1 Why Qwen3 downloads span two overlapping graphs
Open-weight releases travel faster than any one team can document every redirect. On Hugging Face, a typical workflow touches the marketing shell, authenticated Hub JSON, Git and LFS plumbing, short links, and whichever CDN front door serves your region today. On ModelScope, you get a parallel catalog tuned to the domestic ecosystem: model cards, dataset pages, community examples, and download tooling that may resolve object storage on Alibaba Cloud or partner CDNs. Neither story reduces to “just whitelist one domain.”
Clash on the Mihomo core helps because you are not tuning a single TCP session—you are encoding policy for an afternoon of mixed traffic. You want the browser tab that previews a tokenizer to share resolver and egress assumptions with the terminal running huggingface-cli download or ModelScope’s Python helpers, and you want both to stay coherent when a large blob redirects to a hostname your subscription previously classified as generic “foreign media” or “domestic CDN.” Split routing with explicit suffix anchors turns those surprises into logged, testable matches instead of silent stalls on DIRECT.
Nothing here is legal advice about regulated regions, export controls, or employer acceptable-use policies. Treat the following as network-engineering patterns: capture evidence in Mihomo logs, codify rules, version-control YAML, and refresh when vendors ship new subdomains.
2 Relationship to Gemma, DeepSeek, and OpenRouter articles
If you already applied our Gemma 4 + Hugging Face guide, you own the long explanation of Hub APIs, LFS, and CDN coverage for Western distribution paths. Keep that module for anything that still walks pure Hugging Face ergonomics. This Qwen3-focused article adds the missing half for teams that mirror checkpoints on ModelScope, rely on domestic object storage, or split experiments between HF and MS depending on mirror freshness.
DeepSeek centers a single vendor’s chat and API fronts—great when your workload is “one provider, predictable hosts.” OpenRouter focuses on multi-model HTTP APIs and dashboard OAuth. Qwen3 work often mixes static weight pulls with optional cloud inference; the domain graph is closer to “HF + regional hub + optional Alibaba API” than to either DeepSeek or OpenRouter alone. Duplicating entire sections from those articles would waste your time; instead, merge the Hugging Face block from Gemma, add the ModelScope block below, then place optional DashScope rules only if you actually call hosted APIs.
3 Hugging Face: what Qwen3 pulls still need
Official Qwen organization repos on Hugging Face follow the same structural reality as other large checkpoints: catalog HTML may load from huggingface.co while multi-gigabyte objects flow through LFS infrastructure and signed URLs that bounce toward regional CDNs. Short links use hf.co; Spaces and demos may hit hf.space. If your profile only lists the apex domain, you will see the classic failure mode—metadata succeeds, then the transfer hangs because cdn-lfs.huggingface.co or another delivery hostname stayed on DIRECT while the shell used your proxy.
Git clients deserve the same discipline as browsers. A git clone may talk to huggingface.co for refs while LFS batch URLs point elsewhere. Tools such as huggingface-cli wrap redirects and resumable downloads, yet they still obey your OS routing table and proxy environment variables. When those variables disagree with what Mihomo enforces in TUN mode, you can waste hours blaming “bad Wi-Fi” instead of inconsistent policy.
Once per quarter, open connection logs, start a small test artifact, and note every SNI you see for Qwen3 pulls. Fold recurring partner CDNs into either your HF proxy group or a narrowly scoped “HF CDN” group if huge objects need different node characteristics than interactive browsing. For a deeper Hugging Face–only treatment, reuse the Hub/LFS sections in the Gemma article rather than duplicating them here.
4 ModelScope: catalogs, datasets, and storage hosts
ModelScope (often accessed via modelscope.cn) is more than a static file server. Model and dataset pages pull JSON APIs, authentication flows when you use account features, and download URLs that may resolve to Alibaba Cloud OSS-style endpoints or other object-storage hostnames. Community tutorials sometimes reference www.modelscope.cn and mobile-specific hosts; SDKs may call additional API paths as the platform evolves.
Do not assume “domestic hub equals always fast on DIRECT.” Corporate split tunnels, campus DNS, or international research networks can still yield asymmetric paths. Conversely, forcing everything through a distant exit “because AI” can starve transfers that would have been faster locally. The engineering answer is evidence: log which SNIs appear during a full Qwen3 snapshot download from ModelScope, then anchor those suffixes explicitly in rules: instead of guessing from blog posts dated last year.
Large dataset mirrors sometimes fan out to additional CDN or peer hostnames. When you see partial success—some shards at line rate, others crawling—check whether each shard hit a different domain matched by different rules. Tight DOMAIN-SUFFIX coverage plus a stable outbound reduces that variance more than blindly raising concurrency.
