Clash Setup Guide: From Subscription Import to Connection Verification

Confirm the client and subscription URL before you start

You need two things: an installed Clash graphical client and a working subscription URL. The client reads the configuration and handles traffic, while the service provider generates the subscription URL, which typically contains nodes, proxy groups, and routing rules. They serve different purposes; installing the client alone does not create a usable configuration.

If you have not installed a client yet, open the client downloads page and choose a package for your operating system and processor architecture. Windows users usually choose the x64 package; Apple Silicon Macs use ARM, while older Intel Macs use x64. If you are unsure about an Android device's architecture, look for a universal package. After installation, launch the client once normally so the system can create its configuration directory and required components.

The subscription URL is usually available in your service provider's dashboard under labels such as “Subscription,” “One-click subscription,” “Clash configuration,” or “Copy subscription URL.” Copy the complete link beginning with https://, not a node name shown on the page or a screenshot of a QR code. Subscription URLs often contain access credentials, so treat yours as private configuration data and do not paste it into public chats, forum posts, or screenshots.

Before you begin, temporarily close other proxy clients and keep only the one you are configuring active. Multiple clients changing the system proxy or creating virtual network adapters can cause port conflicts or show a connected status while sending requests to the wrong application. You can leave your browser open; it will be used for verification later. Once ready, put the subscription into the client first—do not enable the system proxy yet.

Import the subscription and make it active

After opening the client, look for a “Subscription,” “Configuration,” or “Profiles” page. Desktop clients usually place it in the left navigation; mobile clients may put it in the top-right corner of the home screen, a bottom configuration tab, or a side menu. You should find a subscription URL field, an add button, and a list for configurations. The list may be empty on first use, which is normal.

Paste the complete subscription URL into the field, then click “Import,” “Add,” or “Download.” Some clients ask for a name first; use a short label you will recognize, such as the service name or its purpose, without changing the URL itself. Keep the client in the foreground while it completes the request and parses the response. On success, a new subscription entry appears with a recent update time or an update action.

Once the entry appears, click “Update subscription” or the refresh button beside it. This confirms that the URL is currently reachable and retrieves nodes and rules recently published by the service. After the update succeeds, select the entry or choose “Enable” or “Set as active configuration.” Clients usually show an active marker, a green status dot, or the current configuration name. The corresponding proxy groups will not appear on the Proxy page until the subscription is active.

Next, open the “Proxy” or “Proxies” page and inspect the contents. You should normally see several proxy groups and node options, whose names come from the subscription configuration. Seeing proxy groups confirms that the import path is complete. If the page is still empty, return to the configuration list and make sure the entry is selected, then check for update errors. Do not repeatedly add the same URL, or you may end up with duplicate configurations that are easy to confuse.

After the subscription imports successfully, you do not need to edit its YAML by hand. Basic use only requires confirming the active configuration, updating the subscription, and choosing a proxy group. Rule sets, DNS, configuration overrides, and combining multiple subscriptions are Advanced topics; read the Advanced usage guide when needed. Keep the current subscription selected and continue by choosing a proxy mode.

Choose Rule mode and a proxy-group node

Common Clash modes include Rule, Global, and Direct. For a first setup, use Rule mode. It processes requests according to the configuration's matching order: domains that need a proxy go to proxy groups, while local-network traffic and explicit direct destinations connect directly. This handles common access needs without sending every request through the same node.

The mode switch is usually at the top of the Proxy page, on the client home screen, or in Settings, and may appear as three segmented buttons. Select “Rule,” then inspect the proxy groups below. Group names come from the configuration and may include node selection, auto selection, failover, and region-based groups. You do not need to adjust each one; find the group handling most proxied traffic, then choose “Auto Select” or a working node manually.

If a proxy group offers latency testing, run it once and choose a node that returns a successful result. Latency only reflects the test target's response at that moment and does not represent the actual speed of every website. Selecting a healthy node is more important than repeatedly chasing the lowest number. If a node fails, switch to another node in the same group; there is no need to re-import the subscription.

Global mode sends most matching traffic through the selected global policy, making it useful for temporarily checking whether a problem is caused by rule matching. It should not be the first step in every investigation because it bypasses fine-grained routing. Direct mode sends requests without a proxy and is useful for pausing proxying or comparing network conditions. Return to Rule mode after testing so everyday traffic follows the configuration.

There is one easy-to-miss status to confirm: the main proxy group must have a clearly selected option. Even when the client shows Rule mode, requests can fail if a key group did not load or all its nodes are unavailable. Open the group and make sure the current node or Auto Select option has an active marker. Once confirmed, keep the client open; the next step brings system traffic into Clash.

