Clash Setup Guide
Import a Subscription and Test Your Connection

Step 1: Import a Subscription and Activate the Configuration

Open the client and find the Subscription or Configuration page. You need the subscription URL from your provider—not the account login URL or the purchase page in your browser. A subscription usually includes nodes, proxy groups, and rules, but the contents depend on the provider. The client reads and uses the configuration; installing it does not automatically give you working nodes.

On your provider's subscription page, choose a Clash- or mihomo-compatible format and copy the full URL. In the client, click New, Import, or a plus button, choose the option to import from a URL, and paste the address into the subscription field. Give it a recognizable name, such as “Daily setup.” The name only helps you identify it in the list; it won't change your network route. Make sure there are no spaces or line breaks at either end of the URL, then import it.

Wait for the client to download and parse the configuration. When it's ready, a new card or entry should appear in the configuration list. Some clients activate it automatically; others require you to select the card, click a radio button, or choose Use this configuration. Confirm that it's selected, then open the Proxy page and check that the proxy groups are listed. Seeing an import-success message without activating the configuration is an easy step to miss the first time.

Subscription URLs and Local Configuration Files

If you have a .yaml or .yml file, choose Import from file and open it in the file picker; don't paste its contents into the URL field. Activate the configuration after importing it. A regular local file usually won't receive remote subscription updates. Automatic updates for remote configurations depend on the file contents and client, so the two aren't interchangeable.

If the client reports an invalid format, first check whether the response is actually a configuration. Some URLs return a login page, an expiration notice, or a format intended for another client. If the download fails, check that you can reach the subscription server on your current network, then verify that the link hasn't expired. A failed download doesn't necessarily mean the nodes are unavailable—the client may not have received them yet.

For your first setup, leave the subscription's original contents unchanged; don't rush to edit rules or DNS. This makes it easier to tell whether a later issue comes from the subscription or a local change. For an overview of how configuration files, subscriptions, and proxy groups relate, see the Quick Reference. For now, just confirm that the configuration is active and the Proxy page shows its contents before moving on.

Step 2: Choose a Proxy Mode and Node

Open the client's Proxy or Outbound page and find the Rule, Global, and Direct mode options. Rule mode is a good place to start. It matches connections against the rules in your configuration and routes them to the corresponding policies. It doesn't send every request through the same node, and selecting it alone doesn't guarantee the expected routing—the result depends on the rules in your configuration.

After switching modes, expand the main proxy groups provided by your subscription. Names vary: a group might be called Node Selection, Proxy, or something else entirely. If it lists individual nodes, choose one to start with. If it shows Auto Select or another group, expand that to see which outbound route it uses. Clients may indicate the current selection with a checkmark, border, or highlight; confirm that it changes when you select an option.

If the client offers a latency test, run it once to rule out candidates that are clearly timing out. Test results only show response times for a specific test target and method; they don't indicate download speed or guarantee access to every site. Pick one candidate and keep it selected while you test access in the next step. Avoid changing nodes, modes, and networks repeatedly, or you won't know which change made a difference.

Check Proxy Groups in Rule Mode

Your configuration may route common websites, media services, and other traffic through different groups. Changing one group may not affect the site you're testing. For example, if a rule points to a dedicated proxy group, your main proxy group selection may have no bearing on that request. You don't need to edit rules one by one yet; just check the selections in the groups your configuration uses and make sure the relevant group isn't set to DIRECT or an unavailable node.

If you switch to global mode for comparison, check the global policy group too; don't assume it uses the same node as rule mode. Switch back to rule mode when you're done. Changing modes only affects connections that enter the core—it won't route apps that aren't using the client's traffic entry point. You'll enable the right entry point in the next step. For custom rule ordering and protocol compatibility, see the Protocol Guide.

Step 3: Enable the System Proxy or Connect on Mobile

You now have an active configuration and a selected outbound route, but app traffic still needs to enter the client. Check the home or status page to make sure the core is running. If the client has a separate start button, start it before enabling the proxy. If configuration loading fails, a port is in use, or the core has stopped, fix that error first instead of repeatedly toggling the system proxy. Use the exact error message to find relevant steps in Common Issues.

Enable the System Proxy on Desktop

In your Windows, macOS, or Linux client, find and enable System Proxy. Some clients put the toggle on the home screen; others place it in Settings or the tray menu. Once enabled, browsers and apps that follow system proxy settings will try to connect through the client. Test with a new page in a regular browser first—not a game, command-line tool, or app with its own proxy settings.

