Why “System Proxy On” Is Not a Proof of Reachability

On Windows 11, the phrase “proxy is enabled” usually means the operating system handed WinINet or WinHTTP a PAC file, a manual server, or a loopback address that points at your Clash mixed port. That is necessary but not sufficient for every experience layer. Microsoft Copilot in the shell, the Edge Discover sidebar, Bing Chat panels, and account-linked widgets often combine classic HTTPS fetches with brokered Edge WebView2 surfaces, background token refresh, and telemetry-sized host graphs that do not show up in the one hostname you tested in a normal tab.

When any hop in that graph resolves on a path your rules mark as DIRECT while the rest of the session expects a stable exit region, you get the worst kind of failure: no crisp TLS error, just an empty panel or a polite “not available in your region” string that feels like a product bug. The fix is to stop toggling random switches and instead align three layers—split rules for Microsoft service domains, the resolver story your profile uses (fake-ip versus real DNS), and the Windows system proxy bypass list that can override what Clash thinks it is doing.

If you are new to the Windows client stack, start with our Clash for Windows tutorial so mixed-port, system proxy, and subscription hygiene are boring before you chase Copilot. For transparent capture versus explicit proxy, keep the TUN mode guide open in parallel—this article references the same trade-offs in a Microsoft-specific voice.

Symptoms That Point to Routing, Not “Copilot Is Down”

Treat the following as Clash-adjacent until you disprove them with logs. The Edge main window loads general sites, yet the right-rail sidebar or Bing chat entry stays blank. Windows 11 Copilot opens but never streams tokens, or it errors about region while your Microsoft account and Windows display language look correct. Signing into Microsoft services in one app works while the shell assistant does not, which often means two different processes hit two different rule branches.

Another common pattern is intermittent success after reboot until the first GEOIP or DOMAIN-KEYWORD rule reload flips order. That is a loud hint that your catch-all MATCH or a broad GEOIP,CN line sits above narrower Microsoft exceptions. The operating system is not “forgetting” the proxy; your YAML is simply sending part of the Microsoft graph through the wrong door on every config refresh.

How Copilot and Edge Sidebars Differ From “One Tab in Edge”

Enterprise documentation changes over time, but the troubleshooting mindset stays stable. Shell-integrated assistants and side panels frequently rely on packaged Web content that runs under Edge WebView2 with its own network stack expectations. They still honor the system proxy on many builds, yet they may batch requests across endpoints under microsoft.com, windows.net, live.com, bing.com, and assorted *.cloudapp.azure.com-style hosts used for orchestration.

That matters because a naive ruleset that sends “browser traffic” through a selective group but leaves “Microsoft update traffic” DIRECT can starve just the orchestration host. Likewise, a subscription that lumps all of Asia into a domestic direct path may be correct for video sites and wrong for a Copilot front that insists on the same exit as your signed-in Microsoft identity expects.

Separately, some security products install local HTTPS scanners that break WebView2 trust stores differently than the main Edge profile. If you recently added SSL inspection, test with it disabled before you blame Clash. The goal here is to avoid spending hours tuning DOMAIN-SUFFIX lines when a middlebox already mutated the certificate chain for embedded views only.

Microsoft and Bing Host Buckets Worth Explicit Rules

No public list ages gracefully forever, but you can anchor a maintainable profile by grouping destinations instead of chasing every CDN alias by hand. Keep a dedicated strategy group—call it MICROSOFT or reuse an existing PROXY group with manual selection—and hang explicit DOMAIN-SUFFIX entries above blunt GEOIP rules. Typical buckets include signing and identity (login.live.com, login.microsoftonline.com, account and passport flows), productivity APIs and config fetch endpoints on microsoft.com and microsoftonline.com, consumer Edge and Start experiences on msn.com and related hosts, and search or Copilot experiences that still touch bing.com and bingapis.com families.

Azure-shaped traffic is the footgun: some assistants call regional service hosts that resemble generic cloud domains. If your rules include ultra-broad DOMAIN-KEYWORD matches for “azure” or “cloudapp,” verify they are not accidentally pinned to DIRECT for “local cloud” shortcuts. When in doubt, temporarily log DNS names from Clash or your GUI, add the exact suffixes you see in real failures, and prefer suffix precision over keyword sprawl.

Place those lines above any GEOIP,CN,DIRECT or “domestic direct” section that might otherwise swallow Microsoft CDNs geolocated near you. This ordering advice mirrors what we document for other vendor stacks—compare with the explicit lists in our Gemini routing article and ChatGPT and Claude guide, where the same “vendor block before GEOIP” pattern prevents silent half-proxied sessions.

Clash Rule Order and the “Half Proxied” Failure Mode

Clash evaluates rules from top to bottom. The moment a request matches a DIRECT rule, it will not consult your AI-friendly group farther down the file. That is desirable for bank portals; it is catastrophic for Copilot if a premature direct rule hits only the config or telemetry host while the UI shell still thinks the tunnel is healthy.

Audit the usual suspects: country lists that direct domestic CDNs, gaming or streaming shortcuts, corporate intranet exceptions, and “optimize Microsoft 365” community snippets that assume Office on a clean path but forget consumer Copilot. If you inherited a ruleset from a mobile-only community, remember that desktop Windows 11 generates additional background traffic that phones never trigger.

When testing, freeze your node choice manually inside the MICROSOFT group. Auto groups are great later, but url-test flapping during a multi-step OAuth-style handshake produces the same UI symptom as a hard block: the WebView gives up while a regular tab on a static page still loads.

