Clash Setup Guide
Import a Subscription and Verify Your Connection

Before You Start: Get a Client and an Active Subscription

This quick-start guide is for users who have installed a client and have an active subscription. Basic setup usually takes about 10 minutes, but download times, system permissions, and network troubleshooting depend on your environment. Clash Picks provides client selection and setup guides; installing a client does not provide proxy service. Check with your provider about the subscription URL, service validity, and account status.

Have a subscription URL or a local YAML configuration file supported by your client ready. Subscription URLs usually come from your provider's account page; choose the option labeled Clash or a compatible format for your client's core. Don't mistake an account login, payment page, or ordinary share page for a subscription URL. The URL may contain personal access credentials: copy it in full, but never post it in public comments, screenshots, or online conversion tools.

Quit other proxy clients for now to prevent two apps from changing system proxy settings or creating virtual network interfaces at the same time. Keep your current network connection working, and leave DNS, mixed ports, and advanced routing options alone. If something goes wrong later, change one setting at a time and repeat the final verification step so you can tell what caused the issue. When a system permission prompt appears on first launch, confirm it belongs to the client you just installed and grant only the permissions it needs.

Step 1: Import a Subscription and Activate the Profile

Open the client and go to its “Subscription” or “Configuration” page. Look for “New,” “Add,” or “Import.” Some clients put link imports in a plus menu; others have an input field at the top of the page. Choose remote subscription, enter a recognizable name such as “Daily profile,” and paste the full subscription URL into the address field. The name is just a local label; it won't change the proxy service. Don't enter it in the URL field.

After pasting, check the URL: make sure the protocol at the beginning is intact, no parameters are missing at the end, and there are no spaces or line breaks. Some account pages offer both “Copy subscription” and “Open subscription”; use Copy to avoid grabbing a redirected login page from the browser address bar. Once the URL looks right, tap Save, Download, or Import and wait for the request to finish. Don't keep tapping Add, or you may create duplicate profiles.

A completed download doesn't mean the profile is active. Return to the profile list, select the entry you just imported, or choose “Enable” or “Set as current.” The active entry usually has a selection indicator, though this varies by client. Then open the Proxies page and check that policy groups and their options are visible. If you still see old content, make sure the new profile is selected and check the import message before enabling the system proxy.

If you only have a local configuration file, choose “Import from file” and open the relevant .yaml or .yml file in the file picker. You still need to activate the profile after importing it. Don't save a web page as YAML and import it: the right extension doesn't guarantee valid contents. The file should contain a structured configuration, not login-page HTML, an error message, or just a share URL.

If the import fails, read the specific error first. A request timeout usually means you should check whether your current network can reach the subscription URL. For an authorization failure, ask your provider whether the URL has expired. A parse error may mean the format isn't supported by your client. Subscription downloads sometimes use the client's existing proxy settings; if that proxy isn't working, try the client's direct-connection option for the update. Don't disable certificate verification just to make an import succeed.

After a successful import, keep the subscription as your main update source. Selecting “Update” later fetches the latest content from your provider, but manual edits to a remote profile may be overwritten by the next update. You don't need to edit files to get started. If you do need custom rules, see Configuration Files and Local Overrides. Not sure how subscriptions differ from profiles? Start with the Quick Reference, then choose a proxy mode.

Step 2: Choose a Rule Mode and Proxy

After confirming the profile is active, open the Proxies page and find the “Rule / Global / Direct” mode selector. Start with Rule mode. It uses the rules in the current profile to decide where each connection goes: some destinations connect directly, while others go through a proxy policy group. It doesn't automatically figure out the best route for every site; actual routing depends on the rules included in your subscription. Next, make sure the policy groups have a working proxy selected.

Global mode is useful for a quick troubleshooting comparison. It generally sends all traffic captured by the client through the global policy group. Direct mode sends captured traffic straight to its destination. These modes determine how the core handles traffic it has already received; they don't determine which traffic the system captures. Switching to Global won't route every app through Clash or enable the system proxy or TUN for you. Start with Rule mode, then route traffic through the client in Step 3.

In the policy group list, start with the main proxy group whose name and purpose are clear. Group names are set by the subscription provider and may include labels such as “Proxy,” “Auto,” or an app category, so don't assume you know the structure from the name alone. Open a group to see its options: if it lists proxies directly, choose one; if it lists another policy group, open that too and make sure the final choice isn't Direct or Reject by mistake.

If the profile includes an “Auto” group, you can start with it, but remember that auto-selection depends on the test URL and interval configured in the profile. It doesn't guarantee good speeds for every site. For a manual choice, run the client's latency test and check for a valid result. A timeout means the test didn't finish in time; it doesn't prove the service is permanently unavailable. A latency reading only reflects the test request, not actual download bandwidth.

If there are several groups for different sites or apps, you don't need to adjust them all during initial setup. Check the default main group first, then the group for the destination you plan to visit. For example, if a rule sends a type of traffic to a dedicated policy group, choose a proxy in that group rather than changing only the main group. In Step 4, connection logs will show which rule matched, helping you avoid assuming a proxy change affected traffic when it didn't.

If a policy group has no available proxies, go back to Step 1 and check the active profile, subscription status, and download result. Don't make up a server address: the client needs valid service details to connect. After choosing a proxy, note the current mode and main group selection, leave them unchanged for now, and move on to connecting. For a deeper explanation of nested groups, auto-tests, and rule priority, see the Advanced Configuration Guide. For now, stick to the quickest setup path.

Step 3: Connect and Route Traffic Through the System

You now have an active profile, a rule mode, and a selected proxy. Next, route app traffic through the client. Some desktop clients start the core automatically; others require you to click Start or Connect. Check the core status and any error messages on the home screen, then enable the system proxy. An open client window doesn't mean you're connected, and a colored tray icon alone isn't enough to confirm it.

