Clash Getting Started

Step 1: Import and Enable a Subscription

Open your client and go to “Profiles,” “Configuration,” or “Subscriptions.” Look for “Add,” “Import,” or a plus button, then choose the option to import from a URL. In your provider's subscription settings, copy the configuration URL labeled Clash, Clash Meta, or mihomo, and paste it into the client's URL field. Don't copy the account login page URL or mistake a single node name on the webpage for a subscription link.

If the import dialog asks for a name, use something recognizable, such as “Daily use.” This is just a local label and won't affect the connection. Make sure the URL has no spaces or line breaks at either end, then click “Import” or “Download.” Wait for the client to download and parse it. On success, you'll usually see a profile card or a new entry in the list. If the client then asks you to click “Use,” “Activate,” or the profile name, do that too: downloading the file doesn't mean the core has loaded it.

Make Sure the Configuration Is Loaded

Select the new configuration, then open the Proxy page. Check that its proxy groups and the available nodes or strategies within them are visible. Group names vary by subscription and may reflect use case or region, so don't expect them to match this guide. For now, make sure the list isn't empty and the page shows no configuration parsing errors. An “Import successful” notification alone doesn't confirm which configuration is currently active.

For a local file, choose “Import from file” on the same page, open the complete configuration with a .yaml or .yml extension, and set it as the active configuration. A standard local import usually won't stay in sync with the original subscription; future updates depend on whether the client retains its remote source. You can rename the file, but changing the extension on a snippet of node text doesn't turn it into a complete configuration.

Import Failed? Check the Format First

If the import times out or the download fails, first check whether your current network can reach the subscription service. Then confirm your account is active and the URL is still valid. For YAML parsing errors, missing fields, or unsupported options, check whether the subscription format is compatible with the client's core. A Base64 node list, a single protocol link, and a complete Clash configuration are different kinds of input. Ask your provider for the right format or use an import method the client supports—don't keep pasting the same content and hoping it works.

Enabling “Update through proxy” may not help if the first import hasn't succeeded, since the client may not have a working proxy route yet. First restore the conditions needed to fetch the configuration. For specific errors, see Frequently Asked Questions. For format differences, read Subscription URLs, Local YAML, and Base64: What's the Difference?. Once the proxy groups appear, move on to mode selection; there's no need to edit the configuration file yet.

Step 2: Choose a Rule Mode and Proxy Strategy

Open the “Proxy” or “Operating Mode” page. Find the “Rule / Global / Direct” options and select Rule mode. In this mode, connections are matched against the rules in the active configuration and sent to the corresponding direct route or proxy group. It's a good choice for everyday use: traffic that should connect directly can do so, while traffic that needs a proxy follows the configured strategy. You don't have to switch the client's entire operating mode for each request.

Next, check the proxy groups. Find the group that handles the main proxy route, expand it, and select an available node or use the subscription's automatic selection strategy. Group names depend on the configuration, so don't assume a group called “Default” is for general use. Follow your provider's guidance if available. After selecting a node manually, make sure the selection marker stays on the intended item, then return to the previous page and confirm the group still points to it.

How Mode, Proxy Groups, and System Proxy Differ

These settings do different jobs. Operating mode determines how the core routes connections; a proxy group determines which route a given connection uses; system proxy determines whether apps that support it send requests through the client. Selecting rule mode only sets how traffic is routed—it doesn't mean your browser is connected to the client. You still need to enable a system network route. Seeing nodes in a list doesn't mean setup is complete.

“Global” sends all connections handled by the core through the global strategy; it doesn't automatically route every app on your device through the client. “Direct” sends connections handled by the core straight to their destination; it doesn't exit the client. Stick with rule mode for initial setup. Use global mode briefly only to check whether a rule is causing an access issue, then switch back to rule mode. Don't leave a troubleshooting setting in place as your everyday setup.

If your client offers a connection test, run it once for the node you plan to use and check whether it responds. The result only reflects whether that test destination was reachable at that moment; it doesn't guarantee every site will load, and there's no need to run the test repeatedly. For now, avoid changing multiple groups, deleting rules, or overriding DNS. Keep the subscription's original logic intact so you can tell node issues apart from configuration changes. To understand rule order, read the full guide to rule-based routing.

Step 3: Connect Through the Proxy

With the configuration active and a strategy selected, return to the client's home screen. On desktop, make sure the core or service is running, then turn on the “System Proxy” toggle. Some clients start the core automatically; others require you to click Start first. If the client still says the core isn't running, check the error instead of toggling the system proxy repeatedly. For your first setup, leave TUN off and verify the connection with a browser or another app that typically supports the system proxy.

