Clash Fake IP Breaks TLS Handshake

Installing an AUR package with paru failed with TLS connect error: error:0A000126:SSL routines::unexpected eof while reading — even with TUN and global proxy on. Turned out to be Clash’s Fake IP.

How I Found It

First, confirm the proxy itself is fine:

curl ipinfo.io
# US IP — proxy works

Then check DNS, and the culprit shows up:

nslookup dl.google.com
# Address: 198.18.0.15  ← Fake IP

198.18.0.0/16 is Clash’s Fake-IP range. Inspect the handshake with curl -v:

curl -v https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-canary/google-chrome-canary_146.0.7637.0-1_amd64.deb -o /tmp/test.deb
# * Trying 198.18.0.15:443...
# * TLSv1.3 (OUT), TLS handshake, Client hello (1):
# * TLS connect error: error:0A000126:SSL routines::unexpected eof while reading

After resolving to a Fake IP, Mihomo (Clash Meta) should transparently proxy to the real server, but its handling of TLS handshakes for certain domains under Fake-IP has compatibility issues — likely SNI-related. Google’s CDN sees a malformed handshake and drops the connection.

Fix

The cleanest fix is to exclude dl.google.com from Fake IP. Add a fake-ip-filter to your Clash config (~/.config/clash/config.yaml or ~/.config/mihomo/config.yaml):

dns:
  fake-ip-filter:
    - "dl.google.com"
    - "*.dl.google.com"

Restart Clash and it will resolve with the real IP — handshake succeeds.

If you don’t want to touch the config, downloading the .deb in a browser also works. Browsers use a different TLS stack and don’t hit this bug:

cd ~/Downloads
ar x google-chrome-canary_*.deb
tar xf data.tar.xz
sudo cp -r opt/google/chrome-canary /opt/
sudo cp -r usr/* /usr/