Windows UWP Apps Can't Reach Clash Proxy: 2 Ways to Fix Loopback Exemption

The Symptom: Store Apps Offline, Desktop Apps Fine

The system proxy is on, browsers and regular desktop programs route through it fine, and the Clash panel even shows a steady stream of active connections — but Store-installed apps like Microsoft Store, Weather, Mail, and Xbox all say "No internet connection" or spin forever. Restarting the client, switching nodes, and re-importing your subscription all do nothing.

This isn't a subscription or node problem. These apps share one thing in common: they're UWP (Universal Windows Platform) apps. They run inside an AppContainer sandbox, and Windows blocks sandboxed apps from reaching the local loopback address 127.0.0.1 by default — which happens to be exactly where Clash's system proxy listens.

Why: UWP's Loopback Isolation

When Clash enables the system proxy, it writes an address like 127.0.0.1:7890 into your system settings (the default mixed port — check your client's actual setting). Desktop Win32 apps connect to that local port with no issue. UWP apps reading the same address get blocked at the network isolation layer before the request even reaches the Clash core, which looks exactly like "proxy is on but there's no internet."

This restriction is a deliberate security feature: sandboxed apps aren't allowed to probe or reach local services, which keeps malicious Store apps from attacking other programs on your machine. The fix is to add the specific app to the Loopback Exemption list, and Windows already ships the command-line tool to do it — CheckNetIsolation.exe — with no third-party software required. Pick whichever of the two methods below fits your case.

Method 1: Exempt a Single App by Package Name

Best when you only need proxy access for a few Store apps — it keeps the exemption scope minimal and barely touches the isolation policy.

1. Right-click the Start menu and choose "Terminal (Admin)" or "Windows PowerShell (Admin)." The exemption command requires admin rights — running it without them will fail.
2. Find the target app's PackageFamilyName. For the Weather app, run:

Get-AppxPackage *bingweather* | Select-Object Name, PackageFamilyName

In the output, the PackageFamilyName column looks like Microsoft.BingWeather_8wekyb3d8bbwe. Just swap the keyword between the asterisks for your target app's English name, e.g. *windowsstore* or *windowscalculator*.

1. Add the package family name you found to the exemption list:

CheckNetIsolation.exe LoopbackExempt -a -n=Microsoft.BingWeather_8wekyb3d8bbwe

The -a flag means add, and after -n= you paste the full package family name from the previous step.

1. Close and reopen the app, and its network access should be restored right away — no system restart needed.

Method 2: Exempt All UWP Apps with One Command

If you have a lot of Store apps installed and don't want to look up each package name, you can exempt every app package at once by SID. Again, run this in an admin terminal:

CheckNetIsolation.exe LoopbackExempt -a -p=S-1-15-2-1

S-1-15-2-1 is the SID for the built-in Windows security group "ALL APPLICATION PACKAGES." Once it's added to the exemption list, every UWP app can reach the loopback address, the system proxy applies to all of them, and newly installed Store apps are covered automatically too.

Checking and Reverting

The exemption list can be inspected or cleared any time with these commands:

• List all current exemptions: CheckNetIsolation.exe LoopbackExempt -s
• Remove a single app's exemption: CheckNetIsolation.exe LoopbackExempt -d -n=PackageFamilyName
• Remove the SID-based exemption: CheckNetIsolation.exe LoopbackExempt -d -p=S-1-15-2-1
• Clear all exemptions: CheckNetIsolation.exe LoopbackExempt -c

To confirm it worked, reopen the UWP app that was offline and watch the Clash client's connections panel at the same time — if you see connection entries from that app's process, traffic is reaching the core. Exemptions are written into system config and survive reboots, but it's worth running -s again after a major Windows update to double-check the list is intact.

Still Not Working After Exemption? Troubleshooting and the TUN Alternative

If the app still can't get online after you've added the exemption, check these in order:

• Make sure the command was run in an admin terminal — insufficient privileges will show an elevation-required message;
• Make sure Clash's mixed port or HTTP port hasn't changed and still matches what's set in the system proxy settings;
• Check whether Windows Firewall or third-party security software is blocking the Clash core's local listener;
• Check the Clash logs to see whether the request is reaching the core at all — if it never shows up, traffic is still being blocked at the isolation layer.

Another approach is to bypass the system proxy entirely: turn on TUN mode. TUN sets up a virtual network adapter at the network layer that takes over all system traffic, so UWP app traffic flows straight into the mihomo core through the virtual adapter instead of the 127.0.0.1 proxy address — which means the loopback restriction never comes into play. Clients built on the mihomo core, like Clash Verge Rev and Clash Plus, support TUN mode, though the first time you enable it you'll need to install the service mode or run as administrator. If you rely on a lot of Store apps day to day, TUN mode is far less hassle than maintaining an exemption list.