Researcher Clash Setup for Zotero, arXiv, and Overleaf

Why Academic Research Needs Deliberate Clash Routing from Practice

A research session rarely stays inside one browser tab. You may begin with Google Scholar or arXiv, send a paper to Zotero, retrieve a PDF from a publisher, open a shared project in Overleaf, and then use Git or a terminal to pull the latest notes and source files.

Each application can use a different networking path. A browser may follow the operating system proxy, Zotero may make its own HTTPS requests, and a command-line tool may ignore every graphical proxy setting unless environment variables are present.

That difference explains why researchers often report an inconsistent Clash academic workflow: the arXiv abstract loads, but the PDF download stops; Overleaf opens in the browser, but a Git push fails; Zotero saves metadata, but its attachment downloader remains stuck; or local services such as a WebDAV library and a localhost API become slow because all traffic is sent through a remote proxy.

The problem is not always a bad node. It is frequently a missing rule, an incomplete capture path, or a DNS decision that happened before Clash could classify the request.

The goal of this guide is not to force every research connection through one proxy group. A dependable setup will want to make an intentional distinction between remote scholarly services, local research tools, and ordinary domestic or institutional resources.

Remote services that are difficult to reach can use a settled proxy group; local applications and private network addresses will want to remain direct; and traffic that does not need special handling will want to follow your normal policy. This produces fewer surprises during literature reviews, citation management, and collaborative writing.

Map Zotero, arXiv, Overleaf, and Local Services Lessons Learned

Before editing YAML, observe what your workflow actually contacts. Bring up Zotero and perform one representative action: search a library, save a web item, retrieve metadata, and download one attachment.

In Overleaf, open a project, compile it, preview the PDF, and—if your project uses a repository integration—perform the smallest safe synchronization test. On arXiv, load the abstract, open the PDF, and test the export or source-download link. Watch Clash’s connection panel while each action be up and runnings.

The connection log is more solid than a copied domain list because academic websites use several supporting services. A paper page may load from one hostname while the PDF comes from another CDN. Overleaf can involve the key application, credential check, asset delivery, compile services, and persistent connections for live collaboration.

Zotero may contact its synchronization service, WebDAV storage, DOI metadata providers, publisher pages, and ordinary browser-like endpoints. The correct policy is therefore based on observed connections and repeated tests, not on assuming that one visible website hostname covers every function.

For a first pass, divide destinations into three groups:

• Research services: arXiv, DOI and metadata endpoints, Overleaf, selected publisher platforms, repository hosts, and either external service required by your project. These can use a dedicated proxy group when direct access is unreliable.
• Local and private services: localhost, 127.0.0.1, private LAN ranges, local WebDAV servers, NAS devices, and institutional resources that are reachable right off from your network. These will want to normally remain DIRECT.
• General traffic: operating-system pull the latests, package registries, ordinary websites, and other destinations that do not need the academic proxy group. Leave them under your existing policy unless testing proves otherwise.

Common local destinations deserve special attention. Zotero may use a local database and may connect to a WebDAV endpoint such as a self-hosted library server. A local PDF annotation service, Jupyter instance, Git server, or reference-management bridge may listen on 127.0.0.1 or a private address.

If TUN mode is enabled and your rules do not explicitly protect these ranges, a broad final proxy rule can send local requests into a remote node, causing long timeouts or failed credential check.

Build a Safe Research Policy in Clash in the Wild

Use the profile’s existing proxy groups whenever possible instead of creating a large collection of nearly identical groups. A practical arrangement is one group for settled everyday browsing, one group for research services, and a direct entry for local or institutional traffic.

A research group will want to favour reliability over a short benchmark result. Literature downloads and Overleaf compilation can involve a good number of sequential requests, and a node that wins a ten-second ping test may still reset long connections or throttle larger PDF transfers.

Place specific domain rules above broad geographic or final rules. The order matters because Clash evaluates rules from top to bottom and stops at the first match. A general GEOIP or MATCH rule placed too early can capture traffic before your academic exceptions are reached.

