Clash Setup Guide:
Import a Subscription and Test Your Connection

Before You Begin: Client and Subscription URL

Start by choosing a client for your operating system and processor architecture on the download page. Install it and open the main window. This guide covers common graphical clients in the Clash ecosystem; you don’t need to edit a YAML file first. If you haven’t chosen a client yet, see the client guide. For a first setup, choose a maintained client that supports your current OS; archived clients aren’t recommended as a starting point.

Next, get a Clash- or mihomo-compatible subscription URL from your provider. The client reads the configuration and routes requests; installing it does not provide usable nodes by itself. Subscription URLs are usually available in your provider’s account portal. Choose an entry explicitly labeled as compatible, not the portal’s web address, an order URL, or a browser share link.

A subscription URL may contain account details, so protect it like a password. Don’t include the full URL in public screenshots, support requests, or chat logs. When reporting an issue, keep the error message and redact sensitive parts of the URL. For your first setup, keep your existing configuration intact. Changing network routing while deleting an old profile can make it harder to recover if something goes wrong.

Before importing, open your provider’s site over a regular connection to confirm the device can access the internet. If another proxy or VPN app is running, note its settings and pause it to avoid conflicting traffic-routing settings. When you’re ready, continue to the subscription import steps below.

01 Import a Subscription: Download and Activate a Profile

Copy the subscription URL from your provider’s site, return to the client, and open the “Configuration,” “Subscription,” or “Profiles” page. Look for an option such as “New,” “Add,” or “Import from URL.” Choose a remote profile, then paste the full URL into the URL field. Give it an easy-to-recognize name, such as “Daily profile.” The name only identifies the profile; it doesn’t determine whether its nodes can connect.

Check that the URL has no extra spaces or line breaks, then click “Download,” “Import,” or “Save.” The client will request the subscription from the server and parse the response. You should see a new profile card, sometimes with its last updated time, node count, or download status. The fields shown depend on the client; you don’t need to keep retrying just to find a particular one.

A downloaded profile isn’t necessarily active. Click “Use,” “Activate,” or the equivalent option on the new card to make it the current profile. Then open the Proxies page and confirm that a node list or proxy groups appear. Some clients keep using the previous profile, so an “import successful” message isn’t enough—complete this check before changing nodes, or you may still be looking at an old subscription.

If You See an Error, Check Whether It’s Download or Parsing

A timeout, connection error, or HTTP status error means the subscription couldn’t be fetched. Check that the URL is complete and the subscription is valid, then try updating it over your current network. Being able to open your provider’s homepage in a browser doesn’t guarantee that its subscription endpoint is reachable. Some subscription responses also vary based on the client’s request details, so don’t judge only by what a browser displays.

If you see a YAML parsing error or unsupported format—or no nodes appear after import—check that you copied a Clash-compatible URL. A node share link and a complete YAML profile are different things; not every URL can be imported directly. Subscription conversion involves trust in the service and preserving parameters, so for a first setup, ask your provider for a compatible URL. For more on format differences, see subscription formats and conversion.

Keep Remote Subscriptions; Don’t Overwrite Generated Content

Some clients can import a local profile file, which is useful if you already have a complete YAML file. After selecting the file, activate the profile and check the Proxies page. If you’re using a remote subscription, avoid editing its downloaded content before your first connection: the next update may overwrite your changes. Once nodes and proxy groups appear, choose a proxy mode. There’s no need to change DNS, rule sets, or scripts yet.

02 Choose a Proxy Mode: Rule Mode and Node Strategy

Go to the client’s home or Proxies page and find the mode selector. For your first setup, choose Rule mode (Rule). It handles requests according to the rules in the current profile, routing them directly, through a proxy group, or blocking them. It doesn’t automatically find the best route for every service; results depend on the profile’s rules and proxy groups.

The other common options are “Global” and “Direct.” Global mode usually sends requests that reach the core through a global policy, which can help narrow down an issue briefly. Direct mode usually connects straight to the destination, so it’s not suitable for testing a proxy node. For your first setup, stick with Rule mode instead of switching between all three; connection logs will make it easier to pinpoint issues later.

Choose an Outbound in a Proxy Group

On the Proxies page, find the group used for proxy traffic. It may be called “Node Select,” “Proxy,” or “PROXY,” or have a custom name set by your provider. Open it and select a specific node, or use an auto-select group already in the profile. A group can point to another group, so seeing “Auto Select” doesn’t necessarily mean a specific node is active. Check which node it currently uses.

If the page has a latency test, run it once to rule out candidates that clearly time out. A test result only shows whether the client completed a particular test request; it doesn’t measure the target site’s real-world speed or guarantee that the service accepts that exit. Don’t keep switching based only on region labels or a single test result. Pick a node that passes a test, complete the setup, then decide whether to change it based on the target service.

Some subscriptions put video services, developer sites, and messaging apps in separate proxy groups. If your target belongs to a dedicated group, check that it points to a suitable proxy strategy rather than DIRECT. Change only the group relevant to your test and leave the rest at their subscription defaults. That makes it easier to compare results.

Proxy Mode and Traffic Routing Are Separate Settings

Rule mode determines how requests are handled after they reach the core. System Proxy or TUN determines how apps send requests to the core. So even if Rule mode is selected and a node test passes, your browser may not yet be using the proxy. Before moving on, confirm that the mode is Rule and the relevant group has an outbound selected. Next, enable system traffic routing—don’t assume Global mode means every app is covered.