If you integrate ModelScope’s Python tooling, remember that libraries may open sockets without consulting your shell HTTP_PROXY exports. Symptoms that look like “ModelScope is down” are often “this process is not using Mihomo.” TUN mode frequently reduces that class of surprises because packets meet the proxy before user-space libraries improvise their own routes.
5 Optional: DashScope and cloud API consoles
Not every Qwen3 workflow stops at local weights. Teams experimenting with hosted inference often touch DashScope-family endpoints on Alibaba Cloud (commonly under dashscope.aliyuncs.com and related *.aliyuncs.com infrastructure). Console pages for API keys and billing may use additional Alibaba portal hosts. If your goal is strictly “download weights and disconnect,” you can omit this block. If your IDE or SDK calls cloud APIs in the same session as Hub pulls, failing to route those hosts can look like flaky authentication while transfers succeed.
Treat DashScope rules as an optional module: enable it when logs prove traffic, keep it out of the baseline when you only need static checkpoints. That separation keeps your profile readable and avoids over-broad “route all of Alibaba” shortcuts unless policy truly requires them.
6 Symptoms when rules under-cover Qwen3 workflows
Misrouted ML traffic rarely prints one obvious error string. You might load a model card, authenticate, and watch LFS objects stall at zero percent because the signed URL domain never matched a proxy rule. Conversely, the CLI can report TLS handshake failures while the website still loads—often FakeIP versus OS resolver disagreement for the same hostname. Intermittent HTTP 403 responses on healthy keys frequently correlate with split-brain DNS rather than quota exhaustion, especially when corporate VPNs send some Alibaba hosts domestic while Hugging Face stays global.
Browser success with CLI failure is another classic pattern: the browser respects system proxy settings while Python or Git ignores them, or the inverse when TUN is on but environment variables still point at a dead mixed port. Document the working combination once; OS upgrades love to reset both.
7 Recommended profile shape
Start from a sane baseline: mode: rule, clearly named proxy groups, and finance or intranet destinations pinned to DIRECT. Add a group such as AI_HUB for Hugging Face and ModelScope research traffic. If latency differs materially between “interactive browsing” and “ten-gigabyte weight pulls,” you may split into AI_BROWSER and AI_BULK—just document the split so teammates do not fork contradictory YAML.
Order matters inside rules:. Place explicit DOMAIN and DOMAIN-SUFFIX rows for Hub, ModelScope, and any confirmed storage/CDN hosts above broad GEOIP shortcuts or subscription catch-alls. After the AI module, fall back to your normal policy stack. Keep MATCH semantics predictable; a default to DIRECT at the bottom silently defeats forgotten suffixes.
8 Example DOMAIN-SUFFIX rules (illustrative)
The excerpt below is educational, not universal truth. Replace AI_HUB with your real group label, reconcile names with your subscription, and extend suffixes after you inspect logs during real Qwen3 sessions. Prefer suffix precision over noisy DOMAIN-KEYWORD rows once you know the hosts.
# Hugging Face stack (see Gemma article for CDN drill-down)
- DOMAIN-SUFFIX,huggingface.co,AI_HUB
- DOMAIN-SUFFIX,hf.co,AI_HUB
- DOMAIN-SUFFIX,hf.space,AI_HUB
- DOMAIN-SUFFIX,cdn-lfs.huggingface.co,AI_HUB
# ModelScope (extend with log-driven DOMAIN rows)
- DOMAIN-SUFFIX,modelscope.cn,AI_HUB
# Optional: DashScope / Alibaba API (enable only if you use hosted inference)
# - DOMAIN-SUFFIX,dashscope.aliyuncs.com,AI_HUB
# - DOMAIN-SUFFIX,aliyuncs.com,AI_HUB # very broad—prefer log-confirmed hostnamesWhen Hub redirects to third-party CDNs, add those suffixes after you confirm them in DevTools or CLI verbose logs. For ModelScope, add specific OSS bucket hostnames if logs show stable recurring names; avoid routing “all of object storage” through research exits unless you accept the blast radius.
DOMAIN-KEYWORD or giant provider lists can steer unrelated traffic through research exits. Prefer tight suffixes tied to evidence from your own Qwen3 pulls.
9 Rule providers: share lists, own your overrides
Hand-maintained YAML scales to one disciplined engineer; labs need automation. Community rule providers help teams import curated fragments that track churn in SaaS domains or regional splits. The failure mode is semantic mismatch: a list built for ad blocking might null-route telemetry that ModelScope or Hugging Face still expects during OAuth-style flows. Read provider README assumptions before merging into a research profile.
A pragmatic workflow is a tiny private provider—or plain include file—with Qwen3-related suffixes you validated, then a larger “global AI” provider beneath it. Set a realistic interval for refresh; daily pulls are not inherently better if they introduce unreviewed diffs during a deadline week. Pair refreshes with human-readable diffs so a surprise deletion of cdn-lfs.huggingface.co does not land unnoticed.
