First-Time Setup · Four Steps to Connect
Clash Setup Guide
Import a subscription → choose a proxy mode → connect → check that it works.
If the client is installed and your subscription is ready, allow about 10 minutes for setup.
Before you start, make sure you have a Clash-compatible client installed and a subscription URL or configuration file from your provider. The client reads the configuration, matches rules, and establishes connections; installing it does not automatically give you working nodes. For your first setup, keep the provider's default settings. Avoid editing DNS or rules or enabling every network option right away, so you can verify each step as you go.
If another VPN, proxy client, or network accelerator is running on your device, disconnect it before continuing. Work- or school-managed devices may restrict network settings. If a device policy blocks a change, follow your organization's requirements rather than trying to bypass them. Once these steps are complete, see Advanced for further configuration options.
01 Import a Subscription and Enable the Configuration
Open the client's main window and go to the Subscription or Configuration page. Look for “Add,” “Import,” or a plus button. Choose remote subscription or URL import, then paste the full URL from your provider into the address field. If there's a name field, enter a label that's easy to recognize, such as “Daily.” The name is for local reference only and doesn't change the subscription. Check that the URL's beginning, query parameters, and final characters are intact, then click Download, Save, or Import.
Subscription URLs often contain account-identifying parameters, so protect them like passwords. Don't post a real URL in public screenshots, comment sections, or online conversion tools. The URL below shows the format only; its domain and parameters are examples and won't connect if imported:
https://example.com/sub?token=xxxxWhen the download finishes, check that the configuration shows a success status or that you can open its proxy groups and node list. If the client has a “Use” or “Activate” option, or a selection marker, set the imported configuration as active. Some clients enable it automatically after downloading; others only save the file. Don't move on just because another card appears in the list—make sure the contents of the proxy page have actually updated.
For a local .yaml or .yml file, use the file import option and open it in the file picker. Don't paste the filename into the subscription URL field. If you only have a node URL, QR code, or Base64 text, first check whether your client supports that source. Recognizing a single node doesn't mean the client can read every subscription format. If the format isn't supported, ask your provider for a configuration compatible with Clash or mihomo instead of repeatedly importing the same unsupported content.
If an import fails, first check whether the error occurred during download or parsing. A download failure usually means the URL is incomplete, the subscription is invalid, or your network can't reach the subscription server. A parsing failure may mean the response is a login page or error page rather than a configuration. Don't delete sections from the YAML at random just to clear the warning. For more help, see common issues. Once the configuration is active and its proxy groups are visible, choose an outbound mode.
02 Choose a Mode and a Proxy Node
Return to the client overview, menu bar menu, or Proxies page and find the outbound mode setting. For your first setup, choose Rule. This mode reads the rules in your configuration and decides whether each destination connects directly or through a proxy; it doesn't send every connection to the same node. If your subscription already includes rules, you can usually keep them as provided rather than adding custom rules right away.
Keep “Rule,” “Global,” and “Direct” separate from “System Proxy” and “TUN.” The first group determines how the core routes a connection; the second determines which system traffic reaches the core. This step sets the outbound mode. System traffic comes next. If the mode is set correctly but the system proxy is still off, a regular browser may continue using its original network route. That means setup isn't finished yet, not that the rules have failed.
| Mode | How Connections Are Handled | Recommendation for First-Time Setup |
|---|---|---|
| Rule | Routes connections according to the configured rules | Recommended; check the proxy groups next |
| Global | Routes all connections entering the core through the selected global group | Use for a specific, temporary test |
| Direct | Connects directly to the destination for traffic handled by the core | Not suitable for testing whether a proxy node works |
After choosing Rule mode, open the Proxies, Nodes, or Proxy Groups page. You'll usually see several groups, not just a list of servers. Find the group that controls general proxy traffic in your configuration, open it, and choose a node. Group names are set by the configuration author and may be “Proxy,” “Proxy Select,” or something else, so don't rely on the name alone. If a group currently points to another group, follow the reference until you confirm whether the final choice is a node, an automatic group, or DIRECT.
In a manual selection group, click a specific node to select it. Automatic or failover groups follow the configuration's health-check rules and may not let you pin a node. If the client offers a latency test, run it once to see which nodes respond. Avoid using a node that times out for your first connection test. Test results only reflect the connection to a particular address at that moment; they don't indicate actual download speed or guarantee access to every site.
Some configurations have separate groups for different apps or sites, so changing the main proxy group may not affect a particular service. For your first connection, just find the group controlling the site you want to test; there's no need to change every group. If you're unsure what proxy groups, rule order, or DIRECT mean, see the glossary. Once you have an initial node selection, move on to connecting.
03 Start the Connection and Set Up the System Proxy
Check the overview page and confirm that the core is running. Some clients start the core when you open the window; others require you to click Start or Connect. If the logs show a port conflict, a configuration load error, or an exited core process, fix that specific issue first instead of enabling more network options. If the core isn't running, nothing can receive browser requests—even if the system proxy points to a local port.
