Route qBittorrent Around Clash on Windows: PROCESS-NAME Direct Rules for BT and PT

Why BitTorrent and Clash’s “global proxy” collide

Most newcomers think of Clash as a single toggle that makes “the internet” go through a remote node. In reality, each TCP (and UDP) flow is classified independently. When your profile ends with a broad MATCH,PROXY line, anything that reaches the core—including qBittorrent peer connections—may inherit that default. For web browsing that is convenient; for BT it is expensive. You pay for bytes twice in spirit once: your ISP still moves the data, and your subscription-backed exit also carries the same multi-gigabyte swarm traffic.

Beyond cost, latency matters. Peer selection and choke/unchoke algorithms assume relatively stable RTT. Tunneling everything through an oversubscribed relay adds jitter and reduces upload slots other peers are willing to allocate you. On PT trackers, staff and automation often correlate abnormal peer lists with compromised accounts or compromised clients. Showing up from dozens of countries in a week because your exit rotates is a poor look even when the underlying client is legitimate.

Domain-based rules alone struggle here. Tracker announce URLs might be HTTPS hostnames you could tag with DOMAIN-SUFFIX, but the bulk of data moves between arbitrary IPs after metadata exchange. You do not want to maintain an impossible list of peer IPs. Matching the originating process is the right abstraction: “anything started by qbittorrent.exe leaves my machine on DIRECT,” while Chrome, Edge, or Firefox continues to follow your curated split routing for news, video, and SaaS APIs.

System proxy, TUN, and when qBittorrent even touches Clash

Before editing YAML, be explicit about how traffic reaches the core. If Windows “Use a proxy server” is enabled and points to Clash’s mixed or HTTP port, only applications that honor WinINET settings will send traffic through the local proxy listener. Many native clients do; some do not. qBittorrent ships with its own proxy section under Connection. If that section is empty, the client typically opens sockets directly to peer IPs unless something at the OS level redirects flows.

TUN mode installs a virtual adapter and steers eligible IP packets through the core. That is the configuration where “everything really goes through Clash” becomes closer to true—and where PROCESS-NAME rules become most valuable, because almost every flow is visible for classification. Turning TUN on without understanding rollback order can make it feel like “the whole PC broke”; our TUN troubleshooting guide walks through safe enable/disable paths and DNS alignment.

If you are not using TUN and qBittorrent is not configured to use the local proxy, you might observe that torrents already appear DIRECT in logs while only the browser uses the exit. In that scenario, adding PROCESS-NAME rules does not hurt, but your problem statement is different: you are trying to force other apps through Clash, not to peel torrents off. Match the guide to your actual topology.

PROCESS-NAME in Clash Meta: what it matches

Clash Meta (mihomo) exposes a matcher keyed on the executable image name associated with a connection. In typical desktop usage, that resolves to names like qbittorrent.exe rather than marketing strings such as “qBittorrent v5.x”. The matcher is ideal for long-lived, chatty binaries whose network behavior spans arbitrary endpoints—exactly the BT workload.

It is not a substitute for security policy. A renamed malware binary could masquerade as qbittorrent.exe; we are discussing traffic engineering, not endpoint protection. Within that scope, PROCESS-NAME is one of the most readable switches operators can audit: short, explicit, and easy to diff in Git-backed profiles alongside your subscription URL imports.

Copy-paste YAML patterns for qBittorrent

Place the following style entries in your rules: array (or merge them at the top of a Rule Provider you control). Adjust the target if you route through a named group instead of raw DIRECT:

rules:
  - PROCESS-NAME,qbittorrent.exe,DIRECT
  - PROCESS-NAME,qbittorrent_x64.exe,DIRECT

The second line is defensive: some distributions ship a differently named binary on 64-bit systems. Do not duplicate dozens of speculative names—add lines when logs prove a second process image participates (for example an update helper). If you run multiple isolated instances under distinct executables, mirror each name explicitly.

Users who prefer a dedicated outbound bucket for auditing can route to a transparent copy of DIRECT implemented as a select with only direct members, but for most home labs plain DIRECT is clearer. The important part is ordering, covered next.

Rule order: why your PROCESS-NAME line “does nothing”

Clash evaluates rules top to bottom and stops at the first match. If a subscription Rule Provider expands thousands of IP-CIDR and GEOIP lines above your PROCESS-NAME insertion point, whichever rule matches first wins—even when “obviously” you intended torrent traffic to be special-cased. That is the single most common support-thread failure mode: “I pasted PROCESS-NAME at the bottom.”

Practical placement guidance:

• Keep LAN and link-local DIRECT exceptions first if your baseline requires them.
• Put PROCESS-NAME for heavy desktop binaries immediately after small, well-audited LAN/DNS exceptions and before large remote providers that classify entire countries into PROXY.
• Leave MATCH or final fallbacks at the true bottom.

If you use rule-providers: with behavior: classical, remember the merged order depends on where you include the RULE-SET line relative to inline rules. A common pattern is two-stage composition: short inline exceptions (including PROCESS-NAME) first, then provider blocks, then a conservative MATCH. For a full tour of providers and merge semantics, read the YAML routing and Rule Providers guide before reorganizing a massive profile by hand.

