merge into your maintained list.

10 Wrap-up

PROCESS-NAME routing on Windows closes the gap between “I have a working proxy” and “I can assign different Mihomo exits to different applications.” Pair it with TUN, keep rule mode active, define clear proxy-groups for each role, and place executable rules above broad domain lists so the first match reflects your intent. Maintain a short inventory of .exe names after major game patches, and treat Sniffer plus domain rules as partners—not replacements—when HTTPS or UWP edge cases appear.

Compared with constantly toggling a global node, expressing policy in YAML scales to multiple machines and survives reboots. A desktop client with live logs simply makes the same core behavior easier to observe and tune. When you are ready to install or upgrade, prefer the official site’s download flow so you obtain signed builds for your platform, import the profile, and confirm in the log that PROCESS-NAME fires for both your test game and your browser.

→ Download Clash for free and experience the difference