Researcher Clash Setup for Zotero, arXiv, and Overleaf

Why Academic Research Needs Deliberate Clash Routing Key Takeaways

The goal of this guide is not to force every research connection through one proxy group. A dependable setup are best off make an intentional distinction between remote scholarly services, local research tools, and ordinary domestic or institutional resources.

A research session rarely stays inside one browser tab. You may begin with Google Scholar or arXiv, send a paper to Zotero, retrieve a PDF from a publisher, open a shared project in Overleaf, and then use Git or a terminal to upgrade notes and source files.

Each application can use a different networking path. A browser may follow the operating system proxy, Zotero may make its own HTTPS requests, and a command-line tool may ignore every graphical proxy setting unless environment variables are present.

The key point:That difference explains why researchers often report an inconsistent Clash academic workflow: the arXiv abstract loads, but the PDF download stops; Overleaf opens in the browser, but a Git push fails; Zotero saves metadata, but its attachment downloader remains stuck; or local services such as a WebDAV library and a localhost API become slow because all traffic is sent through a remote proxy.

The problem is not always a bad node. It is frequently a missing rule, an incomplete capture path, or a DNS decision that happened before Clash could classify the request.

Remote services that are difficult to reach can use a trustworthy proxy group; local applications and private network addresses are best off remain direct; and traffic that does not need special handling are best off follow your normal policy. This produces fewer surprises during literature reviews, citation management, and collaborative writing.

Map Zotero, arXiv, Overleaf, and Local Services in Brief

Common local destinations deserve special attention. Zotero may use a local database and may connect to a WebDAV endpoint such as a self-hosted library server. A local PDF annotation service, Jupyter instance, Git server, or reference-management bridge may listen on 127.0.0.1 or a private address.

Let me put it this way:Before editing YAML, observe what your workflow actually contacts. Spin up Zotero and perform one representative action: search a library, save a web item, retrieve metadata, and download one attachment.

In Overleaf, open a project, compile it, preview the PDF, and—if your project uses a repository integration—perform the smallest safe synchronization test. On arXiv, load the abstract, open the PDF, and test the export or source-download link. Watch Clash’s connection panel while each action works.

The connection log is more trustworthy than a copied domain list because academic websites use several supporting services. A paper page may load from one hostname while the PDF comes from another CDN. Overleaf can involve the central application, verification, asset delivery, compile services, and persistent connections for live collaboration.

Concretely:Zotero may contact its synchronization service, WebDAV storage, DOI metadata providers, publisher pages, and ordinary browser-like endpoints. The correct policy is therefore based on observed connections and repeated tests, not on assuming that one visible website hostname covers every function.

• Research services: arXiv, DOI and metadata endpoints, Overleaf, selected publisher platforms, repository hosts, and no matter which external service required by your project. These can use a dedicated proxy group when direct access is unreliable.
• Local and private services: localhost, 127.0.0.1, private LAN ranges, local WebDAV servers, NAS devices, and institutional resources that are reachable straightforward from your network. These are best off normally remain DIRECT.
• General traffic: operating-system upgrades, package registries, ordinary websites, and other destinations that do not need the academic proxy group. Leave them under your existing policy unless testing proves otherwise.

For a first pass, divide destinations into three groups:

If TUN mode is enabled and your rules do not explicitly protect these ranges, a broad final proxy rule can send local requests into a remote node, causing long timeouts or failed verification.

Build a Safe Research Policy in Clash A Closer Look

DNS handling is equally important. If Clash uses fake-IP or another enhanced mode, a hostname can be represented internally before the final rule is selected. Keep the profile’s DNS mode consistent with its rule behavior and avoid mixing several competing resolvers without a reason.

Where this lands:Use the profile’s existing proxy groups whenever possible instead of creating a large collection of nearly identical groups. A practical arrangement is one group for trustworthy everyday browsing, one group for research services, and a direct choice for local or institutional traffic.

A research group are best off favour reliability over a short benchmark result. Literature downloads and Overleaf compilation can involve countless sequential requests, and a node that wins a ten-second response time test may still reset long connections or throttle larger PDF transfers.

