SETUP / FIRST-TIME CONFIGURATION
Import a Clash subscriptionand connect
With an active subscription, follow four steps to get started: import the configuration, choose a rule mode, route traffic, and check requests. First confirm that your browser connects, then enable TUN if needed.
Before you begin, have an active subscription URL or a local configuration file supported by your client. The client reads the configuration and handles network requests; installing it does not provide usable nodes by itself. Use a subscription from a provider you trust and are authorized to use. If you do not have a configuration yet, obtain one before continuing. Keep your device’s existing network setup intact during initial setup. Changing your router, DNS, and multiple proxy tools at once makes problems harder to diagnose.
1. Import a subscriptionand enable the configuration
After launching the client, open the “Configuration,” “Subscription,” or similar page instead of clicking Connect right away. Look for an option such as “Add,” “Import,” or “Import from URL,” then paste the full subscription URL into the address field. Give it a recognizable name, such as “Daily setup.” Check that there are no spaces at either end and that you have not copied explanatory text from a chat message. Click Save or Import and wait for the download and parsing to finish.
After a successful import, the profile list usually shows a new card or row with a name, update time, or status. Select the profile, or choose “Use” or “Enable” from its menu. Some clients select imported profiles automatically; others only save the file. Seeing a name in the list does not necessarily mean the core is using that configuration. Open the “Proxy” page and confirm that proxy groups and node options appear before moving on.
Using a Local YAML File
For a local file, choose “Import from file” and select the appropriate .yaml or .yml file. Do not enter a file path in the subscription URL field or change the file extension to make it open. Enable the configuration after importing it. If it references remote rule sets or proxy providers, those resources may also need to download on first use. A successful parse does not mean all remote resources are ready.
For your first setup, use the client’s import feature and leave the original YAML untouched. Incorrect indentation, misspelled fields, or invalid references can prevent it from loading. If an error appears, note the field name or line number reported by the client and consult the relevant documentation. Avoid piecing together snippets from unrelated guides. For the difference between configuration files and subscriptions, see the glossary. For remote profile updates, read the subscription and configuration management section.
If a Subscription Download Fails, Check the URL First
If the download fails, first confirm that the device can access the internet without the proxy. Then check whether the link has expired, requires a sign-in, or uses a format supported by your client. A web page that opens in a browser is not necessarily a subscription URL. If it returns a login page or HTML, the client cannot use it as a proxy configuration. Import only a subscription URL explicitly provided for that purpose.
A subscription URL may contain credentials for your account. Do not post it in public comments, screenshots, or unfamiliar conversion services, and never forward the full link. When asking for help, share the error message but redact sensitive parts of the URL. Once the import succeeds and proxy groups appear, keep the configuration unchanged and adjust only the mode and node in the next step.
2. Choose a Rule Modeand Proxy Node
Open the client’s home or “Proxy” page and find the mode selector for “Rule,” “Global,” or “Direct.” For a first setup, choose “Rule.” This mode follows the configuration’s rules to decide whether a request goes to a proxy group, connects directly, or is rejected. It does not infer what you want based on the interface language or website name. Available routing behavior depends on the loaded configuration.
After choosing a rule mode, review the proxy groups. A configuration might call a group “Select,” “Proxy,” or something else, so the label may not match this guide. Open a group that requires manual selection and choose a node you are authorized to use. If the selected option is another proxy group, check the selection in that nested group too. Groups such as “Auto” or “Fallback” follow their configured policies; you do not need to set every group to the same node.
Select a Node Before Testing It
If the interface offers a latency test, run it once to see whether any nodes respond. The result reflects a single probe to a specific test address. It is not a measure of actual download speed and does not guarantee that every website or UDP request will work. A timeout may also be caused by the test address or your local network. After choosing a node, verify it with real traffic in step four.
Do not cycle through many nodes just to chase a particular test result. Choose one candidate and complete the connection and verification steps. If access fails, switch only the node and try again. Changing one setting at a time helps identify whether the issue is the node, mode, or traffic routing—instead of leaving you unsure which of several changes made a difference.
| Mode | How it works | Recommended for first setup |
|---|---|---|
| Rule | Matches requests against the configured rules, in order | Use as the starting point for everyday connections |
| Global | Routes requests entering the core through the global proxy group | Use only when you have a specific reason to compare behavior |
| Direct | Routes requests entering the core through a direct outbound | Does not disable the system proxy or exit the client |
Keep “mode” and “traffic routing method” separate. The mode determines what happens after a request enters the core; the system proxy or TUN determines which requests reach the core. Switching to Global does not make every app use the system proxy, and enabling TUN does not automatically change Rule mode to Global. Keep Rule mode and your selected node, then route device traffic in the next step. For details on rule evaluation order, see the rule-based routing section.