On Windows and macOS, the client writes system proxy settings to the system's network configuration, and some clients may request permission. Make sure the request comes from the client you're using, then allow it to proceed. A browser with its own proxy extension or a manually configured proxy may ignore system settings; switch it to use the system proxy for testing. Linux desktop environments and apps vary in their support, so you may need to configure an app separately if it doesn't use the system proxy.

Approve the System Connection on Mobile

Android and iOS clients usually have a “Connect” button or main toggle on the home screen. When you tap it, the system may ask to add a VPN configuration or establish a VPN connection. Check the app name and approve the request, then return to the client and wait for its status to change to Connected. The system VPN interface lets the app handle traffic; it doesn't mean the subscription is working. Even if a VPN icon appears in the status bar, continue to the next step and test web access and rule matching.

If another proxy or VPN app is already running on your device, disconnect it before starting this client. Multiple tools changing system proxy settings, routes, or VPN interfaces make it hard to tell where requests are going. If the mobile client disconnects as soon as you switch to another app, first check whether the client is still running and whether the system is restricting background activity. Don't disable every battery management feature at once; troubleshoot based on the symptoms.

Keep Ports and TUN Simple for Now

Desktop clients may show a local mixed port, such as mixed-port: 7890. This is a common example, not a value you should assume applies to your setup; use the port shown in your client. When you use the system proxy toggle, the client usually sets the correct port automatically, so there's no need to copy the example manually. If the log says the address is already in use, close other proxy apps first. If the conflict persists, change the port and update any apps configured to use it manually.

TUN can handle traffic from more apps that don't use the standard system proxy, but it may require service permissions, a virtual network adapter, and DNS configuration. You don't need to enable it for your first connection. First verify the system proxy route, then decide whether to turn TUN on for a specific app. If you need to route games or other apps that don't use the system proxy, see the TUN section in the full guide. If the client shows a normal connection status, leave it running and check whether sites load as expected.

Step 4: Test Access and Rule Matching

Open a new browser tab and visit one site that should connect directly under your current configuration, then another that should use the proxy. Don't rely only on the client's “Connected” status or on a single page loading successfully. A page may be cached, and an existing connection may still use its previous route. Refresh the page or start a new request while watching the client's connection log.

Switch back to the client and open “Connections,” “Sessions,” or “Logs.” Find the domain you just visited and check three things: whether the request appears, which rule it matched, and which strategy or route it used. Direct requests typically show DIRECT; proxied requests may show a proxy group and the selected node. Field names vary by client, but the logic is the same: traffic expected to use a proxy must follow the right strategy, not just appear in the list.

Narrow Down Issues Using the Connection Log

If the browser sends a request but no related entry appears in the client, first check whether the system proxy is enabled, whether the browser uses system settings, and whether the test request was actually sent again. Don't change routing rules yet—the request may not have reached the core. If an entry appears but uses an unexpected route, check the matched rule and proxy group selection. Rules are checked in order, so the first match determines the route.

If the log shows the request was sent through a proxy but the page still times out, switch to another available node in the same proxy group and retry with a new request. If only certain domains fail, check the log for DNS errors or connection refusals rather than immediately reinstalling the client. If you see a certificate warning, don't disable certificate verification; first check your device's time, the destination site, and the network you're using. For a more detailed diagnostic sequence, see the checklist for when the proxy is connected but pages won't load.

Save Your Everyday Setup

Once access and routing behave as expected, keep rule mode and note which configuration and main proxy group you're using. If the client supports automatic updates, set a reasonable interval in the subscription details. For example, to update once a day, enter 1440 if the field uses minutes, or 24 if it uses hours. Units vary by client, so check the label before saving. Avoid setting an excessively short interval just to get a fresher node list.

Finish with a shutdown check. On desktop, turn off the system proxy before quitting the client normally, then confirm that your usual direct-access sites still load. On mobile, tap Disconnect and make sure the system connection ends. Reconnect when needed after restarting. This helps you spot leftover proxy settings and learn how to stop the client safely. If your browser can't connect after an unexpected shutdown, first check whether the system still points to a local proxy that is no longer running; don't immediately delete the entire configuration.

That's the basic setup complete: the subscription is active, rule mode is selected, app traffic reaches the client, and the connection log shows the expected routes. From here, update the subscription and switch strategies as needed, keeping a configuration you can revert to. For specific questions, see Frequently Asked Questions. When you're ready to configure rules, DNS, or TUN, continue with the complete guide from beginner to advanced. There's no need to change every setting during your first connection.