Recently, while tinkering with website ads, I encountered a very strange issue:

Sometimes the Google AdSense ad slots on my site would display normally, but clicking on the ads wouldn't open the link. On the other hand, when I enabled OpenClash, ad-related requests would directly throw errors, and in the browser console I could see:

net::ERR_CONNECTION_CLOSED

The browser page would also show:

This site can't be reached
www.googleadservices.com unexpectedly closed the connection
ERR_CONNECTION_CLOSED

Initially, I thought it was an issue with the webpage code, the ad code, or AdSense itself. But after troubleshooting, I found that the problem was mainly with OpenClash's rules, DNS, and ad-blocking chain.

This article documents my troubleshooting process.

1. Problem Description

My website uses Google AdSense / Google Ads.

It behaves differently under different network states:

1. When OpenClash is enabled

   • Ad requests may fail outright;
   • The console shows ERR_CONNECTION_CLOSED;
   • Some ad slots don't display, or display abnormally.

2. After disabling OpenClash

   • Ads sometimes display;
   • But clicking on an ad that redirects to www.googleadservices.com doesn't load;
   • The browser indicates the connection was closed.

A typical error from the screenshot is:

www.googleadservices.com unexpectedly closed the connection
ERR_CONNECTION_CLOSED

At this point, it's clear that the problem is not simply a front-end code error, but that connections to ad-related domains are being terminated at the network level.

2. Google Ad-Related Domains Involved

During the investigation, the common domains involved are:

googleads.g.doubleclick.net
adservice.google.com
googleadservices.com
www.googleadservices.com
ad.doubleclick.net
pagead2.googlesyndication.com
tpc.googlesyndication.com
googlesyndication.com
googletagservices.com
googletagmanager.com

These domains can be roughly categorized as follows:

Ad loading:
pagead2.googlesyndication.com
tpc.googlesyndication.com
googleads.g.doubleclick.net

Ad display / analytics:
googlesyndication.com
googletagservices.com
googletagmanager.com
doubleclick.net

Ad click redirect:
googleadservices.com
www.googleadservices.com
adservice.google.com

The most obvious issue I faced was with:

www.googleadservices.com

Ads would display, but clicking them wouldn't work—it all ended up stuck on this domain.

3. My Initial Misplacement

At first, I added these domains to OpenClash's:

Bypass designated region IPv4 blacklist

section.

Something like this:

googleads.g.doubleclick.net
adservice.google.com
googleadservices.com
ad.doubleclick.net

But later I realized that this is not where you write Clash rules.

This section is not the rules area, nor an ad whitelist, nor a proxy rule area.

It is mainly used in conjunction with OpenClash's "Bypass specified region IP" and similar features, and is not suitable for handling issues like Google Ads domains going through proxy/direct connection.

Therefore, rules like the ones below cannot be written there:

- DOMAIN,www.googleadservices.com,Proxy
- DOMAIN-SUFFIX,doubleclick.net,Proxy

The correct place is in OpenClash's:

Override Settings / Custom Rules / Rules

or a similarly named rules: configuration area.

4. The order of rules in Clash / Mihomo is important

Clash / Mihomo rules are matched from top to bottom.

That is, whichever is written first takes effect first.

For example:

rules:
- DOMAIN-SUFFIX,googleadservices.com,Proxy
- DOMAIN-SUFFIX,googleadservices.com,REJECT

In this case, googleadservices.com will first hit Proxy and will not continue to match REJECT below.

But if the order is reversed:

rules:
- DOMAIN-SUFFIX,googleadservices.com,REJECT
- DOMAIN-SUFFIX,googleadservices.com,Proxy

Then it will be directly rejected, and the subsequent Proxy will not take effect at all.

Therefore, Google ad-related rules must be placed at the very top of rules:, before these rules:

- GEOSITE,category-ads-all,REJECT
- RULE-SET,ads,REJECT
- RULE-SET,reject,REJECT
- MATCH,...

Otherwise, they can easily be intercepted by ad filtering rules.

5. Do not write the rule format incorrectly

I have seen some filters with a format like this:

domain:googleads.g.doubleclick.net,

Note, this is not the Clash / Mihomo rules format.

In Clash, it should be written as:

- DOMAIN,googleads.g.doubleclick.net,Proxy
- DOMAIN-SUFFIX,doubleclick.net,Proxy

The difference between the two common rule types is as follows:

- DOMAIN,www.googleadservices.com,Proxy

Indicates an exact match for this domain.

- DOMAIN-SUFFIX,googleadservices.com,Proxy

Indicates matching the entire suffix, including:

googleadservices.com
www.googleadservices.com

Generally, for ad click redirect domains, you can write both the exact domain and the suffix domain to avoid missing hits in some cases.

6. Do not handle the entire google.com roughly

At first, I thought about directly adding:

- DOMAIN-SUFFIX,google.com,Proxy

or:

- DOMAIN-SUFFIX,google.com,DIRECT

But this approach is too rough.

