Clash Setup Guide
Import a Subscription and Verify Your Connection
If you already have a client and a valid subscription, follow these four steps to complete your first setup in about 10 minutes. Start by routing browser requests through the client, then check the rules. There’s no need to change DNS or enable TUN right away.
Before You Begin: Prepare the Client and Subscription URL
First, make sure the client opens normally and your computer or phone has a working internet connection. Installing a Clash-compatible client doesn’t give you proxy nodes; the client reads the configuration, routes traffic, and establishes connections, while your subscription comes from a provider you choose. Have an active subscription ready and confirm your account is in good standing.
Look for “Clash subscription,” “mihomo subscription,” or an import option for your client on your provider’s subscription page. Copy the full subscription URL, not the account page URL from your browser’s address bar. The link often contains account credentials, so treat it like a password. Don’t post it in public comments or group chats, or include it in screenshots.
If another proxy app or VPN is running on your device, disconnect it first to prevent multiple programs from changing your network settings at once. For now, leave your router, browser extensions, and advanced network options untouched. Keeping things simple makes it easier to identify which step is causing a problem.
Step 1: Import a Clash Subscription and Enable the Configuration
Open the client and go to Subscriptions, Configurations, or Profiles. Find the option to create, add, or import from a URL, then paste the full link you copied into the address field. If you can name the entry, choose something easy to recognize, such as “Daily setup.” This is just a local label and won’t change the subscription. Make sure there are no extra spaces or line breaks around the link, then click Import or Save.
The client will fetch the subscription and parse the configuration. Wait for it to finish; a configuration card or subscription entry should appear in the list. You’ll also need to select the entry or choose an option such as Enable or Set as current. Some clients enable it automatically after import, while others only save it to the list. Don’t assume it’s active just because it appears there—check that it’s marked as the current configuration.
Next, open the Proxy or Proxies page. You should see the proxy groups defined in the configuration, along with the available nodes. Group names come from your provider and may be in Chinese or use names like PROXY. If the proxy page is still empty, go back to the configuration page and check that the right entry is enabled. Don’t keep toggling the system proxy yet.
After importing, you can run a manual update to make sure the client can still fetch the subscription. An update usually downloads the configuration again, but may not automatically switch to the latest imported entry. When nodes change, use Update on the same subscription rather than repeatedly adding duplicate entries. If you have multiple subscriptions, give each a distinct name and confirm the active one before switching.
Import Failed? Check the URL and Format Separately
If you see a request failed, timed out, or unreachable message, first check that the URL is complete, the subscription hasn’t expired, and your current network can reach your provider’s subscription service. Being able to open the account page doesn’t mean the subscription endpoint is available. Don’t try to use an error page as a configuration file, and never expose the full subscription URL in log screenshots.
Errors such as YAML parsing failed, invalid configuration, or unsupported field usually point to a response or compatibility issue. Check that you copied a Clash- or mihomo-compatible subscription, not a link for another client. See Incompatible Subscription Format for format issues. If updates keep failing, follow the subscription update troubleshooting guide step by step.
Step complete: The current configuration is selected, and proxy groups are visible on the Proxies page. Once confirmed, choose a connection mode and the node you want to use.
Step 2: Choose a Rule Mode and Proxy Node
Open the client’s home or settings page and find the Mode option. For your first setup, choose Rule. Rule mode uses the conditions in the current configuration to decide which requests connect directly and which go through a proxy. It doesn’t automatically classify traffic as domestic or international; the result depends on the provider’s rules, their order, and your proxy group selections.
Global sends traffic entering the client through the global policy; it doesn’t mean the client has taken over traffic from every app on your device. Direct generally sends requests entering the client straight to their destination. For everyday use, start with Rule mode and switch temporarily only when diagnosing a specific issue. This avoids changing the mode and node at the same time.
Once Rule mode is selected, return to the Proxy page and find the main group that handles proxy traffic. Open the group and select a node you’re allowed to use. Some groups use automatic selection or failover, so you can leave the default in place. Others require you to choose a node manually. The selection indicator shows the current outbound; running a latency test alone doesn’t select a node.
Some configurations nest one proxy group inside another. For example, the main group might use Auto Select, which then chooses an outbound from the node list. If you see this setup, open the next group and confirm it contains an available node. If the main group currently selects DIRECT, requests matched to it may connect directly even when the list contains many proxy nodes. The presence of nodes in the list doesn’t mean the proxy is active.
You can run the client’s connection test to check whether a node is reachable, but the test URL and method may differ from those used by actual websites. A successful result doesn’t guarantee that every site or app will work. For your first connection, choose a node that passes the test; there’s no need to keep chasing better test scores. For help weighing location, traffic multipliers, and protocols, read how to choose a proxy node after completing this guide.
Step complete: Rule mode is selected, and the group handling proxy traffic has a node selected or an automatic policy in place. Next, route your device’s requests through the client.
Step 3: Enable the System Proxy or Connect to the VPN
Enabling the configuration and selecting a node doesn’t automatically route browser traffic through the client. You also need to turn on the device’s traffic entry point. Desktop and mobile clients work differently, so follow the steps for your device. For your first test, don’t enable multiple traffic-routing methods at once.