3. Connectand grant system permissions
Return to the client’s home page and confirm that the core is running, or click the app’s Start or Connect button. If the interface reports a configuration load error, go back to step one and fix it; toggling the system proxy will not resolve a configuration syntax issue. The core and system proxy are separate: even with the client open, the system may not be routing requests through it.
On Desktop, Test with the System Proxy First
In your Windows, macOS, or Linux desktop client, find and enable “System Proxy.” Most graphical clients point the operating system’s proxy settings to a local listening port automatically, so you do not need to copy port numbers from another guide. If you previously entered a proxy address manually, use the listening settings currently shown by your client; an old port may no longer apply.
Once it is enabled, use a browser that follows system proxy settings to open a test page. For now, do not run another proxy client at the same time, and disable browser extensions that override proxy settings. Another app starting up may rewrite the same system settings. Some apps use their own proxy configuration, and terminal programs may not use the desktop system proxy at all. So if the browser works but another app does not, do not assume the node is at fault.
On Mobile, Approve the VPN Connection
On Android or iOS, tapping Connect may prompt you to authorize a VPN connection. Confirm that the app name matches the client you are using, then allow the connection. Return to the app to check its connection status and look for the VPN indicator in the system status bar. The indicator confirms that the system established a network connection for the app; it does not by itself prove that the remote node is working.
If another VPN app is already connected, check your system settings and disconnect any connection you no longer need before starting this client. For the first Android test, keep the client in the foreground. Only investigate background operation and battery restrictions if the connection drops after the screen locks. This helps distinguish a connection that never worked from one that is stopped while running in the background.
Enable TUN Only If You Need It
If your browser works through the system proxy but a target app does not support or use it, consider TUN. It routes traffic through a virtual network interface and may require additional permissions, routing, and DNS settings. A desktop client may ask you to install a service, grant administrator access, or authorize a system change. Follow the prompts in your client; do not enable every option just because it is available.
Before testing TUN for the first time, note the original system proxy state and follow the client’s instructions. Avoid stacking multiple traffic-routing methods manually. If you hit a permission error or routing issue, turn off TUN and confirm that your previous system proxy setup still works. For details on auto-route, strict-route, and DNS interception, see the TUN configuration section. For this initial setup, use one reliable way to route traffic.
4. Verify Requestsand Rule Matching
After connecting, visit a site that should use the proxy under your current configuration, then try a familiar service that should connect directly. If both open, basic access is working; to verify routing, check the client’s “Connections,” “Activity,” or similar page. Check shortly after refreshing the test page so background requests do not make the log harder to read.
Match Web Requests to Client Logs
Look for the site’s domain in the connection log and check the matched rule, proxy group, and final outbound. Fields vary by client; some show only the proxy chain or connection destination. Use the information available in your client. If a request shows Direct and the configuration is supposed to route it directly, that is expected behavior—there is no need to force it through a proxy.
If the browser works but there is no matching entry in the connection list, the app may be bypassing the current routing method, the connection may have ended, or the list may be filtered. Clear any filters, reload the page, and check the browser’s own proxy settings. Do not rely on a public IP lookup alone: the lookup site may be configured for direct access, and cached results or existing long-lived connections can affect what you see. Evaluate the rule log alongside real access.
When Something Fails, Change One Thing at a Time
If no pages load, first disable the system proxy or disconnect the VPN and check whether your regular network works. If it still fails, troubleshoot the local network first. If it works again but fails when connected, return to the client and check that the configuration is enabled, the core is running, and a node is selected. Then test again with just one different node. Do not change DNS, mode, and port all at once.
If only certain domains fail, check the rule they match. If the logs mainly report name resolution errors, investigate DNS next. If the browser works but another app does not, first check whether that app’s traffic reaches the client rather than reinstalling it. For more detailed troubleshooting, search Frequently Asked Questions by symptom. See the glossary for DNS modes and Fake-IP, then consult the DNS section for configuration details.
Keep a Working Setup and Exit Cleanly
Once the connection works, note the active configuration, mode, and routing method. After updating a subscription, check whether proxy group selections have changed. If the client supports backup or export, save a copy of the working configuration and store it securely, as it may contain sensitive information. There is no need to enable startup at login before you have verified the setup; otherwise, an untested configuration may take over your network every time you sign in.
When you are done, turn off the system proxy before quitting the desktop client. On mobile, tap Disconnect and confirm that the system VPN connection has ended. Some clients restore system settings on a normal exit, but force-quitting may leave them behind. If your internet stops working after you exit, check whether the system still points to a local proxy port. Clear any leftover settings and try again instead of immediately resetting all network settings.