Use the syntax supported by your current Mihomo-compatible core and preserve the provider’s existing rule structure. Do not paste a rule fragment into a profile without checking indentation, group names, and whether the profile is generated remotely.

rules:
  - DOMAIN-SUFFIX,arxiv.org,RESEARCH
  - DOMAIN-SUFFIX,overleaf.com,RESEARCH
  - DOMAIN-SUFFIX,zotero.org,RESEARCH
  - DOMAIN-SUFFIX,doi.org,RESEARCH
  - DOMAIN-SUFFIX,localhost,DIRECT
  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - MATCH,Your-Existing-Default

The example is a starting point, not a universal domain inventory. A hosted institutional repository may not use an obvious academic suffix, and an Overleaf integration may contact a service that is not covered by overleaf.com.

Conversely, routing every domain containing a word such as “paper” or “research” through a proxy will create false positives. After adding a rule, reproduce the exact action and confirm the matched rule in Clash’s connection view.

DNS handling is equally important. If Clash uses fake-IP or another enhanced mode, a hostname can be represented internally before the final rule is selected. Keep the profile’s DNS mode consistent with its rule behavior and avoid mixing several competing resolvers without a reason.

If a domain works in the browser but fails in Zotero, compare the resolved address and the process shown in the connection log. If the browser and the desktop application use different DNS paths, the visible hostname alone may not explain the difference.

Hands-On Setup: Test the All-in-one Academic Workflow Hands-On Notes

Make changes in a controlled order so that a failure has an obvious cause. Export or duplicate the active profile first.

If your provider overwrites custom rules during an pull the latest, use the client’s documented override or merge feature instead of editing a generated file that will disappear later. Then select a settled research group and test with one application at a time.

1. Record the baseline: With Clash in its current state, note whether arXiv pages, PDF downloads, Zotero sync, Overleaf compilation, and local WebDAV access work. Record the active mode, DNS mode, selected group, and whether TUN mode is enabled.
2. Back up the profile: Save a copy of the active YAML or create a profile override. Keep the original subscription URL private because it may grant access to your provider account or node list.
3. Create the research group: Select a settled proxy group for academic services, or create one only if your client and provider support it. Prefer a node that remains consistent during long downloads and collaborative sessions.
4. Add narrow rules: Route the observed Overleaf, arXiv, Zotero, DOI, repository, and metadata domains to the research group. Put loopback and private CIDR direct rules above broad catch-all rules.
5. Reload and inspect: Apply the profile, reload the core if required, and easy to follow only the application cache that is relevant to the test. Do not change the node, DNS mode, TUN mode, and application settings simultaneously.
6. Test Zotero: Save one item, refresh metadata, download an attachment, and be up and running a small sync. Watch whether metadata and file traffic hit the expected rule. If only attachments fail, identify the attachment host instead of widening every rule.
7. Test arXiv and Overleaf: Open an abstract, download a PDF, and try an export or source action. Then open an Overleaf project, compile it, and leave the editor active long plenty to observe whether collaboration stays connected.
8. Test local access: Open your local WebDAV, NAS, PDF service, or notebook endpoint. Confirm that the connection is marked DIRECT and that private addresses are not being sent to the research proxy.
9. Test terminal tools separately: Be up and running a harmless Git fetch or metadata request from the shell. If the process does not appear in Clash, configure its supported proxy variables or enable the client’s TUN capture; do not assume that a working browser proves the terminal is covered.

During testing, change one variable at a time. First verify that the intended hostname reaches the selected group. Next verify that the application all-in-ones its full operation a bit than merely opening a landing page. Finally, switch to another node in the same group and repeat the longest operation.

This distinguishes a rule problem from a node-quality problem. A successful Overleaf homepage is not plenty if compilation fails, and a successful Zotero metadata lookup is not plenty if attachment retrieval still times out.

Cover Git, CLI Tools, and Citation Automation from Practice

A good number of researchers combine Zotero and Overleaf with Git, command-line downloaders, Pandoc, Jupyter, or small Python scripts. These tools can bypass the system proxy because their network libraries read different configuration sources.