Place specific domain rules above broad geographic or final rules. The order matters because Clash evaluates rules from top to bottom and stops at the first match. A general GEOIP or MATCH rule placed too early can capture traffic before your academic exceptions are reached.

rules:
  - DOMAIN-SUFFIX,arxiv.org,RESEARCH
  - DOMAIN-SUFFIX,overleaf.com,RESEARCH
  - DOMAIN-SUFFIX,zotero.org,RESEARCH
  - DOMAIN-SUFFIX,doi.org,RESEARCH
  - DOMAIN-SUFFIX,localhost,DIRECT
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - MATCH,Your-Existing-Default

Do not skip this:Use the syntax supported by your current Mihomo-compatible core and preserve the provider’s existing rule structure. Do not paste a rule fragment into a profile without checking indentation, group names, and whether the profile is generated remotely.

The example is a starting point, not a universal domain inventory. A hosted institutional repository may not use an obvious academic suffix, and an Overleaf integration may contact a service that is not covered by overleaf.com.

Conversely, routing every domain containing a word such as “paper” or “research” through a proxy will create false positives. After adding a rule, reproduce the exact action and confirm the matched rule in Clash’s connection view.

The key point:If a domain works in the browser but fails in Zotero, compare the resolved address and the process shown in the connection log. If the browser and the desktop application use different DNS paths, the visible hostname alone may not explain the difference.

Hands-On Setup: Test the Entire Academic Workflow What Matters

During testing, change one variable at a time. First verify that the intended hostname reaches the selected group. Next verify that the application entires its full operation fairly than merely opening a landing page. Finally, switch to another node in the same group and repeat the longest operation.

Make changes in a controlled order so that a failure has an obvious cause. Export or duplicate the active profile first.

1. Record the baseline: With Clash in its current state, note whether arXiv pages, PDF downloads, Zotero sync, Overleaf compilation, and local WebDAV access work. Record the active mode, DNS mode, selected group, and whether TUN mode is enabled.
2. Back up the profile: Save a copy of the active YAML or create a profile override. Keep the original subscription URL private because it may grant access to your provider account or node list.
3. Create the research group: Select a trustworthy proxy group for academic services, or create one only if your client and provider support it. Prefer a node that remains consistent during long downloads and collaborative sessions.
4. Add narrow rules: Route the observed Overleaf, arXiv, Zotero, DOI, repository, and metadata domains to the research group. Put loopback and private CIDR direct rules above broad catch-all rules.
5. Reload and inspect: Apply the profile, reload the core if required, and unambiguous only the application cache that is relevant to the test. Do not change the node, DNS mode, TUN mode, and application settings simultaneously.
6. Test Zotero: Save one item, refresh metadata, download an attachment, and work a small sync. Watch whether metadata and file traffic hit the expected rule. If only attachments fail, identify the attachment host instead of widening every rule.
7. Test arXiv and Overleaf: Open an abstract, download a PDF, and try an export or source action. Then open an Overleaf project, compile it, and leave the editor active long ample to observe whether collaboration stays connected.
8. Test local access: Open your local WebDAV, NAS, PDF service, or notebook endpoint. Confirm that the connection is marked DIRECT and that private addresses are not being sent to the research proxy.
9. Test terminal tools separately: Work a harmless Git fetch or metadata request from the shell. If the process does not appear in Clash, configure its supported proxy variables or enable the client’s TUN capture; do not assume that a working browser proves the terminal is covered.

If your provider overwrites custom rules during an upgrade, use the client’s documented override or merge feature instead of editing a generated file that will disappear later. Then select a trustworthy research group and test with one application at a time.

Let me put it this way:This distinguishes a rule problem from a node-quality problem. A successful Overleaf homepage is not ample if compilation fails, and a successful Zotero metadata lookup is not ample if attachment retrieval still times out.

Cover Git, CLI Tools, and Citation Automation Key Takeaways

Automation are best off also fail clearly. If a script downloads papers or metadata, log the URL host, HTTP status, elapsed time, and whether the request passed through the expected Clash rule. Add retries with a reasonable limit fairly than an infinite loop that hides a routing fault.