TUN Mode Versus System Proxy: Pick One Coherent Story

Many users stack TUN capture and WinINet system proxy because each tutorial added another toggle. That often works until it does not. TUN injects routes and hijacks DNS according to your profile; system proxy tells Win32 apps to speak HTTP CONNECT to a loopback port. If both are active without a clear reason, you can end up with duplicated CONNECT attempts, conflicting DNS answers, or a bypass list that only applies to one layer.

Practical guidance: if you need whole-machine consistency—including stubborn binaries that ignore PAC—bias toward a well-tuned TUN profile and treat system proxy as optional or off. If you prefer explicit proxy only, disable TUN temporarily and verify Copilot still fails; if symptoms disappear, your TUN DNS or routing section—not Copilot itself—was the mismatch. The detailed trade-offs and Windows permission prompts live in the TUN guide; this article only insists you choose a single primary capture story per debugging session.

Loopback listeners must stay reachable. If Clash binds only to a LAN IP for sharing, shell components that expect 127.0.0.1:7890 will miss. Align bind addresses with how your Windows client sets system proxy, or point system proxy at the interface you actually expose, as covered in the LAN sharing checklist.

Proxy Bypass Lists, PAC Files, and “Local Intranet” Surprises

Windows maintains bypass semantics for manual proxy setups: entries in the “do not use proxy for” box, enterprise PAC scripts, and patterns such as <local> or wildcard suffixes. A classic failure is an aggressive bypass for *.microsoft.com intended to speed up corporate SSO that now forces consumer Copilot traffic direct into a filtered ISP path.

When troubleshooting, export or screenshot the effective bypass list from the proxy dialog your Clash GUI edits, then compare it to what netsh winhttp show proxy reports for WinHTTP consumers. Mismatches between WinINet and WinHTTP are rarer on modern builds but still appear when legacy enterprise tooling rewrites one stack and not the other.

If you rely on a PAC file, remember PAC executes before Clash sees some decisions. A condition that returns DIRECT for “anything that looks internal” may classify a Microsoft staging host incorrectly. Simplify temporarily: switch to a manual loopback proxy without PAC, retest Copilot, then reintroduce PAC logic line by line.

DNS, fake-ip, and Why Browsers Lie Better Than WebViews

Profiles that enable fake-ip depend on applications querying Clash’s DNS listener. Mainline Edge might follow that path because the OS resolver chain cooperates; an embedded WebView might not, especially if a security product pinned DoH independently. The observable symptom is a page that works until a nested frame tries to resolve a different alias through public DNS that returns poisoned or filtered answers.

Align nameserver, fallback, and fake-ip-range with the capture mode you chose in the previous section. If you are not ready to debug DNS deeply, a controlled experiment is to run Clash with redir-host semantics for Microsoft suffixes only, or to pause fake-ip temporarily and rely on real addresses while you confirm rule hits—just remember to restore the safer profile afterward.

IPv6 is another silent splitter. If AAAA records steer part of the graph over IPv6 while your tunnel is IPv4-only, WebViews can stall. If you see asymmetric behavior between dual-stack hosts, test with IPv6 disabled briefly on the adapter or add a deliberate IPv6 rule strategy once you confirm the pattern.

Edge and OS Switches That Interact With Proxies

Inside Edge, review whether “Use a proxy server” is set independently of the system dialog. A per-browser override can desynchronize side panels from shell components. Likewise, extensions that promise “split tunneling” for selected sites may reroute only main-frame requests, leaving sidebar iframes on a default path.

On the OS side, time skew breaks token refresh in ways that look like network failure. Confirm the clock, disable aggressive battery savers that pause background network during the first minutes after login, and retest Copilot after a clean boot if you recently resumed from hibernation—those steps are cheap compared to rewriting YAML.

A Practical Troubleshooting Sequence

First, confirm plain Edge can reach a Bing property and a neutral HTTPS site using the same node you assign to MICROSOFT. Second, open your Clash log and filter for blocked or direct hits while launching Copilot; if you see Microsoft hosts on DIRECT while the UI expects a proxy exit, reorder rules. Third, strip PAC and bypass entries temporarily. Fourth, choose either TUN or system proxy as the only active capture mode for a test pass. Fifth, snapshot DNS settings and repeat with a single resolver path.

If everything still fails, rotate the exit node manually—some Microsoft edges block datacenter ranges for consumer assistants even when generic browsing works. That is not a Clash bug; it is an exit reputation issue. Swap to a residential or low-abuse node class if your provider offers it, then revisit split rules once you know the exit is eligible.

Closing the Loop

Windows 11 Copilot and Edge sidebars are convenient canaries: they exercise more of the Microsoft graph than a single bookmark. When they fail while “proxy is on,” treat the incident as feedback that your Clash policy, Windows system proxy bypass semantics, and DNS story disagree. Tighten split rules for Microsoft service domains, keep them above blunt GEOIP direct blocks, run TUN or explicit proxy—not both as accidental competitors—and audit bypass lists with the same rigor you apply to subscription URLs.

Compared with ad hoc toggling, a profile that isolates Microsoft traffic into one stable manual group simply wastes less evening time. You still own the operational trade-offs—privacy, latency, and compliance—but at least the assistant pane stops gaslighting you with blank HTML.

→ Download Clash for free and experience the difference once you want a client stack that stays predictable next to modern Windows assistants.