On desktop, find and enable “System Proxy,” “Set as System Proxy,” or the equivalent option. Windows clients usually offer it in the main window or tray menu; macOS clients commonly have it in the menu bar menu. Once enabled, apps that follow system proxy settings send requests to the local port used by the client. Use the port shown in the client's current settings. Don't change everything to 7890 just because it's a common example port in tutorials.
To check the settings manually, compare the client's mixed port with the address and port in your system proxy settings. On the same device, the address is usually the loopback address 127.0.0.1. You don't need to enable LAN access or expose the proxy listener to other devices for a first setup. Linux desktop environments vary in their system proxy support. If the toggle doesn't update system settings, follow the instructions for your environment in the platform setup guide rather than copying steps for a different desktop.
On Android and iOS, the usual process is to tap Connect or the start button, then approve the VPN connection prompt from the system. When the VPN icon appears in the status bar, return to the client and check its connection status. The icon confirms that the system established a network tunnel; it doesn't guarantee that the remote node works. Disconnect any existing VPN first. Work profiles, device management policies, and other network tools can also interfere with the connection.
Desktop TUN mode can capture more traffic that doesn't follow the system proxy, but it may require extra permissions, a virtual network adapter, or a service component. For your first browser test, use the system proxy. Mobile apps route traffic through the system VPN interface, so there's no need to copy the desktop toggle setup. For now, avoid changing TUN, DNS hijacking, or routing rules at the same time. Configure these options after basic access works.
If the system asks for an administrator password, to install a helper service, or to allow an extension, verify that the prompt comes from the client you just installed and check which permissions it needs before approving it. If the client asks you to restart a service after approval, do that before checking its status. Your configuration, node, and traffic entry point are now in place; test actual access to confirm everything works.
04 Check That It Works and Troubleshoot
Open a new browser tab and visit a site you know is working and that you can reach on your current network. Open the client's connection list or logs at the same time and look for a record matching the time and domain of your visit. Existing browser connections may continue using their old route, so reopen the test page after changing a node or mode. If needed, quit and restart the browser before sending a new request.
In the connection details, check the destination domain, matched rule, and final outbound policy. In Rule mode, DIRECT is expected for some sites; not every direct connection is a failure. Test one destination expected to connect directly and another expected to use a proxy, then check that each follows its rule. Logs showing the proxy group and actual node, combined with the page loading successfully, are more reliable than the color of a toggle.
If the page won't load and the client shows no matching connection record, go back to step three. Check that the system proxy is enabled, its address and port match, and the browser isn't configured to use a different proxy. Make sure you're checking a new request rather than an older log entry. Some apps don't follow the system proxy, so a successful browser test and a failed app aren't necessarily contradictory. Check the app's network settings before deciding whether you need TUN.
If a connection record appears but shows a timeout, the request has at least reached the client. Next, check the selected node and destination. Change just one node and try again; don't re-import the subscription, change DNS, and switch modes all at once. If another node works, the issue is more likely with the original node or route. If only one site fails, check its rule and proxy group rather than assuming the whole client is broken.
If you see a DNS resolution error, note the error type and time from the logs. First confirm that your regular network connection works, then see troubleshooting. Fake-IP, DNS routing, and TUN routing involve a more complex set of configuration dependencies; don't replace your existing subscription settings by copying a full block of network configuration from a tutorial. Before sharing logs for help, hide subscription URLs, account identifiers, and private browsing records. Include only the error context needed to diagnose the issue.
An external IP lookup can be useful as a secondary check, but it shouldn't be your only test. The lookup site may connect directly according to your rules, and the browser may show cached content. Even if the result changes, it only tells you the route used for that particular lookup. Your first test is successful when a destination expected to use a proxy loads, its connection record shows the expected policy, and a destination expected to connect directly still works. With rule-based routing, there's no need for every connection to show the same exit IP.
Finish by checking what happens when you disconnect. On desktop, turn off the system proxy before quitting the client. On mobile, disconnect the VPN in the app first. If your browser says the proxy server is unavailable after exit, open your system network settings and remove any manual proxy still pointing to a local port. Once the network works normally again, start the client and enable the relevant options next time. There's no need to delete the imported configuration.
Everyday Use After Setup
Once your first setup is verified, everyday use usually means starting the client, confirming the active configuration, checking the selected node, and connecting. A subscription update fetches your provider's latest configuration; it doesn't automatically fix every connection problem. If node or proxy group names change after an update, revisit the Proxies page to check your selection. Start with the client's default update interval instead of refreshing manually too often.
Before changing rules, back up the working configuration and check whether your client supports overrides or extension configurations. Direct edits to a downloaded remote subscription may be overwritten the next time it updates. For app routing, TUN, or platform permissions, see the user guide. For a specific error, start with common issues. Change one setting at a time and retest the same destination to make troubleshooting easier.