Desktop: Enable the System Proxy First
Find and enable the System Proxy switch on your desktop, and keep the client running. In desktop clients such as Clash Verge Rev, this switch is usually on the home or settings page. Once enabled, browsers and apps that follow the system proxy settings will send the relevant requests to the client. You don’t need to enter a proxy port manually unless the client explicitly asks you to.
If your browser has a proxy management extension, set it to follow the system settings or temporarily disable it so it doesn’t override the system proxy. Then open a new browser tab and load a page. Don’t rely on a page that was already open: cached content and existing connections can make it hard to tell whether the current settings are working.
Some apps don’t follow system proxy settings, and terminal commands may need separate proxy environment variables. That doesn’t necessarily mean the client is broken. First, verify the setup in a browser as described in this guide, then decide whether you need to route more traffic. TUN requires a virtual network interface, service permissions, and routing configuration. See the TUN mode guide for details; it isn’t required for your first connection.
Mobile: Approve the System VPN Permission
In the Android or iOS client, tap Start or Connect. The first time, your device will usually ask for permission to create a VPN connection or add a VPN configuration. Make sure the request comes from the client you just installed, then approve it as prompted. If your device asks you to unlock it, complete the verification in the system dialog. Don’t enter your device password in an unrelated field such as the subscription URL box.
After granting permission, return to the client and check that the connection is active. The VPN icon on your phone only means the traffic-routing tunnel is established; it doesn’t confirm that the remote node is working. Check the next step’s web requests and connection logs to see whether the node and rules behave as expected. If another VPN is running, disconnect it before starting the current client again.
Step complete: The system proxy is enabled on desktop, or the mobile connection is active and VPN permission has been granted. Keep the client running and verify it with real requests—not just the color of a switch.
Step 4: Verify That Clash Is Working
First, visit a site that should connect directly based on your configuration, then one that should use the proxy. Load each in a new page and look for the corresponding domain on the client’s Proxy or Connections page. Some clients move completed connections to history. If you don’t see a request, watch the connection list while loading the page or check the logs.
For each request, check three things: which rule matched, which proxy group handled it, and which outbound was ultimately selected. A request expected to connect directly should use the direct route; one expected to use a proxy should go through a proxy node. Field names vary between clients, but these three steps are consistent. Labels such as DIRECT and REJECT in a rule match card or log indicate the outbound result, not a fixed node name.
Don’t assume the entire configuration is correct just because a site opens. It may have connected directly anyway or displayed cached content. An IP lookup only shows the route used for that specific request; it doesn’t represent every app. If you check your exit IP, also confirm in the client that the lookup request went through the expected node. This helps avoid mistaking normal differences between requests in Rule mode for a fault.
Use Connection Logs to Choose What to Check Next
If the page loads but there’s no matching request in the connection list, first check whether the system proxy is enabled, the browser is using its own proxy settings, or the mobile VPN connection is still active. Start by confirming that the request is reaching the client; don’t change DNS right away. You can also close and reopen the page to make the new connection easier to spot.
If a request appears but times out or fails to connect to the remote server, try switching to another node in the same proxy group, then load the same page again. If the log shows a domain resolution error, see DNS setup and troubleshooting. Change only one setting at a time and keep track of the original value so you can tell what made a difference.
Step complete: Websites load as expected, and the rules and outbound routes in the connection logs match your expectations. Keep this basic setup in place; add startup behavior or TUN only if needed.
Incompatible Subscription Format: When to Convert a Subscription
Consider conversion only if your provider doesn’t offer a subscription format for your client. First, look for a dedicated Clash or mihomo link on the provider’s site; that’s usually simpler than converting it yourself. Some raw links contain nodes only, while a complete configuration also needs proxy groups and rules. Importing nodes successfully doesn’t mean you have a ready-to-use traffic-routing configuration.
Don’t convert a subscription just because a node won’t connect. Conversion handles format issues; it won’t fix an expired account, unreachable node, or dead subscription URL. Avoid submitting a full subscription to an unfamiliar online converter: the link may contain credentials that grant access to your node configuration. Use the method recommended by your provider, or a tool you manage yourself once you understand where the data goes.
After converting, return to Step 1, import the result as a new configuration, and enable it. Then check the proxy groups again. Keep the original configuration so you can compare or roll back. If an error mentions a protocol or configuration field, first check whether your client’s core supports it. Changing the text format can’t add features the core doesn’t have.
Good Habits After Your First Setup
For future sessions, check the current configuration first, then the mode and node, and finally the system proxy or mobile connection status. Subscription updates may replace rules in the original configuration. For changes you need to keep, use the client’s override feature rather than relying on direct edits to the subscription file.
To turn off the proxy, disable the system proxy before quitting the desktop client. On mobile, tap Stop or Disconnect. If websites stop loading after you quit the desktop client, first check whether the system is still pointing to a local proxy. Once everything is working reliably, follow the startup guide to configure launch behavior, and see the cross-platform usage guide for permissions, rule overrides, and platform-specific issues.