Another subtle conflict: qBittorrent’s embedded search or RSS fetch uses the same process image as peer transfers. If you force PROCESS-NAME,qbittorrent.exe,DIRECT, those HTTP(S) fetches also go direct—which is usually desirable for tracker announces and index pages. If you ever split “metadata via proxy, swarms direct,” you cannot do it with PROCESS-NAME alone; you would need hostname rules or a separate helper process architecture.

qBittorrent connection settings that fight Clash

Open qBittorrent → Tools → Options → Connection. If HTTP or SOCKS proxy fields point at your local Clash port, the client voluntarily tunnels application traffic through the proxy layer even when OS defaults would not. For the “torrents direct, browser proxied” goal, those fields should generally be empty unless you deliberately route metadata only. Mixed setups are possible but fragile; beginners should pick one story.

Also check “Use proxy for peer connections” style toggles (wording varies by version). When enabled, peer wire traffic may attempt to traverse the proxy path—defeating the purpose of swarm-direct peering. Align toggles with the capture mode you chose in the previous section.

Finally, protocol binding matters. If you bind explicitly to a physical interface IP while Clash presents a TUN adapter with its own addressing, you can create asymmetric paths that confuse stateful helpers. After any major network change, restart the client so listening sockets and UPnP/NAT-PMP attempts refresh.

PT-specific etiquette and why DIRECT is the default wisdom

PT sites often publish rules about seedbox IPs, commercial VPN ranges, and hit-and-run ratios. Even when a tracker does not ban VPNs outright, unpredictable exits complicate port-forwarding offers and can trigger automated risk scores. A stable home DIRECT path for the torrent binary keeps your operational story simple: the same ASN your ISP already knows you use, with transparent peering behavior.

This does not mean you must expose every other application. The whole point of combining PROCESS-NAME with a modern Clash profile is differential treatment: browsers and dev tools continue to benefit from split exits, while the high-volume binary bypasses them. Document that choice in your personal runbook so six months later you remember why the rule exists.

Verifying with connection logs and quick live tests

After moving YAML, reload the profile and start a legal test transfer (for example a well-known Linux ISO) that you are permitted to redistribute. Watch the live connections panel: new rows should show the chosen policy as DIRECT (or your equivalent) and list qbittorrent.exe in the process column if your UI exposes it. If you still see a named proxy group, scroll to which rule index matched—your line is still too late.

Cross-check with an unrelated HTTPS request in the browser. It should continue matching your intended non-direct group, proving you did not accidentally promote DIRECT globally. If both browser and torrent suddenly direct, you edited the wrong profile file or failed to reload.

For users sharing Clash from one PC to phones on the LAN, remember phone traffic never hits PROCESS-NAME rules for Windows executables; those flows need their own policy story. See Share Clash on Windows LAN for phones when that is part of the same home network design.

Troubleshooting quick reference

Related Windows capture topics

Some Microsoft Store and UWP apps ignore the system proxy in ways that feel similar to mis-routed torrents, but the fixes involve loopback exemptions rather than process rules. If you are consolidating desktop behavior, skim Fix UWP apps not using Clash on Windows 11 so you do not confuse two separate Windows networking stacks.

For large file workloads that are still HTTP(S)-centric—game launchers and CDNs—domain splits remain the sharper tool. Our Steam and Epic CDN split routing article shows the DOMAIN-first style that complements, not replaces, the process-first approach you used here for qBittorrent.

Keep the engine current

PROCESS-NAME availability and edge-case semantics track the Meta core version bundled with your GUI. Running an outdated build sometimes means chasing ghosts that upstream already fixed. Follow the Meta upgrade guide on a maintenance window, then re-run your torrent smoke test.

Open source and upstream references

Exact matcher tables evolve. When in doubt, cross-check the mihomo repository documentation and release notes. That is separate from downloading installers: use our download page for day-to-day client acquisition, and GitHub for source transparency.

FAQ

Does the install path with spaces change PROCESS-NAME?

No. The matcher keys off the executable image name. Your C:\Program Files\qBittorrent\qbittorrent.exe path matters to Windows ACLs and shortcuts, not to the literal third field of a standard PROCESS-NAME rule.

Can I route only uploads direct but downloads via proxy?

Not with a single PROCESS-NAME line; both directions share the same process context. You would need split processes or highly protocol-specific rules that are brittle for BitTorrent.

What about WebUI traffic?

If you open the WebUI in a browser, that browser process—not qbittorrent.exe—owns the HTTP connections. They follow browser rules. The core torrent engine remains under the client binary.

Closing thoughts

Compared with turning Clash off whenever a seedbox-grade workload appears, a pair of well-placed PROCESS-NAME lines scales: qBittorrent stays on DIRECT, your browser keeps benefiting from curated exits, and your subscription URL stops paying for terabytes of stranger-to-stranger relay that never needed to touch a commercial proxy in the first place. The entire trick is discipline—rule order before MATCH, executable names copied faithfully from Task Manager, and a verification pass in logs after every profile merge.

That maintainability mirrors other 2026 guides on this site: name groups honestly, test with real workloads, and avoid cargo-cult lists you cannot explain. Once the baseline works, revisit quarterly when clients auto-update and rename binaries.

For broader policy design, continue with the YAML routing guide; for the full catalog, browse the tech column.