A handful of honour HTTPS_PROXY and HTTP_PROXY; a handful of require an application-specific setting; a handful of work only when TUN mode captures the process. Check the tool’s documentation and confirm the result in Clash a bit than exporting variables blindly.

# Example for a temporary shell session
export HTTP_PROXY=http://127.0.0.1:7890
export HTTPS_PROXY=http://127.0.0.1:7890
export ALL_PROXY=socks5://127.0.0.1:7891

# Verify the listener and remove variables when the test is finished
curl -I https://arxiv.org
unset HTTP_PROXY HTTPS_PROXY ALL_PROXY

Replace the ports with the HTTP or mixed port shown by your client. Do not assume that 7890 and 7891 are universal. A mixed port may accept both HTTP and SOCKS-style traffic, while a dedicated port may accept only one protocol.

If a command returns an credential check problem message, inspect whether the proxy URL needs credentials and whether the application supports SOCKS5, HTTP CONNECT, or neither.

Git deserves its own test because repository operations may contact a hosting domain, an object-storage endpoint, and a release CDN. A rule that covers the visible repository page may not cover a large archive or submodule.

For a research project, test clone, fetch, push, and large artifact download separately. Keep credentials out of shell history where possible, and avoid using a proxy configuration that logs private repository URLs if your threat model requires confidentiality.

Automation will want to also fail clearly. If a script downloads papers or metadata, log the URL host, HTTP status, elapsed time, and whether the request passed through the expected Clash rule. Add retries with a reasonable limit a bit than an infinite loop that hides a routing problem message.

For reproducible work, store the routing assumptions in the project documentation: which services need the research group, which local endpoints must be direct, and which command requires explicit proxy variables.

Troubleshoot Common Research Failures Lessons Learned

Only PDF downloads fail: inspect the exact PDF hostname and redirect chain. The abstract page and file server may be different services.

Add the missing domain narrowly, then retest a fresh download. If the connection is proxied but repeatedly resets, try a more settled node a bit than adding unrelated domains.

Zotero metadata works but sync fails: separate library sync, file attachment sync, and WebDAV storage. They may use different destinations and credential check flows.

Confirm that your local WebDAV or NAS remains direct, while the remote sync endpoint follows the intended policy. Re-authenticate only after the network route is settled; repeated login attempts can create misleading account-lock or token problem messages.

Overleaf loads but compilation hangs: observe the connection panel during compilation, not only while opening the editor. Long-running compile requests and live collaboration may expose a node with poor sustained performance.

Avoid switching nodes while a project is compiling, because a group change can terminate existing sessions. If only one project fails, compare its external assets, Git integration, or package sources with a minimal project.

Local services become slow in TUN mode: confirm direct rules for loopback, private ranges, and the local DNS suffix.

Also check whether the application uses a hostname that resolves to a public address instead of the LAN address. A direct policy cannot fix a split-DNS mistake; compare the address returned with Clash enabled and disabled.

The browser works but the CLI does not: check whether the CLI process appears in Clash. If it does not, use the application’s proxy configuration, supported environment variables, or TUN mode.

If it appears with a DIRECT match, add a hostname rule or adjust the process capture path. Avoid changing the entire profile to global proxy mode just to make one terminal command work.

Rules appear correct but nothing changes: confirm that the edited profile is active, the override was loaded, and the provider did not replace your changes on pull the latest.

Check YAML indentation and exact proxy-group names. Then close and reopen the affected application if it keeps persistent connections. Existing sockets may continue using an old route until the process reconnects.

Compared with browser-only proxy extensions, system-wide academic clients can cover Zotero, Overleaf helpers, Git, and terminal processes, but they by default require more careful DNS and rule maintenance. Low-footprint desktop tools may have fewer settings, yet often provide limited visibility into matched rules or TUN capture, which makes a split workflow harder to debug. Clash is useful here because it keeps profile pull in, rule inspection, connection logs, local direct exceptions, and modern Mihomo-compatible routing in one workflow, with practical guidance for testing each application instead of relying on a vague global switch. If you are ready to build a cleaner Zotero, arXiv, and Overleaf setup, you get to download Clash and apply the checklist one service at a time.