Desktop: Enable the System Proxy First

On Windows, macOS, or Linux, find “System Proxy” on the client's home or settings page and turn it on. The client will try to point the system proxy to a local listening port. Once enabled, test with a browser that follows system proxy settings; there's no need to enable TUN at the same time. On macOS, changing network proxy settings for the first time may require administrator approval. Linux support varies by desktop environment and browser, so check whether the client and your desktop environment applied the settings successfully.

Keep the default port for now. Depending on the client, it might use 7890, 7897, or another port; these aren't universal, so use the listening port shown by your client. A proxy extension in your browser may override system settings. Set it to use the system proxy or temporarily disable it before testing. Terminals and some professional apps don't use the system proxy, so don't use them to judge whether initial setup worked.

If enabling the proxy reports that the port is in use, make sure other proxy apps are closed and check for another background instance of the same client. Don't keep toggling the system proxy and hope for the best. If you change the mixed port, the client's listening port, the system proxy target, and any manually configured in-app proxy address must all match. See Clash Port Settings for troubleshooting and configuration, then return here to test in a browser.

Mobile: Connect and Approve the VPN

Android and iOS clients usually have a Connect button on the home screen. Tap it; if the system asks to set up a VPN connection, confirm that the app name matches your client and follow the prompt to allow it. iOS may ask to add a VPN configuration and authenticate your device; Android may show a VPN connection request. If you denied permission the first time, tap Connect again or grant it in system settings. Selecting a proxy alone won't restore the connection.

A VPN icon in the status bar only indicates that the tunnel has been established to some extent; it doesn't prove that every destination is reachable. If your phone already uses another VPN, a work profile, or a security app's network tunnel, check which combinations your system allows so they don't replace one another. Keep the client running while you test. If Android disconnects after the screen locks, check its background activity and battery restrictions. Don't change every system setting at once right after importing a profile.

TUN: Consider It After Browser Testing

On desktop, consider TUN only if an app doesn't follow the system proxy. TUN uses a virtual network interface to capture more traffic and may require administrator privileges, a service component, or extra network settings. Don't enable the system proxy and TUN together when getting started; changing both paths makes troubleshooting harder. After browser testing succeeds, follow the TUN Setup Guide and retest the target app. A mobile VPN traffic-capture option is not the same as the desktop TUN switch.

Step 4: Verify Access and Actual Traffic Routing

Once connected, open a site that you genuinely need to access through the proxy and that is normally available. Make sure the page content loads, not just a cached title or old image. Then open the client's Connections page, refresh the browser, and look for a new connection to that domain. The goal of this first check isn't to measure speed; it's to confirm that the request reached the client, matched the expected rule, and used a working proxy.

In the connection log, check the destination domain, matched rule, policy group, and final proxy. Fields vary by client; you may need to open a connection to see its details. If the destination shows Direct when you expected it to use a proxy, return to Step 2 and check the mode and relevant category group. Don't switch all traffic to Global and call the issue fixed. Global can help with a brief comparison, but normal Rule mode still depends on the right rules and group selections.

Next, visit a site that should connect directly under your current profile and check its route in the connection log. Different types of traffic taking different paths in Rule mode is normal. A public IP lookup site only shows the route for that particular request; it doesn't prove that every app is being captured. Likewise, a working browser doesn't mean a terminal, game, or other app uses the same route. To test an app, generate a new request in that app and check the corresponding connection.

If a browser loads a page but no matching connection appears, first make sure the page isn't coming from cache. Check whether the browser uses a proxy extension, its own proxy setting, or another network route. Some connections end quickly and disappear from the list during a refresh; the Logs page can help you find them. If the client can retain closed connections, enable that option to review recent activity. Don't skip checking the actual traffic path just because the system proxy switch is on.

Troubleshooting: Check the Four Steps in Reverse

If nothing can connect, first check whether the client is running, the core reports an error, and the profile you imported is still active. Then make sure the policy group has a working proxy selected. Next, confirm that the system proxy or mobile VPN is actually enabled. On desktop, turn off the system proxy and check whether your regular connection works. On mobile, disconnect the VPN and do the same. If your regular connection is also down, fix the local network before changing proxies.

If only some destinations fail, check their rules and proxy first, then try another working proxy in the same policy group. Change one thing at a time. If the connection log shows the expected proxy but the connection still fails, check the logs for the destination address, DNS errors, or handshake errors, and compare them with the service status. DNS and protocol details are beyond this initial setup guide. Look up terms in the Quick Reference, then find specific settings in Advanced Configuration.

If web pages load but a particular app still fails, check whether it uses the system proxy and whether it needs to be fully quit and restarted after a change. Some apps reuse existing connections and won't reconnect immediately after you switch policy groups. Quit and reopen the app before testing; there's no need to reset the entire client configuration. If the app doesn't follow the system proxy, consider its own proxy settings or TUN rather than repeatedly importing the subscription.

After Setup: Keep a Known-Good Configuration

Initial setup is complete when the correct profile is active, Rule mode is selected, policy groups have working proxies, the target connection appears in the client logs, and access follows the expected route. Note the profile name, proxy mode, and traffic-capture method; there's no need to save a screenshot of your subscription URL. If something goes wrong later, compare your settings with this known-good setup to avoid reinstalling or changing parameters at random.

Before closing the desktop client, turn off the system proxy or confirm that the client restores the system proxy settings when it exits normally. Closing the window may only minimize it to the tray, leaving it running in the background. Force-quitting it can leave the system proxy pointed at a local port, blocking direct access too. When you no longer need traffic routed through the client on mobile, tap Disconnect and confirm the system VPN has ended. You're all set; consult the relevant guides later for subscription updates, rule overrides, or TUN tuning.