If your system asks for permission to change network settings or install a helper service, grant it only after confirming that the request comes from the client you just started. Don't leave a manually configured system proxy pointing at the client while it's not running, or apps will try to connect to a port with no listener. During testing, use only one proxy tool to manage system settings to avoid clients overwriting each other's proxy address.

On Android and iOS, tap Connect or the start button in the app. The first time, the system will ask you to authorize a VPN configuration. After granting permission, return to the client, confirm it shows as connected, and check the system's VPN status indicator. This VPN authorization is the system's traffic-routing entry point; it doesn't mean the proxy node is using a traditional VPN protocol. If another app is already using this type of connection, disconnect it before trying again.

Enable TUN Only When Needed

If your browser works but an app ignores system proxy settings, consider TUN. It routes traffic that meets the routing criteria through a virtual network interface and usually requires administrator privileges or a client service. In Settings, first check that the service is installed and running, then enable TUN as directed by your client. Service setup differs by operating system, so you don't need to follow menu instructions for another platform.

TUN isn't required for initial setup and may not capture traffic from every app or in every network scenario. It also depends on routing and DNS working together. If enabling it cuts off your internet or blocks access to local network devices, turn TUN off and return to the system proxy setup you already verified, then check for compatibility issues. When troubleshooting for the first time, avoid changing the virtual adapter, DNS, and outbound mode all at once. Keep a known-good setup you can return to.

At the end of this step, the status page should show that the core is running, the configuration is active, and the proxy entry point is enabled. Don't rely on a colored toggle to confirm success. Next, make a real request to check whether traffic reaches the client and which policy it follows.

Step 4: Test Access and Verify Rule Matches

Open a site that your subscription rules are expected to route through the proxy, then reload it in a new tab to avoid seeing cached content. Return to the client and open Connections or Active Connections to find the domain you just visited. Some connections end quickly, so watch the list while you refresh the page or check the client's recent connection history.

Open the connection and check three things: the matched rule, the proxy group it was assigned to, and the outbound node ultimately selected. Seeing some connections marked DIRECT in rule mode isn't necessarily a problem; check whether that destination was supposed to connect directly. Likewise, a system VPN indicator or a client showing “Running” only confirms that the relevant components are active. It doesn't verify the route taken by an individual request.

Now open an address that's expected to connect directly under your configuration and compare the results. If both behave as expected, the traffic entry point, rules, and outbound routes are working together for these tests. An IP lookup site can provide another data point, but it only shows the route used to reach that site—not that every app uses the same outbound route. For sensitive tasks, check the target app's connection records separately.

Go Back to the Step That Matches the Symptoms

If a page won't load and the client shows no trace of the request, first check that the system proxy is still enabled, that the browser isn't using its own proxy settings, and that you're checking the right client. Command-line tools often don't use the system proxy. Use the proxy options supported by the tool or consider TUN; don't replace the subscription as your first response.

If the connection reaches the client but the log shows a timeout or handshake error, choose another node in the same proxy group and retry the same destination. If rule mode fails but global mode works, compare the outbound routes and policies selected in each mode. This points to a rule or policy selection worth checking, but doesn't prove that any particular rule is wrong.

If the error points to domain resolution, note the domain and current traffic entry point, then check DNS using the Troubleshooting Guide. Don't paste an entire DNS configuration you found online over your existing settings: fields vary between cores and modes, and a replacement may break the subscription's original setup. For more on Fake-IP, DNS policies, and core differences, see the Quick Reference and Protocol Guide. For now, focus on restoring a basic connection.

Save and Update After Testing

Once access works, note the configuration name, mode, main proxy group selection, and whether you're using the system proxy or TUN. Change one setting at a time and retest the same destination. If you need help, include the error text, operating system, and client name in your screenshot, but hide subscription URLs and authentication details. This context is much more useful than a screenshot showing only a red error message.

To update a remote subscription, return to the configuration list from Step 1, click Update or the refresh button, and wait for it to finish. Confirm that the configuration is still selected and check whether the proxy group selections were preserved. Automatic update timing depends on the client and subscription settings; nodes don't stay unchanged forever just because the subscription hasn't refreshed. If you edit a remote configuration directly in the client, remember that a future update may overwrite your changes.

Finish with a normal disconnect test: turn off the system proxy or mobile connection first, then exit the client and confirm your basic network works as expected. If you want the client to start automatically, enable that after the setup is stable, then check that the core and proxy entry point both start after your next login. You now have a complete workflow for importing a subscription, choosing a mode, routing traffic through the client, and verifying the result. Adjust rules later as needed.