You don’t need to write rules, nest proxy groups, or set up custom routing for a first connection. To add domain rules or learn how rule matching works, see the configuration guide for all platforms. For now, stick to the shortest setup path in this tutorial.

03 Connect: Start the Core and Route System Traffic

Keep the profile and node you just selected, then return to the home page and check the client’s status. Some desktop clients start the core automatically; others require you to click “Start” or “Connect.” Make sure there are no errors such as a failed core startup or an occupied port before enabling traffic routing. If System Proxy points to a local port while the core isn’t running, your browser may immediately lose its connection. That doesn’t mean the subscription node is faulty.

Desktop: Use System Proxy for Your First Browser Test

On Windows and macOS, you can usually turn on “System Proxy” from the home page or tray menu. On Linux, check whether your desktop environment supports automatic proxy settings. If the toggle doesn’t affect the system, check the network proxy settings for your desktop environment. Don’t copy a port number from another device; use the listening port shown in your client’s settings.

After enabling System Proxy, test with a browser that follows system proxy settings by default. If the browser has an extension that manages proxies separately, or you’ve set a custom proxy address, switch it to follow the system temporarily so the extension doesn’t override the system setting. System Proxy only affects apps that use it; command-line tools, games, and some background processes may not. You can configure those separately later.

Mobile: Connect and Approve the System VPN

On Android and iOS, tap Connect in the client. The first time, approve the VPN connection or configuration when prompted by the system. Return to the client and confirm it still shows as connected. A VPN indicator means the system interface is active, not that the node can communicate with every site. Verify access in the next step.

If the connection drops as soon as you return to the home screen, check the client’s status and the system’s background restrictions. Also check whether another VPN app has taken over. Most devices limit how many standard VPN connections can run at once, so repeatedly starting multiple apps only makes the issue harder to diagnose. Keep one client running, pause other traffic-routing apps, and reconnect.

Enable TUN Only If You Need Broader Traffic Routing

If your browser works through System Proxy but an app that ignores system proxy settings still connects directly, enable TUN if your client supports it. On desktop, this may require installing a service, granting administrator access, or approving a network extension. Follow the prompts from the client and operating system. For your first troubleshooting pass, don’t change nodes and DNS while enabling TUN; otherwise, it’s hard to tell which change affected the result.

TUN routes traffic that meets its routing conditions through a virtual network interface; it doesn’t mean every request is forced through a proxy. The rules still determine the final outbound. If enabling TUN disrupts local network access or your connection, turn it off and return to the verified System Proxy setup. Then check the relevant platform section in the configuration guide for permissions and routing. Keep the connection active and continue to the verification steps.

04 Verify the Connection: Review Requests and Test Access

Open a new browser tab and visit a service you expect to use through the proxy, such as a developer site covered by a proxy rule in your profile. Don’t just refresh a tab that’s been open for a while: the browser may reuse an existing connection or cached content. If you’ve just switched nodes, close the old tab and open a new one so the test is more likely to use a fresh connection.

Return to the client and open the “Connections,” “Requests,” or similarly named page. Find the domain you just visited and check three things: whether the request reached the client, which rule it matched, and which outbound or proxy chain it used. Some clients combine multiple proxy layers in the display, so the exact field names may differ. You should still be able to tell why the request went direct or through a proxy.

If the page loads and the connection log shows the expected proxy outbound, your first proxy route is working. Then visit a site that should connect directly under the current profile and check whether its log shows DIRECT. In Rule mode, some requests going direct while others use the proxy is normal. You don’t need to switch to Global just to make every request show a proxy.

No Request in the Log? Check Routing Before Switching Nodes

First, make sure System Proxy or the mobile VPN connection is still enabled and the core is running. Then check whether the browser follows system settings or uses a separate proxy extension. If only one app is missing from the logs but the browser works, that app probably doesn’t use System Proxy. Configure its own proxy settings if needed, or consider TUN as described above. There’s no need to import the same subscription again.

Request Logged but Failing? Narrow It Down from the Log

If the request reaches the core but times out, switch to another available node in the same proxy group and retry the same page. For an authentication error, check whether the subscription is still valid and update it. For a DNS resolution error, check your network and DNS settings. Logs usually show the target, stage, and error cause. Keep those details when reporting an issue, but redact your account information, subscription URL, and other sensitive data.

If regular sites work but one service doesn’t, don’t assume the entire proxy is down. The service may have restrictions based on exit region, account status, or request frequency, or it may use a separate proxy group. Check the actual outbound for that service, then compare it with other sites. A successful node latency test is only a helpful indicator; judge by real access and connection logs.

After testing, note the profile name, mode, proxy group, and system routing method. These are your baseline for troubleshooting later. Change one setting at a time and repeat the same test. That makes it easier to identify the cause than resetting everything at once.

Everyday Use: Update Your Subscription and Disconnect Safely

When you open the client later, check that the correct profile is still active, then connect. If your provider changes its nodes, update the subscription and check the proxy groups afterward; a node you selected manually may have been removed or renamed. If the client supports automatic updates, set an interval that suits your needs. A successful update doesn’t guarantee every target service has been tested.

Before quitting, turn off System Proxy or disconnect the VPN from the client. If a desktop client exits unexpectedly and your browser can’t connect, check whether the system still points to a local proxy. Clear any leftover routing setting and test your regular connection before deleting the subscription. On mobile, confirm that the system VPN is disconnected.

That completes the first-time setup. For switching devices, startup settings, permissions, or custom rules, see the installation and configuration guide for all platforms. To choose another installer, return to the Clash downloads page. Keep the verified basic setup and add features one at a time.