Because google.com involves too many services, such as search, login, API, fonts, captcha, statistics, ad redirects, etc.

My need is only to resolve issues with Google Ads / AdSense related domains, not to affect the entire Google service.

Therefore, the rules in this article only target ad-related domains, not the entire:

google.com

7. DIRECT or Proxy?

This depends on the actual network environment.

My issue is:

www.googleadservices.com
ERR_CONNECTION_CLOSED

That is, www.googleadservices.com is disconnected when accessed directly.

In this case, it should not go through DIRECT, but through a proxy.

The rules I had before were like this:

rules:
- DOMAIN,pagead2.googlesyndication.com,DIRECT
- DOMAIN,tpc.googlesyndication.com,DIRECT
- DOMAIN,googleads.g.doubleclick.net,DIRECT
- DOMAIN-SUFFIX,doubleclick.net,DIRECT
- DOMAIN-SUFFIX,googleadservices.com,DIRECT
- DOMAIN-SUFFIX,googlesyndication.com,DIRECT
- DOMAIN-SUFFIX,googletagservices.com,DIRECT
- DOMAIN-SUFFIX,googletagmanager.com,DIRECT

These rules allow some ad display paths to connect directly, but if www.googleadservices.com cannot be reached directly, clicks and redirects will still fail.

So a more suitable approach for me is to route ad-related domains through a proxy.

8. Recommended Rule Example

Assume your proxy policy group is named:

Proxy

Then you can add the following at the top of the rules: in the OpenClash custom rules:

rules:
- DOMAIN,www.googleadservices.com,Proxy
- DOMAIN,googleadservices.com,Proxy
- DOMAIN,adservice.google.com,Proxy
- DOMAIN,googleads.g.doubleclick.net,Proxy
- DOMAIN,pagead2.googlesyndication.com,Proxy
- DOMAIN,tpc.googlesyndication.com,Proxy
- DOMAIN-SUFFIX,googleadservices.com,Proxy
- DOMAIN-SUFFIX,doubleclick.net,Proxy
- DOMAIN-SUFFIX,googlesyndication.com,Proxy
- DOMAIN-SUFFIX,googletagservices.com,Proxy
- DOMAIN-SUFFIX,googletagmanager.com,Proxy

Note that Proxy must be a policy group name that actually exists in your configuration.

Some people's policy groups are not named Proxy, but instead called:

节点选择
🚀 节点选择
国外流量
手动选择
GLOBAL

Then you need to change it to your own policy group name.

For example, if your policy group is called:

🚀 节点选择

Then the rules should be written as:

rules:
- DOMAIN,www.googleadservices.com,🚀 节点选择
- DOMAIN,googleadservices.com,🚀 节点选择
- DOMAIN,adservice.google.com,🚀 节点选择
- DOMAIN,googleads.g.doubleclick.net,🚀 节点选择
- DOMAIN,pagead2.googlesyndication.com,🚀 节点选择
- DOMAIN,tpc.googlesyndication.com,🚀 节点选择
- DOMAIN-SUFFIX,googleadservices.com,🚀 节点选择
- DOMAIN-SUFFIX,doubleclick.net,🚀 节点选择
- DOMAIN-SUFFIX,googlesyndication.com,🚀 节点选择
- DOMAIN-SUFFIX,googletagservices.com,🚀 节点选择
- DOMAIN-SUFFIX,googletagmanager.com,🚀 节点选择

Do not copy the name Proxy unless your configuration actually has that policy group.

9. Complete Configuration Location Example

My OpenClash custom rules area is roughly structured like this:

rule-providers:
##  google:
##    type: http
##    path: ./rule1.yaml
##    url: "https://raw.githubusercontent.com/../Google.yaml"
##    interval: 600
##    proxy: DIRECT
##    behavior: classical
##    format: yaml
##    size-limit: 0
##    header:
##      User-Agent:
##      - "mihomo/1.18.3"
##      Authorization:
##      - 'token 1231231'
##    payload:
##      - 'DOMAIN-SUFFIX,google.com'

rules:
- DOMAIN,www.googleadservices.com,Proxy
- DOMAIN,googleadservices.com,Proxy
- DOMAIN,adservice.google.com,Proxy
- DOMAIN,googleads.g.doubleclick.net,Proxy
- DOMAIN,pagead2.googlesyndication.com,Proxy
- DOMAIN,tpc.googlesyndication.com,Proxy
- DOMAIN-SUFFIX,googleadservices.com,Proxy
- DOMAIN-SUFFIX,doubleclick.net,Proxy
- DOMAIN-SUFFIX,googlesyndication.com,Proxy
- DOMAIN-SUFFIX,googletagservices.com,Proxy
- DOMAIN-SUFFIX,googletagmanager.com,Proxy

##- PROCESS-NAME,curl,DIRECT #Match the router's own process (curl direct connection)
##- DOMAIN-SUFFIX,google.com,Proxy #Match domain suffix
##- DOMAIN-KEYWORD,google,Proxy #Match domain keyword

Note:

rules:

Do not add ## to the rules below.