Enable the system proxy or TUN to connect

Return to the client home or Settings page and find the “System Proxy” switch. On desktop, start with the system proxy because the path is clear and requires fewer permissions. Once enabled, the client points the operating system's HTTP and HTTPS proxy to a local listening port. Browsers and other apps that follow system proxy settings then send requests to Clash, which chooses the exit according to the active rules and proxy groups.

After enabling the system proxy on Windows, you can see the change in Windows network settings. macOS may ask for your system password or approval for a helper to modify network settings. When an authorization dialog appears, confirm that it comes from the client you installed, then follow the system prompts. Android and iOS usually connect through the system VPN interface; tapping the start button opens a system-level connection request, and the status bar may show a VPN indicator after approval.

If an application ignores the system proxy, or games, command-line programs, and some store apps do not appear in the connection log, consider TUN mode. TUN creates a virtual network interface and usually covers more traffic than the system proxy. Enabling it may require administrator privileges, network-extension approval, or a service component. Follow the client and operating system prompts, and do not start another proxy program that creates a VPN or virtual network adapter at the same time.

You do not need to enable every traffic entry point during basic setup. On desktop, verify a browser with the system proxy first; once the basic path works, decide whether TUN is needed for your applications. On mobile, the start button usually maps to the system VPN interface, so you do not need to look for a desktop-style system proxy switch. For the mechanics, DNS behavior, and limits of the system proxy and TUN, continue with the TUN chapter in Advanced usage.

After enabling the connection, do not immediately change DNS, ports, or rules. Keep the Rule mode and node selection unchanged, open the client's “Connections” or “Logs” page, and leave it visible. Next, make a real request in the browser and use the log to determine whether the traffic reached the client.

Verify the setup with a webpage and connection logs

Open a new browser tab and visit a familiar website that normally works without a proxy. After it loads, return to the client's “Connections” page. You should see the domain, matching rule, and exit policy generated by the browser. Fields vary by client, but usually include at least the destination and policy used. A new entry confirms that browser traffic reached Clash and that the system proxy or mobile VPN interface is working.

Then visit a destination that should be handled by a proxy policy and check for the corresponding connection. If the page opens and the log shows the request using the proxy group or node you selected, basic setup is complete. Return to a direct-connection site and refresh it once to check that it matches a direct rule. This confirms both proxying and routing, which is more reliable than checking whether a client button turned green.

If the page does not open but the connection list shows a request, the traffic entry point is working; the problem is more likely the node, proxy group, rules, or DNS. Switch to another available node in the same group and try again. If it still fails, temporarily switch to Global mode for comparison. If Global works but Rule does not, inspect rule matching; if neither works, check the node status and subscription update result first.

If the page opens but no new connection appears, traffic may not be reaching the active client. On desktop, confirm that the system proxy is still enabled, then close and reopen the browser. On mobile, check that the system VPN was not interrupted by battery-saving settings or another VPN app. You can also pause other proxy tools so the operating system does not send traffic to a different program. For port conflicts, permission dialogs, and service-start failures, use the FAQ to troubleshoot by symptom.

After verification, restore Rule mode and confirm that the main proxy group still has the intended node selected. Do not hide rule problems by leaving Global mode on permanently, and do not re-import the subscription every time you start. In normal use, the existing configuration remains in the client; you only need to launch it, update the subscription, confirm the node, and enable the connection entry point.

The everyday start, update, and stop sequence

When launching the client later, use this order: update the subscription, confirm the proxy group, then enable the connection. You do not need to delete and re-add the subscription each time; click the update button on the existing entry. When the provider changes nodes or rules, updating writes those changes to the local configuration. If the client supports scheduled updates, keep a sensible interval rather than making frequent requests on an unstable network.

When a node is temporarily unavailable, switch to another node in the current proxy group first. Delete and re-import the subscription only when the entire subscription cannot update, the configuration structure has changed, or the provider explicitly asks you to add it again. Note the current configuration name before making changes so you do not delete another local configuration. For multiple subscriptions, local overrides, or DNS changes, work through the Advanced usage guide.

When you finish using the client, first disable the system proxy, TUN, or mobile connection button, then quit the client. This lets the operating system restore its previous network settings. If the browser loses internet access after you force-quit the process, reopen the client and disable the system proxy, or remove the leftover proxy setting in the operating system's network settings. This usually means the entry point still targets a local port that is no longer listening; reinstalling the browser is unnecessary.

The basic workflow ends here. If a single website stops loading, a subscription update fails, TUN will not start, DNS resolution behaves unexpectedly, or a mobile connection drops in the background, do not reinstall everything. Identify whether the issue is in the subscription, policy, traffic entry point, or verification result, then find the matching symptom on the FAQ page. For Fake-IP, rule sets, proxy-group types, and local overrides, use the Advanced configuration guide.