If you have never wired providers before, our ACL4SSR rule provider walkthrough explains URLs, behavior: classical, and merged rule order.
10 CLI downloads, Git LFS, and SDK proxy alignment
Browser previews are only half the story. Serious model weights work flows through huggingface-cli, raw Git LFS, or ModelScope’s Python ecosystem. Those tools honor HTTP_PROXY, HTTPS_PROXY, and ALL_PROXY when implemented correctly, yet many scientific stacks spawn libraries that open sockets without consulting your shell exports. When you see “works in browser, fails in notebook,” suspect bypass before you blame corrupted shards.
For quick experiments, exporting HTTPS_PROXY=http://127.0.0.1:7890 alongside HTTP_PROXY often aligns with Clash’s mixed port, but verify your client’s actual listening ports. SOCKS-heavy environments sometimes prefer ALL_PROXY=socks5://127.0.0.1:7891. Keep NO_PROXY tight so internal PyPI mirrors, corporate registries, and Kubernetes API servers stay local. Test with curl -v https://huggingface.co and the same against your ModelScope entry point from the shell that runs your downloader; if curl succeeds while Python fails, you are debugging library behavior, not node health.
Large transfers benefit from resumable clients and sane retry limits. Clash cannot fix a dead upstream, but consistent routing prevents the “resume hit a different POP with different characteristics” whiplash that shows up as corrupted shards. Snapshot the YAML and environment-variable combo that worked; future you will thank present you after the next OS update.
11 DNS, FakeIP, and TLS friction
Modern browsers parallelize DNS, DoH, and connection warming. Mihomo may map names to FakeIP while a stubborn OS stub resolver still answers differently for the same hostname. The mismatch surfaces as intermittent TLS warnings, partial page loads, or downloads that start then freeze when a redirect hostname never entered Mihomo’s view. Standardize on one resolver story per machine: either Mihomo owns DNS with explicit fallbacks you understand, or you align OS settings to defer cleanly to Mihomo without fighting it.
IPv6 is another silent leak class. If the OS prefers IPv6 first but your policy stack assumes IPv4-only exits, some sessions route outside Mihomo in ways that look like “ModelScope is flaky today.” Either tunnel IPv6 deliberately or test with IPv6 temporarily disabled to isolate the issue, then document the long-term fix.
For deeper patterns—DoH, DoT, FakeIP, and leak checks—reuse our Meta core DNS leak prevention article whenever you touch enhanced-mode or add new upstreams while chasing connectivity.
12 When TUN beats per-app proxy for ML tooling
System proxy mode helps browsers and polite HTTP stacks, but scientific Python environments, containerized runners, and some Git helpers ignore environment variables entirely. TUN pushes routing into the kernel so packets meet Mihomo before user-space libraries decide how to connect. For a workstation that mixes Hugging Face tabs, ModelScope downloads, and background fine-tuning jobs, TUN frequently reduces bespoke configuration. Our Clash Verge Rev TUN mode guide covers loop avoidance, verification, and the mental model for full-traffic capture.
After enabling TUN, re-run a small Hub or ModelScope fetch with system proxy disabled to confirm the CLI still exits through Mihomo. Snapshot the YAML that worked.
13 FAQ
- HF card loads but LFS stalls: Log the redirected CDN hostname and add a precise
DOMAIN-SUFFIXrow above catch-alls; see the Gemma article for Hub-specific depth. - ModelScope web works, Python fails: Compare TUN capture versus proxy env vars; many SDKs bypass system proxy unless forced.
- Do I need a separate VPN? Not if your Clash profile encodes the hostname graph; blunt VPNs often add jitter without fixing LFS redirects.
- Where should teammates get the client? Prefer the site download hub for installers; keep GitHub for source and issues.
14 Wrap-up
Qwen3 workflows in 2026 are a useful reminder that “open weights” means a multi-host graph, not a single URL. Hugging Face and ModelScope each bring their own APIs, mirrors, and storage planes; optional DashScope APIs add another layer when you mix local checkpoints with cloud inference. Clash shines when you stop treating that graph as tribal knowledge and encode it as ordered split routing—anchored with DOMAIN-SUFFIX lines you can defend with logs, augmented by disciplined rule providers, and supported by DNS and optional TUN choices that keep every layer honest about the same exit path.
Compared with all-or-nothing VPN clients, a Mihomo-powered profile preserves sensible latency for everyday browsing while giving research traffic the stable handoff it needs for both quick catalog browsing and long model weights sessions. Invest once in evidence-based YAML, then spend your attention on evaluation metrics instead of staring at stalled progress bars.
When you are ready to standardize clients across a team, start from our download hub so installers stay reproducible; upstream repositories remain the right place for license text and collaboration, not the first hop for a teammate who only wants routing to behave before dinner.