Countless researchers combine Zotero and Overleaf with Git, command-line downloaders, Pandoc, Jupyter, or small Python scripts. These tools can bypass the system proxy because their network libraries read different configuration sources.

# Example for a temporary shell session
export HTTP_PROXY=http://127.0.0.1:7890
export HTTPS_PROXY=http://127.0.0.1:7890
export ALL_PROXY=socks5://127.0.0.1:7891

# Verify the listener and remove variables when the test is finished
curl -I https://arxiv.org
unset HTTP_PROXY HTTPS_PROXY ALL_PROXY

A fair few honour HTTPS_PROXY and HTTP_PROXY; a fair few require an application-specific setting; a fair few work only when TUN mode captures the process. Check the tool’s documentation and confirm the result in Clash fairly than exporting variables blindly.

Concretely:Replace the ports with the HTTP or mixed port shown by your client. Do not assume that 7890 and 7891 are universal. A mixed port may accept both HTTP and SOCKS-style traffic, while a dedicated port may accept only one protocol.

If a command returns an verification fault, inspect whether the proxy URL needs credentials and whether the application supports SOCKS5, HTTP CONNECT, or neither.

Git deserves its own test because repository operations may contact a hosting domain, an object-storage endpoint, and a release CDN. A rule that covers the visible repository page may not cover a large archive or submodule.

Where this lands:For a research project, test clone, fetch, push, and large artifact download separately. Keep credentials out of shell history where possible, and avoid using a proxy configuration that logs private repository URLs if your threat model requires confidentiality.

For reproducible work, store the routing assumptions in the project documentation: which services need the research group, which local endpoints must be direct, and which command requires explicit proxy variables.

Troubleshoot Common Research Failures in Brief

Rules appear correct but nothing changes: confirm that the edited profile is active, the override was loaded, and the provider did not replace your changes on upgrade.

Only PDF downloads fail: inspect the exact PDF hostname and redirect chain. The abstract page and file server may be different services.

Add the missing domain narrowly, then retest a fresh download. If the connection is proxied but repeatedly resets, try a more trustworthy node fairly than adding unrelated domains.

Zotero metadata works but sync fails: separate library sync, file attachment sync, and WebDAV storage. They may use different destinations and verification flows.

Do not skip this:Confirm that your local WebDAV or NAS remains direct, while the remote sync endpoint follows the intended policy. Re-authenticate only after the network route is trustworthy; repeated login attempts can create misleading account-lock or token faults.

Overleaf loads but compilation hangs: observe the connection panel during compilation, not only while opening the editor. Long-running compile requests and live collaboration may expose a node with poor sustained performance.

Avoid switching nodes while a project is compiling, because a group change can terminate existing sessions. If only one project fails, compare its external assets, Git integration, or package sources with a minimal project.

Local services become slow in TUN mode: confirm direct rules for loopback, private ranges, and the local DNS suffix.

Also check whether the application uses a hostname that resolves to a public address instead of the LAN address. A direct policy cannot fix a split-DNS mistake; compare the address returned with Clash enabled and disabled.

The browser works but the CLI does not: check whether the CLI process appears in Clash. If it does not, use the application’s proxy configuration, supported environment variables, or TUN mode.

The key point:If it appears with a DIRECT match, add a hostname rule or adjust the process capture path. Avoid changing the entire profile to global proxy mode just to make one terminal command work.

Check YAML indentation and exact proxy-group names. Then close and reopen the affected application if it keeps persistent connections. Existing sockets may continue using an old route until the process reconnects.

Compared with browser-only proxy extensions, system-wide academic clients can cover Zotero, Overleaf helpers, Git, and terminal processes, but they as a rule require more careful DNS and rule maintenance. Slim desktop tools may have fewer settings, yet often provide limited visibility into matched rules or TUN capture, which makes a split workflow harder to debug. Clash is useful here because it keeps profile load, rule inspection, connection logs, local direct exceptions, and modern Mihomo-compatible routing in one workflow, with practical guidance for testing each application instead of relying on a vague global switch. If you are ready to build a cleaner Zotero, arXiv, and Overleaf setup, it is possible to download Clash and apply the checklist one service at a time.