Because lines starting with ## are comments and will not take effect.

10. Save and restart the service

After saving the rules, it is recommended to restart OpenClash and dnsmasq:

/etc/init.d/openclash restart
/etc/init.d/dnsmasq restart

Then force refresh the browser:

Ctrl + F5

You can also test directly in incognito mode to avoid browser cache and extensions affecting judgment.

11. View OpenClash connection logs

After configuration, don't just look at the browser page; the most important thing is to check the OpenClash connection log.

Search the connection log for:

googleadservices
www.googleadservices.com
doubleclick
googlesyndication
pagead2
adservice.google.com

Normally, these domains should hit your proxy policy group, e.g.:

Proxy

Or:

🚀 Node Select

It should not be:

REJECT
REJECT-DROP
Block
Ad Block
Blacklist
DIRECT

If you want it to go through the proxy but the log shows DIRECT, it means the rule is written incorrectly or a previous rule has matched it.

If the log shows REJECT, it is still being blocked by ad rules, usually because your rule is not placed first or another ad blocking module processed it first.

12. Also check DNS and browser extensions

If the OpenClash log shows it is going through the proxy but the browser still cannot open the page, then check the computer and browser side.

Common influences include:

AdGuard
uBlock Origin
AdBlock
Tampermonkey ad-blocking scripts
Browser secure DNS
Windows hosts
Antivirus network protection
System proxy

Especially browser extensions; sometimes even if the router rules have allowed it, the extension will still block the ad request.

It is recommended when testing:

1. Open incognito mode;
2. Temporarily disable ad-blocking plugins;
3. Turn off browser secure DNS;
4. Clear system DNS cache.

On Windows, you can run:

ipconfig /flushdns

Then reopen the webpage to test.

13. If it still doesn't work, check these key areas

If the rules are written but still not working, follow this order to troubleshoot:

1. Is the policy group name correct?

For example, if you wrote:

- DOMAIN,www.googleadservices.com,Proxy

But your configuration doesn't have a Proxy policy group at all, the rule naturally won't work as expected.

You need to look in the configuration file for:

proxy-groups:

Check what the actual name is below.

2. Is the rule really at the top?

Ad-related rules must be placed before all ad-blocking rules.

If there are already rules like:

- GEOSITE,category-ads-all,REJECT
- RULE-SET,ads,REJECT

Then writing proxy rules later will be too late.

3. Are there additional DNS ad filters?

Some people use, besides OpenClash:

AdGuard Home
SmartDNS ad blocking
anti-AD hosts
NextDNS
AdGuard DNS
Browser secure DNS

These all affect ad domain resolution and connections.

If the DNS layer has polluted, blocked, or returned incorrect IPs for the domain, Clash rules may not have a chance to process it normally.

4. Are browser extensions blocking?

Especially:

uBlock Origin
AdGuard
AdBlock
Tampermonkey ad-block scripts

These plugins directly block ad requests, leading you to mistakenly think it's an OpenClash issue.

14. My final understanding

The core of this issue is not "Google ads not working," but:

Google ad display and click redirect paths were incorrectly handled by OpenClash / DNS / ad-blocking rules.

The domains involved in ad display and click redirect are not exactly the same.

Being able to display ads does not necessarily mean the click path is working correctly.

The most critical domain for me is:

www.googleadservices.com

If this domain triggers ERR_CONNECTION_CLOSED when using direct connection, it should go through the proxy instead of being forced to DIRECT.

At the same time, it's not advisable to blindly route the entire:

google.com

through proxy or direct connection.

A safer approach is to only handle Google Ads / AdSense / DoubleClick related domains.

15. Final reminder

This article is just a record of the troubleshooting process when Google AdSense ad requests are incorrectly blocked in an OpenClash environment.

It is not teaching people to click on ads, nor suggesting clicking on your own ads.

Do not click on your own ads randomly, as it may trigger Google AdSense's invalid click risk control, which could affect your account in severe cases.

What we need to solve is the network path issue, not artificially generate clicks.

Summary

If you also encounter:

Google AdSense ads display, but clicks don't open
www.googleadservices.com ERR_CONNECTION_CLOSED
After OpenClash is enabled, ad requests fail

Key points to check:

1. Whether the rules are written in the rules: section;
2. Whether they are mistakenly written into "Bypass specified region IPv4 blacklist";
3. Whether the Clash rule format is correct;
4. Whether ad-related rules are placed at the top;
5. Whether www.googleadservices.com should go through proxy;
6. Whether the policy group name is correct;
7. Whether there are any DNS or browser extensions blocking ad requests.

My final approach here is:

Do not globally handle google.com; only handle Google Ads-related domains separately.
If the ad click redirect domain fails over direct connection, let it go through the proxy.

This way, it won't affect the entire Google service, and can more precisely solve the issues with AdSense ad display and click redirects.